1 diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2 index dfa6fc6..0095943 100644
3 --- a/Documentation/dontdiff
4 +++ b/Documentation/dontdiff
33 @@ -70,6 +74,7 @@ Kerntypes
41 @@ -93,19 +98,24 @@ bounds.h
66 @@ -119,6 +129,7 @@ dslm
70 +exception_policy.conf
74 @@ -126,12 +137,15 @@ fore200e_pca_fw.c*
90 @@ -146,7 +160,7 @@ int32.c
99 @@ -154,7 +168,6 @@ kxgettext
107 @@ -166,14 +179,15 @@ machtypes.h
124 @@ -209,6 +223,7 @@ r300_reg_safe.h
132 @@ -219,6 +234,7 @@ setup
140 @@ -229,6 +245,7 @@ tftpboot.img
148 @@ -246,7 +263,9 @@ vmlinux
158 @@ -254,9 +273,11 @@ vsyscall_32.lds
170 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
171 index d6e6724..a024ce8 100644
172 --- a/Documentation/kernel-parameters.txt
173 +++ b/Documentation/kernel-parameters.txt
174 @@ -1898,6 +1898,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
175 the specified number of seconds. This is to be used if
176 your oopses keep scrolling off the screen.
178 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
179 + virtualization environments that don't cope well with the
180 + expand down segment used by UDEREF on X86-32 or the frequent
181 + page table updates on X86-64.
183 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
188 diff --git a/Makefile b/Makefile
189 index 96c48df..f811964 100644
192 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
196 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
198 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
199 +HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
200 +HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
202 # Decide whether to build built-in, modular, or both.
203 # Normally, just do built-in.
204 @@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
205 # Rules shared between *config targets and build targets
207 # Basic helpers built in scripts/
208 -PHONY += scripts_basic
210 +PHONY += scripts_basic gcc-plugins
211 +scripts_basic: gcc-plugins
212 $(Q)$(MAKE) $(build)=scripts/basic
213 $(Q)rm -f .tmp_quiet_recordmcount
215 @@ -564,6 +565,42 @@ else
219 +ifndef DISABLE_PAX_PLUGINS
220 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
221 +ifndef DISABLE_PAX_CONSTIFY_PLUGIN
222 +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
224 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
225 +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
226 +STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
228 +ifdef CONFIG_KALLOCSTAT_PLUGIN
229 +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
231 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
232 +KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
233 +KERNEXEC_PLUGIN += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD)
235 +ifdef CONFIG_CHECKER_PLUGIN
236 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
237 +CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
240 +GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
241 +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
243 + $(Q)$(MAKE) $(build)=tools/gcc
246 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
247 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
249 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
251 + $(Q)echo "PAX_MEMORY_STACKLEAK and other features will be less secure"
255 include $(srctree)/arch/$(SRCARCH)/Makefile
257 ifneq ($(CONFIG_FRAME_WARN),0)
258 @@ -708,7 +745,7 @@ export mod_strip_cmd
261 ifeq ($(KBUILD_EXTMOD),)
262 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
263 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
265 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
266 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
267 @@ -932,6 +969,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
269 # The actual objects are generated when descending,
270 # make sure no implicit rule kicks in
271 +$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
272 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
274 # Handle descending into subdirectories listed in $(vmlinux-dirs)
275 @@ -941,7 +979,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
276 # Error messages still appears in the original language
278 PHONY += $(vmlinux-dirs)
279 -$(vmlinux-dirs): prepare scripts
280 +$(vmlinux-dirs): gcc-plugins prepare scripts
281 $(Q)$(MAKE) $(build)=$@
283 # Store (new) KERNELRELASE string in include/config/kernel.release
284 @@ -986,6 +1024,7 @@ prepare0: archprepare FORCE
285 $(Q)$(MAKE) $(build)=. missing-syscalls
287 # All the preparing..
288 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
291 # Generate some files
292 @@ -1087,6 +1126,7 @@ all: modules
293 # using awk while concatenating to the final file.
296 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
297 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
298 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
299 @$(kecho) ' Building modules, stage 2.';
300 @@ -1102,7 +1142,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
302 # Target to prepare building external modules
303 PHONY += modules_prepare
304 -modules_prepare: prepare scripts
305 +modules_prepare: gcc-plugins prepare scripts
307 # Target to install modules
308 PHONY += modules_install
309 @@ -1198,7 +1238,7 @@ distclean: mrproper
310 @find $(srctree) $(RCS_FIND_IGNORE) \
311 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
312 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
313 - -o -name '.*.rej' -o -size 0 \
314 + -o -name '.*.rej' -o -name '*.so' -o -size 0 \
315 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
316 -type f -print | xargs rm -f
318 @@ -1360,6 +1400,7 @@ PHONY += $(module-dirs) modules
319 $(module-dirs): crmodverdir $(objtree)/Module.symvers
320 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
322 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
323 modules: $(module-dirs)
324 @$(kecho) ' Building modules, stage 2.';
325 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
326 @@ -1486,17 +1527,19 @@ else
327 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
330 -%.s: %.c prepare scripts FORCE
331 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
332 +%.s: %.c gcc-plugins prepare scripts FORCE
333 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
334 %.i: %.c prepare scripts FORCE
335 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
336 -%.o: %.c prepare scripts FORCE
337 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
338 +%.o: %.c gcc-plugins prepare scripts FORCE
339 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
340 %.lst: %.c prepare scripts FORCE
341 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
342 -%.s: %.S prepare scripts FORCE
343 +%.s: %.S gcc-plugins prepare scripts FORCE
344 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
345 -%.o: %.S prepare scripts FORCE
346 +%.o: %.S gcc-plugins prepare scripts FORCE
347 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
348 %.symtypes: %.c prepare scripts FORCE
349 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
350 @@ -1506,11 +1549,13 @@ endif
352 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
353 $(build)=$(build-dir)
354 -%/: prepare scripts FORCE
355 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
356 +%/: gcc-plugins prepare scripts FORCE
358 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
359 $(build)=$(build-dir)
360 -%.ko: prepare scripts FORCE
361 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
362 +%.ko: gcc-plugins prepare scripts FORCE
364 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
365 $(build)=$(build-dir) $(@:.ko=.o)
366 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
367 index da5449e..7418343 100644
368 --- a/arch/alpha/include/asm/elf.h
369 +++ b/arch/alpha/include/asm/elf.h
370 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
372 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
374 +#ifdef CONFIG_PAX_ASLR
375 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
377 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
378 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
381 /* $0 is set by ld.so to a pointer to a function which might be
382 registered using atexit. This provides a mean for the dynamic
383 linker to call DT_FINI functions for shared libraries that have
384 diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
385 index de98a73..bd4f1f8 100644
386 --- a/arch/alpha/include/asm/pgtable.h
387 +++ b/arch/alpha/include/asm/pgtable.h
388 @@ -101,6 +101,17 @@ struct vm_area_struct;
389 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
390 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
391 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
393 +#ifdef CONFIG_PAX_PAGEEXEC
394 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
395 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
396 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
398 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
399 +# define PAGE_COPY_NOEXEC PAGE_COPY
400 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
403 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
405 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
406 diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
407 index 2fd00b7..cfd5069 100644
408 --- a/arch/alpha/kernel/module.c
409 +++ b/arch/alpha/kernel/module.c
410 @@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
412 /* The small sections were sorted to the end of the segment.
413 The following should definitely cover them. */
414 - gp = (u64)me->module_core + me->core_size - 0x8000;
415 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
416 got = sechdrs[me->arch.gotsecindex].sh_addr;
418 for (i = 0; i < n; i++) {
419 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
420 index 01e8715..be0e80f 100644
421 --- a/arch/alpha/kernel/osf_sys.c
422 +++ b/arch/alpha/kernel/osf_sys.c
423 @@ -1147,7 +1147,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
424 /* At this point: (!vma || addr < vma->vm_end). */
425 if (limit - len < addr)
427 - if (!vma || addr + len <= vma->vm_start)
428 + if (check_heap_stack_gap(vma, addr, len))
432 @@ -1183,6 +1183,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
433 merely specific addresses, but regions of memory -- perhaps
434 this feature should be incorporated into all ports? */
436 +#ifdef CONFIG_PAX_RANDMMAP
437 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
441 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
442 if (addr != (unsigned long) -ENOMEM)
443 @@ -1190,8 +1194,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
446 /* Next, try allocating at TASK_UNMAPPED_BASE. */
447 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
449 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
451 if (addr != (unsigned long) -ENOMEM)
454 diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
455 index fadd5f8..904e73a 100644
456 --- a/arch/alpha/mm/fault.c
457 +++ b/arch/alpha/mm/fault.c
458 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
459 __reload_thread(pcb);
462 +#ifdef CONFIG_PAX_PAGEEXEC
464 + * PaX: decide what to do with offenders (regs->pc = fault address)
466 + * returns 1 when task should be killed
467 + * 2 when patched PLT trampoline was detected
468 + * 3 when unpatched PLT trampoline was detected
470 +static int pax_handle_fetch_fault(struct pt_regs *regs)
473 +#ifdef CONFIG_PAX_EMUPLT
476 + do { /* PaX: patched PLT emulation #1 */
477 + unsigned int ldah, ldq, jmp;
479 + err = get_user(ldah, (unsigned int *)regs->pc);
480 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
481 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
486 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
487 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
488 + jmp == 0x6BFB0000U)
490 + unsigned long r27, addr;
491 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
492 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
494 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
495 + err = get_user(r27, (unsigned long *)addr);
505 + do { /* PaX: patched PLT emulation #2 */
506 + unsigned int ldah, lda, br;
508 + err = get_user(ldah, (unsigned int *)regs->pc);
509 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
510 + err |= get_user(br, (unsigned int *)(regs->pc+8));
515 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
516 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
517 + (br & 0xFFE00000U) == 0xC3E00000U)
519 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
520 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
521 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
523 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
524 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
529 + do { /* PaX: unpatched PLT emulation */
532 + err = get_user(br, (unsigned int *)regs->pc);
534 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
535 + unsigned int br2, ldq, nop, jmp;
536 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
538 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
539 + err = get_user(br2, (unsigned int *)addr);
540 + err |= get_user(ldq, (unsigned int *)(addr+4));
541 + err |= get_user(nop, (unsigned int *)(addr+8));
542 + err |= get_user(jmp, (unsigned int *)(addr+12));
543 + err |= get_user(resolver, (unsigned long *)(addr+16));
548 + if (br2 == 0xC3600000U &&
549 + ldq == 0xA77B000CU &&
550 + nop == 0x47FF041FU &&
551 + jmp == 0x6B7B0000U)
553 + regs->r28 = regs->pc+4;
554 + regs->r27 = addr+16;
555 + regs->pc = resolver;
565 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
569 + printk(KERN_ERR "PAX: bytes at PC: ");
570 + for (i = 0; i < 5; i++) {
572 + if (get_user(c, (unsigned int *)pc+i))
573 + printk(KERN_CONT "???????? ");
575 + printk(KERN_CONT "%08x ", c);
582 * This routine handles page faults. It determines the address,
583 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
585 si_code = SEGV_ACCERR;
587 - if (!(vma->vm_flags & VM_EXEC))
588 + if (!(vma->vm_flags & VM_EXEC)) {
590 +#ifdef CONFIG_PAX_PAGEEXEC
591 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
594 + up_read(&mm->mmap_sem);
595 + switch (pax_handle_fetch_fault(regs)) {
597 +#ifdef CONFIG_PAX_EMUPLT
604 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
605 + do_group_exit(SIGKILL);
612 /* Allow reads even for write-only mappings */
613 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
614 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
615 index 86976d0..8a57797 100644
616 --- a/arch/arm/include/asm/atomic.h
617 +++ b/arch/arm/include/asm/atomic.h
618 @@ -239,6 +239,14 @@ typedef struct {
619 u64 __aligned(8) counter;
622 +#ifdef CONFIG_PAX_REFCOUNT
624 + u64 __aligned(8) counter;
625 +} atomic64_unchecked_t;
627 +typedef atomic64_t atomic64_unchecked_t;
630 #define ATOMIC64_INIT(i) { (i) }
632 static inline u64 atomic64_read(atomic64_t *v)
633 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
634 index 0e9ce8d..6ef1e03 100644
635 --- a/arch/arm/include/asm/elf.h
636 +++ b/arch/arm/include/asm/elf.h
637 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
638 the loader. We need to make sure that it is out of the way of the program
639 that it will "exec", and that there is sufficient room for the brk. */
641 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
642 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
644 +#ifdef CONFIG_PAX_ASLR
645 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
647 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
648 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
651 /* When the program starts, a1 contains a pointer to a function to be
652 registered with atexit, as per the SVR4 ABI. A value of 0 means we
653 @@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
654 extern void elf_set_personality(const struct elf32_hdr *);
655 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
658 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
659 -#define arch_randomize_brk arch_randomize_brk
661 extern int vectors_user_mapping(void);
662 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
663 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
664 diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
665 index e51b1e8..32a3113 100644
666 --- a/arch/arm/include/asm/kmap_types.h
667 +++ b/arch/arm/include/asm/kmap_types.h
668 @@ -21,6 +21,7 @@ enum km_type {
676 diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
677 index b293616..96310e5 100644
678 --- a/arch/arm/include/asm/uaccess.h
679 +++ b/arch/arm/include/asm/uaccess.h
681 #define VERIFY_READ 0
682 #define VERIFY_WRITE 1
684 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
687 * The exception table consists of pairs of addresses: the first is the
688 * address of an instruction that is allowed to fault, and the second is
689 @@ -387,8 +389,23 @@ do { \
693 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
694 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
695 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
696 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
698 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
700 + if (!__builtin_constant_p(n))
701 + check_object_size(to, n, false);
702 + return ___copy_from_user(to, from, n);
705 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
707 + if (!__builtin_constant_p(n))
708 + check_object_size(from, n, true);
709 + return ___copy_to_user(to, from, n);
712 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
713 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
714 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
715 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
717 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
722 if (access_ok(VERIFY_READ, from, n))
723 n = __copy_from_user(to, from, n);
724 else /* security hole - plug it */
725 @@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
727 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
732 if (access_ok(VERIFY_WRITE, to, n))
733 n = __copy_to_user(to, from, n);
735 diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
736 index aeef960..2966009 100644
737 --- a/arch/arm/kernel/armksyms.c
738 +++ b/arch/arm/kernel/armksyms.c
739 @@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
741 EXPORT_SYMBOL(copy_page);
743 -EXPORT_SYMBOL(__copy_from_user);
744 -EXPORT_SYMBOL(__copy_to_user);
745 +EXPORT_SYMBOL(___copy_from_user);
746 +EXPORT_SYMBOL(___copy_to_user);
747 EXPORT_SYMBOL(__clear_user);
749 EXPORT_SYMBOL(__get_user_1);
750 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
751 index c9d11ea..5078081 100644
752 --- a/arch/arm/kernel/process.c
753 +++ b/arch/arm/kernel/process.c
755 #include <linux/tick.h>
756 #include <linux/utsname.h>
757 #include <linux/uaccess.h>
758 -#include <linux/random.h>
759 #include <linux/hw_breakpoint.h>
760 #include <linux/cpuidle.h>
762 @@ -484,12 +483,6 @@ unsigned long get_wchan(struct task_struct *p)
766 -unsigned long arch_randomize_brk(struct mm_struct *mm)
768 - unsigned long range_end = mm->brk + 0x02000000;
769 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
774 * The vectors page is always readable from user space for the
775 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
776 index bc9f9da..c75d826 100644
777 --- a/arch/arm/kernel/traps.c
778 +++ b/arch/arm/kernel/traps.c
779 @@ -257,6 +257,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
781 static DEFINE_SPINLOCK(die_lock);
783 +extern void gr_handle_kernel_exploit(void);
786 * This function is protected against re-entrancy.
788 @@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs *regs, int err)
789 panic("Fatal exception in interrupt");
791 panic("Fatal exception");
793 + gr_handle_kernel_exploit();
795 if (ret != NOTIFY_STOP)
798 diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
799 index 66a477a..bee61d3 100644
800 --- a/arch/arm/lib/copy_from_user.S
801 +++ b/arch/arm/lib/copy_from_user.S
806 - * size_t __copy_from_user(void *to, const void *from, size_t n)
807 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
815 -ENTRY(__copy_from_user)
816 +ENTRY(___copy_from_user)
818 #include "copy_template.S"
820 -ENDPROC(__copy_from_user)
821 +ENDPROC(___copy_from_user)
823 .pushsection .fixup,"ax"
825 diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
826 index d066df6..df28194 100644
827 --- a/arch/arm/lib/copy_to_user.S
828 +++ b/arch/arm/lib/copy_to_user.S
833 - * size_t __copy_to_user(void *to, const void *from, size_t n)
834 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
841 ENTRY(__copy_to_user_std)
842 -WEAK(__copy_to_user)
843 +WEAK(___copy_to_user)
845 #include "copy_template.S"
847 -ENDPROC(__copy_to_user)
848 +ENDPROC(___copy_to_user)
849 ENDPROC(__copy_to_user_std)
851 .pushsection .fixup,"ax"
852 diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
853 index d0ece2a..5ae2f39 100644
854 --- a/arch/arm/lib/uaccess.S
855 +++ b/arch/arm/lib/uaccess.S
858 #define PAGE_SHIFT 12
860 -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
861 +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
862 * Purpose : copy a block to user memory from kernel memory
863 * Params : to - user memory
864 * : from - kernel memory
865 @@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May fault
869 -ENTRY(__copy_to_user)
870 +ENTRY(___copy_to_user)
871 stmfd sp!, {r2, r4 - r7, lr}
874 @@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May fault
876 USER( T(strgtb) r3, [r0], #1) @ May fault
878 -ENDPROC(__copy_to_user)
879 +ENDPROC(___copy_to_user)
881 .pushsection .fixup,"ax"
883 9001: ldmfd sp!, {r0, r4 - r7, pc}
886 -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
887 +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
888 * Purpose : copy a block from user memory to kernel memory
889 * Params : to - kernel memory
890 * : from - user memory
891 @@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May fault
895 -ENTRY(__copy_from_user)
896 +ENTRY(___copy_from_user)
897 stmfd sp!, {r0, r2, r4 - r7, lr}
900 @@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May fault
901 USER( T(ldrgtb) r3, [r1], #1) @ May fault
904 -ENDPROC(__copy_from_user)
905 +ENDPROC(___copy_from_user)
907 .pushsection .fixup,"ax"
909 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
910 index 8b9b136..70d5100 100644
911 --- a/arch/arm/lib/uaccess_with_memcpy.c
912 +++ b/arch/arm/lib/uaccess_with_memcpy.c
913 @@ -103,7 +103,7 @@ out:
917 -__copy_to_user(void __user *to, const void *from, unsigned long n)
918 +___copy_to_user(void __user *to, const void *from, unsigned long n)
921 * This test is stubbed out of the main function above to keep
922 diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
923 index 2b2d51c..0127490 100644
924 --- a/arch/arm/mach-ux500/mbox-db5500.c
925 +++ b/arch/arm/mach-ux500/mbox-db5500.c
926 @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct device *dev,
927 return sprintf(buf, "0x%X\n", mbox_value);
930 -static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
931 +static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
933 static int mbox_show(struct seq_file *s, void *data)
935 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
936 index 3b5ea68..42fc9af 100644
937 --- a/arch/arm/mm/fault.c
938 +++ b/arch/arm/mm/fault.c
939 @@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
943 +#ifdef CONFIG_PAX_PAGEEXEC
944 + if (fsr & FSR_LNX_PF) {
945 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
946 + do_group_exit(SIGKILL);
950 tsk->thread.address = addr;
951 tsk->thread.error_code = fsr;
952 tsk->thread.trap_no = 14;
953 @@ -383,6 +390,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
955 #endif /* CONFIG_MMU */
957 +#ifdef CONFIG_PAX_PAGEEXEC
958 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
962 + printk(KERN_ERR "PAX: bytes at PC: ");
963 + for (i = 0; i < 20; i++) {
965 + if (get_user(c, (__force unsigned char __user *)pc+i))
966 + printk(KERN_CONT "?? ");
968 + printk(KERN_CONT "%02x ", c);
972 + printk(KERN_ERR "PAX: bytes at SP-4: ");
973 + for (i = -1; i < 20; i++) {
975 + if (get_user(c, (__force unsigned long __user *)sp+i))
976 + printk(KERN_CONT "???????? ");
978 + printk(KERN_CONT "%08lx ", c);
985 * First Level Translation Fault Handler
987 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
988 index 74be05f..f605b8c 100644
989 --- a/arch/arm/mm/mmap.c
990 +++ b/arch/arm/mm/mmap.c
991 @@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
995 +#ifdef CONFIG_PAX_RANDMMAP
996 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1001 addr = COLOUR_ALIGN(addr, pgoff);
1002 @@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1003 addr = PAGE_ALIGN(addr);
1005 vma = find_vma(mm, addr);
1006 - if (TASK_SIZE - len >= addr &&
1007 - (!vma || addr + len <= vma->vm_start))
1008 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1011 if (len > mm->cached_hole_size) {
1012 - start_addr = addr = mm->free_area_cache;
1013 + start_addr = addr = mm->free_area_cache;
1015 - start_addr = addr = TASK_UNMAPPED_BASE;
1016 - mm->cached_hole_size = 0;
1017 + start_addr = addr = mm->mmap_base;
1018 + mm->cached_hole_size = 0;
1020 /* 8 bits of randomness in 20 address space bits */
1021 if ((current->flags & PF_RANDOMIZE) &&
1022 @@ -100,14 +103,14 @@ full_search:
1023 * Start a new search - just in case we missed
1026 - if (start_addr != TASK_UNMAPPED_BASE) {
1027 - start_addr = addr = TASK_UNMAPPED_BASE;
1028 + if (start_addr != mm->mmap_base) {
1029 + start_addr = addr = mm->mmap_base;
1030 mm->cached_hole_size = 0;
1035 - if (!vma || addr + len <= vma->vm_start) {
1036 + if (check_heap_stack_gap(vma, addr, len)) {
1038 * Remember the place where we stopped the search:
1040 diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
1041 index 3b3159b..425ea94 100644
1042 --- a/arch/avr32/include/asm/elf.h
1043 +++ b/arch/avr32/include/asm/elf.h
1044 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
1045 the loader. We need to make sure that it is out of the way of the program
1046 that it will "exec", and that there is sufficient room for the brk. */
1048 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1049 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1051 +#ifdef CONFIG_PAX_ASLR
1052 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1054 +#define PAX_DELTA_MMAP_LEN 15
1055 +#define PAX_DELTA_STACK_LEN 15
1058 /* This yields a mask that user programs can use to figure out what
1059 instruction set this CPU supports. This could be done in user space,
1060 diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
1061 index b7f5c68..556135c 100644
1062 --- a/arch/avr32/include/asm/kmap_types.h
1063 +++ b/arch/avr32/include/asm/kmap_types.h
1064 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1069 +D(14) KM_CLEARPAGE,
1074 diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
1075 index f7040a1..db9f300 100644
1076 --- a/arch/avr32/mm/fault.c
1077 +++ b/arch/avr32/mm/fault.c
1078 @@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
1080 int exception_trace = 1;
1082 +#ifdef CONFIG_PAX_PAGEEXEC
1083 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1087 + printk(KERN_ERR "PAX: bytes at PC: ");
1088 + for (i = 0; i < 20; i++) {
1090 + if (get_user(c, (unsigned char *)pc+i))
1091 + printk(KERN_CONT "???????? ");
1093 + printk(KERN_CONT "%02x ", c);
1100 * This routine handles page faults. It determines the address and the
1101 * problem, and then passes it off to one of the appropriate routines.
1102 @@ -156,6 +173,16 @@ bad_area:
1103 up_read(&mm->mmap_sem);
1105 if (user_mode(regs)) {
1107 +#ifdef CONFIG_PAX_PAGEEXEC
1108 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1109 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1110 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1111 + do_group_exit(SIGKILL);
1116 if (exception_trace && printk_ratelimit())
1117 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1118 "sp %08lx ecr %lu\n",
1119 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
1120 index f8e16b2..c73ff79 100644
1121 --- a/arch/frv/include/asm/kmap_types.h
1122 +++ b/arch/frv/include/asm/kmap_types.h
1123 @@ -23,6 +23,7 @@ enum km_type {
1131 diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
1132 index 385fd30..6c3d97e 100644
1133 --- a/arch/frv/mm/elf-fdpic.c
1134 +++ b/arch/frv/mm/elf-fdpic.c
1135 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1137 addr = PAGE_ALIGN(addr);
1138 vma = find_vma(current->mm, addr);
1139 - if (TASK_SIZE - len >= addr &&
1140 - (!vma || addr + len <= vma->vm_start))
1141 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1145 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1146 for (; vma; vma = vma->vm_next) {
1149 - if (addr + len <= vma->vm_start)
1150 + if (check_heap_stack_gap(vma, addr, len))
1154 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
1155 for (; vma; vma = vma->vm_next) {
1158 - if (addr + len <= vma->vm_start)
1159 + if (check_heap_stack_gap(vma, addr, len))
1163 diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
1164 index b5298eb..67c6e62 100644
1165 --- a/arch/ia64/include/asm/elf.h
1166 +++ b/arch/ia64/include/asm/elf.h
1169 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1171 +#ifdef CONFIG_PAX_ASLR
1172 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1174 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1175 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1178 #define PT_IA_64_UNWIND 0x70000001
1180 /* IA-64 relocations: */
1181 diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
1182 index 1a97af3..7529d31 100644
1183 --- a/arch/ia64/include/asm/pgtable.h
1184 +++ b/arch/ia64/include/asm/pgtable.h
1186 * David Mosberger-Tang <davidm@hpl.hp.com>
1190 +#include <linux/const.h>
1191 #include <asm/mman.h>
1192 #include <asm/page.h>
1193 #include <asm/processor.h>
1194 @@ -143,6 +143,17 @@
1195 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1196 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1197 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1199 +#ifdef CONFIG_PAX_PAGEEXEC
1200 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1201 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1202 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1204 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1205 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1206 +# define PAGE_COPY_NOEXEC PAGE_COPY
1209 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1210 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1211 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1212 diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
1213 index b77768d..e0795eb 100644
1214 --- a/arch/ia64/include/asm/spinlock.h
1215 +++ b/arch/ia64/include/asm/spinlock.h
1216 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
1217 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1219 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1220 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1221 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1224 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1225 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
1226 index 449c8c0..432a3d2 100644
1227 --- a/arch/ia64/include/asm/uaccess.h
1228 +++ b/arch/ia64/include/asm/uaccess.h
1229 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1230 const void *__cu_from = (from); \
1231 long __cu_len = (n); \
1233 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
1234 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1235 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1238 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
1239 long __cu_len = (n); \
1241 __chk_user_ptr(__cu_from); \
1242 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
1243 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1244 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1247 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
1248 index 24603be..948052d 100644
1249 --- a/arch/ia64/kernel/module.c
1250 +++ b/arch/ia64/kernel/module.c
1251 @@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
1253 module_free (struct module *mod, void *module_region)
1255 - if (mod && mod->arch.init_unw_table &&
1256 - module_region == mod->module_init) {
1257 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1258 unw_remove_unwind_table(mod->arch.init_unw_table);
1259 mod->arch.init_unw_table = NULL;
1261 @@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
1265 +in_init_rx (const struct module *mod, uint64_t addr)
1267 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1271 +in_init_rw (const struct module *mod, uint64_t addr)
1273 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1277 in_init (const struct module *mod, uint64_t addr)
1279 - return addr - (uint64_t) mod->module_init < mod->init_size;
1280 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1284 +in_core_rx (const struct module *mod, uint64_t addr)
1286 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1290 +in_core_rw (const struct module *mod, uint64_t addr)
1292 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1296 in_core (const struct module *mod, uint64_t addr)
1298 - return addr - (uint64_t) mod->module_core < mod->core_size;
1299 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1303 @@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
1307 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1308 + if (in_init_rx(mod, val))
1309 + val -= (uint64_t) mod->module_init_rx;
1310 + else if (in_init_rw(mod, val))
1311 + val -= (uint64_t) mod->module_init_rw;
1312 + else if (in_core_rx(mod, val))
1313 + val -= (uint64_t) mod->module_core_rx;
1314 + else if (in_core_rw(mod, val))
1315 + val -= (uint64_t) mod->module_core_rw;
1319 @@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
1320 * addresses have been selected...
1323 - if (mod->core_size > MAX_LTOFF)
1324 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1326 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1327 * at the end of the module.
1329 - gp = mod->core_size - MAX_LTOFF / 2;
1330 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1332 - gp = mod->core_size / 2;
1333 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1334 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1335 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1337 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1339 diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
1340 index 609d500..7dde2a8 100644
1341 --- a/arch/ia64/kernel/sys_ia64.c
1342 +++ b/arch/ia64/kernel/sys_ia64.c
1343 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1344 if (REGION_NUMBER(addr) == RGN_HPAGE)
1348 +#ifdef CONFIG_PAX_RANDMMAP
1349 + if (mm->pax_flags & MF_PAX_RANDMMAP)
1350 + addr = mm->free_area_cache;
1355 addr = mm->free_area_cache;
1357 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
1358 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1359 /* At this point: (!vma || addr < vma->vm_end). */
1360 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1361 - if (start_addr != TASK_UNMAPPED_BASE) {
1362 + if (start_addr != mm->mmap_base) {
1363 /* Start a new search --- just in case we missed some holes. */
1364 - addr = TASK_UNMAPPED_BASE;
1365 + addr = mm->mmap_base;
1370 - if (!vma || addr + len <= vma->vm_start) {
1371 + if (check_heap_stack_gap(vma, addr, len)) {
1372 /* Remember the address where we stopped this search: */
1373 mm->free_area_cache = addr + len;
1375 diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
1376 index 53c0ba0..2accdde 100644
1377 --- a/arch/ia64/kernel/vmlinux.lds.S
1378 +++ b/arch/ia64/kernel/vmlinux.lds.S
1379 @@ -199,7 +199,7 @@ SECTIONS {
1381 . = ALIGN(PERCPU_PAGE_SIZE);
1382 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1383 - __phys_per_cpu_start = __per_cpu_load;
1384 + __phys_per_cpu_start = per_cpu_load;
1386 * ensure percpu data fits
1387 * into percpu page size
1388 diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
1389 index 20b3593..1ce77f0 100644
1390 --- a/arch/ia64/mm/fault.c
1391 +++ b/arch/ia64/mm/fault.c
1392 @@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned long address)
1393 return pte_present(pte);
1396 +#ifdef CONFIG_PAX_PAGEEXEC
1397 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1401 + printk(KERN_ERR "PAX: bytes at PC: ");
1402 + for (i = 0; i < 8; i++) {
1404 + if (get_user(c, (unsigned int *)pc+i))
1405 + printk(KERN_CONT "???????? ");
1407 + printk(KERN_CONT "%08x ", c);
1414 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1416 @@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
1417 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1418 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1420 - if ((vma->vm_flags & mask) != mask)
1421 + if ((vma->vm_flags & mask) != mask) {
1423 +#ifdef CONFIG_PAX_PAGEEXEC
1424 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1425 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1428 + up_read(&mm->mmap_sem);
1429 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1430 + do_group_exit(SIGKILL);
1439 * If for any reason at all we couldn't handle the fault, make
1440 * sure we exit gracefully rather than endlessly redo the
1441 diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
1442 index 5ca674b..e0e1b70 100644
1443 --- a/arch/ia64/mm/hugetlbpage.c
1444 +++ b/arch/ia64/mm/hugetlbpage.c
1445 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
1446 /* At this point: (!vmm || addr < vmm->vm_end). */
1447 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1449 - if (!vmm || (addr + len) <= vmm->vm_start)
1450 + if (check_heap_stack_gap(vmm, addr, len))
1452 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1454 diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
1455 index 00cb0e2..2ad8024 100644
1456 --- a/arch/ia64/mm/init.c
1457 +++ b/arch/ia64/mm/init.c
1458 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1459 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1460 vma->vm_end = vma->vm_start + PAGE_SIZE;
1461 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1463 +#ifdef CONFIG_PAX_PAGEEXEC
1464 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1465 + vma->vm_flags &= ~VM_EXEC;
1467 +#ifdef CONFIG_PAX_MPROTECT
1468 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1469 + vma->vm_flags &= ~VM_MAYEXEC;
1475 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1476 down_write(¤t->mm->mmap_sem);
1477 if (insert_vm_struct(current->mm, vma)) {
1478 diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
1479 index 82abd15..d95ae5d 100644
1480 --- a/arch/m32r/lib/usercopy.c
1481 +++ b/arch/m32r/lib/usercopy.c
1484 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1490 if (access_ok(VERIFY_WRITE, to, n))
1491 __copy_user(to,from,n);
1492 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1494 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1500 if (access_ok(VERIFY_READ, from, n))
1501 __copy_user_zeroing(to,from,n);
1502 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
1503 index 455c0ac..ad65fbe 100644
1504 --- a/arch/mips/include/asm/elf.h
1505 +++ b/arch/mips/include/asm/elf.h
1506 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
1507 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1510 +#ifdef CONFIG_PAX_ASLR
1511 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1513 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1514 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1517 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1518 struct linux_binprm;
1519 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1523 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1524 -#define arch_randomize_brk arch_randomize_brk
1526 #endif /* _ASM_ELF_H */
1527 diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
1528 index e59cd1a..8e329d6 100644
1529 --- a/arch/mips/include/asm/page.h
1530 +++ b/arch/mips/include/asm/page.h
1531 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
1532 #ifdef CONFIG_CPU_MIPS32
1533 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1534 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1535 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1536 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1538 typedef struct { unsigned long long pte; } pte_t;
1539 #define pte_val(x) ((x).pte)
1540 diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
1541 index 6018c80..7c37203 100644
1542 --- a/arch/mips/include/asm/system.h
1543 +++ b/arch/mips/include/asm/system.h
1544 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1546 #define __ARCH_WANT_UNLOCKED_CTXSW
1548 -extern unsigned long arch_align_stack(unsigned long sp);
1549 +#define arch_align_stack(x) ((x) & ~0xfUL)
1551 #endif /* _ASM_SYSTEM_H */
1552 diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
1553 index 9fdd8bc..4bd7f1a 100644
1554 --- a/arch/mips/kernel/binfmt_elfn32.c
1555 +++ b/arch/mips/kernel/binfmt_elfn32.c
1556 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1557 #undef ELF_ET_DYN_BASE
1558 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1560 +#ifdef CONFIG_PAX_ASLR
1561 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1563 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1564 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1567 #include <asm/processor.h>
1568 #include <linux/module.h>
1569 #include <linux/elfcore.h>
1570 diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
1571 index ff44823..97f8906 100644
1572 --- a/arch/mips/kernel/binfmt_elfo32.c
1573 +++ b/arch/mips/kernel/binfmt_elfo32.c
1574 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
1575 #undef ELF_ET_DYN_BASE
1576 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1578 +#ifdef CONFIG_PAX_ASLR
1579 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1581 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1582 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1585 #include <asm/processor.h>
1588 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
1589 index b30cb25..454c0a9 100644
1590 --- a/arch/mips/kernel/process.c
1591 +++ b/arch/mips/kernel/process.c
1592 @@ -481,15 +481,3 @@ unsigned long get_wchan(struct task_struct *task)
1598 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1599 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1601 -unsigned long arch_align_stack(unsigned long sp)
1603 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1604 - sp -= get_random_int() & ~PAGE_MASK;
1606 - return sp & ALMASK;
1608 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
1609 index 937cf33..adb39bb 100644
1610 --- a/arch/mips/mm/fault.c
1611 +++ b/arch/mips/mm/fault.c
1613 #include <asm/highmem.h> /* For VMALLOC_END */
1614 #include <linux/kdebug.h>
1616 +#ifdef CONFIG_PAX_PAGEEXEC
1617 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1621 + printk(KERN_ERR "PAX: bytes at PC: ");
1622 + for (i = 0; i < 5; i++) {
1624 + if (get_user(c, (unsigned int *)pc+i))
1625 + printk(KERN_CONT "???????? ");
1627 + printk(KERN_CONT "%08x ", c);
1634 * This routine handles page faults. It determines the address,
1635 * and the problem, and then passes it off to one of the appropriate
1636 diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
1637 index 302d779..7d35bf8 100644
1638 --- a/arch/mips/mm/mmap.c
1639 +++ b/arch/mips/mm/mmap.c
1640 @@ -95,6 +95,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1643 /* requesting a specific address */
1645 +#ifdef CONFIG_PAX_RANDMMAP
1646 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1651 addr = COLOUR_ALIGN(addr, pgoff);
1652 @@ -102,8 +107,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1653 addr = PAGE_ALIGN(addr);
1655 vma = find_vma(mm, addr);
1656 - if (TASK_SIZE - len >= addr &&
1657 - (!vma || addr + len <= vma->vm_start))
1658 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1662 @@ -118,7 +122,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1663 /* At this point: (!vma || addr < vma->vm_end). */
1664 if (TASK_SIZE - len < addr)
1666 - if (!vma || addr + len <= vma->vm_start)
1667 + if (check_heap_stack_gap(vmm, addr, len))
1671 @@ -145,7 +149,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1672 /* make sure it can fit in the remaining address space */
1673 if (likely(addr > len)) {
1674 vma = find_vma(mm, addr - len);
1675 - if (!vma || addr <= vma->vm_start) {
1676 + if (check_heap_stack_gap(vmm, addr - len, len))
1677 /* cache the address as a hint for next time */
1678 return mm->free_area_cache = addr - len;
1680 @@ -165,7 +169,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
1681 * return with success:
1683 vma = find_vma(mm, addr);
1684 - if (likely(!vma || addr + len <= vma->vm_start)) {
1685 + if (check_heap_stack_gap(vmm, addr, len)) {
1686 /* cache the address as a hint for next time */
1687 return mm->free_area_cache = addr;
1689 @@ -242,30 +246,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
1690 mm->unmap_area = arch_unmap_area_topdown;
1694 -static inline unsigned long brk_rnd(void)
1696 - unsigned long rnd = get_random_int();
1698 - rnd = rnd << PAGE_SHIFT;
1699 - /* 8MB for 32bit, 256MB for 64bit */
1700 - if (TASK_IS_32BIT_ADDR)
1701 - rnd = rnd & 0x7ffffful;
1703 - rnd = rnd & 0xffffffful;
1708 -unsigned long arch_randomize_brk(struct mm_struct *mm)
1710 - unsigned long base = mm->brk;
1711 - unsigned long ret;
1713 - ret = PAGE_ALIGN(base + brk_rnd());
1715 - if (ret < mm->brk)
1720 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
1721 index 19f6cb1..6c78cf2 100644
1722 --- a/arch/parisc/include/asm/elf.h
1723 +++ b/arch/parisc/include/asm/elf.h
1724 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
1726 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1728 +#ifdef CONFIG_PAX_ASLR
1729 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
1731 +#define PAX_DELTA_MMAP_LEN 16
1732 +#define PAX_DELTA_STACK_LEN 16
1735 /* This yields a mask that user programs can use to figure out what
1736 instruction set this CPU supports. This could be done in user space,
1737 but it's not easy, and we've already done it here. */
1738 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
1739 index 22dadeb..f6c2be4 100644
1740 --- a/arch/parisc/include/asm/pgtable.h
1741 +++ b/arch/parisc/include/asm/pgtable.h
1742 @@ -210,6 +210,17 @@ struct vm_area_struct;
1743 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1744 #define PAGE_COPY PAGE_EXECREAD
1745 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1747 +#ifdef CONFIG_PAX_PAGEEXEC
1748 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1749 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1750 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1752 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1753 +# define PAGE_COPY_NOEXEC PAGE_COPY
1754 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1757 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1758 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1759 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1760 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
1761 index 5e34ccf..672bc9c 100644
1762 --- a/arch/parisc/kernel/module.c
1763 +++ b/arch/parisc/kernel/module.c
1766 /* three functions to determine where in the module core
1767 * or init pieces the location is */
1768 +static inline int in_init_rx(struct module *me, void *loc)
1770 + return (loc >= me->module_init_rx &&
1771 + loc < (me->module_init_rx + me->init_size_rx));
1774 +static inline int in_init_rw(struct module *me, void *loc)
1776 + return (loc >= me->module_init_rw &&
1777 + loc < (me->module_init_rw + me->init_size_rw));
1780 static inline int in_init(struct module *me, void *loc)
1782 - return (loc >= me->module_init &&
1783 - loc <= (me->module_init + me->init_size));
1784 + return in_init_rx(me, loc) || in_init_rw(me, loc);
1787 +static inline int in_core_rx(struct module *me, void *loc)
1789 + return (loc >= me->module_core_rx &&
1790 + loc < (me->module_core_rx + me->core_size_rx));
1793 +static inline int in_core_rw(struct module *me, void *loc)
1795 + return (loc >= me->module_core_rw &&
1796 + loc < (me->module_core_rw + me->core_size_rw));
1799 static inline int in_core(struct module *me, void *loc)
1801 - return (loc >= me->module_core &&
1802 - loc <= (me->module_core + me->core_size));
1803 + return in_core_rx(me, loc) || in_core_rw(me, loc);
1806 static inline int in_local(struct module *me, void *loc)
1807 @@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
1810 /* align things a bit */
1811 - me->core_size = ALIGN(me->core_size, 16);
1812 - me->arch.got_offset = me->core_size;
1813 - me->core_size += gots * sizeof(struct got_entry);
1814 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1815 + me->arch.got_offset = me->core_size_rw;
1816 + me->core_size_rw += gots * sizeof(struct got_entry);
1818 - me->core_size = ALIGN(me->core_size, 16);
1819 - me->arch.fdesc_offset = me->core_size;
1820 - me->core_size += fdescs * sizeof(Elf_Fdesc);
1821 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1822 + me->arch.fdesc_offset = me->core_size_rw;
1823 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1825 me->arch.got_max = gots;
1826 me->arch.fdesc_max = fdescs;
1827 @@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1831 - got = me->module_core + me->arch.got_offset;
1832 + got = me->module_core_rw + me->arch.got_offset;
1833 for (i = 0; got[i].addr; i++)
1834 if (got[i].addr == value)
1836 @@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
1838 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1840 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1841 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1844 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1845 @@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1847 /* Create new one */
1848 fdesc->addr = value;
1849 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1850 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1851 return (Elf_Addr)fdesc;
1853 #endif /* CONFIG_64BIT */
1854 @@ -845,7 +867,7 @@ register_unwind_table(struct module *me,
1856 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1857 end = table + sechdrs[me->arch.unwind_section].sh_size;
1858 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1859 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1861 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1862 me->arch.unwind_section, table, end, gp);
1863 diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
1864 index c9b9322..02d8940 100644
1865 --- a/arch/parisc/kernel/sys_parisc.c
1866 +++ b/arch/parisc/kernel/sys_parisc.c
1867 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
1868 /* At this point: (!vma || addr < vma->vm_end). */
1869 if (TASK_SIZE - len < addr)
1871 - if (!vma || addr + len <= vma->vm_start)
1872 + if (check_heap_stack_gap(vma, addr, len))
1876 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
1877 /* At this point: (!vma || addr < vma->vm_end). */
1878 if (TASK_SIZE - len < addr)
1880 - if (!vma || addr + len <= vma->vm_start)
1881 + if (check_heap_stack_gap(vma, addr, len))
1883 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1884 if (addr < vma->vm_end) /* handle wraparound */
1885 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
1886 if (flags & MAP_FIXED)
1889 - addr = TASK_UNMAPPED_BASE;
1890 + addr = current->mm->mmap_base;
1893 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1894 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
1895 index f19e660..414fe24 100644
1896 --- a/arch/parisc/kernel/traps.c
1897 +++ b/arch/parisc/kernel/traps.c
1898 @@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
1900 down_read(¤t->mm->mmap_sem);
1901 vma = find_vma(current->mm,regs->iaoq[0]);
1902 - if (vma && (regs->iaoq[0] >= vma->vm_start)
1903 - && (vma->vm_flags & VM_EXEC)) {
1905 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1906 fault_address = regs->iaoq[0];
1907 fault_space = regs->iasq[0];
1909 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
1910 index 18162ce..94de376 100644
1911 --- a/arch/parisc/mm/fault.c
1912 +++ b/arch/parisc/mm/fault.c
1914 #include <linux/sched.h>
1915 #include <linux/interrupt.h>
1916 #include <linux/module.h>
1917 +#include <linux/unistd.h>
1919 #include <asm/uaccess.h>
1920 #include <asm/traps.h>
1921 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
1922 static unsigned long
1923 parisc_acctyp(unsigned long code, unsigned int inst)
1925 - if (code == 6 || code == 16)
1926 + if (code == 6 || code == 7 || code == 16)
1929 switch (inst & 0xf0000000) {
1930 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
1934 +#ifdef CONFIG_PAX_PAGEEXEC
1936 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1938 + * returns 1 when task should be killed
1939 + * 2 when rt_sigreturn trampoline was detected
1940 + * 3 when unpatched PLT trampoline was detected
1942 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1945 +#ifdef CONFIG_PAX_EMUPLT
1948 + do { /* PaX: unpatched PLT emulation */
1949 + unsigned int bl, depwi;
1951 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1952 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1957 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1958 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1960 + err = get_user(ldw, (unsigned int *)addr);
1961 + err |= get_user(bv, (unsigned int *)(addr+4));
1962 + err |= get_user(ldw2, (unsigned int *)(addr+8));
1967 + if (ldw == 0x0E801096U &&
1968 + bv == 0xEAC0C000U &&
1969 + ldw2 == 0x0E881095U)
1971 + unsigned int resolver, map;
1973 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1974 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1978 + regs->gr[20] = instruction_pointer(regs)+8;
1979 + regs->gr[21] = map;
1980 + regs->gr[22] = resolver;
1981 + regs->iaoq[0] = resolver | 3UL;
1982 + regs->iaoq[1] = regs->iaoq[0] + 4;
1989 +#ifdef CONFIG_PAX_EMUTRAMP
1991 +#ifndef CONFIG_PAX_EMUSIGRT
1992 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1996 + do { /* PaX: rt_sigreturn emulation */
1997 + unsigned int ldi1, ldi2, bel, nop;
1999 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
2000 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
2001 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
2002 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
2007 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
2008 + ldi2 == 0x3414015AU &&
2009 + bel == 0xE4008200U &&
2010 + nop == 0x08000240U)
2012 + regs->gr[25] = (ldi1 & 2) >> 1;
2013 + regs->gr[20] = __NR_rt_sigreturn;
2014 + regs->gr[31] = regs->iaoq[1] + 16;
2015 + regs->sr[0] = regs->iasq[1];
2016 + regs->iaoq[0] = 0x100UL;
2017 + regs->iaoq[1] = regs->iaoq[0] + 4;
2018 + regs->iasq[0] = regs->sr[2];
2019 + regs->iasq[1] = regs->sr[2];
2028 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2032 + printk(KERN_ERR "PAX: bytes at PC: ");
2033 + for (i = 0; i < 5; i++) {
2035 + if (get_user(c, (unsigned int *)pc+i))
2036 + printk(KERN_CONT "???????? ");
2038 + printk(KERN_CONT "%08x ", c);
2044 int fixup_exception(struct pt_regs *regs)
2046 const struct exception_table_entry *fix;
2047 @@ -192,8 +303,33 @@ good_area:
2049 acc_type = parisc_acctyp(code,regs->iir);
2051 - if ((vma->vm_flags & acc_type) != acc_type)
2052 + if ((vma->vm_flags & acc_type) != acc_type) {
2054 +#ifdef CONFIG_PAX_PAGEEXEC
2055 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2056 + (address & ~3UL) == instruction_pointer(regs))
2058 + up_read(&mm->mmap_sem);
2059 + switch (pax_handle_fetch_fault(regs)) {
2061 +#ifdef CONFIG_PAX_EMUPLT
2066 +#ifdef CONFIG_PAX_EMUTRAMP
2072 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2073 + do_group_exit(SIGKILL);
2081 * If for any reason at all we couldn't handle the fault, make
2082 diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
2083 index 3bf9cca..e7457d0 100644
2084 --- a/arch/powerpc/include/asm/elf.h
2085 +++ b/arch/powerpc/include/asm/elf.h
2086 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
2087 the loader. We need to make sure that it is out of the way of the program
2088 that it will "exec", and that there is sufficient room for the brk. */
2090 -extern unsigned long randomize_et_dyn(unsigned long base);
2091 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2092 +#define ELF_ET_DYN_BASE (0x20000000)
2094 +#ifdef CONFIG_PAX_ASLR
2095 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2097 +#ifdef __powerpc64__
2098 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
2099 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
2101 +#define PAX_DELTA_MMAP_LEN 15
2102 +#define PAX_DELTA_STACK_LEN 15
2107 * Our registers are always unsigned longs, whether we're a 32 bit
2108 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2109 (0x7ff >> (PAGE_SHIFT - 12)) : \
2110 (0x3ffff >> (PAGE_SHIFT - 12)))
2112 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2113 -#define arch_randomize_brk arch_randomize_brk
2115 #endif /* __KERNEL__ */
2118 diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
2119 index bca8fdc..61e9580 100644
2120 --- a/arch/powerpc/include/asm/kmap_types.h
2121 +++ b/arch/powerpc/include/asm/kmap_types.h
2122 @@ -27,6 +27,7 @@ enum km_type {
2130 diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
2131 index d4a7f64..451de1c 100644
2132 --- a/arch/powerpc/include/asm/mman.h
2133 +++ b/arch/powerpc/include/asm/mman.h
2134 @@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
2136 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
2138 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
2139 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
2141 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
2143 diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
2144 index 2cd664e..1d2e8a7 100644
2145 --- a/arch/powerpc/include/asm/page.h
2146 +++ b/arch/powerpc/include/asm/page.h
2147 @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
2148 * and needs to be executable. This means the whole heap ends
2149 * up being executable.
2151 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2152 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2153 +#define VM_DATA_DEFAULT_FLAGS32 \
2154 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2155 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2157 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2158 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2159 @@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
2160 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2163 +#define ktla_ktva(addr) (addr)
2164 +#define ktva_ktla(addr) (addr)
2166 #ifndef __ASSEMBLY__
2168 #undef STRICT_MM_TYPECHECKS
2169 diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
2170 index 9356262..ea96148 100644
2171 --- a/arch/powerpc/include/asm/page_64.h
2172 +++ b/arch/powerpc/include/asm/page_64.h
2173 @@ -155,15 +155,18 @@ do { \
2174 * stack by default, so in the absence of a PT_GNU_STACK program header
2175 * we turn execute permission off.
2177 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2178 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2179 +#define VM_STACK_DEFAULT_FLAGS32 \
2180 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2181 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2183 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2184 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2186 +#ifndef CONFIG_PAX_PAGEEXEC
2187 #define VM_STACK_DEFAULT_FLAGS \
2188 (is_32bit_task() ? \
2189 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2192 #include <asm-generic/getorder.h>
2194 diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
2195 index 88b0bd9..e32bc67 100644
2196 --- a/arch/powerpc/include/asm/pgtable.h
2197 +++ b/arch/powerpc/include/asm/pgtable.h
2199 #define _ASM_POWERPC_PGTABLE_H
2202 +#include <linux/const.h>
2203 #ifndef __ASSEMBLY__
2204 #include <asm/processor.h> /* For TASK_SIZE */
2205 #include <asm/mmu.h>
2206 diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
2207 index 4aad413..85d86bf 100644
2208 --- a/arch/powerpc/include/asm/pte-hash32.h
2209 +++ b/arch/powerpc/include/asm/pte-hash32.h
2211 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2212 #define _PAGE_USER 0x004 /* usermode access allowed */
2213 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2214 +#define _PAGE_EXEC _PAGE_GUARDED
2215 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2216 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2217 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2218 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
2219 index 559da19..7e5835c 100644
2220 --- a/arch/powerpc/include/asm/reg.h
2221 +++ b/arch/powerpc/include/asm/reg.h
2223 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2224 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2225 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2226 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2227 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2228 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2229 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2230 diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
2231 index e30a13d..2b7d994 100644
2232 --- a/arch/powerpc/include/asm/system.h
2233 +++ b/arch/powerpc/include/asm/system.h
2234 @@ -530,7 +530,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
2235 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2238 -extern unsigned long arch_align_stack(unsigned long sp);
2239 +#define arch_align_stack(x) ((x) & ~0xfUL)
2241 /* Used in very early kernel initialization. */
2242 extern unsigned long reloc_offset(void);
2243 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
2244 index bd0fb84..a42a14b 100644
2245 --- a/arch/powerpc/include/asm/uaccess.h
2246 +++ b/arch/powerpc/include/asm/uaccess.h
2248 #define VERIFY_READ 0
2249 #define VERIFY_WRITE 1
2251 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
2254 * The fs value determines whether argument validity checking should be
2255 * performed or not. If get_fs() == USER_DS, checking is performed, with
2256 @@ -327,52 +329,6 @@ do { \
2257 extern unsigned long __copy_tofrom_user(void __user *to,
2258 const void __user *from, unsigned long size);
2260 -#ifndef __powerpc64__
2262 -static inline unsigned long copy_from_user(void *to,
2263 - const void __user *from, unsigned long n)
2265 - unsigned long over;
2267 - if (access_ok(VERIFY_READ, from, n))
2268 - return __copy_tofrom_user((__force void __user *)to, from, n);
2269 - if ((unsigned long)from < TASK_SIZE) {
2270 - over = (unsigned long)from + n - TASK_SIZE;
2271 - return __copy_tofrom_user((__force void __user *)to, from,
2277 -static inline unsigned long copy_to_user(void __user *to,
2278 - const void *from, unsigned long n)
2280 - unsigned long over;
2282 - if (access_ok(VERIFY_WRITE, to, n))
2283 - return __copy_tofrom_user(to, (__force void __user *)from, n);
2284 - if ((unsigned long)to < TASK_SIZE) {
2285 - over = (unsigned long)to + n - TASK_SIZE;
2286 - return __copy_tofrom_user(to, (__force void __user *)from,
2292 -#else /* __powerpc64__ */
2294 -#define __copy_in_user(to, from, size) \
2295 - __copy_tofrom_user((to), (from), (size))
2297 -extern unsigned long copy_from_user(void *to, const void __user *from,
2299 -extern unsigned long copy_to_user(void __user *to, const void *from,
2301 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
2304 -#endif /* __powerpc64__ */
2306 static inline unsigned long __copy_from_user_inatomic(void *to,
2307 const void __user *from, unsigned long n)
2309 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
2314 + if (!__builtin_constant_p(n))
2315 + check_object_size(to, n, false);
2317 return __copy_tofrom_user((__force void __user *)to, from, n);
2320 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
2325 + if (!__builtin_constant_p(n))
2326 + check_object_size(from, n, true);
2328 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2331 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
2332 return __copy_to_user_inatomic(to, from, size);
2335 +#ifndef __powerpc64__
2337 +static inline unsigned long __must_check copy_from_user(void *to,
2338 + const void __user *from, unsigned long n)
2340 + unsigned long over;
2345 + if (access_ok(VERIFY_READ, from, n)) {
2346 + if (!__builtin_constant_p(n))
2347 + check_object_size(to, n, false);
2348 + return __copy_tofrom_user((__force void __user *)to, from, n);
2350 + if ((unsigned long)from < TASK_SIZE) {
2351 + over = (unsigned long)from + n - TASK_SIZE;
2352 + if (!__builtin_constant_p(n - over))
2353 + check_object_size(to, n - over, false);
2354 + return __copy_tofrom_user((__force void __user *)to, from,
2360 +static inline unsigned long __must_check copy_to_user(void __user *to,
2361 + const void *from, unsigned long n)
2363 + unsigned long over;
2368 + if (access_ok(VERIFY_WRITE, to, n)) {
2369 + if (!__builtin_constant_p(n))
2370 + check_object_size(from, n, true);
2371 + return __copy_tofrom_user(to, (__force void __user *)from, n);
2373 + if ((unsigned long)to < TASK_SIZE) {
2374 + over = (unsigned long)to + n - TASK_SIZE;
2375 + if (!__builtin_constant_p(n))
2376 + check_object_size(from, n - over, true);
2377 + return __copy_tofrom_user(to, (__force void __user *)from,
2383 +#else /* __powerpc64__ */
2385 +#define __copy_in_user(to, from, size) \
2386 + __copy_tofrom_user((to), (from), (size))
2388 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2390 + if ((long)n < 0 || n > INT_MAX)
2393 + if (!__builtin_constant_p(n))
2394 + check_object_size(to, n, false);
2396 + if (likely(access_ok(VERIFY_READ, from, n)))
2397 + n = __copy_from_user(to, from, n);
2403 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2405 + if ((long)n < 0 || n > INT_MAX)
2408 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
2409 + if (!__builtin_constant_p(n))
2410 + check_object_size(from, n, true);
2411 + n = __copy_to_user(to, from, n);
2416 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
2419 +#endif /* __powerpc64__ */
2421 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2423 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2424 diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
2425 index 429983c..7af363b 100644
2426 --- a/arch/powerpc/kernel/exceptions-64e.S
2427 +++ b/arch/powerpc/kernel/exceptions-64e.S
2428 @@ -587,6 +587,7 @@ storage_fault_common:
2431 addi r3,r1,STACK_FRAME_OVERHEAD
2435 ld r14,PACA_EXGEN+EX_R14(r13)
2436 @@ -596,8 +597,7 @@ storage_fault_common:
2439 b .ret_from_except_lite
2443 addi r3,r1,STACK_FRAME_OVERHEAD
2446 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
2447 index 41b02c7..05e76fb 100644
2448 --- a/arch/powerpc/kernel/exceptions-64s.S
2449 +++ b/arch/powerpc/kernel/exceptions-64s.S
2450 @@ -1014,10 +1014,10 @@ handle_page_fault:
2453 addi r3,r1,STACK_FRAME_OVERHEAD
2460 addi r3,r1,STACK_FRAME_OVERHEAD
2462 diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
2463 index 0b6d796..d760ddb 100644
2464 --- a/arch/powerpc/kernel/module_32.c
2465 +++ b/arch/powerpc/kernel/module_32.c
2466 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
2467 me->arch.core_plt_section = i;
2469 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2470 - printk("Module doesn't contain .plt or .init.plt sections.\n");
2471 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2475 @@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
2477 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2478 /* Init, or core PLT? */
2479 - if (location >= mod->module_core
2480 - && location < mod->module_core + mod->core_size)
2481 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2482 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2483 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2485 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2486 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2487 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2489 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2493 /* Find this entry, or if that fails, the next avail. entry */
2494 while (entry->jump[0]) {
2495 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
2496 index 8f53954..a704ad6 100644
2497 --- a/arch/powerpc/kernel/process.c
2498 +++ b/arch/powerpc/kernel/process.c
2499 @@ -682,8 +682,8 @@ void show_regs(struct pt_regs * regs)
2500 * Lookup NIP late so we have the best change of getting the
2501 * above info out without failing
2503 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2504 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2505 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2506 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2508 show_stack(current, (unsigned long *) regs->gpr[1]);
2509 if (!user_mode(regs))
2510 @@ -1187,10 +1187,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2512 ip = stack[STACK_FRAME_LR_SAVE];
2513 if (!firstframe || ip != lr) {
2514 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2515 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2516 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2517 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2520 (void *)current->ret_stack[curr_frame].ret);
2523 @@ -1210,7 +1210,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
2524 struct pt_regs *regs = (struct pt_regs *)
2525 (sp + STACK_FRAME_OVERHEAD);
2527 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
2528 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
2529 regs->trap, (void *)regs->nip, (void *)lr);
2532 @@ -1285,58 +1285,3 @@ void thread_info_cache_init(void)
2535 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2537 -unsigned long arch_align_stack(unsigned long sp)
2539 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2540 - sp -= get_random_int() & ~PAGE_MASK;
2544 -static inline unsigned long brk_rnd(void)
2546 - unsigned long rnd = 0;
2548 - /* 8MB for 32bit, 1GB for 64bit */
2549 - if (is_32bit_task())
2550 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2552 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2554 - return rnd << PAGE_SHIFT;
2557 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2559 - unsigned long base = mm->brk;
2560 - unsigned long ret;
2562 -#ifdef CONFIG_PPC_STD_MMU_64
2564 - * If we are using 1TB segments and we are allowed to randomise
2565 - * the heap, we can put it above 1TB so it is backed by a 1TB
2566 - * segment. Otherwise the heap will be in the bottom 1TB
2567 - * which always uses 256MB segments and this may result in a
2568 - * performance penalty.
2570 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2571 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2574 - ret = PAGE_ALIGN(base + brk_rnd());
2576 - if (ret < mm->brk)
2582 -unsigned long randomize_et_dyn(unsigned long base)
2584 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2591 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
2592 index 78b76dc..7f232ef 100644
2593 --- a/arch/powerpc/kernel/signal_32.c
2594 +++ b/arch/powerpc/kernel/signal_32.c
2595 @@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
2596 /* Save user registers on the stack */
2597 frame = &rt_sf->uc.uc_mcontext;
2599 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2600 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2601 if (save_user_regs(regs, frame, 0, 1))
2603 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2604 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
2605 index e91c736..742ec06 100644
2606 --- a/arch/powerpc/kernel/signal_64.c
2607 +++ b/arch/powerpc/kernel/signal_64.c
2608 @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
2609 current->thread.fpscr.val = 0;
2611 /* Set up to return from userspace. */
2612 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2613 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2614 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2616 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2617 diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
2618 index f19d977..8ac286e 100644
2619 --- a/arch/powerpc/kernel/traps.c
2620 +++ b/arch/powerpc/kernel/traps.c
2621 @@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2622 static inline void pmac_backlight_unblank(void) { }
2625 +extern void gr_handle_kernel_exploit(void);
2627 int die(const char *str, struct pt_regs *regs, long err)
2630 @@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs *regs, long err)
2632 panic("Fatal exception");
2634 + gr_handle_kernel_exploit();
2639 diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
2640 index 142ab10..236e61a 100644
2641 --- a/arch/powerpc/kernel/vdso.c
2642 +++ b/arch/powerpc/kernel/vdso.c
2644 #include <asm/firmware.h>
2645 #include <asm/vdso.h>
2646 #include <asm/vdso_datapage.h>
2647 +#include <asm/mman.h>
2651 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2652 vdso_base = VDSO32_MBASE;
2655 - current->mm->context.vdso_base = 0;
2656 + current->mm->context.vdso_base = ~0UL;
2658 /* vDSO has a problem and was disabled, just don't "enable" it for the
2660 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2661 vdso_base = get_unmapped_area(NULL, vdso_base,
2662 (vdso_pages << PAGE_SHIFT) +
2663 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2665 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
2666 if (IS_ERR_VALUE(vdso_base)) {
2669 diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
2670 index 5eea6f3..5d10396 100644
2671 --- a/arch/powerpc/lib/usercopy_64.c
2672 +++ b/arch/powerpc/lib/usercopy_64.c
2674 #include <linux/module.h>
2675 #include <asm/uaccess.h>
2677 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2679 - if (likely(access_ok(VERIFY_READ, from, n)))
2680 - n = __copy_from_user(to, from, n);
2686 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2688 - if (likely(access_ok(VERIFY_WRITE, to, n)))
2689 - n = __copy_to_user(to, from, n);
2693 unsigned long copy_in_user(void __user *to, const void __user *from,
2696 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
2700 -EXPORT_SYMBOL(copy_from_user);
2701 -EXPORT_SYMBOL(copy_to_user);
2702 EXPORT_SYMBOL(copy_in_user);
2704 diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
2705 index 5efe8c9..db9ceef 100644
2706 --- a/arch/powerpc/mm/fault.c
2707 +++ b/arch/powerpc/mm/fault.c
2709 #include <linux/perf_event.h>
2710 #include <linux/magic.h>
2711 #include <linux/ratelimit.h>
2712 +#include <linux/slab.h>
2713 +#include <linux/pagemap.h>
2714 +#include <linux/compiler.h>
2715 +#include <linux/unistd.h>
2717 #include <asm/firmware.h>
2718 #include <asm/page.h>
2720 #include <asm/tlbflush.h>
2721 #include <asm/siginfo.h>
2722 #include <mm/mmu_decl.h>
2723 +#include <asm/ptrace.h>
2725 #ifdef CONFIG_KPROBES
2726 static inline int notify_page_fault(struct pt_regs *regs)
2727 @@ -66,6 +71,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
2731 +#ifdef CONFIG_PAX_PAGEEXEC
2733 + * PaX: decide what to do with offenders (regs->nip = fault address)
2735 + * returns 1 when task should be killed
2737 +static int pax_handle_fetch_fault(struct pt_regs *regs)
2742 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2746 + printk(KERN_ERR "PAX: bytes at PC: ");
2747 + for (i = 0; i < 5; i++) {
2749 + if (get_user(c, (unsigned int __user *)pc+i))
2750 + printk(KERN_CONT "???????? ");
2752 + printk(KERN_CONT "%08x ", c);
2759 * Check whether the instruction at regs->nip is a store using
2760 * an update addressing form which will update r1.
2761 @@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
2762 * indicate errors in DSISR but can validly be set in SRR1.
2765 - error_code &= 0x48200000;
2766 + error_code &= 0x58200000;
2768 is_write = error_code & DSISR_ISSTORE;
2770 @@ -259,7 +291,7 @@ good_area:
2771 * "undefined". Of those that can be set, this is the only
2772 * one which seems bad.
2774 - if (error_code & 0x10000000)
2775 + if (error_code & DSISR_GUARDED)
2776 /* Guarded storage error. */
2778 #endif /* CONFIG_8xx */
2779 @@ -274,7 +306,7 @@ good_area:
2780 * processors use the same I/D cache coherency mechanism
2783 - if (error_code & DSISR_PROTFAULT)
2784 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2786 #endif /* CONFIG_PPC_STD_MMU */
2788 @@ -343,6 +375,23 @@ bad_area:
2789 bad_area_nosemaphore:
2790 /* User mode accesses cause a SIGSEGV */
2791 if (user_mode(regs)) {
2793 +#ifdef CONFIG_PAX_PAGEEXEC
2794 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2795 +#ifdef CONFIG_PPC_STD_MMU
2796 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2798 + if (is_exec && regs->nip == address) {
2800 + switch (pax_handle_fetch_fault(regs)) {
2803 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2804 + do_group_exit(SIGKILL);
2809 _exception(SIGSEGV, regs, code, address);
2812 diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
2813 index 5a783d8..c23e14b 100644
2814 --- a/arch/powerpc/mm/mmap_64.c
2815 +++ b/arch/powerpc/mm/mmap_64.c
2816 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
2818 if (mmap_is_legacy()) {
2819 mm->mmap_base = TASK_UNMAPPED_BASE;
2821 +#ifdef CONFIG_PAX_RANDMMAP
2822 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2823 + mm->mmap_base += mm->delta_mmap;
2826 mm->get_unmapped_area = arch_get_unmapped_area;
2827 mm->unmap_area = arch_unmap_area;
2829 mm->mmap_base = mmap_base();
2831 +#ifdef CONFIG_PAX_RANDMMAP
2832 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2833 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2836 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2837 mm->unmap_area = arch_unmap_area_topdown;
2839 diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
2840 index ba51948..23009d9 100644
2841 --- a/arch/powerpc/mm/slice.c
2842 +++ b/arch/powerpc/mm/slice.c
2843 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
2844 if ((mm->task_size - len) < addr)
2846 vma = find_vma(mm, addr);
2847 - return (!vma || (addr + len) <= vma->vm_start);
2848 + return check_heap_stack_gap(vma, addr, len);
2851 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2852 @@ -256,7 +256,7 @@ full_search:
2853 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2856 - if (!vma || addr + len <= vma->vm_start) {
2857 + if (check_heap_stack_gap(vma, addr, len)) {
2859 * Remember the place where we stopped the search:
2861 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2865 - addr = mm->mmap_base;
2866 - while (addr > len) {
2867 + if (mm->mmap_base < len)
2870 + addr = mm->mmap_base - len;
2872 + while (!IS_ERR_VALUE(addr)) {
2873 /* Go down by chunk size */
2874 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2875 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
2877 /* Check for hit with different page size */
2878 mask = slice_range_to_mask(addr, len);
2879 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2880 * return with success:
2882 vma = find_vma(mm, addr);
2883 - if (!vma || (addr + len) <= vma->vm_start) {
2884 + if (check_heap_stack_gap(vma, addr, len)) {
2885 /* remember the address as a hint for next time */
2887 mm->free_area_cache = addr;
2888 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
2889 mm->cached_hole_size = vma->vm_start - addr;
2891 /* try just below the current vma->vm_start */
2892 - addr = vma->vm_start;
2893 + addr = skip_heap_stack_gap(vma, len);
2897 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
2898 if (fixed && addr > (mm->task_size - len))
2901 +#ifdef CONFIG_PAX_RANDMMAP
2902 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2906 /* If hint, make sure it matches our alignment restrictions */
2907 if (!fixed && addr) {
2908 addr = _ALIGN_UP(addr, 1ul << pshift);
2909 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
2910 index 547f1a6..3fff354 100644
2911 --- a/arch/s390/include/asm/elf.h
2912 +++ b/arch/s390/include/asm/elf.h
2913 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2914 the loader. We need to make sure that it is out of the way of the program
2915 that it will "exec", and that there is sufficient room for the brk. */
2917 -extern unsigned long randomize_et_dyn(unsigned long base);
2918 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2919 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2921 +#ifdef CONFIG_PAX_ASLR
2922 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2924 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2925 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2928 /* This yields a mask that user programs can use to figure out what
2929 instruction set this CPU supports. */
2930 @@ -211,7 +217,4 @@ struct linux_binprm;
2931 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2932 int arch_setup_additional_pages(struct linux_binprm *, int);
2934 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2935 -#define arch_randomize_brk arch_randomize_brk
2938 diff --git a/arch/s390/include/asm/system.h b/arch/s390/include/asm/system.h
2939 index 6582f69..b69906f 100644
2940 --- a/arch/s390/include/asm/system.h
2941 +++ b/arch/s390/include/asm/system.h
2942 @@ -256,7 +256,7 @@ extern void (*_machine_restart)(char *command);
2943 extern void (*_machine_halt)(void);
2944 extern void (*_machine_power_off)(void);
2946 -extern unsigned long arch_align_stack(unsigned long sp);
2947 +#define arch_align_stack(x) ((x) & ~0xfUL)
2949 static inline int tprot(unsigned long addr)
2951 diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
2952 index 2b23885..e136e31 100644
2953 --- a/arch/s390/include/asm/uaccess.h
2954 +++ b/arch/s390/include/asm/uaccess.h
2955 @@ -235,6 +235,10 @@ static inline unsigned long __must_check
2956 copy_to_user(void __user *to, const void *from, unsigned long n)
2963 if (access_ok(VERIFY_WRITE, to, n))
2964 n = __copy_to_user(to, from, n);
2966 @@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
2967 static inline unsigned long __must_check
2968 __copy_from_user(void *to, const void __user *from, unsigned long n)
2973 if (__builtin_constant_p(n) && (n <= 256))
2974 return uaccess.copy_from_user_small(n, from, to);
2976 @@ -294,6 +301,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
2977 unsigned int sz = __compiletime_object_size(to);
2984 if (unlikely(sz != -1 && sz < n)) {
2985 copy_from_user_overflow();
2987 diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
2988 index dfcb343..eda788a 100644
2989 --- a/arch/s390/kernel/module.c
2990 +++ b/arch/s390/kernel/module.c
2991 @@ -161,11 +161,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
2993 /* Increase core size by size of got & plt and set start
2994 offsets for got and plt. */
2995 - me->core_size = ALIGN(me->core_size, 4);
2996 - me->arch.got_offset = me->core_size;
2997 - me->core_size += me->arch.got_size;
2998 - me->arch.plt_offset = me->core_size;
2999 - me->core_size += me->arch.plt_size;
3000 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
3001 + me->arch.got_offset = me->core_size_rw;
3002 + me->core_size_rw += me->arch.got_size;
3003 + me->arch.plt_offset = me->core_size_rx;
3004 + me->core_size_rx += me->arch.plt_size;
3008 @@ -242,7 +242,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3009 if (info->got_initialized == 0) {
3012 - gotent = me->module_core + me->arch.got_offset +
3013 + gotent = me->module_core_rw + me->arch.got_offset +
3016 info->got_initialized = 1;
3017 @@ -266,7 +266,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3018 else if (r_type == R_390_GOTENT ||
3019 r_type == R_390_GOTPLTENT)
3020 *(unsigned int *) loc =
3021 - (val + (Elf_Addr) me->module_core - loc) >> 1;
3022 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3023 else if (r_type == R_390_GOT64 ||
3024 r_type == R_390_GOTPLT64)
3025 *(unsigned long *) loc = val;
3026 @@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3027 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3028 if (info->plt_initialized == 0) {
3030 - ip = me->module_core + me->arch.plt_offset +
3031 + ip = me->module_core_rx + me->arch.plt_offset +
3033 #ifndef CONFIG_64BIT
3034 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3035 @@ -305,7 +305,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3036 val - loc + 0xffffUL < 0x1ffffeUL) ||
3037 (r_type == R_390_PLT32DBL &&
3038 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3039 - val = (Elf_Addr) me->module_core +
3040 + val = (Elf_Addr) me->module_core_rx +
3041 me->arch.plt_offset +
3043 val += rela->r_addend - loc;
3044 @@ -327,7 +327,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3045 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3046 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3047 val = val + rela->r_addend -
3048 - ((Elf_Addr) me->module_core + me->arch.got_offset);
3049 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3050 if (r_type == R_390_GOTOFF16)
3051 *(unsigned short *) loc = val;
3052 else if (r_type == R_390_GOTOFF32)
3053 @@ -337,7 +337,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
3055 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3056 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3057 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
3058 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3059 rela->r_addend - loc;
3060 if (r_type == R_390_GOTPC)
3061 *(unsigned int *) loc = val;
3062 diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
3063 index 541a750..8739853 100644
3064 --- a/arch/s390/kernel/process.c
3065 +++ b/arch/s390/kernel/process.c
3066 @@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_struct *p)
3071 -unsigned long arch_align_stack(unsigned long sp)
3073 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3074 - sp -= get_random_int() & ~PAGE_MASK;
3078 -static inline unsigned long brk_rnd(void)
3080 - /* 8MB for 32bit, 1GB for 64bit */
3081 - if (is_32bit_task())
3082 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
3084 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
3087 -unsigned long arch_randomize_brk(struct mm_struct *mm)
3089 - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
3091 - if (ret < mm->brk)
3096 -unsigned long randomize_et_dyn(unsigned long base)
3098 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3100 - if (!(current->flags & PF_RANDOMIZE))
3106 diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
3107 index 7b371c3..ad06cf1 100644
3108 --- a/arch/s390/kernel/setup.c
3109 +++ b/arch/s390/kernel/setup.c
3110 @@ -271,7 +271,7 @@ static int __init early_parse_mem(char *p)
3112 early_param("mem", early_parse_mem);
3114 -unsigned int user_mode = HOME_SPACE_MODE;
3115 +unsigned int user_mode = SECONDARY_SPACE_MODE;
3116 EXPORT_SYMBOL_GPL(user_mode);
3118 static int set_amode_and_uaccess(unsigned long user_amode,
3119 diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
3120 index c9a9f7f..60d0315 100644
3121 --- a/arch/s390/mm/mmap.c
3122 +++ b/arch/s390/mm/mmap.c
3123 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3125 if (mmap_is_legacy()) {
3126 mm->mmap_base = TASK_UNMAPPED_BASE;
3128 +#ifdef CONFIG_PAX_RANDMMAP
3129 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3130 + mm->mmap_base += mm->delta_mmap;
3133 mm->get_unmapped_area = arch_get_unmapped_area;
3134 mm->unmap_area = arch_unmap_area;
3136 mm->mmap_base = mmap_base();
3138 +#ifdef CONFIG_PAX_RANDMMAP
3139 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3140 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3143 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3144 mm->unmap_area = arch_unmap_area_topdown;
3146 @@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3148 if (mmap_is_legacy()) {
3149 mm->mmap_base = TASK_UNMAPPED_BASE;
3151 +#ifdef CONFIG_PAX_RANDMMAP
3152 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3153 + mm->mmap_base += mm->delta_mmap;
3156 mm->get_unmapped_area = s390_get_unmapped_area;
3157 mm->unmap_area = arch_unmap_area;
3159 mm->mmap_base = mmap_base();
3161 +#ifdef CONFIG_PAX_RANDMMAP
3162 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3163 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3166 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3167 mm->unmap_area = arch_unmap_area_topdown;
3169 diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
3170 index 589d5c7..669e274 100644
3171 --- a/arch/score/include/asm/system.h
3172 +++ b/arch/score/include/asm/system.h
3173 @@ -17,7 +17,7 @@ do { \
3174 #define finish_arch_switch(prev) do {} while (0)
3176 typedef void (*vi_handler_t)(void);
3177 -extern unsigned long arch_align_stack(unsigned long sp);
3178 +#define arch_align_stack(x) (x)
3180 #define mb() barrier()
3181 #define rmb() barrier()
3182 diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
3183 index 25d0803..d6c8e36 100644
3184 --- a/arch/score/kernel/process.c
3185 +++ b/arch/score/kernel/process.c
3186 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
3188 return task_pt_regs(task)->cp0_epc;
3191 -unsigned long arch_align_stack(unsigned long sp)
3195 diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
3196 index afeb710..d1d1289 100644
3197 --- a/arch/sh/mm/mmap.c
3198 +++ b/arch/sh/mm/mmap.c
3199 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
3200 addr = PAGE_ALIGN(addr);
3202 vma = find_vma(mm, addr);
3203 - if (TASK_SIZE - len >= addr &&
3204 - (!vma || addr + len <= vma->vm_start))
3205 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3209 @@ -106,7 +105,7 @@ full_search:
3213 - if (likely(!vma || addr + len <= vma->vm_start)) {
3214 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3216 * Remember the place where we stopped the search:
3218 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3219 addr = PAGE_ALIGN(addr);
3221 vma = find_vma(mm, addr);
3222 - if (TASK_SIZE - len >= addr &&
3223 - (!vma || addr + len <= vma->vm_start))
3224 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3228 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3229 /* make sure it can fit in the remaining address space */
3230 if (likely(addr > len)) {
3231 vma = find_vma(mm, addr-len);
3232 - if (!vma || addr <= vma->vm_start) {
3233 + if (check_heap_stack_gap(vma, addr - len, len)) {
3234 /* remember the address as a hint for next time */
3235 return (mm->free_area_cache = addr-len);
3237 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3238 if (unlikely(mm->mmap_base < len))
3241 - addr = mm->mmap_base-len;
3242 - if (do_colour_align)
3243 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3244 + addr = mm->mmap_base - len;
3247 + if (do_colour_align)
3248 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3250 * Lookup failure means no vma is above this address,
3251 * else if new region fits below vma->vm_start,
3252 * return with success:
3254 vma = find_vma(mm, addr);
3255 - if (likely(!vma || addr+len <= vma->vm_start)) {
3256 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3257 /* remember the address as a hint for next time */
3258 return (mm->free_area_cache = addr);
3260 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3261 mm->cached_hole_size = vma->vm_start - addr;
3263 /* try just below the current vma->vm_start */
3264 - addr = vma->vm_start-len;
3265 - if (do_colour_align)
3266 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3267 - } while (likely(len < vma->vm_start));
3268 + addr = skip_heap_stack_gap(vma, len);
3269 + } while (!IS_ERR_VALUE(addr));
3273 diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
3274 index ad1fb5d..fc5315b 100644
3275 --- a/arch/sparc/Makefile
3276 +++ b/arch/sparc/Makefile
3277 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
3278 # Export what is needed by arch/sparc/boot/Makefile
3279 export VMLINUX_INIT VMLINUX_MAIN
3280 VMLINUX_INIT := $(head-y) $(init-y)
3281 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
3282 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
3283 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
3284 VMLINUX_MAIN += $(drivers-y) $(net-y)
3286 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
3287 index 9f421df..b81fc12 100644
3288 --- a/arch/sparc/include/asm/atomic_64.h
3289 +++ b/arch/sparc/include/asm/atomic_64.h
3291 #define ATOMIC64_INIT(i) { (i) }
3293 #define atomic_read(v) (*(volatile int *)&(v)->counter)
3294 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3296 + return v->counter;
3298 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
3299 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3301 + return v->counter;
3304 #define atomic_set(v, i) (((v)->counter) = i)
3305 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3309 #define atomic64_set(v, i) (((v)->counter) = i)
3310 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3315 extern void atomic_add(int, atomic_t *);
3316 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3317 extern void atomic64_add(long, atomic64_t *);
3318 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3319 extern void atomic_sub(int, atomic_t *);
3320 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3321 extern void atomic64_sub(long, atomic64_t *);
3322 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3324 extern int atomic_add_ret(int, atomic_t *);
3325 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3326 extern long atomic64_add_ret(long, atomic64_t *);
3327 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3328 extern int atomic_sub_ret(int, atomic_t *);
3329 extern long atomic64_sub_ret(long, atomic64_t *);
3331 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3332 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3334 #define atomic_inc_return(v) atomic_add_ret(1, v)
3335 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3337 + return atomic_add_ret_unchecked(1, v);
3339 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3340 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3342 + return atomic64_add_ret_unchecked(1, v);
3345 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3346 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3348 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3349 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3351 + return atomic_add_ret_unchecked(i, v);
3353 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3354 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3356 + return atomic64_add_ret_unchecked(i, v);
3360 * atomic_inc_and_test - increment and test
3361 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3364 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3365 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3367 + return atomic_inc_return_unchecked(v) == 0;
3369 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3371 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3372 @@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
3373 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3375 #define atomic_inc(v) atomic_add(1, v)
3376 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3378 + atomic_add_unchecked(1, v);
3380 #define atomic64_inc(v) atomic64_add(1, v)
3381 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3383 + atomic64_add_unchecked(1, v);
3386 #define atomic_dec(v) atomic_sub(1, v)
3387 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3389 + atomic_sub_unchecked(1, v);
3391 #define atomic64_dec(v) atomic64_sub(1, v)
3392 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3394 + atomic64_sub_unchecked(1, v);
3397 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3398 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3400 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3401 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3403 + return cmpxchg(&v->counter, old, new);
3405 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3406 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3408 + return xchg(&v->counter, new);
3411 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3417 - if (unlikely(c == (u)))
3418 + if (unlikely(c == u))
3420 - old = atomic_cmpxchg((v), c, c + (a));
3422 + asm volatile("addcc %2, %0, %0\n"
3424 +#ifdef CONFIG_PAX_REFCOUNT
3429 + : "0" (c), "ir" (a)
3432 + old = atomic_cmpxchg(v, c, new);
3433 if (likely(old == c))
3436 @@ -89,20 +166,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
3437 #define atomic64_cmpxchg(v, o, n) \
3438 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3439 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3440 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3442 + return xchg(&v->counter, new);
3445 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3449 c = atomic64_read(v);
3451 - if (unlikely(c == (u)))
3452 + if (unlikely(c == u))
3454 - old = atomic64_cmpxchg((v), c, c + (a));
3456 + asm volatile("addcc %2, %0, %0\n"
3458 +#ifdef CONFIG_PAX_REFCOUNT
3463 + : "0" (c), "ir" (a)
3466 + old = atomic64_cmpxchg(v, c, new);
3467 if (likely(old == c))
3475 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3476 diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
3477 index 69358b5..17b4745 100644
3478 --- a/arch/sparc/include/asm/cache.h
3479 +++ b/arch/sparc/include/asm/cache.h
3481 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3483 #define L1_CACHE_SHIFT 5
3484 -#define L1_CACHE_BYTES 32
3485 +#define L1_CACHE_BYTES 32UL
3487 #ifdef CONFIG_SPARC32
3488 #define SMP_CACHE_BYTES_SHIFT 5
3489 diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
3490 index 4269ca6..e3da77f 100644
3491 --- a/arch/sparc/include/asm/elf_32.h
3492 +++ b/arch/sparc/include/asm/elf_32.h
3493 @@ -114,6 +114,13 @@ typedef struct {
3495 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3497 +#ifdef CONFIG_PAX_ASLR
3498 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3500 +#define PAX_DELTA_MMAP_LEN 16
3501 +#define PAX_DELTA_STACK_LEN 16
3504 /* This yields a mask that user programs can use to figure out what
3505 instruction set this cpu supports. This can NOT be done in userspace
3507 diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
3508 index 7df8b7f..4946269 100644
3509 --- a/arch/sparc/include/asm/elf_64.h
3510 +++ b/arch/sparc/include/asm/elf_64.h
3511 @@ -180,6 +180,13 @@ typedef struct {
3512 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3513 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3515 +#ifdef CONFIG_PAX_ASLR
3516 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3518 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3519 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3522 extern unsigned long sparc64_elf_hwcap;
3523 #define ELF_HWCAP sparc64_elf_hwcap
3525 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
3526 index 5b31a8e..1d92567 100644
3527 --- a/arch/sparc/include/asm/pgtable_32.h
3528 +++ b/arch/sparc/include/asm/pgtable_32.h
3529 @@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3530 BTFIXUPDEF_INT(page_none)
3531 BTFIXUPDEF_INT(page_copy)
3532 BTFIXUPDEF_INT(page_readonly)
3534 +#ifdef CONFIG_PAX_PAGEEXEC
3535 +BTFIXUPDEF_INT(page_shared_noexec)
3536 +BTFIXUPDEF_INT(page_copy_noexec)
3537 +BTFIXUPDEF_INT(page_readonly_noexec)
3540 BTFIXUPDEF_INT(page_kernel)
3542 #define PMD_SHIFT SUN4C_PMD_SHIFT
3543 @@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3544 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3545 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3547 +#ifdef CONFIG_PAX_PAGEEXEC
3548 +extern pgprot_t PAGE_SHARED_NOEXEC;
3549 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3550 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3552 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
3553 +# define PAGE_COPY_NOEXEC PAGE_COPY
3554 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
3557 extern unsigned long page_kernel;
3560 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
3561 index f6ae2b2..b03ffc7 100644
3562 --- a/arch/sparc/include/asm/pgtsrmmu.h
3563 +++ b/arch/sparc/include/asm/pgtsrmmu.h
3564 @@ -115,6 +115,13 @@
3565 SRMMU_EXEC | SRMMU_REF)
3566 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3567 SRMMU_EXEC | SRMMU_REF)
3569 +#ifdef CONFIG_PAX_PAGEEXEC
3570 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3571 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3572 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3575 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3576 SRMMU_DIRTY | SRMMU_REF)
3578 diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
3579 index 9689176..63c18ea 100644
3580 --- a/arch/sparc/include/asm/spinlock_64.h
3581 +++ b/arch/sparc/include/asm/spinlock_64.h
3582 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
3584 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3586 -static void inline arch_read_lock(arch_rwlock_t *lock)
3587 +static inline void arch_read_lock(arch_rwlock_t *lock)
3589 unsigned long tmp1, tmp2;
3591 __asm__ __volatile__ (
3592 "1: ldsw [%2], %0\n"
3594 -"4: add %0, 1, %1\n"
3595 +"4: addcc %0, 1, %1\n"
3597 +#ifdef CONFIG_PAX_REFCOUNT
3601 " cas [%2], %0, %1\n"
3603 " bne,pn %%icc, 1b\n"
3604 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
3606 : "=&r" (tmp1), "=&r" (tmp2)
3609 + : "memory", "cc");
3612 -static int inline arch_read_trylock(arch_rwlock_t *lock)
3613 +static inline int arch_read_trylock(arch_rwlock_t *lock)
3617 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3618 "1: ldsw [%2], %0\n"
3619 " brlz,a,pn %0, 2f\n"
3622 +" addcc %0, 1, %1\n"
3624 +#ifdef CONFIG_PAX_REFCOUNT
3628 " cas [%2], %0, %1\n"
3630 " bne,pn %%icc, 1b\n"
3631 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
3635 -static void inline arch_read_unlock(arch_rwlock_t *lock)
3636 +static inline void arch_read_unlock(arch_rwlock_t *lock)
3638 unsigned long tmp1, tmp2;
3640 __asm__ __volatile__(
3641 "1: lduw [%2], %0\n"
3643 +" subcc %0, 1, %1\n"
3645 +#ifdef CONFIG_PAX_REFCOUNT
3649 " cas [%2], %0, %1\n"
3651 " bne,pn %%xcc, 1b\n"
3652 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
3656 -static void inline arch_write_lock(arch_rwlock_t *lock)
3657 +static inline void arch_write_lock(arch_rwlock_t *lock)
3659 unsigned long mask, tmp1, tmp2;
3661 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
3665 -static void inline arch_write_unlock(arch_rwlock_t *lock)
3666 +static inline void arch_write_unlock(arch_rwlock_t *lock)
3668 __asm__ __volatile__(
3670 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
3674 -static int inline arch_write_trylock(arch_rwlock_t *lock)
3675 +static inline int arch_write_trylock(arch_rwlock_t *lock)
3677 unsigned long mask, tmp1, tmp2, result;
3679 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
3680 index fa57532..e1a4c53 100644
3681 --- a/arch/sparc/include/asm/thread_info_32.h
3682 +++ b/arch/sparc/include/asm/thread_info_32.h
3683 @@ -50,6 +50,8 @@ struct thread_info {
3684 unsigned long w_saved;
3686 struct restart_block restart_block;
3688 + unsigned long lowest_stack;
3692 diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
3693 index 60d86be..952dea1 100644
3694 --- a/arch/sparc/include/asm/thread_info_64.h
3695 +++ b/arch/sparc/include/asm/thread_info_64.h
3696 @@ -63,6 +63,8 @@ struct thread_info {
3697 struct pt_regs *kern_una_regs;
3698 unsigned int kern_una_insn;
3700 + unsigned long lowest_stack;
3702 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3705 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
3706 index e88fbe5..96b0ce5 100644
3707 --- a/arch/sparc/include/asm/uaccess.h
3708 +++ b/arch/sparc/include/asm/uaccess.h
3710 #ifndef ___ASM_SPARC_UACCESS_H
3711 #define ___ASM_SPARC_UACCESS_H
3714 +#ifndef __ASSEMBLY__
3715 +#include <linux/types.h>
3716 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3720 #if defined(__sparc__) && defined(__arch64__)
3721 #include <asm/uaccess_64.h>
3723 diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
3724 index 8303ac4..07f333d 100644
3725 --- a/arch/sparc/include/asm/uaccess_32.h
3726 +++ b/arch/sparc/include/asm/uaccess_32.h
3727 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
3729 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3731 - if (n && __access_ok((unsigned long) to, n))
3735 + if (n && __access_ok((unsigned long) to, n)) {
3736 + if (!__builtin_constant_p(n))
3737 + check_object_size(from, n, true);
3738 return __copy_user(to, (__force void __user *) from, n);
3744 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3749 + if (!__builtin_constant_p(n))
3750 + check_object_size(from, n, true);
3752 return __copy_user(to, (__force void __user *) from, n);
3755 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3757 - if (n && __access_ok((unsigned long) from, n))
3761 + if (n && __access_ok((unsigned long) from, n)) {
3762 + if (!__builtin_constant_p(n))
3763 + check_object_size(to, n, false);
3764 return __copy_user((__force void __user *) to, from, n);
3770 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3775 return __copy_user((__force void __user *) to, from, n);
3778 diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
3779 index 3e1449f..5293a0e 100644
3780 --- a/arch/sparc/include/asm/uaccess_64.h
3781 +++ b/arch/sparc/include/asm/uaccess_64.h
3783 #include <linux/compiler.h>
3784 #include <linux/string.h>
3785 #include <linux/thread_info.h>
3786 +#include <linux/kernel.h>
3787 #include <asm/asi.h>
3788 #include <asm/system.h>
3789 #include <asm/spitfire.h>
3790 @@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
3791 static inline unsigned long __must_check
3792 copy_from_user(void *to, const void __user *from, unsigned long size)
3794 - unsigned long ret = ___copy_from_user(to, from, size);
3795 + unsigned long ret;
3797 + if ((long)size < 0 || size > INT_MAX)
3800 + if (!__builtin_constant_p(size))
3801 + check_object_size(to, size, false);
3803 + ret = ___copy_from_user(to, from, size);
3805 ret = copy_from_user_fixup(to, from, size);
3807 @@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
3808 static inline unsigned long __must_check
3809 copy_to_user(void __user *to, const void *from, unsigned long size)
3811 - unsigned long ret = ___copy_to_user(to, from, size);
3812 + unsigned long ret;
3814 + if ((long)size < 0 || size > INT_MAX)
3817 + if (!__builtin_constant_p(size))
3818 + check_object_size(from, size, true);
3820 + ret = ___copy_to_user(to, from, size);
3822 ret = copy_to_user_fixup(to, from, size);
3824 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
3825 index cb85458..e063f17 100644
3826 --- a/arch/sparc/kernel/Makefile
3827 +++ b/arch/sparc/kernel/Makefile
3832 -ccflags-y := -Werror
3833 +#ccflags-y := -Werror
3835 extra-y := head_$(BITS).o
3836 extra-y += init_task.o
3837 diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
3838 index f793742..4d880af 100644
3839 --- a/arch/sparc/kernel/process_32.c
3840 +++ b/arch/sparc/kernel/process_32.c
3841 @@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3842 rw->ins[4], rw->ins[5],
3845 - printk("%pS\n", (void *) rw->ins[7]);
3846 + printk("%pA\n", (void *) rw->ins[7]);
3847 rw = (struct reg_window32 *) rw->ins[6];
3849 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3850 @@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3852 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3853 r->psr, r->pc, r->npc, r->y, print_tainted());
3854 - printk("PC: <%pS>\n", (void *) r->pc);
3855 + printk("PC: <%pA>\n", (void *) r->pc);
3856 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3857 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3858 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3859 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3860 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3861 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3862 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3863 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3865 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3866 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3867 @@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
3868 rw = (struct reg_window32 *) fp;
3870 printk("[%08lx : ", pc);
3871 - printk("%pS ] ", (void *) pc);
3872 + printk("%pA ] ", (void *) pc);
3874 } while (++count < 16);
3876 diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
3877 index d959cd0..7b42812 100644
3878 --- a/arch/sparc/kernel/process_64.c
3879 +++ b/arch/sparc/kernel/process_64.c
3880 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
3881 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3882 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3883 if (regs->tstate & TSTATE_PRIV)
3884 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3885 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3888 void show_regs(struct pt_regs *regs)
3890 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3891 regs->tpc, regs->tnpc, regs->y, print_tainted());
3892 - printk("TPC: <%pS>\n", (void *) regs->tpc);
3893 + printk("TPC: <%pA>\n", (void *) regs->tpc);
3894 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3895 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3897 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3898 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3899 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3901 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3902 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3903 show_regwindow(regs);
3904 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3906 @@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void)
3907 ((tp && tp->task) ? tp->task->pid : -1));
3909 if (gp->tstate & TSTATE_PRIV) {
3910 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3911 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3915 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
3916 index 42b282f..28ce9f2 100644
3917 --- a/arch/sparc/kernel/sys_sparc_32.c
3918 +++ b/arch/sparc/kernel/sys_sparc_32.c
3919 @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3920 if (ARCH_SUN4C && len > 0x20000000)
3923 - addr = TASK_UNMAPPED_BASE;
3924 + addr = current->mm->mmap_base;
3926 if (flags & MAP_SHARED)
3927 addr = COLOUR_ALIGN(addr);
3928 @@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3930 if (TASK_SIZE - PAGE_SIZE - len < addr)
3932 - if (!vmm || addr + len <= vmm->vm_start)
3933 + if (check_heap_stack_gap(vmm, addr, len))
3936 if (flags & MAP_SHARED)
3937 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
3938 index 908b47a..aa9e584 100644
3939 --- a/arch/sparc/kernel/sys_sparc_64.c
3940 +++ b/arch/sparc/kernel/sys_sparc_64.c
3941 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3942 /* We do not accept a shared mapping if it would violate
3943 * cache aliasing constraints.
3945 - if ((flags & MAP_SHARED) &&
3946 + if ((filp || (flags & MAP_SHARED)) &&
3947 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3950 @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3951 if (filp || (flags & MAP_SHARED))
3954 +#ifdef CONFIG_PAX_RANDMMAP
3955 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3960 addr = COLOUR_ALIGN(addr, pgoff);
3961 @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
3962 addr = PAGE_ALIGN(addr);
3964 vma = find_vma(mm, addr);
3965 - if (task_size - len >= addr &&
3966 - (!vma || addr + len <= vma->vm_start))
3967 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3971 if (len > mm->cached_hole_size) {
3972 - start_addr = addr = mm->free_area_cache;
3973 + start_addr = addr = mm->free_area_cache;
3975 - start_addr = addr = TASK_UNMAPPED_BASE;
3976 + start_addr = addr = mm->mmap_base;
3977 mm->cached_hole_size = 0;
3980 @@ -174,14 +177,14 @@ full_search:
3981 vma = find_vma(mm, VA_EXCLUDE_END);
3983 if (unlikely(task_size < addr)) {
3984 - if (start_addr != TASK_UNMAPPED_BASE) {
3985 - start_addr = addr = TASK_UNMAPPED_BASE;
3986 + if (start_addr != mm->mmap_base) {
3987 + start_addr = addr = mm->mmap_base;
3988 mm->cached_hole_size = 0;
3993 - if (likely(!vma || addr + len <= vma->vm_start)) {
3994 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3996 * Remember the place where we stopped the search:
3998 @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
3999 /* We do not accept a shared mapping if it would violate
4000 * cache aliasing constraints.
4002 - if ((flags & MAP_SHARED) &&
4003 + if ((filp || (flags & MAP_SHARED)) &&
4004 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4007 @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4008 addr = PAGE_ALIGN(addr);
4010 vma = find_vma(mm, addr);
4011 - if (task_size - len >= addr &&
4012 - (!vma || addr + len <= vma->vm_start))
4013 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4017 @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4018 /* make sure it can fit in the remaining address space */
4019 if (likely(addr > len)) {
4020 vma = find_vma(mm, addr-len);
4021 - if (!vma || addr <= vma->vm_start) {
4022 + if (check_heap_stack_gap(vma, addr - len, len)) {
4023 /* remember the address as a hint for next time */
4024 return (mm->free_area_cache = addr-len);
4026 @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4027 if (unlikely(mm->mmap_base < len))
4030 - addr = mm->mmap_base-len;
4031 - if (do_color_align)
4032 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4033 + addr = mm->mmap_base - len;
4036 + if (do_color_align)
4037 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4039 * Lookup failure means no vma is above this address,
4040 * else if new region fits below vma->vm_start,
4041 * return with success:
4043 vma = find_vma(mm, addr);
4044 - if (likely(!vma || addr+len <= vma->vm_start)) {
4045 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4046 /* remember the address as a hint for next time */
4047 return (mm->free_area_cache = addr);
4049 @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4050 mm->cached_hole_size = vma->vm_start - addr;
4052 /* try just below the current vma->vm_start */
4053 - addr = vma->vm_start-len;
4054 - if (do_color_align)
4055 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4056 - } while (likely(len < vma->vm_start));
4057 + addr = skip_heap_stack_gap(vma, len);
4058 + } while (!IS_ERR_VALUE(addr));
4062 @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4063 gap == RLIM_INFINITY ||
4064 sysctl_legacy_va_layout) {
4065 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4067 +#ifdef CONFIG_PAX_RANDMMAP
4068 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4069 + mm->mmap_base += mm->delta_mmap;
4072 mm->get_unmapped_area = arch_get_unmapped_area;
4073 mm->unmap_area = arch_unmap_area;
4075 @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4076 gap = (task_size / 6 * 5);
4078 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4080 +#ifdef CONFIG_PAX_RANDMMAP
4081 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4082 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4085 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4086 mm->unmap_area = arch_unmap_area_topdown;
4088 diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
4089 index c0490c7..84959d1 100644
4090 --- a/arch/sparc/kernel/traps_32.c
4091 +++ b/arch/sparc/kernel/traps_32.c
4092 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
4093 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4094 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4096 +extern void gr_handle_kernel_exploit(void);
4098 void die_if_kernel(char *str, struct pt_regs *regs)
4100 static int die_counter;
4101 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4103 (((unsigned long) rw) >= PAGE_OFFSET) &&
4104 !(((unsigned long) rw) & 0x7)) {
4105 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
4106 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
4107 (void *) rw->ins[7]);
4108 rw = (struct reg_window32 *)rw->ins[6];
4111 printk("Instruction DUMP:");
4112 instruction_dump ((unsigned long *) regs->pc);
4113 - if(regs->psr & PSR_PS)
4114 + if(regs->psr & PSR_PS) {
4115 + gr_handle_kernel_exploit();
4121 diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
4122 index 0cbdaa4..438e4c9 100644
4123 --- a/arch/sparc/kernel/traps_64.c
4124 +++ b/arch/sparc/kernel/traps_64.c
4125 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
4127 p->trapstack[i].tstate, p->trapstack[i].tpc,
4128 p->trapstack[i].tnpc, p->trapstack[i].tt);
4129 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4130 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4134 @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
4137 if (regs->tstate & TSTATE_PRIV) {
4139 +#ifdef CONFIG_PAX_REFCOUNT
4141 + pax_report_refcount_overflow(regs);
4144 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4145 die_if_kernel(buffer, regs);
4147 @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
4148 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4153 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4154 0, lvl, SIGTRAP) == NOTIFY_STOP)
4157 +#ifdef CONFIG_PAX_REFCOUNT
4159 + pax_report_refcount_overflow(regs);
4162 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4164 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4165 @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
4166 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4167 printk("%s" "ERROR(%d): ",
4168 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4169 - printk("TPC<%pS>\n", (void *) regs->tpc);
4170 + printk("TPC<%pA>\n", (void *) regs->tpc);
4171 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4172 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4173 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4174 @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4176 (type & 0x1) ? 'I' : 'D',
4178 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4179 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4180 panic("Irrecoverable Cheetah+ parity error.");
4183 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
4185 (type & 0x1) ? 'I' : 'D',
4187 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4188 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4191 struct sun4v_error_entry {
4192 @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
4194 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4196 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4197 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4198 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4199 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4200 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4201 (void *) regs->u_regs[UREG_I7]);
4202 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4203 "pte[%lx] error[%lx]\n",
4204 @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
4206 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4208 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4209 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4210 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4211 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4212 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4213 (void *) regs->u_regs[UREG_I7]);
4214 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4215 "pte[%lx] error[%lx]\n",
4216 @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
4217 fp = (unsigned long)sf->fp + STACK_BIAS;
4220 - printk(" [%016lx] %pS\n", pc, (void *) pc);
4221 + printk(" [%016lx] %pA\n", pc, (void *) pc);
4222 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4223 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
4224 int index = tsk->curr_ret_stack;
4225 if (tsk->ret_stack && index >= graph) {
4226 pc = tsk->ret_stack[index - graph].ret;
4227 - printk(" [%016lx] %pS\n", pc, (void *) pc);
4228 + printk(" [%016lx] %pA\n", pc, (void *) pc);
4232 @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
4233 return (struct reg_window *) (fp + STACK_BIAS);
4236 +extern void gr_handle_kernel_exploit(void);
4238 void die_if_kernel(char *str, struct pt_regs *regs)
4240 static int die_counter;
4241 @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4244 kstack_valid(tp, (unsigned long) rw)) {
4245 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
4246 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
4247 (void *) rw->ins[7]);
4249 rw = kernel_stack_up(rw);
4250 @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
4252 user_instruction_dump ((unsigned int __user *) regs->tpc);
4254 - if (regs->tstate & TSTATE_PRIV)
4255 + if (regs->tstate & TSTATE_PRIV) {
4256 + gr_handle_kernel_exploit();
4261 EXPORT_SYMBOL(die_if_kernel);
4262 diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
4263 index 76e4ac1..78f8bb1 100644
4264 --- a/arch/sparc/kernel/unaligned_64.c
4265 +++ b/arch/sparc/kernel/unaligned_64.c
4266 @@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs *regs)
4267 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
4269 if (__ratelimit(&ratelimit)) {
4270 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
4271 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
4272 regs->tpc, (void *) regs->tpc);
4275 diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
4276 index a3fc437..fea9957 100644
4277 --- a/arch/sparc/lib/Makefile
4278 +++ b/arch/sparc/lib/Makefile
4282 asflags-y := -ansi -DST_DIV0=0x02
4283 -ccflags-y := -Werror
4284 +#ccflags-y := -Werror
4286 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4287 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4288 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
4289 index 59186e0..f747d7a 100644
4290 --- a/arch/sparc/lib/atomic_64.S
4291 +++ b/arch/sparc/lib/atomic_64.S
4293 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4297 + addcc %g1, %o0, %g7
4299 +#ifdef CONFIG_PAX_REFCOUNT
4305 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4306 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4307 2: BACKOFF_SPIN(%o2, %o3, 1b)
4308 .size atomic_add, .-atomic_add
4310 + .globl atomic_add_unchecked
4311 + .type atomic_add_unchecked,#function
4312 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4313 + BACKOFF_SETUP(%o2)
4316 + cas [%o1], %g1, %g7
4322 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4323 + .size atomic_add_unchecked, .-atomic_add_unchecked
4326 .type atomic_sub,#function
4327 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4331 + subcc %g1, %o0, %g7
4333 +#ifdef CONFIG_PAX_REFCOUNT
4339 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4340 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4341 2: BACKOFF_SPIN(%o2, %o3, 1b)
4342 .size atomic_sub, .-atomic_sub
4344 + .globl atomic_sub_unchecked
4345 + .type atomic_sub_unchecked,#function
4346 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4347 + BACKOFF_SETUP(%o2)
4350 + cas [%o1], %g1, %g7
4356 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4357 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
4359 .globl atomic_add_ret
4360 .type atomic_add_ret,#function
4361 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4365 + addcc %g1, %o0, %g7
4367 +#ifdef CONFIG_PAX_REFCOUNT
4373 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4374 @@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4375 2: BACKOFF_SPIN(%o2, %o3, 1b)
4376 .size atomic_add_ret, .-atomic_add_ret
4378 + .globl atomic_add_ret_unchecked
4379 + .type atomic_add_ret_unchecked,#function
4380 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4381 + BACKOFF_SETUP(%o2)
4383 + addcc %g1, %o0, %g7
4384 + cas [%o1], %g1, %g7
4391 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4392 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4394 .globl atomic_sub_ret
4395 .type atomic_sub_ret,#function
4396 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4400 + subcc %g1, %o0, %g7
4402 +#ifdef CONFIG_PAX_REFCOUNT
4408 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
4409 @@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4410 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4414 + addcc %g1, %o0, %g7
4416 +#ifdef CONFIG_PAX_REFCOUNT
4420 casx [%o1], %g1, %g7
4422 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4423 @@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4424 2: BACKOFF_SPIN(%o2, %o3, 1b)
4425 .size atomic64_add, .-atomic64_add
4427 + .globl atomic64_add_unchecked
4428 + .type atomic64_add_unchecked,#function
4429 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4430 + BACKOFF_SETUP(%o2)
4432 + addcc %g1, %o0, %g7
4433 + casx [%o1], %g1, %g7
4439 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4440 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
4443 .type atomic64_sub,#function
4444 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4448 + subcc %g1, %o0, %g7
4450 +#ifdef CONFIG_PAX_REFCOUNT
4454 casx [%o1], %g1, %g7
4456 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4457 @@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4458 2: BACKOFF_SPIN(%o2, %o3, 1b)
4459 .size atomic64_sub, .-atomic64_sub
4461 + .globl atomic64_sub_unchecked
4462 + .type atomic64_sub_unchecked,#function
4463 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4464 + BACKOFF_SETUP(%o2)
4466 + subcc %g1, %o0, %g7
4467 + casx [%o1], %g1, %g7
4473 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4474 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
4476 .globl atomic64_add_ret
4477 .type atomic64_add_ret,#function
4478 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4482 + addcc %g1, %o0, %g7
4484 +#ifdef CONFIG_PAX_REFCOUNT
4488 casx [%o1], %g1, %g7
4490 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4491 @@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4492 2: BACKOFF_SPIN(%o2, %o3, 1b)
4493 .size atomic64_add_ret, .-atomic64_add_ret
4495 + .globl atomic64_add_ret_unchecked
4496 + .type atomic64_add_ret_unchecked,#function
4497 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4498 + BACKOFF_SETUP(%o2)
4500 + addcc %g1, %o0, %g7
4501 + casx [%o1], %g1, %g7
4508 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4509 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4511 .globl atomic64_sub_ret
4512 .type atomic64_sub_ret,#function
4513 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4517 + subcc %g1, %o0, %g7
4519 +#ifdef CONFIG_PAX_REFCOUNT
4523 casx [%o1], %g1, %g7
4525 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4526 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
4527 index 1b30bb3..b4a16c7 100644
4528 --- a/arch/sparc/lib/ksyms.c
4529 +++ b/arch/sparc/lib/ksyms.c
4530 @@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4532 /* Atomic counter implementation. */
4533 EXPORT_SYMBOL(atomic_add);
4534 +EXPORT_SYMBOL(atomic_add_unchecked);
4535 EXPORT_SYMBOL(atomic_add_ret);
4536 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
4537 EXPORT_SYMBOL(atomic_sub);
4538 +EXPORT_SYMBOL(atomic_sub_unchecked);
4539 EXPORT_SYMBOL(atomic_sub_ret);
4540 EXPORT_SYMBOL(atomic64_add);
4541 +EXPORT_SYMBOL(atomic64_add_unchecked);
4542 EXPORT_SYMBOL(atomic64_add_ret);
4543 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4544 EXPORT_SYMBOL(atomic64_sub);
4545 +EXPORT_SYMBOL(atomic64_sub_unchecked);
4546 EXPORT_SYMBOL(atomic64_sub_ret);
4548 /* Atomic bit operations. */
4549 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
4550 index e3cda21..a68e4cb 100644
4551 --- a/arch/sparc/mm/Makefile
4552 +++ b/arch/sparc/mm/Makefile
4557 -ccflags-y := -Werror
4558 +#ccflags-y := -Werror
4560 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
4561 obj-y += fault_$(BITS).o
4562 diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
4563 index aa1c1b1..f93e28f 100644
4564 --- a/arch/sparc/mm/fault_32.c
4565 +++ b/arch/sparc/mm/fault_32.c
4567 #include <linux/interrupt.h>
4568 #include <linux/module.h>
4569 #include <linux/kdebug.h>
4570 +#include <linux/slab.h>
4571 +#include <linux/pagemap.h>
4572 +#include <linux/compiler.h>
4574 #include <asm/system.h>
4575 #include <asm/page.h>
4576 @@ -209,6 +212,268 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
4577 return safe_compute_effective_address(regs, insn);
4580 +#ifdef CONFIG_PAX_PAGEEXEC
4581 +#ifdef CONFIG_PAX_DLRESOLVE
4582 +static void pax_emuplt_close(struct vm_area_struct *vma)
4584 + vma->vm_mm->call_dl_resolve = 0UL;
4587 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4589 + unsigned int *kaddr;
4591 + vmf->page = alloc_page(GFP_HIGHUSER);
4593 + return VM_FAULT_OOM;
4595 + kaddr = kmap(vmf->page);
4596 + memset(kaddr, 0, PAGE_SIZE);
4597 + kaddr[0] = 0x9DE3BFA8U; /* save */
4598 + flush_dcache_page(vmf->page);
4599 + kunmap(vmf->page);
4600 + return VM_FAULT_MAJOR;
4603 +static const struct vm_operations_struct pax_vm_ops = {
4604 + .close = pax_emuplt_close,
4605 + .fault = pax_emuplt_fault
4608 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4612 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4613 + vma->vm_mm = current->mm;
4614 + vma->vm_start = addr;
4615 + vma->vm_end = addr + PAGE_SIZE;
4616 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4617 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4618 + vma->vm_ops = &pax_vm_ops;
4620 + ret = insert_vm_struct(current->mm, vma);
4624 + ++current->mm->total_vm;
4630 + * PaX: decide what to do with offenders (regs->pc = fault address)
4632 + * returns 1 when task should be killed
4633 + * 2 when patched PLT trampoline was detected
4634 + * 3 when unpatched PLT trampoline was detected
4636 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4639 +#ifdef CONFIG_PAX_EMUPLT
4642 + do { /* PaX: patched PLT emulation #1 */
4643 + unsigned int sethi1, sethi2, jmpl;
4645 + err = get_user(sethi1, (unsigned int *)regs->pc);
4646 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4647 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4652 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4653 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4654 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4656 + unsigned int addr;
4658 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4659 + addr = regs->u_regs[UREG_G1];
4660 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4662 + regs->npc = addr+4;
4667 + { /* PaX: patched PLT emulation #2 */
4670 + err = get_user(ba, (unsigned int *)regs->pc);
4672 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4673 + unsigned int addr;
4675 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4677 + regs->npc = addr+4;
4682 + do { /* PaX: patched PLT emulation #3 */
4683 + unsigned int sethi, jmpl, nop;
4685 + err = get_user(sethi, (unsigned int *)regs->pc);
4686 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4687 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4692 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4693 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4694 + nop == 0x01000000U)
4696 + unsigned int addr;
4698 + addr = (sethi & 0x003FFFFFU) << 10;
4699 + regs->u_regs[UREG_G1] = addr;
4700 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4702 + regs->npc = addr+4;
4707 + do { /* PaX: unpatched PLT emulation step 1 */
4708 + unsigned int sethi, ba, nop;
4710 + err = get_user(sethi, (unsigned int *)regs->pc);
4711 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
4712 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4717 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4718 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4719 + nop == 0x01000000U)
4721 + unsigned int addr, save, call;
4723 + if ((ba & 0xFFC00000U) == 0x30800000U)
4724 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4726 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4728 + err = get_user(save, (unsigned int *)addr);
4729 + err |= get_user(call, (unsigned int *)(addr+4));
4730 + err |= get_user(nop, (unsigned int *)(addr+8));
4734 +#ifdef CONFIG_PAX_DLRESOLVE
4735 + if (save == 0x9DE3BFA8U &&
4736 + (call & 0xC0000000U) == 0x40000000U &&
4737 + nop == 0x01000000U)
4739 + struct vm_area_struct *vma;
4740 + unsigned long call_dl_resolve;
4742 + down_read(¤t->mm->mmap_sem);
4743 + call_dl_resolve = current->mm->call_dl_resolve;
4744 + up_read(¤t->mm->mmap_sem);
4745 + if (likely(call_dl_resolve))
4748 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4750 + down_write(¤t->mm->mmap_sem);
4751 + if (current->mm->call_dl_resolve) {
4752 + call_dl_resolve = current->mm->call_dl_resolve;
4753 + up_write(¤t->mm->mmap_sem);
4755 + kmem_cache_free(vm_area_cachep, vma);
4759 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4760 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4761 + up_write(¤t->mm->mmap_sem);
4763 + kmem_cache_free(vm_area_cachep, vma);
4767 + if (pax_insert_vma(vma, call_dl_resolve)) {
4768 + up_write(¤t->mm->mmap_sem);
4769 + kmem_cache_free(vm_area_cachep, vma);
4773 + current->mm->call_dl_resolve = call_dl_resolve;
4774 + up_write(¤t->mm->mmap_sem);
4777 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4778 + regs->pc = call_dl_resolve;
4779 + regs->npc = addr+4;
4784 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4785 + if ((save & 0xFFC00000U) == 0x05000000U &&
4786 + (call & 0xFFFFE000U) == 0x85C0A000U &&
4787 + nop == 0x01000000U)
4789 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4790 + regs->u_regs[UREG_G2] = addr + 4;
4791 + addr = (save & 0x003FFFFFU) << 10;
4792 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4794 + regs->npc = addr+4;
4800 + do { /* PaX: unpatched PLT emulation step 2 */
4801 + unsigned int save, call, nop;
4803 + err = get_user(save, (unsigned int *)(regs->pc-4));
4804 + err |= get_user(call, (unsigned int *)regs->pc);
4805 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
4809 + if (save == 0x9DE3BFA8U &&
4810 + (call & 0xC0000000U) == 0x40000000U &&
4811 + nop == 0x01000000U)
4813 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4815 + regs->u_regs[UREG_RETPC] = regs->pc;
4816 + regs->pc = dl_resolve;
4817 + regs->npc = dl_resolve+4;
4826 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4830 + printk(KERN_ERR "PAX: bytes at PC: ");
4831 + for (i = 0; i < 8; i++) {
4833 + if (get_user(c, (unsigned int *)pc+i))
4834 + printk(KERN_CONT "???????? ");
4836 + printk(KERN_CONT "%08x ", c);
4842 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4845 @@ -281,6 +546,24 @@ good_area:
4846 if(!(vma->vm_flags & VM_WRITE))
4850 +#ifdef CONFIG_PAX_PAGEEXEC
4851 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4852 + up_read(&mm->mmap_sem);
4853 + switch (pax_handle_fetch_fault(regs)) {
4855 +#ifdef CONFIG_PAX_EMUPLT
4862 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4863 + do_group_exit(SIGKILL);
4867 /* Allow reads even for write-only mappings */
4868 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4870 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
4871 index 504c062..6fcb9c6 100644
4872 --- a/arch/sparc/mm/fault_64.c
4873 +++ b/arch/sparc/mm/fault_64.c
4875 #include <linux/kprobes.h>
4876 #include <linux/kdebug.h>
4877 #include <linux/percpu.h>
4878 +#include <linux/slab.h>
4879 +#include <linux/pagemap.h>
4880 +#include <linux/compiler.h>
4882 #include <asm/page.h>
4883 #include <asm/pgtable.h>
4884 @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
4885 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4887 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4888 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4889 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4890 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4892 unhandled_fault(regs->tpc, current, regs);
4893 @@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
4897 +#ifdef CONFIG_PAX_PAGEEXEC
4898 +#ifdef CONFIG_PAX_DLRESOLVE
4899 +static void pax_emuplt_close(struct vm_area_struct *vma)
4901 + vma->vm_mm->call_dl_resolve = 0UL;
4904 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4906 + unsigned int *kaddr;
4908 + vmf->page = alloc_page(GFP_HIGHUSER);
4910 + return VM_FAULT_OOM;
4912 + kaddr = kmap(vmf->page);
4913 + memset(kaddr, 0, PAGE_SIZE);
4914 + kaddr[0] = 0x9DE3BFA8U; /* save */
4915 + flush_dcache_page(vmf->page);
4916 + kunmap(vmf->page);
4917 + return VM_FAULT_MAJOR;
4920 +static const struct vm_operations_struct pax_vm_ops = {
4921 + .close = pax_emuplt_close,
4922 + .fault = pax_emuplt_fault
4925 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4929 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4930 + vma->vm_mm = current->mm;
4931 + vma->vm_start = addr;
4932 + vma->vm_end = addr + PAGE_SIZE;
4933 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4934 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4935 + vma->vm_ops = &pax_vm_ops;
4937 + ret = insert_vm_struct(current->mm, vma);
4941 + ++current->mm->total_vm;
4947 + * PaX: decide what to do with offenders (regs->tpc = fault address)
4949 + * returns 1 when task should be killed
4950 + * 2 when patched PLT trampoline was detected
4951 + * 3 when unpatched PLT trampoline was detected
4953 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4956 +#ifdef CONFIG_PAX_EMUPLT
4959 + do { /* PaX: patched PLT emulation #1 */
4960 + unsigned int sethi1, sethi2, jmpl;
4962 + err = get_user(sethi1, (unsigned int *)regs->tpc);
4963 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4964 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4969 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4970 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4971 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4973 + unsigned long addr;
4975 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4976 + addr = regs->u_regs[UREG_G1];
4977 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4979 + if (test_thread_flag(TIF_32BIT))
4980 + addr &= 0xFFFFFFFFUL;
4983 + regs->tnpc = addr+4;
4988 + { /* PaX: patched PLT emulation #2 */
4991 + err = get_user(ba, (unsigned int *)regs->tpc);
4993 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4994 + unsigned long addr;
4996 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4998 + if (test_thread_flag(TIF_32BIT))
4999 + addr &= 0xFFFFFFFFUL;
5002 + regs->tnpc = addr+4;
5007 + do { /* PaX: patched PLT emulation #3 */
5008 + unsigned int sethi, jmpl, nop;
5010 + err = get_user(sethi, (unsigned int *)regs->tpc);
5011 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5012 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5017 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5018 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5019 + nop == 0x01000000U)
5021 + unsigned long addr;
5023 + addr = (sethi & 0x003FFFFFU) << 10;
5024 + regs->u_regs[UREG_G1] = addr;
5025 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5027 + if (test_thread_flag(TIF_32BIT))
5028 + addr &= 0xFFFFFFFFUL;
5031 + regs->tnpc = addr+4;
5036 + do { /* PaX: patched PLT emulation #4 */
5037 + unsigned int sethi, mov1, call, mov2;
5039 + err = get_user(sethi, (unsigned int *)regs->tpc);
5040 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5041 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
5042 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5047 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5048 + mov1 == 0x8210000FU &&
5049 + (call & 0xC0000000U) == 0x40000000U &&
5050 + mov2 == 0x9E100001U)
5052 + unsigned long addr;
5054 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5055 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5057 + if (test_thread_flag(TIF_32BIT))
5058 + addr &= 0xFFFFFFFFUL;
5061 + regs->tnpc = addr+4;
5066 + do { /* PaX: patched PLT emulation #5 */
5067 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5069 + err = get_user(sethi, (unsigned int *)regs->tpc);
5070 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5071 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5072 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5073 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5074 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5075 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5076 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5081 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5082 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5083 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5084 + (or1 & 0xFFFFE000U) == 0x82106000U &&
5085 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5086 + sllx == 0x83287020U &&
5087 + jmpl == 0x81C04005U &&
5088 + nop == 0x01000000U)
5090 + unsigned long addr;
5092 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5093 + regs->u_regs[UREG_G1] <<= 32;
5094 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5095 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5097 + regs->tnpc = addr+4;
5102 + do { /* PaX: patched PLT emulation #6 */
5103 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5105 + err = get_user(sethi, (unsigned int *)regs->tpc);
5106 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5107 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5108 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5109 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
5110 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5111 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5116 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5117 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5118 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5119 + sllx == 0x83287020U &&
5120 + (or & 0xFFFFE000U) == 0x8A116000U &&
5121 + jmpl == 0x81C04005U &&
5122 + nop == 0x01000000U)
5124 + unsigned long addr;
5126 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5127 + regs->u_regs[UREG_G1] <<= 32;
5128 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5129 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5131 + regs->tnpc = addr+4;
5136 + do { /* PaX: unpatched PLT emulation step 1 */
5137 + unsigned int sethi, ba, nop;
5139 + err = get_user(sethi, (unsigned int *)regs->tpc);
5140 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5141 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5146 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5147 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5148 + nop == 0x01000000U)
5150 + unsigned long addr;
5151 + unsigned int save, call;
5152 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5154 + if ((ba & 0xFFC00000U) == 0x30800000U)
5155 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5157 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5159 + if (test_thread_flag(TIF_32BIT))
5160 + addr &= 0xFFFFFFFFUL;
5162 + err = get_user(save, (unsigned int *)addr);
5163 + err |= get_user(call, (unsigned int *)(addr+4));
5164 + err |= get_user(nop, (unsigned int *)(addr+8));
5168 +#ifdef CONFIG_PAX_DLRESOLVE
5169 + if (save == 0x9DE3BFA8U &&
5170 + (call & 0xC0000000U) == 0x40000000U &&
5171 + nop == 0x01000000U)
5173 + struct vm_area_struct *vma;
5174 + unsigned long call_dl_resolve;
5176 + down_read(¤t->mm->mmap_sem);
5177 + call_dl_resolve = current->mm->call_dl_resolve;
5178 + up_read(¤t->mm->mmap_sem);
5179 + if (likely(call_dl_resolve))
5182 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5184 + down_write(¤t->mm->mmap_sem);
5185 + if (current->mm->call_dl_resolve) {
5186 + call_dl_resolve = current->mm->call_dl_resolve;
5187 + up_write(¤t->mm->mmap_sem);
5189 + kmem_cache_free(vm_area_cachep, vma);
5193 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5194 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5195 + up_write(¤t->mm->mmap_sem);
5197 + kmem_cache_free(vm_area_cachep, vma);
5201 + if (pax_insert_vma(vma, call_dl_resolve)) {
5202 + up_write(¤t->mm->mmap_sem);
5203 + kmem_cache_free(vm_area_cachep, vma);
5207 + current->mm->call_dl_resolve = call_dl_resolve;
5208 + up_write(¤t->mm->mmap_sem);
5211 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5212 + regs->tpc = call_dl_resolve;
5213 + regs->tnpc = addr+4;
5218 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5219 + if ((save & 0xFFC00000U) == 0x05000000U &&
5220 + (call & 0xFFFFE000U) == 0x85C0A000U &&
5221 + nop == 0x01000000U)
5223 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5224 + regs->u_regs[UREG_G2] = addr + 4;
5225 + addr = (save & 0x003FFFFFU) << 10;
5226 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5228 + if (test_thread_flag(TIF_32BIT))
5229 + addr &= 0xFFFFFFFFUL;
5232 + regs->tnpc = addr+4;
5236 + /* PaX: 64-bit PLT stub */
5237 + err = get_user(sethi1, (unsigned int *)addr);
5238 + err |= get_user(sethi2, (unsigned int *)(addr+4));
5239 + err |= get_user(or1, (unsigned int *)(addr+8));
5240 + err |= get_user(or2, (unsigned int *)(addr+12));
5241 + err |= get_user(sllx, (unsigned int *)(addr+16));
5242 + err |= get_user(add, (unsigned int *)(addr+20));
5243 + err |= get_user(jmpl, (unsigned int *)(addr+24));
5244 + err |= get_user(nop, (unsigned int *)(addr+28));
5248 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5249 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5250 + (or1 & 0xFFFFE000U) == 0x88112000U &&
5251 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5252 + sllx == 0x89293020U &&
5253 + add == 0x8A010005U &&
5254 + jmpl == 0x89C14000U &&
5255 + nop == 0x01000000U)
5257 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5258 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5259 + regs->u_regs[UREG_G4] <<= 32;
5260 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5261 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5262 + regs->u_regs[UREG_G4] = addr + 24;
5263 + addr = regs->u_regs[UREG_G5];
5265 + regs->tnpc = addr+4;
5271 +#ifdef CONFIG_PAX_DLRESOLVE
5272 + do { /* PaX: unpatched PLT emulation step 2 */
5273 + unsigned int save, call, nop;
5275 + err = get_user(save, (unsigned int *)(regs->tpc-4));
5276 + err |= get_user(call, (unsigned int *)regs->tpc);
5277 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5281 + if (save == 0x9DE3BFA8U &&
5282 + (call & 0xC0000000U) == 0x40000000U &&
5283 + nop == 0x01000000U)
5285 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5287 + if (test_thread_flag(TIF_32BIT))
5288 + dl_resolve &= 0xFFFFFFFFUL;
5290 + regs->u_regs[UREG_RETPC] = regs->tpc;
5291 + regs->tpc = dl_resolve;
5292 + regs->tnpc = dl_resolve+4;
5298 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5299 + unsigned int sethi, ba, nop;
5301 + err = get_user(sethi, (unsigned int *)regs->tpc);
5302 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5303 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5308 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5309 + (ba & 0xFFF00000U) == 0x30600000U &&
5310 + nop == 0x01000000U)
5312 + unsigned long addr;
5314 + addr = (sethi & 0x003FFFFFU) << 10;
5315 + regs->u_regs[UREG_G1] = addr;
5316 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5318 + if (test_thread_flag(TIF_32BIT))
5319 + addr &= 0xFFFFFFFFUL;
5322 + regs->tnpc = addr+4;
5332 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5336 + printk(KERN_ERR "PAX: bytes at PC: ");
5337 + for (i = 0; i < 8; i++) {
5339 + if (get_user(c, (unsigned int *)pc+i))
5340 + printk(KERN_CONT "???????? ");
5342 + printk(KERN_CONT "%08x ", c);
5348 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5350 struct mm_struct *mm = current->mm;
5351 @@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5355 +#ifdef CONFIG_PAX_PAGEEXEC
5356 + /* PaX: detect ITLB misses on non-exec pages */
5357 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5358 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5360 + if (address != regs->tpc)
5363 + up_read(&mm->mmap_sem);
5364 + switch (pax_handle_fetch_fault(regs)) {
5366 +#ifdef CONFIG_PAX_EMUPLT
5373 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
5374 + do_group_exit(SIGKILL);
5378 /* Pure DTLB misses do not tell us whether the fault causing
5379 * load/store/atomic was a write or not, it only says that there
5380 * was no match. So in such a case we (carefully) read the
5381 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
5382 index f4e9764..5682724 100644
5383 --- a/arch/sparc/mm/hugetlbpage.c
5384 +++ b/arch/sparc/mm/hugetlbpage.c
5385 @@ -68,7 +68,7 @@ full_search:
5389 - if (likely(!vma || addr + len <= vma->vm_start)) {
5390 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5392 * Remember the place where we stopped the search:
5394 @@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5395 /* make sure it can fit in the remaining address space */
5396 if (likely(addr > len)) {
5397 vma = find_vma(mm, addr-len);
5398 - if (!vma || addr <= vma->vm_start) {
5399 + if (check_heap_stack_gap(vma, addr - len, len)) {
5400 /* remember the address as a hint for next time */
5401 return (mm->free_area_cache = addr-len);
5403 @@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5404 if (unlikely(mm->mmap_base < len))
5407 - addr = (mm->mmap_base-len) & HPAGE_MASK;
5408 + addr = mm->mmap_base - len;
5411 + addr &= HPAGE_MASK;
5413 * Lookup failure means no vma is above this address,
5414 * else if new region fits below vma->vm_start,
5415 * return with success:
5417 vma = find_vma(mm, addr);
5418 - if (likely(!vma || addr+len <= vma->vm_start)) {
5419 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5420 /* remember the address as a hint for next time */
5421 return (mm->free_area_cache = addr);
5423 @@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5424 mm->cached_hole_size = vma->vm_start - addr;
5426 /* try just below the current vma->vm_start */
5427 - addr = (vma->vm_start-len) & HPAGE_MASK;
5428 - } while (likely(len < vma->vm_start));
5429 + addr = skip_heap_stack_gap(vma, len);
5430 + } while (!IS_ERR_VALUE(addr));
5434 @@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
5436 addr = ALIGN(addr, HPAGE_SIZE);
5437 vma = find_vma(mm, addr);
5438 - if (task_size - len >= addr &&
5439 - (!vma || addr + len <= vma->vm_start))
5440 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5443 if (mm->get_unmapped_area == arch_get_unmapped_area)
5444 diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
5445 index 7b00de6..78239f4 100644
5446 --- a/arch/sparc/mm/init_32.c
5447 +++ b/arch/sparc/mm/init_32.c
5448 @@ -316,6 +316,9 @@ extern void device_scan(void);
5449 pgprot_t PAGE_SHARED __read_mostly;
5450 EXPORT_SYMBOL(PAGE_SHARED);
5452 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
5453 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
5455 void __init paging_init(void)
5457 switch(sparc_cpu_model) {
5458 @@ -344,17 +347,17 @@ void __init paging_init(void)
5460 /* Initialize the protection map with non-constant, MMU dependent values. */
5461 protection_map[0] = PAGE_NONE;
5462 - protection_map[1] = PAGE_READONLY;
5463 - protection_map[2] = PAGE_COPY;
5464 - protection_map[3] = PAGE_COPY;
5465 + protection_map[1] = PAGE_READONLY_NOEXEC;
5466 + protection_map[2] = PAGE_COPY_NOEXEC;
5467 + protection_map[3] = PAGE_COPY_NOEXEC;
5468 protection_map[4] = PAGE_READONLY;
5469 protection_map[5] = PAGE_READONLY;
5470 protection_map[6] = PAGE_COPY;
5471 protection_map[7] = PAGE_COPY;
5472 protection_map[8] = PAGE_NONE;
5473 - protection_map[9] = PAGE_READONLY;
5474 - protection_map[10] = PAGE_SHARED;
5475 - protection_map[11] = PAGE_SHARED;
5476 + protection_map[9] = PAGE_READONLY_NOEXEC;
5477 + protection_map[10] = PAGE_SHARED_NOEXEC;
5478 + protection_map[11] = PAGE_SHARED_NOEXEC;
5479 protection_map[12] = PAGE_READONLY;
5480 protection_map[13] = PAGE_READONLY;
5481 protection_map[14] = PAGE_SHARED;
5482 diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
5483 index cbef74e..c38fead 100644
5484 --- a/arch/sparc/mm/srmmu.c
5485 +++ b/arch/sparc/mm/srmmu.c
5486 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5487 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5488 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5489 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5491 +#ifdef CONFIG_PAX_PAGEEXEC
5492 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5493 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5494 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5497 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5498 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5500 diff --git a/arch/um/Makefile b/arch/um/Makefile
5501 index c0f712c..3a5c4c9 100644
5502 --- a/arch/um/Makefile
5503 +++ b/arch/um/Makefile
5504 @@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
5505 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5506 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5508 +ifdef CONSTIFY_PLUGIN
5509 +USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5512 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5514 #This will adjust *FLAGS accordingly to the platform.
5515 diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
5516 index 6c03acd..a5e0215 100644
5517 --- a/arch/um/include/asm/kmap_types.h
5518 +++ b/arch/um/include/asm/kmap_types.h
5519 @@ -23,6 +23,7 @@ enum km_type {
5527 diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
5528 index 4cc9b6c..02e5029 100644
5529 --- a/arch/um/include/asm/page.h
5530 +++ b/arch/um/include/asm/page.h
5532 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5533 #define PAGE_MASK (~(PAGE_SIZE-1))
5535 +#define ktla_ktva(addr) (addr)
5536 +#define ktva_ktla(addr) (addr)
5538 #ifndef __ASSEMBLY__
5541 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
5542 index 21c1ae7..4640aaa 100644
5543 --- a/arch/um/kernel/process.c
5544 +++ b/arch/um/kernel/process.c
5545 @@ -404,22 +404,6 @@ int singlestepping(void * t)
5550 - * Only x86 and x86_64 have an arch_align_stack().
5551 - * All other arches have "#define arch_align_stack(x) (x)"
5552 - * in their asm/system.h
5553 - * As this is included in UML from asm-um/system-generic.h,
5554 - * we can use it to behave as the subarch does.
5556 -#ifndef arch_align_stack
5557 -unsigned long arch_align_stack(unsigned long sp)
5559 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5560 - sp -= get_random_int() % 8192;
5565 unsigned long get_wchan(struct task_struct *p)
5567 unsigned long stack_page, sp, ip;
5568 diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
5569 index d1b93c4..ae1b7fd 100644
5570 --- a/arch/um/sys-i386/shared/sysdep/system.h
5571 +++ b/arch/um/sys-i386/shared/sysdep/system.h
5573 # define AT_VECTOR_SIZE_ARCH 1
5576 -extern unsigned long arch_align_stack(unsigned long sp);
5577 +#define arch_align_stack(x) ((x) & ~0xfUL)
5579 void default_idle(void);
5581 diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
5582 index 70ca357..728d1cc 100644
5583 --- a/arch/um/sys-i386/syscalls.c
5584 +++ b/arch/um/sys-i386/syscalls.c
5586 #include "asm/uaccess.h"
5587 #include "asm/unistd.h"
5589 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5591 + unsigned long pax_task_size = TASK_SIZE;
5593 +#ifdef CONFIG_PAX_SEGMEXEC
5594 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5595 + pax_task_size = SEGMEXEC_TASK_SIZE;
5598 + if (len > pax_task_size || addr > pax_task_size - len)
5605 * The prototype on i386 is:
5607 diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
5608 index d1b93c4..ae1b7fd 100644
5609 --- a/arch/um/sys-x86_64/shared/sysdep/system.h
5610 +++ b/arch/um/sys-x86_64/shared/sysdep/system.h
5612 # define AT_VECTOR_SIZE_ARCH 1
5615 -extern unsigned long arch_align_stack(unsigned long sp);
5616 +#define arch_align_stack(x) ((x) & ~0xfUL)
5618 void default_idle(void);
5620 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
5621 index 6a47bb2..dc9a868 100644
5622 --- a/arch/x86/Kconfig
5623 +++ b/arch/x86/Kconfig
5624 @@ -236,7 +236,7 @@ config X86_HT
5626 config X86_32_LAZY_GS
5628 - depends on X86_32 && !CC_STACKPROTECTOR
5629 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
5631 config ARCH_HWEIGHT_CFLAGS
5633 @@ -1019,7 +1019,7 @@ choice
5637 - depends on !X86_NUMAQ
5638 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5640 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
5641 However, the address space of 32-bit x86 processors is only 4
5642 @@ -1056,7 +1056,7 @@ config NOHIGHMEM
5646 - depends on !X86_NUMAQ
5647 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
5649 Select this if you have a 32-bit processor and between 1 and 4
5650 gigabytes of physical RAM.
5651 @@ -1110,7 +1110,7 @@ config PAGE_OFFSET
5653 default 0xB0000000 if VMSPLIT_3G_OPT
5654 default 0x80000000 if VMSPLIT_2G
5655 - default 0x78000000 if VMSPLIT_2G_OPT
5656 + default 0x70000000 if VMSPLIT_2G_OPT
5657 default 0x40000000 if VMSPLIT_1G
5660 @@ -1484,6 +1484,7 @@ config SECCOMP
5662 config CC_STACKPROTECTOR
5663 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
5664 + depends on X86_64 || !PAX_MEMORY_UDEREF
5666 This option turns on the -fstack-protector GCC feature. This
5667 feature puts, at the beginning of functions, a canary value on
5668 @@ -1541,6 +1542,7 @@ config KEXEC_JUMP
5669 config PHYSICAL_START
5670 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
5672 + range 0x400000 0x40000000
5674 This gives the physical address where the kernel is loaded.
5676 @@ -1604,6 +1606,7 @@ config X86_NEED_RELOCS
5677 config PHYSICAL_ALIGN
5678 hex "Alignment value to which kernel should be aligned" if X86_32
5680 + range 0x400000 0x1000000 if PAX_KERNEXEC
5681 range 0x2000 0x1000000
5683 This value puts the alignment restrictions on physical address
5684 @@ -1635,9 +1638,10 @@ config HOTPLUG_CPU
5685 Say N if you want to disable CPU hotplug.
5690 prompt "Compat VDSO support"
5691 depends on X86_32 || IA32_EMULATION
5692 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
5694 Map the 32-bit VDSO to the predictable old-style address too.
5696 diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
5697 index e3ca7e0..b30b28a 100644
5698 --- a/arch/x86/Kconfig.cpu
5699 +++ b/arch/x86/Kconfig.cpu
5700 @@ -341,7 +341,7 @@ config X86_PPRO_FENCE
5704 - depends on M586MMX || M586TSC || M586 || M486 || M386
5705 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
5709 @@ -365,7 +365,7 @@ config X86_POPAD_OK
5711 config X86_ALIGNMENT_16
5713 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5714 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
5716 config X86_INTEL_USERCOPY
5718 @@ -411,7 +411,7 @@ config X86_CMPXCHG64
5722 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5723 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
5725 config X86_MINIMUM_CPU_FAMILY
5727 diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
5728 index c0f8a5c..6404f61 100644
5729 --- a/arch/x86/Kconfig.debug
5730 +++ b/arch/x86/Kconfig.debug
5731 @@ -81,7 +81,7 @@ config X86_PTDUMP
5733 bool "Write protect kernel read-only data structures"
5735 - depends on DEBUG_KERNEL
5736 + depends on DEBUG_KERNEL && BROKEN
5738 Mark the kernel read-only data as write-protected in the pagetables,
5739 in order to catch accidental (and incorrect) writes to such const
5740 @@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
5742 config DEBUG_SET_MODULE_RONX
5743 bool "Set loadable kernel module data as NX and text as RO"
5744 - depends on MODULES
5745 + depends on MODULES && BROKEN
5747 This option helps catch unintended modifications to loadable
5748 kernel module's text and read-only data. It also prevents execution
5749 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
5750 index b02e509..2631e48 100644
5751 --- a/arch/x86/Makefile
5752 +++ b/arch/x86/Makefile
5753 @@ -46,6 +46,7 @@ else
5754 UTS_MACHINE := x86_64
5755 CHECKFLAGS += -D__x86_64__ -m64
5757 + biarch := $(call cc-option,-m64)
5758 KBUILD_AFLAGS += -m64
5759 KBUILD_CFLAGS += -m64
5761 @@ -195,3 +196,12 @@ define archhelp
5762 echo ' FDARGS="..." arguments for the booted kernel'
5763 echo ' FDINITRD=file initrd for the booted kernel'
5768 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
5769 +*** Please upgrade your binutils to 2.18 or newer
5773 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
5774 diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
5775 index 95365a8..52f857b 100644
5776 --- a/arch/x86/boot/Makefile
5777 +++ b/arch/x86/boot/Makefile
5778 @@ -63,6 +63,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
5779 $(call cc-option, -fno-stack-protector) \
5780 $(call cc-option, -mpreferred-stack-boundary=2)
5781 KBUILD_CFLAGS += $(call cc-option, -m32)
5782 +ifdef CONSTIFY_PLUGIN
5783 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5785 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5788 diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
5789 index 878e4b9..20537ab 100644
5790 --- a/arch/x86/boot/bitops.h
5791 +++ b/arch/x86/boot/bitops.h
5792 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5794 const u32 *p = (const u32 *)addr;
5796 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5797 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5801 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
5803 static inline void set_bit(int nr, void *addr)
5805 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5806 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5809 #endif /* BOOT_BITOPS_H */
5810 diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
5811 index c7093bd..d4247ffe0 100644
5812 --- a/arch/x86/boot/boot.h
5813 +++ b/arch/x86/boot/boot.h
5814 @@ -85,7 +85,7 @@ static inline void io_delay(void)
5815 static inline u16 ds(void)
5818 - asm("movw %%ds,%0" : "=rm" (seg));
5819 + asm volatile("movw %%ds,%0" : "=rm" (seg));
5823 @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t addr)
5824 static inline int memcmp(const void *s1, const void *s2, size_t len)
5827 - asm("repe; cmpsb; setnz %0"
5828 + asm volatile("repe; cmpsb; setnz %0"
5829 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5832 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
5833 index 09664ef..edc5d03 100644
5834 --- a/arch/x86/boot/compressed/Makefile
5835 +++ b/arch/x86/boot/compressed/Makefile
5836 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
5837 KBUILD_CFLAGS += $(cflags-y)
5838 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5839 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5840 +ifdef CONSTIFY_PLUGIN
5841 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5844 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5846 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
5847 index 67a655a..b924059 100644
5848 --- a/arch/x86/boot/compressed/head_32.S
5849 +++ b/arch/x86/boot/compressed/head_32.S
5850 @@ -76,7 +76,7 @@ ENTRY(startup_32)
5854 - movl $LOAD_PHYSICAL_ADDR, %ebx
5855 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5858 /* Target address to relocate to for decompression */
5859 @@ -162,7 +162,7 @@ relocated:
5860 * and where it was actually loaded.
5863 - subl $LOAD_PHYSICAL_ADDR, %ebx
5864 + subl $____LOAD_PHYSICAL_ADDR, %ebx
5865 jz 2f /* Nothing to be done if loaded at compiled addr. */
5867 * Process relocations.
5868 @@ -170,8 +170,7 @@ relocated:
5875 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5878 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
5879 index 35af09d..99c9676 100644
5880 --- a/arch/x86/boot/compressed/head_64.S
5881 +++ b/arch/x86/boot/compressed/head_64.S
5882 @@ -91,7 +91,7 @@ ENTRY(startup_32)
5886 - movl $LOAD_PHYSICAL_ADDR, %ebx
5887 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5890 /* Target address to relocate to for decompression */
5891 @@ -233,7 +233,7 @@ ENTRY(startup_64)
5895 - movq $LOAD_PHYSICAL_ADDR, %rbp
5896 + movq $____LOAD_PHYSICAL_ADDR, %rbp
5899 /* Target address to relocate to for decompression */
5900 diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
5901 index 3a19d04..7c1d55a 100644
5902 --- a/arch/x86/boot/compressed/misc.c
5903 +++ b/arch/x86/boot/compressed/misc.c
5904 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
5906 #ifdef CONFIG_RELOCATABLE
5908 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5909 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5911 dest = (void *)(phdr->p_paddr);
5913 @@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
5914 error("Destination address too large");
5916 #ifndef CONFIG_RELOCATABLE
5917 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5918 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5919 error("Wrong destination address");
5922 diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
5923 index 89bbf4e..869908e 100644
5924 --- a/arch/x86/boot/compressed/relocs.c
5925 +++ b/arch/x86/boot/compressed/relocs.c
5928 static void die(char *fmt, ...);
5930 +#include "../../../../include/generated/autoconf.h"
5932 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5933 static Elf32_Ehdr ehdr;
5934 +static Elf32_Phdr *phdr;
5935 static unsigned long reloc_count, reloc_idx;
5936 static unsigned long *relocs;
5938 @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5942 +static void read_phdrs(FILE *fp)
5946 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5948 + die("Unable to allocate %d program headers\n",
5951 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5952 + die("Seek to %d failed: %s\n",
5953 + ehdr.e_phoff, strerror(errno));
5955 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5956 + die("Cannot read ELF program headers: %s\n",
5959 + for(i = 0; i < ehdr.e_phnum; i++) {
5960 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5961 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5962 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5963 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5964 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5965 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5966 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5967 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5972 static void read_shdrs(FILE *fp)
5978 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5979 @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5981 static void read_strtabs(FILE *fp)
5985 for (i = 0; i < ehdr.e_shnum; i++) {
5986 struct section *sec = &secs[i];
5987 if (sec->shdr.sh_type != SHT_STRTAB) {
5988 @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5990 static void read_symtabs(FILE *fp)
5994 for (i = 0; i < ehdr.e_shnum; i++) {
5995 struct section *sec = &secs[i];
5996 if (sec->shdr.sh_type != SHT_SYMTAB) {
5997 @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5999 static void read_relocs(FILE *fp)
6005 for (i = 0; i < ehdr.e_shnum; i++) {
6006 struct section *sec = &secs[i];
6007 if (sec->shdr.sh_type != SHT_REL) {
6008 @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
6009 die("Cannot read symbol table: %s\n",
6013 + for (j = 0; j < ehdr.e_phnum; j++) {
6014 + if (phdr[j].p_type != PT_LOAD )
6016 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6018 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6021 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6022 Elf32_Rel *rel = &sec->reltab[j];
6023 - rel->r_offset = elf32_to_cpu(rel->r_offset);
6024 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6025 rel->r_info = elf32_to_cpu(rel->r_info);
6028 @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
6030 static void print_absolute_symbols(void)
6034 printf("Absolute symbols\n");
6035 printf(" Num: Value Size Type Bind Visibility Name\n");
6036 for (i = 0; i < ehdr.e_shnum; i++) {
6037 struct section *sec = &secs[i];
6039 Elf32_Sym *sh_symtab;
6043 if (sec->shdr.sh_type != SHT_SYMTAB) {
6045 @@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
6047 static void print_absolute_relocs(void)
6049 - int i, printed = 0;
6050 + unsigned int i, printed = 0;
6052 for (i = 0; i < ehdr.e_shnum; i++) {
6053 struct section *sec = &secs[i];
6054 struct section *sec_applies, *sec_symtab;
6056 Elf32_Sym *sh_symtab;
6059 if (sec->shdr.sh_type != SHT_REL) {
6062 @@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
6064 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6068 /* Walk through the relocations */
6069 for (i = 0; i < ehdr.e_shnum; i++) {
6071 Elf32_Sym *sh_symtab;
6072 struct section *sec_applies, *sec_symtab;
6075 struct section *sec = &secs[i];
6077 if (sec->shdr.sh_type != SHT_REL) {
6078 @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6079 !is_rel_reloc(sym_name(sym_strtab, sym))) {
6082 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6083 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6086 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6087 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6088 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6090 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6092 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6094 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6101 @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, const void *vb)
6103 static void emit_relocs(int as_text)
6107 /* Count how many relocations I have and allocate space for them. */
6109 walk_relocs(count_reloc);
6110 @@ -665,6 +725,7 @@ int main(int argc, char **argv)
6111 fname, strerror(errno));
6118 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
6119 index 4d3ff03..e4972ff 100644
6120 --- a/arch/x86/boot/cpucheck.c
6121 +++ b/arch/x86/boot/cpucheck.c
6122 @@ -74,7 +74,7 @@ static int has_fpu(void)
6123 u16 fcw = -1, fsw = -1;
6126 - asm("movl %%cr0,%0" : "=r" (cr0));
6127 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
6128 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6129 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6130 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6131 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6136 + asm volatile("pushfl ; "
6140 @@ -115,7 +115,7 @@ static void get_flags(void)
6141 set_bit(X86_FEATURE_FPU, cpu.flags);
6143 if (has_eflag(X86_EFLAGS_ID)) {
6145 + asm volatile("cpuid"
6146 : "=a" (max_intel_level),
6147 "=b" (cpu_vendor[0]),
6148 "=d" (cpu_vendor[1]),
6149 @@ -124,7 +124,7 @@ static void get_flags(void)
6151 if (max_intel_level >= 0x00000001 &&
6152 max_intel_level <= 0x0000ffff) {
6154 + asm volatile("cpuid"
6156 "=c" (cpu.flags[4]),
6158 @@ -136,7 +136,7 @@ static void get_flags(void)
6159 cpu.model += ((tfms >> 16) & 0xf) << 4;
6163 + asm volatile("cpuid"
6164 : "=a" (max_amd_level)
6166 : "ebx", "ecx", "edx");
6167 @@ -144,7 +144,7 @@ static void get_flags(void)
6168 if (max_amd_level >= 0x80000001 &&
6169 max_amd_level <= 0x8000ffff) {
6170 u32 eax = 0x80000001;
6172 + asm volatile("cpuid"
6174 "=c" (cpu.flags[6]),
6176 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6177 u32 ecx = MSR_K7_HWCR;
6180 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6181 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6183 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6184 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6186 get_flags(); /* Make sure it really did something */
6187 err = check_flags();
6188 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6189 u32 ecx = MSR_VIA_FCR;
6192 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6193 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6194 eax |= (1<<1)|(1<<7);
6195 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6196 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6198 set_bit(X86_FEATURE_CX8, cpu.flags);
6199 err = check_flags();
6200 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
6204 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6205 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6207 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6208 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6209 + asm volatile("cpuid"
6210 : "+a" (level), "=d" (cpu.flags[0])
6212 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6213 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6215 err = check_flags();
6217 diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
6218 index 93e689f..504ba09 100644
6219 --- a/arch/x86/boot/header.S
6220 +++ b/arch/x86/boot/header.S
6221 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to
6222 # single linked list of
6225 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6226 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6228 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6229 #define VO_INIT_SIZE (VO__end - VO__text)
6230 diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
6231 index db75d07..8e6d0af 100644
6232 --- a/arch/x86/boot/memory.c
6233 +++ b/arch/x86/boot/memory.c
6236 static int detect_memory_e820(void)
6239 + unsigned int count = 0;
6240 struct biosregs ireg, oreg;
6241 struct e820entry *desc = boot_params.e820_map;
6242 static struct e820entry buf; /* static so it is zeroed */
6243 diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
6244 index 11e8c6e..fdbb1ed 100644
6245 --- a/arch/x86/boot/video-vesa.c
6246 +++ b/arch/x86/boot/video-vesa.c
6247 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6249 boot_params.screen_info.vesapm_seg = oreg.es;
6250 boot_params.screen_info.vesapm_off = oreg.di;
6251 + boot_params.screen_info.vesapm_size = oreg.cx;
6255 diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
6256 index 43eda28..5ab5fdb 100644
6257 --- a/arch/x86/boot/video.c
6258 +++ b/arch/x86/boot/video.c
6259 @@ -96,7 +96,7 @@ static void store_mode_params(void)
6260 static unsigned int get_entry(void)
6264 + unsigned int i, len = 0;
6268 diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
6269 index 5b577d5..3c1fed4 100644
6270 --- a/arch/x86/crypto/aes-x86_64-asm_64.S
6271 +++ b/arch/x86/crypto/aes-x86_64-asm_64.S
6273 * including this sentence is retained in full.
6276 +#include <asm/alternative-asm.h>
6278 .extern crypto_ft_tab
6279 .extern crypto_it_tab
6280 .extern crypto_fl_tab
6281 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6285 +#define ret pax_force_retaddr 0, 1; ret
6287 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6290 diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
6291 index be6d9e3..21fbbca 100644
6292 --- a/arch/x86/crypto/aesni-intel_asm.S
6293 +++ b/arch/x86/crypto/aesni-intel_asm.S
6296 #include <linux/linkage.h>
6297 #include <asm/inst.h>
6298 +#include <asm/alternative-asm.h>
6302 @@ -1436,7 +1437,9 @@ _return_T_done_decrypt:
6306 + pax_force_retaddr 0, 1
6308 +ENDPROC(aesni_gcm_dec)
6311 /*****************************************************************************
6312 @@ -1699,7 +1702,9 @@ _return_T_done_encrypt:
6316 + pax_force_retaddr 0, 1
6318 +ENDPROC(aesni_gcm_enc)
6322 @@ -1714,6 +1719,7 @@ _key_expansion_256a:
6324 movaps %xmm0, (TKEYP)
6326 + pax_force_retaddr_bts
6330 @@ -1738,6 +1744,7 @@ _key_expansion_192a:
6331 shufps $0b01001110, %xmm2, %xmm1
6332 movaps %xmm1, 0x10(TKEYP)
6334 + pax_force_retaddr_bts
6338 @@ -1757,6 +1764,7 @@ _key_expansion_192b:
6340 movaps %xmm0, (TKEYP)
6342 + pax_force_retaddr_bts
6346 @@ -1769,6 +1777,7 @@ _key_expansion_256b:
6348 movaps %xmm2, (TKEYP)
6350 + pax_force_retaddr_bts
6354 @@ -1881,7 +1890,9 @@ ENTRY(aesni_set_key)
6358 + pax_force_retaddr 0, 1
6360 +ENDPROC(aesni_set_key)
6363 * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
6364 @@ -1902,7 +1913,9 @@ ENTRY(aesni_enc)
6368 + pax_force_retaddr 0, 1
6373 * _aesni_enc1: internal ABI
6374 @@ -1959,6 +1972,7 @@ _aesni_enc1:
6376 movaps 0x70(TKEYP), KEY
6377 AESENCLAST KEY STATE
6378 + pax_force_retaddr_bts
6382 @@ -2067,6 +2081,7 @@ _aesni_enc4:
6383 AESENCLAST KEY STATE2
6384 AESENCLAST KEY STATE3
6385 AESENCLAST KEY STATE4
6386 + pax_force_retaddr_bts
6390 @@ -2089,7 +2104,9 @@ ENTRY(aesni_dec)
6394 + pax_force_retaddr 0, 1
6399 * _aesni_dec1: internal ABI
6400 @@ -2146,6 +2163,7 @@ _aesni_dec1:
6402 movaps 0x70(TKEYP), KEY
6403 AESDECLAST KEY STATE
6404 + pax_force_retaddr_bts
6408 @@ -2254,6 +2272,7 @@ _aesni_dec4:
6409 AESDECLAST KEY STATE2
6410 AESDECLAST KEY STATE3
6411 AESDECLAST KEY STATE4
6412 + pax_force_retaddr_bts
6416 @@ -2311,7 +2330,9 @@ ENTRY(aesni_ecb_enc)
6420 + pax_force_retaddr 0, 1
6422 +ENDPROC(aesni_ecb_enc)
6425 * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6426 @@ -2369,7 +2390,9 @@ ENTRY(aesni_ecb_dec)
6430 + pax_force_retaddr 0, 1
6432 +ENDPROC(aesni_ecb_dec)
6435 * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6436 @@ -2410,7 +2433,9 @@ ENTRY(aesni_cbc_enc)
6440 + pax_force_retaddr 0, 1
6442 +ENDPROC(aesni_cbc_enc)
6445 * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
6446 @@ -2498,7 +2523,9 @@ ENTRY(aesni_cbc_dec)
6450 + pax_force_retaddr 0, 1
6452 +ENDPROC(aesni_cbc_dec)
6456 @@ -2524,6 +2551,7 @@ _aesni_inc_init:
6458 MOVQ_R64_XMM TCTR_LOW INC
6459 MOVQ_R64_XMM CTR TCTR_LOW
6460 + pax_force_retaddr_bts
6464 @@ -2552,6 +2580,7 @@ _aesni_inc:
6467 PSHUFB_XMM BSWAP_MASK IV
6468 + pax_force_retaddr_bts
6472 @@ -2612,5 +2641,7 @@ ENTRY(aesni_ctr_enc)
6476 + pax_force_retaddr 0, 1
6478 +ENDPROC(aesni_ctr_enc)
6480 diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6481 index 6214a9b..1f4fc9a 100644
6482 --- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
6483 +++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
6485 +#include <asm/alternative-asm.h>
6487 # enter ECRYPT_encrypt_bytes
6490 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6494 + pax_force_retaddr 0, 1
6498 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
6504 # enter ECRYPT_ivsetup
6506 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6512 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
6513 index 573aa10..b73ad89 100644
6514 --- a/arch/x86/crypto/twofish-x86_64-asm_64.S
6515 +++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
6519 #include <asm/asm-offsets.h>
6520 +#include <asm/alternative-asm.h>
6524 @@ -269,6 +270,7 @@ twofish_enc_blk:
6528 + pax_force_retaddr 0, 1
6532 @@ -321,4 +323,5 @@ twofish_dec_blk:
6536 + pax_force_retaddr 0, 1
6538 diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
6539 index fd84387..0b4af7d 100644
6540 --- a/arch/x86/ia32/ia32_aout.c
6541 +++ b/arch/x86/ia32/ia32_aout.c
6542 @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
6543 unsigned long dump_start, dump_size;
6546 + memset(&dump, 0, sizeof(dump));
6551 diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
6552 index 6557769..ef6ae89 100644
6553 --- a/arch/x86/ia32/ia32_signal.c
6554 +++ b/arch/x86/ia32/ia32_signal.c
6555 @@ -169,7 +169,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
6559 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
6560 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
6562 if (ret >= 0 && uoss_ptr) {
6563 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
6564 @@ -370,7 +370,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
6566 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6569 + void __user **fpstate)
6573 @@ -391,7 +391,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6576 sp = sp - sig_xstate_ia32_size;
6577 - *fpstate = (struct _fpstate_ia32 *) sp;
6578 + *fpstate = (struct _fpstate_ia32 __user *) sp;
6579 if (save_i387_xstate_ia32(*fpstate) < 0)
6580 return (void __user *) -1L;
6582 @@ -399,7 +399,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
6584 /* Align the stack pointer according to the i386 ABI,
6585 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
6586 - sp = ((sp + 4) & -16ul) - 4;
6587 + sp = ((sp - 12) & -16ul) - 4;
6588 return (void __user *) sp;
6591 @@ -457,7 +457,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
6592 * These are actually not used anymore, but left because some
6593 * gdb versions depend on them as a marker.
6595 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6596 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6597 } put_user_catch(err);
6600 @@ -499,7 +499,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6602 __NR_ia32_rt_sigreturn,
6608 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
6609 @@ -529,16 +529,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
6611 if (ka->sa.sa_flags & SA_RESTORER)
6612 restorer = ka->sa.sa_restorer;
6613 + else if (current->mm->context.vdso)
6614 + /* Return stub is in 32bit vsyscall page */
6615 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6617 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
6619 + restorer = &frame->retcode;
6620 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
6623 * Not actually used anymore, but left because some gdb
6626 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6627 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
6628 } put_user_catch(err);
6631 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
6632 index 54edb207..9335b5f 100644
6633 --- a/arch/x86/ia32/ia32entry.S
6634 +++ b/arch/x86/ia32/ia32entry.S
6636 #include <asm/thread_info.h>
6637 #include <asm/segment.h>
6638 #include <asm/irqflags.h>
6639 +#include <asm/pgtable.h>
6640 #include <linux/linkage.h>
6641 +#include <asm/alternative-asm.h>
6643 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6644 #include <linux/elf-em.h>
6645 @@ -95,6 +97,30 @@ ENTRY(native_irq_enable_sysexit)
6646 ENDPROC(native_irq_enable_sysexit)
6649 + .macro pax_enter_kernel_user
6651 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6652 + call pax_enter_kernel_user
6656 + .macro pax_exit_kernel_user
6657 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6658 + call pax_exit_kernel_user
6660 +#ifdef CONFIG_PAX_RANDKSTACK
6662 + call pax_randomize_kstack
6667 +.macro pax_erase_kstack
6668 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6669 + call pax_erase_kstack
6674 * 32bit SYSENTER instruction entry.
6676 @@ -121,12 +147,6 @@ ENTRY(ia32_sysenter_target)
6677 CFI_REGISTER rsp,rbp
6679 movq PER_CPU_VAR(kernel_stack), %rsp
6680 - addq $(KERNEL_STACK_OFFSET),%rsp
6682 - * No need to follow this irqs on/off section: the syscall
6683 - * disabled irqs, here we enable it straight after entry:
6685 - ENABLE_INTERRUPTS(CLBR_NONE)
6686 movl %ebp,%ebp /* zero extension */
6687 pushq_cfi $__USER32_DS
6688 /*CFI_REL_OFFSET ss,0*/
6689 @@ -134,25 +154,38 @@ ENTRY(ia32_sysenter_target)
6690 CFI_REL_OFFSET rsp,0
6692 /*CFI_REL_OFFSET rflags,0*/
6693 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6694 - CFI_REGISTER rip,r10
6695 + GET_THREAD_INFO(%r11)
6696 + movl TI_sysenter_return(%r11), %r11d
6697 + CFI_REGISTER rip,r11
6698 pushq_cfi $__USER32_CS
6699 /*CFI_REL_OFFSET cs,0*/
6703 CFI_REL_OFFSET rip,0
6707 + pax_enter_kernel_user
6709 + * No need to follow this irqs on/off section: the syscall
6710 + * disabled irqs, here we enable it straight after entry:
6712 + ENABLE_INTERRUPTS(CLBR_NONE)
6713 /* no need to do an access_ok check here because rbp has been
6714 32bit zero extended */
6716 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6717 + mov $PAX_USER_SHADOW_BASE,%r11
6722 .section __ex_table,"a"
6723 .quad 1b,ia32_badarg
6725 - GET_THREAD_INFO(%r10)
6726 - orl $TS_COMPAT,TI_status(%r10)
6727 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6728 + GET_THREAD_INFO(%r11)
6729 + orl $TS_COMPAT,TI_status(%r11)
6730 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6732 jnz sysenter_tracesys
6733 cmpq $(IA32_NR_syscalls-1),%rax
6734 @@ -162,13 +195,15 @@ sysenter_do_call:
6736 call *ia32_sys_call_table(,%rax,8)
6737 movq %rax,RAX-ARGOFFSET(%rsp)
6738 - GET_THREAD_INFO(%r10)
6739 + GET_THREAD_INFO(%r11)
6740 DISABLE_INTERRUPTS(CLBR_NONE)
6742 - testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6743 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6745 sysexit_from_sys_call:
6746 - andl $~TS_COMPAT,TI_status(%r10)
6747 + pax_exit_kernel_user
6749 + andl $~TS_COMPAT,TI_status(%r11)
6750 /* clear IF, that popfq doesn't enable interrupts early */
6751 andl $~0x200,EFLAGS-R11(%rsp)
6752 movl RIP-R11(%rsp),%edx /* User %eip */
6753 @@ -194,6 +229,9 @@ sysexit_from_sys_call:
6754 movl %eax,%esi /* 2nd arg: syscall number */
6755 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6756 call audit_syscall_entry
6760 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6761 cmpq $(IA32_NR_syscalls-1),%rax
6763 @@ -205,7 +243,7 @@ sysexit_from_sys_call:
6766 .macro auditsys_exit exit
6767 - testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6768 + testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6769 jnz ia32_ret_from_sys_call
6772 @@ -215,12 +253,12 @@ sysexit_from_sys_call:
6773 movzbl %al,%edi /* zero-extend that into %edi */
6774 inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
6775 call audit_syscall_exit
6776 - GET_THREAD_INFO(%r10)
6777 + GET_THREAD_INFO(%r11)
6778 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
6779 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
6782 - testl %edi,TI_flags(%r10)
6783 + testl %edi,TI_flags(%r11)
6785 CLEAR_RREGS -ARGOFFSET
6787 @@ -238,7 +276,7 @@ sysexit_audit:
6790 #ifdef CONFIG_AUDITSYSCALL
6791 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6792 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6793 jz sysenter_auditsys
6796 @@ -246,6 +284,9 @@ sysenter_tracesys:
6797 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6798 movq %rsp,%rdi /* &pt_regs -> arg1 */
6799 call syscall_trace_enter
6803 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6805 cmpq $(IA32_NR_syscalls-1),%rax
6806 @@ -277,19 +318,20 @@ ENDPROC(ia32_sysenter_target)
6807 ENTRY(ia32_cstar_target)
6808 CFI_STARTPROC32 simple
6810 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6812 CFI_REGISTER rip,rcx
6813 /*CFI_REGISTER rflags,r11*/
6817 movq PER_CPU_VAR(kernel_stack),%rsp
6819 + pax_enter_kernel_user
6821 * No need to follow this irqs on/off section: the syscall
6822 * disabled irqs and here we enable it straight after entry:
6824 ENABLE_INTERRUPTS(CLBR_NONE)
6826 movl %eax,%eax /* zero extension */
6827 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6828 movq %rcx,RIP-ARGOFFSET(%rsp)
6829 @@ -305,13 +347,19 @@ ENTRY(ia32_cstar_target)
6830 /* no need to do an access_ok check here because r8 has been
6831 32bit zero extended */
6832 /* hardware stack frame is complete now */
6834 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6835 + mov $PAX_USER_SHADOW_BASE,%r11
6840 .section __ex_table,"a"
6841 .quad 1b,ia32_badarg
6843 - GET_THREAD_INFO(%r10)
6844 - orl $TS_COMPAT,TI_status(%r10)
6845 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6846 + GET_THREAD_INFO(%r11)
6847 + orl $TS_COMPAT,TI_status(%r11)
6848 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6851 cmpq $IA32_NR_syscalls-1,%rax
6852 @@ -321,13 +369,15 @@ cstar_do_call:
6854 call *ia32_sys_call_table(,%rax,8)
6855 movq %rax,RAX-ARGOFFSET(%rsp)
6856 - GET_THREAD_INFO(%r10)
6857 + GET_THREAD_INFO(%r11)
6858 DISABLE_INTERRUPTS(CLBR_NONE)
6860 - testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6861 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
6863 sysretl_from_sys_call:
6864 - andl $~TS_COMPAT,TI_status(%r10)
6865 + pax_exit_kernel_user
6867 + andl $~TS_COMPAT,TI_status(%r11)
6868 RESTORE_ARGS 0,-ARG_SKIP,0,0,0
6869 movl RIP-ARGOFFSET(%rsp),%ecx
6870 CFI_REGISTER rip,rcx
6871 @@ -355,7 +405,7 @@ sysretl_audit:
6874 #ifdef CONFIG_AUDITSYSCALL
6875 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
6876 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
6880 @@ -364,6 +414,9 @@ cstar_tracesys:
6881 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6882 movq %rsp,%rdi /* &pt_regs -> arg1 */
6883 call syscall_trace_enter
6887 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6890 @@ -409,20 +462,21 @@ ENTRY(ia32_syscall)
6891 CFI_REL_OFFSET rip,RIP-RIP
6892 PARAVIRT_ADJUST_EXCEPTION_FRAME
6895 - * No need to follow this irqs on/off section: the syscall
6896 - * disabled irqs and here we enable it straight after entry:
6898 - ENABLE_INTERRUPTS(CLBR_NONE)
6902 /* note the registers are not zero extended to the sf.
6903 this could be a problem. */
6905 - GET_THREAD_INFO(%r10)
6906 - orl $TS_COMPAT,TI_status(%r10)
6907 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
6908 + pax_enter_kernel_user
6910 + * No need to follow this irqs on/off section: the syscall
6911 + * disabled irqs and here we enable it straight after entry:
6913 + ENABLE_INTERRUPTS(CLBR_NONE)
6914 + GET_THREAD_INFO(%r11)
6915 + orl $TS_COMPAT,TI_status(%r11)
6916 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
6918 cmpq $(IA32_NR_syscalls-1),%rax
6920 @@ -441,6 +495,9 @@ ia32_tracesys:
6921 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6922 movq %rsp,%rdi /* &pt_regs -> arg1 */
6923 call syscall_trace_enter
6927 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6929 cmpq $(IA32_NR_syscalls-1),%rax
6930 @@ -455,6 +512,7 @@ ia32_badsys:
6938 diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
6939 index f6f5c53..b358b28 100644
6940 --- a/arch/x86/ia32/sys_ia32.c
6941 +++ b/arch/x86/ia32/sys_ia32.c
6942 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
6944 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
6946 - typeof(ubuf->st_uid) uid = 0;
6947 - typeof(ubuf->st_gid) gid = 0;
6948 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
6949 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
6950 SET_UID(uid, stat->uid);
6951 SET_GID(gid, stat->gid);
6952 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6953 @@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
6956 ret = sys_rt_sigprocmask(how,
6957 - set ? (sigset_t __user *)&s : NULL,
6958 - oset ? (sigset_t __user *)&s : NULL,
6959 + set ? (sigset_t __force_user *)&s : NULL,
6960 + oset ? (sigset_t __force_user *)&s : NULL,
6964 @@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int seconds)
6965 return alarm_setitimer(seconds);
6968 -asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6969 +asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6972 return compat_sys_wait4(pid, stat_addr, options, NULL);
6973 @@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
6974 mm_segment_t old_fs = get_fs();
6977 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6978 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6980 if (put_compat_timespec(&t, interval))
6982 @@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
6983 mm_segment_t old_fs = get_fs();
6986 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6987 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6990 switch (_NSIG_WORDS) {
6991 @@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
6992 if (copy_siginfo_from_user32(&info, uinfo))
6995 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6996 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
7000 @@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
7004 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
7005 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
7009 diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
7010 index 091508b..0ee32ec 100644
7011 --- a/arch/x86/include/asm/alternative-asm.h
7012 +++ b/arch/x86/include/asm/alternative-asm.h
7017 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7018 + .macro pax_force_retaddr_bts rip=0
7019 + btsq $63,\rip(%rsp)
7021 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
7022 + .macro pax_force_retaddr rip=0, reload=0
7023 + btsq $63,\rip(%rsp)
7025 + .macro pax_force_fptr ptr
7028 + .macro pax_set_fptr_mask
7031 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
7032 + .macro pax_force_retaddr rip=0, reload=0
7036 + orq %r10,\rip(%rsp)
7038 + .macro pax_force_fptr ptr
7041 + .macro pax_set_fptr_mask
7042 + movabs $0x8000000000000000,%r10
7046 + .macro pax_force_retaddr rip=0, reload=0
7048 + .macro pax_force_fptr ptr
7050 + .macro pax_force_retaddr_bts rip=0
7052 + .macro pax_set_fptr_mask
7056 .macro altinstruction_entry orig alt feature orig_len alt_len
7059 diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
7060 index 37ad100..7d47faa 100644
7061 --- a/arch/x86/include/asm/alternative.h
7062 +++ b/arch/x86/include/asm/alternative.h
7063 @@ -89,7 +89,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
7064 ".section .discard,\"aw\",@progbits\n" \
7065 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
7067 - ".section .altinstr_replacement, \"ax\"\n" \
7068 + ".section .altinstr_replacement, \"a\"\n" \
7069 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7072 diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
7073 index 9b7273c..e9fcc24 100644
7074 --- a/arch/x86/include/asm/apic.h
7075 +++ b/arch/x86/include/asm/apic.h
7076 @@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
7078 #ifdef CONFIG_X86_LOCAL_APIC
7080 -extern unsigned int apic_verbosity;
7081 +extern int apic_verbosity;
7082 extern int local_apic_timer_c2_ok;
7084 extern int disable_apic;
7085 diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
7086 index 20370c6..a2eb9b0 100644
7087 --- a/arch/x86/include/asm/apm.h
7088 +++ b/arch/x86/include/asm/apm.h
7089 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
7090 __asm__ __volatile__(APM_DO_ZERO_SEGS
7093 - "lcall *%%cs:apm_bios_entry\n\t"
7094 + "lcall *%%ss:apm_bios_entry\n\t"
7098 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
7099 __asm__ __volatile__(APM_DO_ZERO_SEGS
7102 - "lcall *%%cs:apm_bios_entry\n\t"
7103 + "lcall *%%ss:apm_bios_entry\n\t"
7107 diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
7108 index 10572e3..2618d91 100644
7109 --- a/arch/x86/include/asm/atomic.h
7110 +++ b/arch/x86/include/asm/atomic.h
7113 static inline int atomic_read(const atomic_t *v)
7115 - return (*(volatile int *)&(v)->counter);
7116 + return (*(volatile const int *)&(v)->counter);
7120 + * atomic_read_unchecked - read atomic variable
7121 + * @v: pointer of type atomic_unchecked_t
7123 + * Atomically reads the value of @v.
7125 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7127 + return (*(volatile const int *)&(v)->counter);
7131 @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *v, int i)
7135 + * atomic_set_unchecked - set atomic variable
7136 + * @v: pointer of type atomic_unchecked_t
7137 + * @i: required value
7139 + * Atomically sets the value of @v to @i.
7141 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7147 * atomic_add - add integer to atomic variable
7148 * @i: integer value to add
7149 * @v: pointer of type atomic_t
7150 @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *v, int i)
7152 static inline void atomic_add(int i, atomic_t *v)
7154 - asm volatile(LOCK_PREFIX "addl %1,%0"
7155 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7157 +#ifdef CONFIG_PAX_REFCOUNT
7159 + LOCK_PREFIX "subl %1,%0\n"
7161 + _ASM_EXTABLE(0b, 0b)
7164 + : "+m" (v->counter)
7169 + * atomic_add_unchecked - add integer to atomic variable
7170 + * @i: integer value to add
7171 + * @v: pointer of type atomic_unchecked_t
7173 + * Atomically adds @i to @v.
7175 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7177 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7181 @@ -60,7 +105,29 @@ static inline void atomic_add(int i, atomic_t *v)
7183 static inline void atomic_sub(int i, atomic_t *v)
7185 - asm volatile(LOCK_PREFIX "subl %1,%0"
7186 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7188 +#ifdef CONFIG_PAX_REFCOUNT
7190 + LOCK_PREFIX "addl %1,%0\n"
7192 + _ASM_EXTABLE(0b, 0b)
7195 + : "+m" (v->counter)
7200 + * atomic_sub_unchecked - subtract integer from atomic variable
7201 + * @i: integer value to subtract
7202 + * @v: pointer of type atomic_unchecked_t
7204 + * Atomically subtracts @i from @v.
7206 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7208 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7212 @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7216 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7217 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
7219 +#ifdef CONFIG_PAX_REFCOUNT
7221 + LOCK_PREFIX "addl %2,%0\n"
7223 + _ASM_EXTABLE(0b, 0b)
7227 : "+m" (v->counter), "=qm" (c)
7228 : "ir" (i) : "memory");
7230 @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
7232 static inline void atomic_inc(atomic_t *v)
7234 - asm volatile(LOCK_PREFIX "incl %0"
7235 + asm volatile(LOCK_PREFIX "incl %0\n"
7237 +#ifdef CONFIG_PAX_REFCOUNT
7239 + LOCK_PREFIX "decl %0\n"
7241 + _ASM_EXTABLE(0b, 0b)
7244 + : "+m" (v->counter));
7248 + * atomic_inc_unchecked - increment atomic variable
7249 + * @v: pointer of type atomic_unchecked_t
7251 + * Atomically increments @v by 1.
7253 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7255 + asm volatile(LOCK_PREFIX "incl %0\n"
7256 : "+m" (v->counter));
7259 @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *v)
7261 static inline void atomic_dec(atomic_t *v)
7263 - asm volatile(LOCK_PREFIX "decl %0"
7264 + asm volatile(LOCK_PREFIX "decl %0\n"
7266 +#ifdef CONFIG_PAX_REFCOUNT
7268 + LOCK_PREFIX "incl %0\n"
7270 + _ASM_EXTABLE(0b, 0b)
7273 + : "+m" (v->counter));
7277 + * atomic_dec_unchecked - decrement atomic variable
7278 + * @v: pointer of type atomic_unchecked_t
7280 + * Atomically decrements @v by 1.
7282 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7284 + asm volatile(LOCK_PREFIX "decl %0\n"
7285 : "+m" (v->counter));
7288 @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
7292 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
7293 + asm volatile(LOCK_PREFIX "decl %0\n"
7295 +#ifdef CONFIG_PAX_REFCOUNT
7297 + LOCK_PREFIX "incl %0\n"
7299 + _ASM_EXTABLE(0b, 0b)
7303 : "+m" (v->counter), "=qm" (c)
7306 @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
7310 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
7311 + asm volatile(LOCK_PREFIX "incl %0\n"
7313 +#ifdef CONFIG_PAX_REFCOUNT
7315 + LOCK_PREFIX "decl %0\n"
7317 + _ASM_EXTABLE(0b, 0b)
7321 + : "+m" (v->counter), "=qm" (c)
7327 + * atomic_inc_and_test_unchecked - increment and test
7328 + * @v: pointer of type atomic_unchecked_t
7330 + * Atomically increments @v by 1
7331 + * and returns true if the result is zero, or false for all
7334 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7338 + asm volatile(LOCK_PREFIX "incl %0\n"
7340 : "+m" (v->counter), "=qm" (c)
7343 @@ -157,7 +310,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
7347 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7348 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
7350 +#ifdef CONFIG_PAX_REFCOUNT
7352 + LOCK_PREFIX "subl %2,%0\n"
7354 + _ASM_EXTABLE(0b, 0b)
7358 : "+m" (v->counter), "=qm" (c)
7359 : "ir" (i) : "memory");
7361 @@ -180,6 +342,46 @@ static inline int atomic_add_return(int i, atomic_t *v)
7363 /* Modern 486+ processor */
7365 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7367 +#ifdef CONFIG_PAX_REFCOUNT
7371 + _ASM_EXTABLE(0b, 0b)
7374 + : "+r" (i), "+m" (v->counter)
7379 +no_xadd: /* Legacy 386 processor */
7380 + local_irq_save(flags);
7381 + __i = atomic_read(v);
7382 + atomic_set(v, i + __i);
7383 + local_irq_restore(flags);
7389 + * atomic_add_return_unchecked - add integer and return
7390 + * @v: pointer of type atomic_unchecked_t
7391 + * @i: integer value to add
7393 + * Atomically adds @i to @v and returns @i + @v
7395 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7399 + unsigned long flags;
7400 + if (unlikely(boot_cpu_data.x86 <= 3))
7403 + /* Modern 486+ processor */
7405 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7406 : "+r" (i), "+m" (v->counter)
7408 @@ -208,6 +410,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
7411 #define atomic_inc_return(v) (atomic_add_return(1, v))
7412 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7414 + return atomic_add_return_unchecked(1, v);
7416 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7418 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7419 @@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
7420 return cmpxchg(&v->counter, old, new);
7423 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7425 + return cmpxchg(&v->counter, old, new);
7428 static inline int atomic_xchg(atomic_t *v, int new)
7430 return xchg(&v->counter, new);
7433 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7435 + return xchg(&v->counter, new);
7439 * __atomic_add_unless - add unless the number is already a given value
7440 * @v: pointer of type atomic_t
7441 @@ -231,12 +447,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
7443 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7449 - if (unlikely(c == (u)))
7450 + if (unlikely(c == u))
7452 - old = atomic_cmpxchg((v), c, c + (a));
7454 + asm volatile("addl %2,%0\n"
7456 +#ifdef CONFIG_PAX_REFCOUNT
7460 + _ASM_EXTABLE(0b, 0b)
7464 + : "0" (c), "ir" (a));
7466 + old = atomic_cmpxchg(v, c, new);
7467 if (likely(old == c))
7470 @@ -244,6 +473,48 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
7475 + * atomic_inc_not_zero_hint - increment if not null
7476 + * @v: pointer of type atomic_t
7477 + * @hint: probable value of the atomic before the increment
7479 + * This version of atomic_inc_not_zero() gives a hint of probable
7480 + * value of the atomic. This helps processor to not read the memory
7481 + * before doing the atomic read/modify/write cycle, lowering
7482 + * number of bus transactions on some arches.
7484 + * Returns: 0 if increment was not done, 1 otherwise.
7486 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
7487 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
7489 + int val, c = hint, new;
7491 + /* sanity test, should be removed by compiler if hint is a constant */
7493 + return __atomic_add_unless(v, 1, 0);
7496 + asm volatile("incl %0\n"
7498 +#ifdef CONFIG_PAX_REFCOUNT
7502 + _ASM_EXTABLE(0b, 0b)
7508 + val = atomic_cmpxchg(v, c, new);
7518 * atomic_dec_if_positive - decrement by 1 if old value positive
7519 diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
7520 index 24098aa..1e37723 100644
7521 --- a/arch/x86/include/asm/atomic64_32.h
7522 +++ b/arch/x86/include/asm/atomic64_32.h
7523 @@ -12,6 +12,14 @@ typedef struct {
7524 u64 __aligned(8) counter;
7527 +#ifdef CONFIG_PAX_REFCOUNT
7529 + u64 __aligned(8) counter;
7530 +} atomic64_unchecked_t;
7532 +typedef atomic64_t atomic64_unchecked_t;
7535 #define ATOMIC64_INIT(val) { (val) }
7537 #ifdef CONFIG_X86_CMPXCHG64
7538 @@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
7542 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
7543 + * @p: pointer to type atomic64_unchecked_t
7544 + * @o: expected value
7547 + * Atomically sets @v to @n if it was equal to @o and returns
7551 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
7553 + return cmpxchg64(&v->counter, o, n);
7557 * atomic64_xchg - xchg atomic64 variable
7558 * @v: pointer to type atomic64_t
7559 * @n: value to assign
7560 @@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64_t *v, long long i)
7564 + * atomic64_set_unchecked - set atomic64 variable
7565 + * @v: pointer to type atomic64_unchecked_t
7566 + * @n: value to assign
7568 + * Atomically sets the value of @v to @n.
7570 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
7572 + unsigned high = (unsigned)(i >> 32);
7573 + unsigned low = (unsigned)i;
7574 + asm volatile(ATOMIC64_ALTERNATIVE(set)
7575 + : "+b" (low), "+c" (high)
7577 + : "eax", "edx", "memory"
7582 * atomic64_read - read atomic64 variable
7583 * @v: pointer to type atomic64_t
7585 @@ -93,6 +134,22 @@ static inline long long atomic64_read(atomic64_t *v)
7589 + * atomic64_read_unchecked - read atomic64 variable
7590 + * @v: pointer to type atomic64_unchecked_t
7592 + * Atomically reads the value of @v and returns it.
7594 +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
7597 + asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
7598 + : "=A" (r), "+c" (v)
7605 * atomic64_add_return - add and return
7606 * @i: integer value to add
7607 * @v: pointer to type atomic64_t
7608 @@ -108,6 +165,22 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
7613 + * atomic64_add_return_unchecked - add and return
7614 + * @i: integer value to add
7615 + * @v: pointer to type atomic64_unchecked_t
7617 + * Atomically adds @i to @v and returns @i + *@v
7619 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
7621 + asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
7622 + : "+A" (i), "+c" (v)
7629 * Other variants with different arithmetic operators:
7631 @@ -131,6 +204,17 @@ static inline long long atomic64_inc_return(atomic64_t *v)
7635 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7638 + asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
7646 static inline long long atomic64_dec_return(atomic64_t *v)
7649 @@ -159,6 +243,22 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
7653 + * atomic64_add_unchecked - add integer to atomic64 variable
7654 + * @i: integer value to add
7655 + * @v: pointer to type atomic64_unchecked_t
7657 + * Atomically adds @i to @v.
7659 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
7661 + asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
7662 + : "+A" (i), "+c" (v)
7669 * atomic64_sub - subtract the atomic64 variable
7670 * @i: integer value to subtract
7671 * @v: pointer to type atomic64_t
7672 diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
7673 index 017594d..d3fcf72 100644
7674 --- a/arch/x86/include/asm/atomic64_64.h
7675 +++ b/arch/x86/include/asm/atomic64_64.h
7678 static inline long atomic64_read(const atomic64_t *v)
7680 - return (*(volatile long *)&(v)->counter);
7681 + return (*(volatile const long *)&(v)->counter);
7685 + * atomic64_read_unchecked - read atomic64 variable
7686 + * @v: pointer of type atomic64_unchecked_t
7688 + * Atomically reads the value of @v.
7689 + * Doesn't imply a read memory barrier.
7691 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
7693 + return (*(volatile const long *)&(v)->counter);
7697 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
7701 + * atomic64_set_unchecked - set atomic64 variable
7702 + * @v: pointer to type atomic64_unchecked_t
7703 + * @i: required value
7705 + * Atomically sets the value of @v to @i.
7707 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
7713 * atomic64_add - add integer to atomic64 variable
7714 * @i: integer value to add
7715 * @v: pointer to type atomic64_t
7716 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
7718 static inline void atomic64_add(long i, atomic64_t *v)
7720 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
7722 +#ifdef CONFIG_PAX_REFCOUNT
7724 + LOCK_PREFIX "subq %1,%0\n"
7726 + _ASM_EXTABLE(0b, 0b)
7729 + : "=m" (v->counter)
7730 + : "er" (i), "m" (v->counter));
7734 + * atomic64_add_unchecked - add integer to atomic64 variable
7735 + * @i: integer value to add
7736 + * @v: pointer to type atomic64_unchecked_t
7738 + * Atomically adds @i to @v.
7740 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
7742 asm volatile(LOCK_PREFIX "addq %1,%0"
7744 : "er" (i), "m" (v->counter));
7745 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
7747 static inline void atomic64_sub(long i, atomic64_t *v)
7749 - asm volatile(LOCK_PREFIX "subq %1,%0"
7750 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
7752 +#ifdef CONFIG_PAX_REFCOUNT
7754 + LOCK_PREFIX "addq %1,%0\n"
7756 + _ASM_EXTABLE(0b, 0b)
7759 + : "=m" (v->counter)
7760 + : "er" (i), "m" (v->counter));
7764 + * atomic64_sub_unchecked - subtract the atomic64 variable
7765 + * @i: integer value to subtract
7766 + * @v: pointer to type atomic64_unchecked_t
7768 + * Atomically subtracts @i from @v.
7770 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
7772 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
7774 : "er" (i), "m" (v->counter));
7776 @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7780 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
7781 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
7783 +#ifdef CONFIG_PAX_REFCOUNT
7785 + LOCK_PREFIX "addq %2,%0\n"
7787 + _ASM_EXTABLE(0b, 0b)
7791 : "=m" (v->counter), "=qm" (c)
7792 : "er" (i), "m" (v->counter) : "memory");
7794 @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
7796 static inline void atomic64_inc(atomic64_t *v)
7798 + asm volatile(LOCK_PREFIX "incq %0\n"
7800 +#ifdef CONFIG_PAX_REFCOUNT
7802 + LOCK_PREFIX "decq %0\n"
7804 + _ASM_EXTABLE(0b, 0b)
7807 + : "=m" (v->counter)
7808 + : "m" (v->counter));
7812 + * atomic64_inc_unchecked - increment atomic64 variable
7813 + * @v: pointer to type atomic64_unchecked_t
7815 + * Atomically increments @v by 1.
7817 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
7819 asm volatile(LOCK_PREFIX "incq %0"
7821 : "m" (v->counter));
7822 @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64_t *v)
7824 static inline void atomic64_dec(atomic64_t *v)
7826 - asm volatile(LOCK_PREFIX "decq %0"
7827 + asm volatile(LOCK_PREFIX "decq %0\n"
7829 +#ifdef CONFIG_PAX_REFCOUNT
7831 + LOCK_PREFIX "incq %0\n"
7833 + _ASM_EXTABLE(0b, 0b)
7836 + : "=m" (v->counter)
7837 + : "m" (v->counter));
7841 + * atomic64_dec_unchecked - decrement atomic64 variable
7842 + * @v: pointer to type atomic64_t
7844 + * Atomically decrements @v by 1.
7846 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
7848 + asm volatile(LOCK_PREFIX "decq %0\n"
7850 : "m" (v->counter));
7852 @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
7856 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
7857 + asm volatile(LOCK_PREFIX "decq %0\n"
7859 +#ifdef CONFIG_PAX_REFCOUNT
7861 + LOCK_PREFIX "incq %0\n"
7863 + _ASM_EXTABLE(0b, 0b)
7867 : "=m" (v->counter), "=qm" (c)
7868 : "m" (v->counter) : "memory");
7870 @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
7874 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
7875 + asm volatile(LOCK_PREFIX "incq %0\n"
7877 +#ifdef CONFIG_PAX_REFCOUNT
7879 + LOCK_PREFIX "decq %0\n"
7881 + _ASM_EXTABLE(0b, 0b)
7885 : "=m" (v->counter), "=qm" (c)
7886 : "m" (v->counter) : "memory");
7888 @@ -155,7 +292,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7892 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
7893 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
7895 +#ifdef CONFIG_PAX_REFCOUNT
7897 + LOCK_PREFIX "subq %2,%0\n"
7899 + _ASM_EXTABLE(0b, 0b)
7903 : "=m" (v->counter), "=qm" (c)
7904 : "er" (i), "m" (v->counter) : "memory");
7906 @@ -171,7 +317,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
7907 static inline long atomic64_add_return(long i, atomic64_t *v)
7910 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
7911 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
7913 +#ifdef CONFIG_PAX_REFCOUNT
7917 + _ASM_EXTABLE(0b, 0b)
7920 + : "+r" (i), "+m" (v->counter)
7926 + * atomic64_add_return_unchecked - add and return
7927 + * @i: integer value to add
7928 + * @v: pointer to type atomic64_unchecked_t
7930 + * Atomically adds @i to @v and returns @i + @v
7932 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
7935 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
7936 : "+r" (i), "+m" (v->counter)
7939 @@ -183,6 +353,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
7942 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
7943 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
7945 + return atomic64_add_return_unchecked(1, v);
7947 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
7949 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7950 @@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
7951 return cmpxchg(&v->counter, old, new);
7954 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
7956 + return cmpxchg(&v->counter, old, new);
7959 static inline long atomic64_xchg(atomic64_t *v, long new)
7961 return xchg(&v->counter, new);
7962 @@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
7964 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
7968 c = atomic64_read(v);
7970 - if (unlikely(c == (u)))
7971 + if (unlikely(c == u))
7973 - old = atomic64_cmpxchg((v), c, c + (a));
7975 + asm volatile("add %2,%0\n"
7977 +#ifdef CONFIG_PAX_REFCOUNT
7981 + _ASM_EXTABLE(0b, 0b)
7985 + : "0" (c), "ir" (a));
7987 + old = atomic64_cmpxchg(v, c, new);
7988 if (likely(old == c))
7996 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
7997 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
7998 index 1775d6e..b65017f 100644
7999 --- a/arch/x86/include/asm/bitops.h
8000 +++ b/arch/x86/include/asm/bitops.h
8002 * a mask operation on a byte.
8004 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8005 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8006 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8007 #define CONST_MASK(nr) (1 << ((nr) & 7))
8010 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
8011 index 5e1a2ee..c9f9533 100644
8012 --- a/arch/x86/include/asm/boot.h
8013 +++ b/arch/x86/include/asm/boot.h
8015 #include <asm/pgtable_types.h>
8017 /* Physical address where kernel should be loaded. */
8018 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8019 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8020 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8021 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8023 +#ifndef __ASSEMBLY__
8024 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
8025 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8028 /* Minimum kernel alignment, as a power of two */
8029 #ifdef CONFIG_X86_64
8030 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8031 diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
8032 index 48f99f1..d78ebf9 100644
8033 --- a/arch/x86/include/asm/cache.h
8034 +++ b/arch/x86/include/asm/cache.h
8037 /* L1 cache line size */
8038 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8039 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8040 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8042 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
8043 +#define __read_only __attribute__((__section__(".data..read_only")))
8045 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
8046 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
8047 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
8049 #ifdef CONFIG_X86_VSMP
8051 diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
8052 index 4e12668..501d239 100644
8053 --- a/arch/x86/include/asm/cacheflush.h
8054 +++ b/arch/x86/include/asm/cacheflush.h
8055 @@ -26,7 +26,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
8056 unsigned long pg_flags = pg->flags & _PGMT_MASK;
8058 if (pg_flags == _PGMT_DEFAULT)
8061 else if (pg_flags == _PGMT_WC)
8062 return _PAGE_CACHE_WC;
8063 else if (pg_flags == _PGMT_UC_MINUS)
8064 diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
8065 index 46fc474..b02b0f9 100644
8066 --- a/arch/x86/include/asm/checksum_32.h
8067 +++ b/arch/x86/include/asm/checksum_32.h
8068 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
8069 int len, __wsum sum,
8070 int *src_err_ptr, int *dst_err_ptr);
8072 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8073 + int len, __wsum sum,
8074 + int *src_err_ptr, int *dst_err_ptr);
8076 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8077 + int len, __wsum sum,
8078 + int *src_err_ptr, int *dst_err_ptr);
8081 * Note: when you get a NULL pointer exception here this means someone
8082 * passed in an incorrect kernel address to one of these functions.
8083 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
8087 - return csum_partial_copy_generic((__force void *)src, dst,
8088 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
8089 len, sum, err_ptr, NULL);
8092 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
8095 if (access_ok(VERIFY_WRITE, dst, len))
8096 - return csum_partial_copy_generic(src, (__force void *)dst,
8097 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8098 len, sum, NULL, err_ptr);
8101 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
8102 index 88b23a4..d2e5f9f 100644
8103 --- a/arch/x86/include/asm/cpufeature.h
8104 +++ b/arch/x86/include/asm/cpufeature.h
8105 @@ -358,7 +358,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
8106 ".section .discard,\"aw\",@progbits\n"
8107 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
8109 - ".section .altinstr_replacement,\"ax\"\n"
8110 + ".section .altinstr_replacement,\"a\"\n"
8114 diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
8115 index 41935fa..3b40db8 100644
8116 --- a/arch/x86/include/asm/desc.h
8117 +++ b/arch/x86/include/asm/desc.h
8119 #include <asm/desc_defs.h>
8120 #include <asm/ldt.h>
8121 #include <asm/mmu.h>
8122 +#include <asm/pgtable.h>
8124 #include <linux/smp.h>
8126 @@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8128 desc->type = (info->read_exec_only ^ 1) << 1;
8129 desc->type |= info->contents << 2;
8130 + desc->type |= info->seg_not_present ^ 1;
8134 @@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
8137 extern struct desc_ptr idt_descr;
8138 -extern gate_desc idt_table[];
8141 - struct desc_struct gdt[GDT_ENTRIES];
8142 -} __attribute__((aligned(PAGE_SIZE)));
8144 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8145 +extern gate_desc idt_table[256];
8147 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8148 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8150 - return per_cpu(gdt_page, cpu).gdt;
8151 + return cpu_gdt_table[cpu];
8154 #ifdef CONFIG_X86_64
8155 @@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
8156 unsigned long base, unsigned dpl, unsigned flags,
8159 - gate->a = (seg << 16) | (base & 0xffff);
8160 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8161 + gate->gate.offset_low = base;
8162 + gate->gate.seg = seg;
8163 + gate->gate.reserved = 0;
8164 + gate->gate.type = type;
8166 + gate->gate.dpl = dpl;
8168 + gate->gate.offset_high = base >> 16;
8172 @@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
8174 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
8176 + pax_open_kernel();
8177 memcpy(&idt[entry], gate, sizeof(*gate));
8178 + pax_close_kernel();
8181 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
8183 + pax_open_kernel();
8184 memcpy(&ldt[entry], desc, 8);
8185 + pax_close_kernel();
8189 @@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
8190 default: size = sizeof(*gdt); break;
8193 + pax_open_kernel();
8194 memcpy(&gdt[entry], desc, size);
8195 + pax_close_kernel();
8198 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8199 @@ -207,7 +216,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
8201 static inline void native_load_tr_desc(void)
8203 + pax_open_kernel();
8204 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8205 + pax_close_kernel();
8208 static inline void native_load_gdt(const struct desc_ptr *dtr)
8209 @@ -244,8 +255,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
8210 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8213 + pax_open_kernel();
8214 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8215 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8216 + pax_close_kernel();
8219 #define _LDT_empty(info) \
8220 @@ -307,7 +320,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
8221 desc->limit = (limit >> 16) & 0xf;
8224 -static inline void _set_gate(int gate, unsigned type, void *addr,
8225 +static inline void _set_gate(int gate, unsigned type, const void *addr,
8226 unsigned dpl, unsigned ist, unsigned seg)
8229 @@ -326,7 +339,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
8230 * Pentium F0 0F bugfix can have resulted in the mapped
8231 * IDT being write-protected.
8233 -static inline void set_intr_gate(unsigned int n, void *addr)
8234 +static inline void set_intr_gate(unsigned int n, const void *addr)
8236 BUG_ON((unsigned)n > 0xFF);
8237 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8238 @@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
8240 * This routine sets up an interrupt gate at directory privilege level 3.
8242 -static inline void set_system_intr_gate(unsigned int n, void *addr)
8243 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
8245 BUG_ON((unsigned)n > 0xFF);
8246 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8249 -static inline void set_system_trap_gate(unsigned int n, void *addr)
8250 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
8252 BUG_ON((unsigned)n > 0xFF);
8253 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8256 -static inline void set_trap_gate(unsigned int n, void *addr)
8257 +static inline void set_trap_gate(unsigned int n, const void *addr)
8259 BUG_ON((unsigned)n > 0xFF);
8260 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8261 @@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
8262 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8264 BUG_ON((unsigned)n > 0xFF);
8265 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8266 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8269 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8270 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8272 BUG_ON((unsigned)n > 0xFF);
8273 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8276 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8277 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8279 BUG_ON((unsigned)n > 0xFF);
8280 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8283 +#ifdef CONFIG_X86_32
8284 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8286 + struct desc_struct d;
8288 + if (likely(limit))
8289 + limit = (limit - 1UL) >> PAGE_SHIFT;
8290 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
8291 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8295 #endif /* _ASM_X86_DESC_H */
8296 diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
8297 index 278441f..b95a174 100644
8298 --- a/arch/x86/include/asm/desc_defs.h
8299 +++ b/arch/x86/include/asm/desc_defs.h
8300 @@ -31,6 +31,12 @@ struct desc_struct {
8301 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8302 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8307 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8308 + unsigned offset_high: 16;
8311 } __attribute__((packed));
8313 diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
8314 index 908b969..a1f4eb4 100644
8315 --- a/arch/x86/include/asm/e820.h
8316 +++ b/arch/x86/include/asm/e820.h
8317 @@ -69,7 +69,7 @@ struct e820map {
8318 #define ISA_START_ADDRESS 0xa0000
8319 #define ISA_END_ADDRESS 0x100000
8321 -#define BIOS_BEGIN 0x000a0000
8322 +#define BIOS_BEGIN 0x000c0000
8323 #define BIOS_END 0x00100000
8325 #define BIOS_ROM_BASE 0xffe00000
8326 diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
8327 index f2ad216..eb24c96 100644
8328 --- a/arch/x86/include/asm/elf.h
8329 +++ b/arch/x86/include/asm/elf.h
8330 @@ -237,7 +237,25 @@ extern int force_personality32;
8331 the loader. We need to make sure that it is out of the way of the program
8332 that it will "exec", and that there is sufficient room for the brk. */
8334 +#ifdef CONFIG_PAX_SEGMEXEC
8335 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8337 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8340 +#ifdef CONFIG_PAX_ASLR
8341 +#ifdef CONFIG_X86_32
8342 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8344 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8345 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8347 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
8349 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8350 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8354 /* This yields a mask that user programs can use to figure out what
8355 instruction set this CPU supports. This could be done in user space,
8356 @@ -290,9 +308,7 @@ do { \
8358 #define ARCH_DLINFO \
8360 - if (vdso_enabled) \
8361 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8362 - (unsigned long)current->mm->context.vdso); \
8363 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8366 #define AT_SYSINFO 32
8367 @@ -303,7 +319,7 @@ do { \
8369 #endif /* !CONFIG_X86_32 */
8371 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8372 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8374 #define VDSO_ENTRY \
8375 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8376 @@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
8377 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8378 #define compat_arch_setup_additional_pages syscall32_setup_pages
8380 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8381 -#define arch_randomize_brk arch_randomize_brk
8383 #endif /* _ASM_X86_ELF_H */
8384 diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
8385 index cc70c1c..d96d011 100644
8386 --- a/arch/x86/include/asm/emergency-restart.h
8387 +++ b/arch/x86/include/asm/emergency-restart.h
8388 @@ -15,6 +15,6 @@ enum reboot_type {
8390 extern enum reboot_type reboot_type;
8392 -extern void machine_emergency_restart(void);
8393 +extern void machine_emergency_restart(void) __noreturn;
8395 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8396 diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
8397 index d09bb03..4ea4194 100644
8398 --- a/arch/x86/include/asm/futex.h
8399 +++ b/arch/x86/include/asm/futex.h
8401 #include <asm/system.h>
8403 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8404 + typecheck(u32 __user *, uaddr); \
8405 asm volatile("1:\t" insn "\n" \
8406 "2:\t.section .fixup,\"ax\"\n" \
8407 "3:\tmov\t%3, %1\n" \
8410 _ASM_EXTABLE(1b, 3b) \
8411 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8412 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8413 : "i" (-EFAULT), "0" (oparg), "1" (0))
8415 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8416 + typecheck(u32 __user *, uaddr); \
8417 asm volatile("1:\tmovl %2, %0\n" \
8418 "\tmovl\t%0, %3\n" \
8421 _ASM_EXTABLE(1b, 4b) \
8422 _ASM_EXTABLE(2b, 4b) \
8423 : "=&a" (oldval), "=&r" (ret), \
8424 - "+m" (*uaddr), "=&r" (tem) \
8425 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8426 : "r" (oparg), "i" (-EFAULT), "1" (0))
8428 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8429 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8433 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8434 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8437 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8438 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8442 @@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
8443 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8446 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
8447 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
8448 "2:\t.section .fixup, \"ax\"\n"
8452 _ASM_EXTABLE(1b, 3b)
8453 - : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
8454 + : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
8455 : "i" (-EFAULT), "r" (newval), "1" (oldval)
8458 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
8459 index 0919905..2cf38d6 100644
8460 --- a/arch/x86/include/asm/hw_irq.h
8461 +++ b/arch/x86/include/asm/hw_irq.h
8462 @@ -136,8 +136,8 @@ extern void setup_ioapic_dest(void);
8463 extern void enable_IO_APIC(void);
8466 -extern atomic_t irq_err_count;
8467 -extern atomic_t irq_mis_count;
8468 +extern atomic_unchecked_t irq_err_count;
8469 +extern atomic_unchecked_t irq_mis_count;
8472 extern void eisa_set_level_irq(unsigned int irq);
8473 diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
8474 index c9e09ea..73888df 100644
8475 --- a/arch/x86/include/asm/i387.h
8476 +++ b/arch/x86/include/asm/i387.h
8477 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
8481 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8482 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8483 + fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
8486 /* See comment in fxsave() below. */
8487 #ifdef CONFIG_AS_FXSAVEQ
8488 asm volatile("1: fxrstorq %[fx]\n\t"
8489 @@ -121,6 +126,11 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
8493 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8494 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8495 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
8499 * Clear the bytes not touched by the fxsave and reserved
8501 @@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu *fpu)
8502 #endif /* CONFIG_X86_64 */
8504 /* We need a safe address that is cheap to find and that is already
8505 - in L1 during context switch. The best choices are unfortunately
8506 - different for UP and SMP */
8508 -#define safe_address (__per_cpu_offset[0])
8510 -#define safe_address (kstat_cpu(0).cpustat.user)
8512 + in L1 during context switch. */
8513 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
8516 * These must be called with preempt disabled
8517 @@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void)
8518 struct thread_info *me = current_thread_info();
8520 if (me->status & TS_USEDFPU)
8521 - __save_init_fpu(me->task);
8522 + __save_init_fpu(current);
8526 diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
8527 index d8e8eef..99f81ae 100644
8528 --- a/arch/x86/include/asm/io.h
8529 +++ b/arch/x86/include/asm/io.h
8530 @@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
8532 #include <linux/vmalloc.h>
8534 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8535 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8537 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8540 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8542 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8546 * Convert a virtual cached pointer to an uncached pointer
8548 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
8549 index bba3cf8..06bc8da 100644
8550 --- a/arch/x86/include/asm/irqflags.h
8551 +++ b/arch/x86/include/asm/irqflags.h
8552 @@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
8556 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
8557 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
8558 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
8559 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
8562 #define INTERRUPT_RETURN iret
8563 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
8564 diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
8565 index 5478825..839e88c 100644
8566 --- a/arch/x86/include/asm/kprobes.h
8567 +++ b/arch/x86/include/asm/kprobes.h
8568 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
8569 #define RELATIVEJUMP_SIZE 5
8570 #define RELATIVECALL_OPCODE 0xe8
8571 #define RELATIVE_ADDR_SIZE 4
8572 -#define MAX_STACK_SIZE 64
8573 -#define MIN_STACK_SIZE(ADDR) \
8574 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
8575 - THREAD_SIZE - (unsigned long)(ADDR))) \
8576 - ? (MAX_STACK_SIZE) \
8577 - : (((unsigned long)current_thread_info()) + \
8578 - THREAD_SIZE - (unsigned long)(ADDR)))
8579 +#define MAX_STACK_SIZE 64UL
8580 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
8582 #define flush_insn_slot(p) do { } while (0)
8584 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
8585 index dd51c83..66cbfac 100644
8586 --- a/arch/x86/include/asm/kvm_host.h
8587 +++ b/arch/x86/include/asm/kvm_host.h
8588 @@ -456,7 +456,7 @@ struct kvm_arch {
8589 unsigned int n_requested_mmu_pages;
8590 unsigned int n_max_mmu_pages;
8591 unsigned int indirect_shadow_pages;
8592 - atomic_t invlpg_counter;
8593 + atomic_unchecked_t invlpg_counter;
8594 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
8596 * Hash table of struct kvm_mmu_page.
8597 @@ -636,7 +636,7 @@ struct kvm_x86_ops {
8598 enum x86_intercept_stage stage);
8600 const struct trace_print_flags *exit_reasons_str;
8604 struct kvm_arch_async_pf {
8606 diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
8607 index 9cdae5d..300d20f 100644
8608 --- a/arch/x86/include/asm/local.h
8609 +++ b/arch/x86/include/asm/local.h
8610 @@ -18,26 +18,58 @@ typedef struct {
8612 static inline void local_inc(local_t *l)
8614 - asm volatile(_ASM_INC "%0"
8615 + asm volatile(_ASM_INC "%0\n"
8617 +#ifdef CONFIG_PAX_REFCOUNT
8621 + _ASM_EXTABLE(0b, 0b)
8624 : "+m" (l->a.counter));
8627 static inline void local_dec(local_t *l)
8629 - asm volatile(_ASM_DEC "%0"
8630 + asm volatile(_ASM_DEC "%0\n"
8632 +#ifdef CONFIG_PAX_REFCOUNT
8636 + _ASM_EXTABLE(0b, 0b)
8639 : "+m" (l->a.counter));
8642 static inline void local_add(long i, local_t *l)
8644 - asm volatile(_ASM_ADD "%1,%0"
8645 + asm volatile(_ASM_ADD "%1,%0\n"
8647 +#ifdef CONFIG_PAX_REFCOUNT
8649 + _ASM_SUB "%1,%0\n"
8651 + _ASM_EXTABLE(0b, 0b)
8654 : "+m" (l->a.counter)
8658 static inline void local_sub(long i, local_t *l)
8660 - asm volatile(_ASM_SUB "%1,%0"
8661 + asm volatile(_ASM_SUB "%1,%0\n"
8663 +#ifdef CONFIG_PAX_REFCOUNT
8665 + _ASM_ADD "%1,%0\n"
8667 + _ASM_EXTABLE(0b, 0b)
8670 : "+m" (l->a.counter)
8673 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(long i, local_t *l)
8677 - asm volatile(_ASM_SUB "%2,%0; sete %1"
8678 + asm volatile(_ASM_SUB "%2,%0\n"
8680 +#ifdef CONFIG_PAX_REFCOUNT
8682 + _ASM_ADD "%2,%0\n"
8684 + _ASM_EXTABLE(0b, 0b)
8688 : "+m" (l->a.counter), "=qm" (c)
8689 : "ir" (i) : "memory");
8691 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(local_t *l)
8695 - asm volatile(_ASM_DEC "%0; sete %1"
8696 + asm volatile(_ASM_DEC "%0\n"
8698 +#ifdef CONFIG_PAX_REFCOUNT
8702 + _ASM_EXTABLE(0b, 0b)
8706 : "+m" (l->a.counter), "=qm" (c)
8709 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(local_t *l)
8713 - asm volatile(_ASM_INC "%0; sete %1"
8714 + asm volatile(_ASM_INC "%0\n"
8716 +#ifdef CONFIG_PAX_REFCOUNT
8720 + _ASM_EXTABLE(0b, 0b)
8724 : "+m" (l->a.counter), "=qm" (c)
8727 @@ -110,7 +169,16 @@ static inline int local_add_negative(long i, local_t *l)
8731 - asm volatile(_ASM_ADD "%2,%0; sets %1"
8732 + asm volatile(_ASM_ADD "%2,%0\n"
8734 +#ifdef CONFIG_PAX_REFCOUNT
8736 + _ASM_SUB "%2,%0\n"
8738 + _ASM_EXTABLE(0b, 0b)
8742 : "+m" (l->a.counter), "=qm" (c)
8743 : "ir" (i) : "memory");
8745 @@ -133,7 +201,15 @@ static inline long local_add_return(long i, local_t *l)
8747 /* Modern 486+ processor */
8749 - asm volatile(_ASM_XADD "%0, %1;"
8750 + asm volatile(_ASM_XADD "%0, %1\n"
8752 +#ifdef CONFIG_PAX_REFCOUNT
8754 + _ASM_MOV "%0,%1\n"
8756 + _ASM_EXTABLE(0b, 0b)
8759 : "+r" (i), "+m" (l->a.counter)
8762 diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
8763 index 593e51d..fa69c9a 100644
8764 --- a/arch/x86/include/asm/mman.h
8765 +++ b/arch/x86/include/asm/mman.h
8768 #include <asm-generic/mman.h>
8771 +#ifndef __ASSEMBLY__
8772 +#ifdef CONFIG_X86_32
8773 +#define arch_mmap_check i386_mmap_check
8774 +int i386_mmap_check(unsigned long addr, unsigned long len,
8775 + unsigned long flags);
8780 #endif /* _ASM_X86_MMAN_H */
8781 diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
8782 index 5f55e69..e20bfb1 100644
8783 --- a/arch/x86/include/asm/mmu.h
8784 +++ b/arch/x86/include/asm/mmu.h
8786 * we put the segment information here.
8790 + struct desc_struct *ldt;
8793 #ifdef CONFIG_X86_64
8794 @@ -18,7 +18,19 @@ typedef struct {
8799 + unsigned long vdso;
8801 +#ifdef CONFIG_X86_32
8802 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
8803 + unsigned long user_cs_base;
8804 + unsigned long user_cs_limit;
8806 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8807 + cpumask_t cpu_user_cs_mask;
8815 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
8816 index 6902152..399f3a2 100644
8817 --- a/arch/x86/include/asm/mmu_context.h
8818 +++ b/arch/x86/include/asm/mmu_context.h
8819 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
8821 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
8824 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8828 + pax_open_kernel();
8829 + pgd = get_cpu_pgd(smp_processor_id());
8830 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
8831 + set_pgd_batched(pgd+i, native_make_pgd(0));
8832 + pax_close_kernel();
8836 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
8837 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
8838 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8839 struct task_struct *tsk)
8841 unsigned cpu = smp_processor_id();
8842 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8843 + int tlbstate = TLBSTATE_OK;
8846 if (likely(prev != next)) {
8848 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8849 + tlbstate = percpu_read(cpu_tlbstate.state);
8851 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8852 percpu_write(cpu_tlbstate.active_mm, next);
8854 cpumask_set_cpu(cpu, mm_cpumask(next));
8856 /* Re-load page tables */
8857 +#ifdef CONFIG_PAX_PER_CPU_PGD
8858 + pax_open_kernel();
8859 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8860 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8861 + pax_close_kernel();
8862 + load_cr3(get_cpu_pgd(cpu));
8864 load_cr3(next->pgd);
8867 /* stop flush ipis for the previous mm */
8868 cpumask_clear_cpu(cpu, mm_cpumask(prev));
8869 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8871 if (unlikely(prev->context.ldt != next->context.ldt))
8872 load_LDT_nolock(&next->context);
8875 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
8876 + if (!(__supported_pte_mask & _PAGE_NX)) {
8877 + smp_mb__before_clear_bit();
8878 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
8879 + smp_mb__after_clear_bit();
8880 + cpu_set(cpu, next->context.cpu_user_cs_mask);
8884 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8885 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
8886 + prev->context.user_cs_limit != next->context.user_cs_limit))
8887 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8889 + else if (unlikely(tlbstate != TLBSTATE_OK))
8890 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8897 +#ifdef CONFIG_PAX_PER_CPU_PGD
8898 + pax_open_kernel();
8899 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
8900 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
8901 + pax_close_kernel();
8902 + load_cr3(get_cpu_pgd(cpu));
8906 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
8907 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
8909 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
8910 * tlb flush IPI delivery. We must reload CR3
8911 * to make sure to use no freed page tables.
8914 +#ifndef CONFIG_PAX_PER_CPU_PGD
8915 load_cr3(next->pgd);
8918 load_LDT_nolock(&next->context);
8920 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
8921 + if (!(__supported_pte_mask & _PAGE_NX))
8922 + cpu_set(cpu, next->context.cpu_user_cs_mask);
8925 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
8926 +#ifdef CONFIG_PAX_PAGEEXEC
8927 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
8929 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
8938 #define activate_mm(prev, next) \
8939 diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
8940 index 9eae775..c914fea 100644
8941 --- a/arch/x86/include/asm/module.h
8942 +++ b/arch/x86/include/asm/module.h
8945 #ifdef CONFIG_X86_64
8946 /* X86_64 does not define MODULE_PROC_FAMILY */
8947 +#define MODULE_PROC_FAMILY ""
8948 #elif defined CONFIG_M386
8949 #define MODULE_PROC_FAMILY "386 "
8950 #elif defined CONFIG_M486
8952 #error unknown processor family
8955 -#ifdef CONFIG_X86_32
8956 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
8957 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
8958 +#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
8959 +#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
8960 +#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
8962 +#define MODULE_PAX_KERNEXEC ""
8965 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8966 +#define MODULE_PAX_UDEREF "UDEREF "
8968 +#define MODULE_PAX_UDEREF ""
8971 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
8973 #endif /* _ASM_X86_MODULE_H */
8974 diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
8975 index 7639dbf..e08a58c 100644
8976 --- a/arch/x86/include/asm/page_64_types.h
8977 +++ b/arch/x86/include/asm/page_64_types.h
8978 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
8980 /* duplicated to the one in bootmem.h */
8981 extern unsigned long max_pfn;
8982 -extern unsigned long phys_base;
8983 +extern const unsigned long phys_base;
8985 extern unsigned long __phys_addr(unsigned long);
8986 #define __phys_reloc_hide(x) (x)
8987 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
8988 index a7d2db9..edb023e 100644
8989 --- a/arch/x86/include/asm/paravirt.h
8990 +++ b/arch/x86/include/asm/paravirt.h
8991 @@ -667,6 +667,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
8995 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
8997 + pgdval_t val = native_pgd_val(pgd);
8999 + if (sizeof(pgdval_t) > sizeof(long))
9000 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9001 + val, (u64)val >> 32);
9003 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9007 static inline void pgd_clear(pgd_t *pgdp)
9009 set_pgd(pgdp, __pgd(0));
9010 @@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
9011 pv_mmu_ops.set_fixmap(idx, phys, flags);
9014 +#ifdef CONFIG_PAX_KERNEXEC
9015 +static inline unsigned long pax_open_kernel(void)
9017 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9020 +static inline unsigned long pax_close_kernel(void)
9022 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9025 +static inline unsigned long pax_open_kernel(void) { return 0; }
9026 +static inline unsigned long pax_close_kernel(void) { return 0; }
9029 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9031 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
9032 @@ -964,7 +991,7 @@ extern void default_banner(void);
9034 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9035 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9036 -#define PARA_INDIRECT(addr) *%cs:addr
9037 +#define PARA_INDIRECT(addr) *%ss:addr
9040 #define INTERRUPT_RETURN \
9041 @@ -1041,6 +1068,21 @@ extern void default_banner(void);
9042 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9044 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9046 +#define GET_CR0_INTO_RDI \
9047 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9050 +#define SET_RDI_INTO_CR0 \
9051 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9053 +#define GET_CR3_INTO_RDI \
9054 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9057 +#define SET_RDI_INTO_CR3 \
9058 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9060 #endif /* CONFIG_X86_32 */
9062 #endif /* __ASSEMBLY__ */
9063 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
9064 index 8e8b9a4..f07d725 100644
9065 --- a/arch/x86/include/asm/paravirt_types.h
9066 +++ b/arch/x86/include/asm/paravirt_types.h
9067 @@ -84,20 +84,20 @@ struct pv_init_ops {
9069 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9070 unsigned long addr, unsigned len);
9075 struct pv_lazy_ops {
9076 /* Set deferred update mode, used for batching operations. */
9077 void (*enter)(void);
9078 void (*leave)(void);
9082 struct pv_time_ops {
9083 unsigned long long (*sched_clock)(void);
9084 unsigned long long (*steal_clock)(int cpu);
9085 unsigned long (*get_tsc_khz)(void);
9090 /* hooks for various privileged instructions */
9091 @@ -193,7 +193,7 @@ struct pv_cpu_ops {
9093 void (*start_context_switch)(struct task_struct *prev);
9094 void (*end_context_switch)(struct task_struct *next);
9100 @@ -224,7 +224,7 @@ struct pv_apic_ops {
9101 unsigned long start_eip,
9102 unsigned long start_esp);
9108 unsigned long (*read_cr2)(void);
9109 @@ -313,6 +313,7 @@ struct pv_mmu_ops {
9110 struct paravirt_callee_save make_pud;
9112 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9113 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9114 #endif /* PAGETABLE_LEVELS == 4 */
9115 #endif /* PAGETABLE_LEVELS >= 3 */
9117 @@ -324,6 +325,12 @@ struct pv_mmu_ops {
9118 an mfn. We can tell which is which from the index. */
9119 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9120 phys_addr_t phys, pgprot_t flags);
9122 +#ifdef CONFIG_PAX_KERNEXEC
9123 + unsigned long (*pax_open_kernel)(void);
9124 + unsigned long (*pax_close_kernel)(void);
9129 struct arch_spinlock;
9130 @@ -334,7 +341,7 @@ struct pv_lock_ops {
9131 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
9132 int (*spin_trylock)(struct arch_spinlock *lock);
9133 void (*spin_unlock)(struct arch_spinlock *lock);
9137 /* This contains all the paravirt structures: we get a convenient
9138 * number for each function using the offset which we use to indicate
9139 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
9140 index b4389a4..b7ff22c 100644
9141 --- a/arch/x86/include/asm/pgalloc.h
9142 +++ b/arch/x86/include/asm/pgalloc.h
9143 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
9144 pmd_t *pmd, pte_t *pte)
9146 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9147 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9150 +static inline void pmd_populate_user(struct mm_struct *mm,
9151 + pmd_t *pmd, pte_t *pte)
9153 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9154 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9157 diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
9158 index 98391db..8f6984e 100644
9159 --- a/arch/x86/include/asm/pgtable-2level.h
9160 +++ b/arch/x86/include/asm/pgtable-2level.h
9161 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
9163 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9165 + pax_open_kernel();
9167 + pax_close_kernel();
9170 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9171 diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
9172 index effff47..f9e4035 100644
9173 --- a/arch/x86/include/asm/pgtable-3level.h
9174 +++ b/arch/x86/include/asm/pgtable-3level.h
9175 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9177 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9179 + pax_open_kernel();
9180 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9181 + pax_close_kernel();
9184 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9186 + pax_open_kernel();
9187 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9188 + pax_close_kernel();
9192 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
9193 index 18601c8..3d716d1 100644
9194 --- a/arch/x86/include/asm/pgtable.h
9195 +++ b/arch/x86/include/asm/pgtable.h
9196 @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9198 #ifndef __PAGETABLE_PUD_FOLDED
9199 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9200 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9201 #define pgd_clear(pgd) native_pgd_clear(pgd)
9204 @@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
9206 #define arch_end_context_switch(prev) do {} while(0)
9208 +#define pax_open_kernel() native_pax_open_kernel()
9209 +#define pax_close_kernel() native_pax_close_kernel()
9210 #endif /* CONFIG_PARAVIRT */
9212 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
9213 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9215 +#ifdef CONFIG_PAX_KERNEXEC
9216 +static inline unsigned long native_pax_open_kernel(void)
9218 + unsigned long cr0;
9220 + preempt_disable();
9222 + cr0 = read_cr0() ^ X86_CR0_WP;
9223 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
9225 + return cr0 ^ X86_CR0_WP;
9228 +static inline unsigned long native_pax_close_kernel(void)
9230 + unsigned long cr0;
9232 + cr0 = read_cr0() ^ X86_CR0_WP;
9233 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9236 + preempt_enable_no_resched();
9237 + return cr0 ^ X86_CR0_WP;
9240 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
9241 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
9245 * The following only work if pte_present() is true.
9246 * Undefined behaviour if not..
9248 +static inline int pte_user(pte_t pte)
9250 + return pte_val(pte) & _PAGE_USER;
9253 static inline int pte_dirty(pte_t pte)
9255 return pte_flags(pte) & _PAGE_DIRTY;
9256 @@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
9257 return pte_clear_flags(pte, _PAGE_RW);
9260 +static inline pte_t pte_mkread(pte_t pte)
9262 + return __pte(pte_val(pte) | _PAGE_USER);
9265 static inline pte_t pte_mkexec(pte_t pte)
9267 - return pte_clear_flags(pte, _PAGE_NX);
9268 +#ifdef CONFIG_X86_PAE
9269 + if (__supported_pte_mask & _PAGE_NX)
9270 + return pte_clear_flags(pte, _PAGE_NX);
9273 + return pte_set_flags(pte, _PAGE_USER);
9276 +static inline pte_t pte_exprotect(pte_t pte)
9278 +#ifdef CONFIG_X86_PAE
9279 + if (__supported_pte_mask & _PAGE_NX)
9280 + return pte_set_flags(pte, _PAGE_NX);
9283 + return pte_clear_flags(pte, _PAGE_USER);
9286 static inline pte_t pte_mkdirty(pte_t pte)
9287 @@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
9290 #ifndef __ASSEMBLY__
9292 +#ifdef CONFIG_PAX_PER_CPU_PGD
9293 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
9294 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
9296 + return cpu_pgd[cpu];
9300 #include <linux/mm_types.h>
9302 static inline int pte_none(pte_t pte)
9303 @@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
9305 static inline int pgd_bad(pgd_t pgd)
9307 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
9308 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
9311 static inline int pgd_none(pgd_t pgd)
9312 @@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
9313 * pgd_offset() returns a (pgd_t *)
9314 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
9316 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
9317 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
9319 +#ifdef CONFIG_PAX_PER_CPU_PGD
9320 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
9324 * a shortcut which implies the use of the kernel's pgd, instead
9326 @@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
9327 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
9328 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
9330 +#ifdef CONFIG_X86_32
9331 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
9333 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
9334 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
9336 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9337 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
9339 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
9344 #ifndef __ASSEMBLY__
9346 extern int direct_gbpages;
9347 @@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
9348 * dst and src can be on the same page, but the range must not overlap,
9349 * and must not cross a page boundary.
9351 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
9352 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
9354 - memcpy(dst, src, count * sizeof(pgd_t));
9355 + pax_open_kernel();
9358 + pax_close_kernel();
9361 +#ifdef CONFIG_PAX_PER_CPU_PGD
9362 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9365 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9366 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9368 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
9371 #include <asm-generic/pgtable.h>
9372 #endif /* __ASSEMBLY__ */
9373 diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
9374 index 0c92113..34a77c6 100644
9375 --- a/arch/x86/include/asm/pgtable_32.h
9376 +++ b/arch/x86/include/asm/pgtable_32.h
9379 struct vm_area_struct;
9381 -extern pgd_t swapper_pg_dir[1024];
9382 -extern pgd_t initial_page_table[1024];
9384 static inline void pgtable_cache_init(void) { }
9385 static inline void check_pgt_cache(void) { }
9386 void paging_init(void);
9387 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9388 # include <asm/pgtable-2level.h>
9391 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9392 +extern pgd_t initial_page_table[PTRS_PER_PGD];
9393 +#ifdef CONFIG_X86_PAE
9394 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9397 #if defined(CONFIG_HIGHPTE)
9398 #define pte_offset_map(dir, address) \
9399 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
9400 @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
9401 /* Clear a kernel PTE and flush it from the TLB */
9402 #define kpte_clear_flush(ptep, vaddr) \
9404 + pax_open_kernel(); \
9405 pte_clear(&init_mm, (vaddr), (ptep)); \
9406 + pax_close_kernel(); \
9407 __flush_tlb_one((vaddr)); \
9410 @@ -74,6 +79,9 @@ do { \
9412 #endif /* !__ASSEMBLY__ */
9414 +#define HAVE_ARCH_UNMAPPED_AREA
9415 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9418 * kern_addr_valid() is (1) for FLATMEM and (0) for
9419 * SPARSEMEM and DISCONTIGMEM
9420 diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
9421 index ed5903b..c7fe163 100644
9422 --- a/arch/x86/include/asm/pgtable_32_types.h
9423 +++ b/arch/x86/include/asm/pgtable_32_types.h
9426 #ifdef CONFIG_X86_PAE
9427 # include <asm/pgtable-3level_types.h>
9428 -# define PMD_SIZE (1UL << PMD_SHIFT)
9429 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9430 # define PMD_MASK (~(PMD_SIZE - 1))
9432 # include <asm/pgtable-2level_types.h>
9433 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
9434 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9437 +#ifdef CONFIG_PAX_KERNEXEC
9438 +#ifndef __ASSEMBLY__
9439 +extern unsigned char MODULES_EXEC_VADDR[];
9440 +extern unsigned char MODULES_EXEC_END[];
9442 +#include <asm/boot.h>
9443 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9444 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9446 +#define ktla_ktva(addr) (addr)
9447 +#define ktva_ktla(addr) (addr)
9450 #define MODULES_VADDR VMALLOC_START
9451 #define MODULES_END VMALLOC_END
9452 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9453 diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
9454 index 975f709..107976d 100644
9455 --- a/arch/x86/include/asm/pgtable_64.h
9456 +++ b/arch/x86/include/asm/pgtable_64.h
9459 extern pud_t level3_kernel_pgt[512];
9460 extern pud_t level3_ident_pgt[512];
9461 +extern pud_t level3_vmalloc_start_pgt[512];
9462 +extern pud_t level3_vmalloc_end_pgt[512];
9463 +extern pud_t level3_vmemmap_pgt[512];
9464 +extern pud_t level2_vmemmap_pgt[512];
9465 extern pmd_t level2_kernel_pgt[512];
9466 extern pmd_t level2_fixmap_pgt[512];
9467 -extern pmd_t level2_ident_pgt[512];
9468 -extern pgd_t init_level4_pgt[];
9469 +extern pmd_t level2_ident_pgt[512*2];
9470 +extern pgd_t init_level4_pgt[512];
9472 #define swapper_pg_dir init_level4_pgt
9474 @@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9476 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9478 + pax_open_kernel();
9480 + pax_close_kernel();
9483 static inline void native_pmd_clear(pmd_t *pmd)
9484 @@ -107,6 +113,13 @@ static inline void native_pud_clear(pud_t *pud)
9486 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9488 + pax_open_kernel();
9490 + pax_close_kernel();
9493 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9498 diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
9499 index 766ea16..5b96cb3 100644
9500 --- a/arch/x86/include/asm/pgtable_64_types.h
9501 +++ b/arch/x86/include/asm/pgtable_64_types.h
9502 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9503 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9504 #define MODULES_END _AC(0xffffffffff000000, UL)
9505 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9506 +#define MODULES_EXEC_VADDR MODULES_VADDR
9507 +#define MODULES_EXEC_END MODULES_END
9509 +#define ktla_ktva(addr) (addr)
9510 +#define ktva_ktla(addr) (addr)
9512 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9513 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
9514 index 013286a..8b42f4f 100644
9515 --- a/arch/x86/include/asm/pgtable_types.h
9516 +++ b/arch/x86/include/asm/pgtable_types.h
9518 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
9519 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
9520 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
9521 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
9522 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
9523 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
9524 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
9525 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
9526 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
9527 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
9528 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
9529 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
9530 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
9531 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
9533 /* If _PAGE_BIT_PRESENT is clear, we use these: */
9535 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
9536 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
9537 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
9538 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
9539 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
9540 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
9541 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
9544 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
9545 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
9547 +#elif defined(CONFIG_KMEMCHECK)
9548 #define _PAGE_NX (_AT(pteval_t, 0))
9550 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
9553 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
9555 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
9558 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
9559 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
9561 #define __PAGE_KERNEL_EXEC \
9562 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
9563 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
9565 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
9566 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
9567 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
9568 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
9569 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
9570 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
9571 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
9572 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
9574 * bits are combined, this will alow user to access the high address mapped
9575 * VDSO in the presence of CONFIG_COMPAT_VDSO
9577 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
9578 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
9579 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9580 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9581 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
9584 @@ -207,7 +210,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
9586 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
9590 +#if PAGETABLE_LEVELS == 3
9591 +#include <asm-generic/pgtable-nopud.h>
9594 +#if PAGETABLE_LEVELS == 2
9595 +#include <asm-generic/pgtable-nopmd.h>
9598 +#ifndef __ASSEMBLY__
9599 #if PAGETABLE_LEVELS > 3
9600 typedef struct { pudval_t pud; } pud_t;
9602 @@ -221,8 +234,6 @@ static inline pudval_t native_pud_val(pud_t pud)
9606 -#include <asm-generic/pgtable-nopud.h>
9608 static inline pudval_t native_pud_val(pud_t pud)
9610 return native_pgd_val(pud.pgd);
9611 @@ -242,8 +253,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
9615 -#include <asm-generic/pgtable-nopmd.h>
9617 static inline pmdval_t native_pmd_val(pmd_t pmd)
9619 return native_pgd_val(pmd.pud.pgd);
9620 @@ -283,7 +292,6 @@ typedef struct page *pgtable_t;
9622 extern pteval_t __supported_pte_mask;
9623 extern void set_nx(void);
9624 -extern int nx_enabled;
9626 #define pgprot_writecombine pgprot_writecombine
9627 extern pgprot_t pgprot_writecombine(pgprot_t prot);
9628 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
9629 index 0d1171c..36571a9 100644
9630 --- a/arch/x86/include/asm/processor.h
9631 +++ b/arch/x86/include/asm/processor.h
9632 @@ -266,7 +266,7 @@ struct tss_struct {
9634 } ____cacheline_aligned;
9636 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
9637 +extern struct tss_struct init_tss[NR_CPUS];
9640 * Save the original ist values for checking stack pointers during debugging
9641 @@ -858,11 +858,18 @@ static inline void spin_lock_prefetch(const void *x)
9643 #define TASK_SIZE PAGE_OFFSET
9644 #define TASK_SIZE_MAX TASK_SIZE
9646 +#ifdef CONFIG_PAX_SEGMEXEC
9647 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
9648 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
9650 #define STACK_TOP TASK_SIZE
9651 -#define STACK_TOP_MAX STACK_TOP
9654 +#define STACK_TOP_MAX TASK_SIZE
9656 #define INIT_THREAD { \
9657 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
9658 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9659 .vm86_info = NULL, \
9660 .sysenter_cs = __KERNEL_CS, \
9661 .io_bitmap_ptr = NULL, \
9662 @@ -876,7 +883,7 @@ static inline void spin_lock_prefetch(const void *x)
9664 #define INIT_TSS { \
9666 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
9667 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
9668 .ss0 = __KERNEL_DS, \
9669 .ss1 = __KERNEL_CS, \
9670 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
9671 @@ -887,11 +894,7 @@ static inline void spin_lock_prefetch(const void *x)
9672 extern unsigned long thread_saved_pc(struct task_struct *tsk);
9674 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
9675 -#define KSTK_TOP(info) \
9677 - unsigned long *__ptr = (unsigned long *)(info); \
9678 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
9680 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
9683 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
9684 @@ -906,7 +909,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9685 #define task_pt_regs(task) \
9687 struct pt_regs *__regs__; \
9688 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
9689 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
9693 @@ -916,13 +919,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9695 * User space process size. 47bits minus one guard page.
9697 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
9698 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
9700 /* This decides where the kernel will search for a free chunk of vm
9701 * space during mmap's.
9703 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
9704 - 0xc0000000 : 0xFFFFe000)
9705 + 0xc0000000 : 0xFFFFf000)
9707 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
9708 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
9709 @@ -933,11 +936,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
9710 #define STACK_TOP_MAX TASK_SIZE_MAX
9712 #define INIT_THREAD { \
9713 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9714 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9717 #define INIT_TSS { \
9718 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
9719 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
9723 @@ -959,6 +962,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
9725 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
9727 +#ifdef CONFIG_PAX_SEGMEXEC
9728 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
9731 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
9733 /* Get/set a process' ability to use the timestamp counter instruction */
9734 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
9735 index 3566454..4bdfb8c 100644
9736 --- a/arch/x86/include/asm/ptrace.h
9737 +++ b/arch/x86/include/asm/ptrace.h
9738 @@ -156,28 +156,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
9742 - * user_mode_vm(regs) determines whether a register set came from user mode.
9743 + * user_mode(regs) determines whether a register set came from user mode.
9744 * This is true if V8086 mode was enabled OR if the register set was from
9745 * protected mode with RPL-3 CS value. This tricky test checks that with
9746 * one comparison. Many places in the kernel can bypass this full check
9747 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
9748 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
9751 -static inline int user_mode(struct pt_regs *regs)
9752 +static inline int user_mode_novm(struct pt_regs *regs)
9754 #ifdef CONFIG_X86_32
9755 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
9757 - return !!(regs->cs & 3);
9758 + return !!(regs->cs & SEGMENT_RPL_MASK);
9762 -static inline int user_mode_vm(struct pt_regs *regs)
9763 +static inline int user_mode(struct pt_regs *regs)
9765 #ifdef CONFIG_X86_32
9766 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
9769 - return user_mode(regs);
9770 + return user_mode_novm(regs);
9774 @@ -193,15 +194,16 @@ static inline int v8086_mode(struct pt_regs *regs)
9775 #ifdef CONFIG_X86_64
9776 static inline bool user_64bit_mode(struct pt_regs *regs)
9778 + unsigned long cs = regs->cs & 0xffff;
9779 #ifndef CONFIG_PARAVIRT
9781 * On non-paravirt systems, this is the only long mode CPL 3
9782 * selector. We do not allow long mode selectors in the LDT.
9784 - return regs->cs == __USER_CS;
9785 + return cs == __USER_CS;
9787 /* Headers are too twisted for this to go in paravirt.h. */
9788 - return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
9789 + return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
9793 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
9794 index 3250e3d..20db631 100644
9795 --- a/arch/x86/include/asm/reboot.h
9796 +++ b/arch/x86/include/asm/reboot.h
9800 struct machine_ops {
9801 - void (*restart)(char *cmd);
9802 - void (*halt)(void);
9803 - void (*power_off)(void);
9804 + void (* __noreturn restart)(char *cmd);
9805 + void (* __noreturn halt)(void);
9806 + void (* __noreturn power_off)(void);
9807 void (*shutdown)(void);
9808 void (*crash_shutdown)(struct pt_regs *);
9809 - void (*emergency_restart)(void);
9811 + void (* __noreturn emergency_restart)(void);
9814 extern struct machine_ops machine_ops;
9816 void native_machine_crash_shutdown(struct pt_regs *regs);
9817 void native_machine_shutdown(void);
9818 -void machine_real_restart(unsigned int type);
9819 +void machine_real_restart(unsigned int type) __noreturn;
9820 /* These must match dispatch_table in reboot_32.S */
9823 diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
9824 index df4cd32..27ae072 100644
9825 --- a/arch/x86/include/asm/rwsem.h
9826 +++ b/arch/x86/include/asm/rwsem.h
9827 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
9829 asm volatile("# beginning down_read\n\t"
9830 LOCK_PREFIX _ASM_INC "(%1)\n\t"
9832 +#ifdef CONFIG_PAX_REFCOUNT
9834 + LOCK_PREFIX _ASM_DEC "(%1)\n"
9836 + _ASM_EXTABLE(0b, 0b)
9839 /* adds 0x00000001 */
9841 " call call_rwsem_down_read_failed\n"
9842 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
9847 +#ifdef CONFIG_PAX_REFCOUNT
9851 + _ASM_EXTABLE(0b, 0b)
9855 LOCK_PREFIX " cmpxchg %2,%0\n\t"
9857 @@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
9859 asm volatile("# beginning down_write\n\t"
9860 LOCK_PREFIX " xadd %1,(%2)\n\t"
9862 +#ifdef CONFIG_PAX_REFCOUNT
9866 + _ASM_EXTABLE(0b, 0b)
9869 /* adds 0xffff0001, returns the old value */
9871 /* was the count 0 before? */
9872 @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_semaphore *sem)
9874 asm volatile("# beginning __up_read\n\t"
9875 LOCK_PREFIX " xadd %1,(%2)\n\t"
9877 +#ifdef CONFIG_PAX_REFCOUNT
9881 + _ASM_EXTABLE(0b, 0b)
9884 /* subtracts 1, returns the old value */
9886 " call call_rwsem_wake\n" /* expects old value in %edx */
9887 @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_semaphore *sem)
9889 asm volatile("# beginning __up_write\n\t"
9890 LOCK_PREFIX " xadd %1,(%2)\n\t"
9892 +#ifdef CONFIG_PAX_REFCOUNT
9896 + _ASM_EXTABLE(0b, 0b)
9899 /* subtracts 0xffff0001, returns the old value */
9901 " call call_rwsem_wake\n" /* expects old value in %edx */
9902 @@ -176,6 +216,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9904 asm volatile("# beginning __downgrade_write\n\t"
9905 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
9907 +#ifdef CONFIG_PAX_REFCOUNT
9909 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
9911 + _ASM_EXTABLE(0b, 0b)
9915 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
9916 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
9917 @@ -194,7 +242,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
9919 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
9921 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
9922 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
9924 +#ifdef CONFIG_PAX_REFCOUNT
9926 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
9928 + _ASM_EXTABLE(0b, 0b)
9934 @@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
9938 - asm volatile(LOCK_PREFIX "xadd %0,%1"
9939 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
9941 +#ifdef CONFIG_PAX_REFCOUNT
9945 + _ASM_EXTABLE(0b, 0b)
9948 : "+r" (tmp), "+m" (sem->count)
9951 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
9952 index 5e64171..f58957e 100644
9953 --- a/arch/x86/include/asm/segment.h
9954 +++ b/arch/x86/include/asm/segment.h
9956 * 26 - ESPFIX small SS
9957 * 27 - per-cpu [ offset to per-cpu data area ]
9958 * 28 - stack_canary-20 [ for stack protector ]
9961 + * 29 - PCI BIOS CS
9962 + * 30 - PCI BIOS DS
9963 * 31 - TSS for double fault handler
9965 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
9966 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
9967 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
9968 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
9970 #define GDT_ENTRY_TLS_MIN 6
9971 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
9975 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
9977 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
9979 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
9981 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
9982 @@ -104,6 +111,12 @@
9983 #define __KERNEL_STACK_CANARY 0
9986 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
9987 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
9989 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
9990 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
9992 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
9998 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
9999 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10000 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10004 @@ -165,6 +178,8 @@
10005 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
10006 #define __USER32_DS __USER_DS
10008 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10010 #define GDT_ENTRY_TSS 8 /* needs two entries */
10011 #define GDT_ENTRY_LDT 10 /* needs two entries */
10012 #define GDT_ENTRY_TLS_MIN 12
10013 @@ -185,6 +200,7 @@
10016 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
10017 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
10018 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
10019 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
10020 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
10021 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
10022 index 73b11bc..d4a3b63 100644
10023 --- a/arch/x86/include/asm/smp.h
10024 +++ b/arch/x86/include/asm/smp.h
10025 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10026 /* cpus sharing the last level cache: */
10027 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
10028 DECLARE_PER_CPU(u16, cpu_llc_id);
10029 -DECLARE_PER_CPU(int, cpu_number);
10030 +DECLARE_PER_CPU(unsigned int, cpu_number);
10032 static inline struct cpumask *cpu_sibling_mask(int cpu)
10034 @@ -77,7 +77,7 @@ struct smp_ops {
10036 void (*send_call_func_ipi)(const struct cpumask *mask);
10037 void (*send_call_func_single_ipi)(int cpu);
10041 /* Globals due to paravirt */
10042 extern void set_cpu_sibling_map(int cpu);
10043 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata;
10044 extern int safe_smp_processor_id(void);
10046 #elif defined(CONFIG_X86_64_SMP)
10047 -#define raw_smp_processor_id() (percpu_read(cpu_number))
10049 -#define stack_smp_processor_id() \
10051 - struct thread_info *ti; \
10052 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10055 +#define raw_smp_processor_id() (percpu_read(cpu_number))
10056 +#define stack_smp_processor_id() raw_smp_processor_id()
10057 #define safe_smp_processor_id() smp_processor_id()
10060 diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
10061 index ee67edf..49c796b 100644
10062 --- a/arch/x86/include/asm/spinlock.h
10063 +++ b/arch/x86/include/asm/spinlock.h
10064 @@ -248,6 +248,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
10065 static inline void arch_read_lock(arch_rwlock_t *rw)
10067 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
10069 +#ifdef CONFIG_PAX_REFCOUNT
10071 + LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
10073 + _ASM_EXTABLE(0b, 0b)
10077 "call __read_lock_failed\n\t"
10079 @@ -257,6 +265,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
10080 static inline void arch_write_lock(arch_rwlock_t *rw)
10082 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
10084 +#ifdef CONFIG_PAX_REFCOUNT
10086 + LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
10088 + _ASM_EXTABLE(0b, 0b)
10092 "call __write_lock_failed\n\t"
10094 @@ -286,13 +302,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
10096 static inline void arch_read_unlock(arch_rwlock_t *rw)
10098 - asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
10099 + asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
10101 +#ifdef CONFIG_PAX_REFCOUNT
10103 + LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
10105 + _ASM_EXTABLE(0b, 0b)
10108 :"+m" (rw->lock) : : "memory");
10111 static inline void arch_write_unlock(arch_rwlock_t *rw)
10113 - asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
10114 + asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
10116 +#ifdef CONFIG_PAX_REFCOUNT
10118 + LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
10120 + _ASM_EXTABLE(0b, 0b)
10123 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
10126 diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
10127 index 1575177..cb23f52 100644
10128 --- a/arch/x86/include/asm/stackprotector.h
10129 +++ b/arch/x86/include/asm/stackprotector.h
10131 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10133 #define GDT_STACK_CANARY_INIT \
10134 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10135 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10138 * Initialize the stackprotector canary value.
10139 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
10141 static inline void load_stack_canary_segment(void)
10143 -#ifdef CONFIG_X86_32
10144 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10145 asm volatile ("mov %0, %%gs" : : "r" (0));
10148 diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
10149 index 70bbe39..4ae2bd4 100644
10150 --- a/arch/x86/include/asm/stacktrace.h
10151 +++ b/arch/x86/include/asm/stacktrace.h
10152 @@ -11,28 +11,20 @@
10154 extern int kstack_depth_to_print;
10156 -struct thread_info;
10157 +struct task_struct;
10158 struct stacktrace_ops;
10160 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
10161 - unsigned long *stack,
10162 - unsigned long bp,
10163 - const struct stacktrace_ops *ops,
10165 - unsigned long *end,
10167 +typedef unsigned long walk_stack_t(struct task_struct *task,
10168 + void *stack_start,
10169 + unsigned long *stack,
10170 + unsigned long bp,
10171 + const struct stacktrace_ops *ops,
10173 + unsigned long *end,
10176 -extern unsigned long
10177 -print_context_stack(struct thread_info *tinfo,
10178 - unsigned long *stack, unsigned long bp,
10179 - const struct stacktrace_ops *ops, void *data,
10180 - unsigned long *end, int *graph);
10182 -extern unsigned long
10183 -print_context_stack_bp(struct thread_info *tinfo,
10184 - unsigned long *stack, unsigned long bp,
10185 - const struct stacktrace_ops *ops, void *data,
10186 - unsigned long *end, int *graph);
10187 +extern walk_stack_t print_context_stack;
10188 +extern walk_stack_t print_context_stack_bp;
10190 /* Generic stack tracer with callbacks */
10192 @@ -40,7 +32,7 @@ struct stacktrace_ops {
10193 void (*address)(void *data, unsigned long address, int reliable);
10194 /* On negative return stop dumping */
10195 int (*stack)(void *data, char *name);
10196 - walk_stack_t walk_stack;
10197 + walk_stack_t *walk_stack;
10200 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
10201 diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
10202 index cb23852..2dde194 100644
10203 --- a/arch/x86/include/asm/sys_ia32.h
10204 +++ b/arch/x86/include/asm/sys_ia32.h
10205 @@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int, compat_sigset_t __user *,
10206 compat_sigset_t __user *, unsigned int);
10207 asmlinkage long sys32_alarm(unsigned int);
10209 -asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
10210 +asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
10211 asmlinkage long sys32_sysfs(int, u32, u32);
10213 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
10214 diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
10215 index 2d2f01c..f985723 100644
10216 --- a/arch/x86/include/asm/system.h
10217 +++ b/arch/x86/include/asm/system.h
10218 @@ -129,7 +129,7 @@ do { \
10219 "call __switch_to\n\t" \
10220 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10222 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
10223 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10224 "movq %%rax,%%rdi\n\t" \
10225 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10226 "jnz ret_from_fork\n\t" \
10227 @@ -140,7 +140,7 @@ do { \
10228 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10229 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10230 [_tif_fork] "i" (_TIF_FORK), \
10231 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
10232 + [thread_info] "m" (current_tinfo), \
10233 [current_task] "m" (current_task) \
10234 __switch_canary_iparam \
10235 : "memory", "cc" __EXTRA_CLOBBER)
10236 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
10238 unsigned long __limit;
10239 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10240 - return __limit + 1;
10244 static inline void native_clts(void)
10245 @@ -397,13 +397,13 @@ void enable_hlt(void);
10247 void cpu_idle_wait(void);
10249 -extern unsigned long arch_align_stack(unsigned long sp);
10250 +#define arch_align_stack(x) ((x) & ~0xfUL)
10251 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10253 void default_idle(void);
10254 bool set_pm_idle_to_default(void);
10256 -void stop_this_cpu(void *dummy);
10257 +void stop_this_cpu(void *dummy) __noreturn;
10260 * Force strict CPU ordering.
10261 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
10262 index a1fe5c1..ee326d8 100644
10263 --- a/arch/x86/include/asm/thread_info.h
10264 +++ b/arch/x86/include/asm/thread_info.h
10266 #include <linux/compiler.h>
10267 #include <asm/page.h>
10268 #include <asm/types.h>
10269 +#include <asm/percpu.h>
10272 * low level task data that entry.S needs immediate access to
10273 @@ -24,7 +25,6 @@ struct exec_domain;
10274 #include <linux/atomic.h>
10276 struct thread_info {
10277 - struct task_struct *task; /* main task structure */
10278 struct exec_domain *exec_domain; /* execution domain */
10279 __u32 flags; /* low level flags */
10280 __u32 status; /* thread synchronous flags */
10281 @@ -34,18 +34,12 @@ struct thread_info {
10282 mm_segment_t addr_limit;
10283 struct restart_block restart_block;
10284 void __user *sysenter_return;
10285 -#ifdef CONFIG_X86_32
10286 - unsigned long previous_esp; /* ESP of the previous stack in
10287 - case of nested (IRQ) stacks
10289 - __u8 supervisor_stack[0];
10291 + unsigned long lowest_stack;
10295 -#define INIT_THREAD_INFO(tsk) \
10296 +#define INIT_THREAD_INFO \
10299 .exec_domain = &default_exec_domain, \
10302 @@ -56,7 +50,7 @@ struct thread_info {
10306 -#define init_thread_info (init_thread_union.thread_info)
10307 +#define init_thread_info (init_thread_union.stack)
10308 #define init_stack (init_thread_union.stack)
10310 #else /* !__ASSEMBLY__ */
10311 @@ -170,45 +164,40 @@ struct thread_info {
10315 -#ifdef CONFIG_X86_32
10317 -#define STACK_WARN (THREAD_SIZE/8)
10319 - * macros/functions for gaining access to the thread information structure
10321 - * preempt_count needs to be 1 initially, until the scheduler is functional.
10323 -#ifndef __ASSEMBLY__
10326 -/* how to get the current stack pointer from C */
10327 -register unsigned long current_stack_pointer asm("esp") __used;
10329 -/* how to get the thread information struct from C */
10330 -static inline struct thread_info *current_thread_info(void)
10332 - return (struct thread_info *)
10333 - (current_stack_pointer & ~(THREAD_SIZE - 1));
10336 -#else /* !__ASSEMBLY__ */
10338 +#ifdef __ASSEMBLY__
10339 /* how to get the thread information struct from ASM */
10340 #define GET_THREAD_INFO(reg) \
10341 - movl $-THREAD_SIZE, reg; \
10343 + mov PER_CPU_VAR(current_tinfo), reg
10345 /* use this one if reg already contains %esp */
10346 -#define GET_THREAD_INFO_WITH_ESP(reg) \
10347 - andl $-THREAD_SIZE, reg
10348 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10350 +/* how to get the thread information struct from C */
10351 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10353 +static __always_inline struct thread_info *current_thread_info(void)
10355 + return percpu_read_stable(current_tinfo);
10359 +#ifdef CONFIG_X86_32
10361 +#define STACK_WARN (THREAD_SIZE/8)
10363 + * macros/functions for gaining access to the thread information structure
10365 + * preempt_count needs to be 1 initially, until the scheduler is functional.
10367 +#ifndef __ASSEMBLY__
10369 +/* how to get the current stack pointer from C */
10370 +register unsigned long current_stack_pointer asm("esp") __used;
10376 -#include <asm/percpu.h>
10377 -#define KERNEL_STACK_OFFSET (5*8)
10380 * macros/functions for gaining access to the thread information structure
10381 * preempt_count needs to be 1 initially, until the scheduler is functional.
10382 @@ -216,21 +205,8 @@ static inline struct thread_info *current_thread_info(void)
10383 #ifndef __ASSEMBLY__
10384 DECLARE_PER_CPU(unsigned long, kernel_stack);
10386 -static inline struct thread_info *current_thread_info(void)
10388 - struct thread_info *ti;
10389 - ti = (void *)(percpu_read_stable(kernel_stack) +
10390 - KERNEL_STACK_OFFSET - THREAD_SIZE);
10394 -#else /* !__ASSEMBLY__ */
10396 -/* how to get the thread information struct from ASM */
10397 -#define GET_THREAD_INFO(reg) \
10398 - movq PER_CPU_VAR(kernel_stack),reg ; \
10399 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10401 +/* how to get the current stack pointer from C */
10402 +register unsigned long current_stack_pointer asm("rsp") __used;
10405 #endif /* !X86_32 */
10406 @@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
10407 extern void free_thread_info(struct thread_info *ti);
10408 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10409 #define arch_task_cache_init arch_task_cache_init
10411 +#define __HAVE_THREAD_FUNCTIONS
10412 +#define task_thread_info(task) (&(task)->tinfo)
10413 +#define task_stack_page(task) ((task)->stack)
10414 +#define setup_thread_stack(p, org) do {} while (0)
10415 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10417 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10418 +extern struct task_struct *alloc_task_struct_node(int node);
10419 +extern void free_task_struct(struct task_struct *);
10422 #endif /* _ASM_X86_THREAD_INFO_H */
10423 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
10424 index 36361bf..324f262 100644
10425 --- a/arch/x86/include/asm/uaccess.h
10426 +++ b/arch/x86/include/asm/uaccess.h
10428 #include <linux/compiler.h>
10429 #include <linux/thread_info.h>
10430 #include <linux/string.h>
10431 +#include <linux/sched.h>
10432 #include <asm/asm.h>
10433 #include <asm/page.h>
10435 #define VERIFY_READ 0
10436 #define VERIFY_WRITE 1
10438 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
10441 * The fs value determines whether argument validity checking should be
10442 * performed or not. If get_fs() == USER_DS, checking is performed, with
10445 #define get_ds() (KERNEL_DS)
10446 #define get_fs() (current_thread_info()->addr_limit)
10447 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10448 +void __set_fs(mm_segment_t x);
10449 +void set_fs(mm_segment_t x);
10451 #define set_fs(x) (current_thread_info()->addr_limit = (x))
10454 #define segment_eq(a, b) ((a).seg == (b).seg)
10457 * checks that the pointer is in the user space range - after calling
10458 * this function, memory access functions may still return -EFAULT.
10460 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10461 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
10462 +#define access_ok(type, addr, size) \
10464 + long __size = size; \
10465 + unsigned long __addr = (unsigned long)addr; \
10466 + unsigned long __addr_ao = __addr & PAGE_MASK; \
10467 + unsigned long __end_ao = __addr + __size - 1; \
10468 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
10469 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
10470 + while(__addr_ao <= __end_ao) { \
10472 + __addr_ao += PAGE_SIZE; \
10473 + if (__size > PAGE_SIZE) \
10474 + cond_resched(); \
10475 + if (__get_user(__c_ao, (char __user *)__addr)) \
10477 + if (type != VERIFY_WRITE) { \
10478 + __addr = __addr_ao; \
10481 + if (__put_user(__c_ao, (char __user *)__addr)) \
10483 + __addr = __addr_ao; \
10490 * The exception table consists of pairs of addresses: the first is the
10491 @@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10492 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10493 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10496 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10497 +#define __copyuser_seg "gs;"
10498 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10499 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10501 +#define __copyuser_seg
10502 +#define __COPYUSER_SET_ES
10503 +#define __COPYUSER_RESTORE_ES
10506 #ifdef CONFIG_X86_32
10507 #define __put_user_asm_u64(x, addr, err, errret) \
10508 - asm volatile("1: movl %%eax,0(%2)\n" \
10509 - "2: movl %%edx,4(%2)\n" \
10510 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10511 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10513 ".section .fixup,\"ax\"\n" \
10514 "4: movl %3,%0\n" \
10515 @@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10516 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10518 #define __put_user_asm_ex_u64(x, addr) \
10519 - asm volatile("1: movl %%eax,0(%1)\n" \
10520 - "2: movl %%edx,4(%1)\n" \
10521 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10522 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10524 _ASM_EXTABLE(1b, 2b - 1b) \
10525 _ASM_EXTABLE(2b, 3b - 2b) \
10526 @@ -252,7 +294,7 @@ extern void __put_user_8(void);
10527 __typeof__(*(ptr)) __pu_val; \
10528 __chk_user_ptr(ptr); \
10531 + __pu_val = (x); \
10532 switch (sizeof(*(ptr))) { \
10534 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10535 @@ -373,7 +415,7 @@ do { \
10538 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10539 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10540 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10542 ".section .fixup,\"ax\"\n" \
10544 @@ -381,7 +423,7 @@ do { \
10547 _ASM_EXTABLE(1b, 3b) \
10548 - : "=r" (err), ltype(x) \
10549 + : "=r" (err), ltype (x) \
10550 : "m" (__m(addr)), "i" (errret), "0" (err))
10552 #define __get_user_size_ex(x, ptr, size) \
10553 @@ -406,7 +448,7 @@ do { \
10556 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10557 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10558 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10560 _ASM_EXTABLE(1b, 2b - 1b) \
10561 : ltype(x) : "m" (__m(addr)))
10562 @@ -423,13 +465,24 @@ do { \
10564 unsigned long __gu_val; \
10565 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10566 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
10567 + (x) = (__typeof__(*(ptr)))__gu_val; \
10571 /* FIXME: this hack is definitely wrong -AK */
10572 struct __large_struct { unsigned long buf[100]; };
10573 -#define __m(x) (*(struct __large_struct __user *)(x))
10574 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10575 +#define ____m(x) \
10577 + unsigned long ____x = (unsigned long)(x); \
10578 + if (____x < PAX_USER_SHADOW_BASE) \
10579 + ____x += PAX_USER_SHADOW_BASE; \
10580 + (void __user *)____x; \
10583 +#define ____m(x) (x)
10585 +#define __m(x) (*(struct __large_struct __user *)____m(x))
10588 * Tell gcc we read from memory instead of writing: this is because
10589 @@ -437,7 +490,7 @@ struct __large_struct { unsigned long buf[100]; };
10592 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10593 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10594 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10596 ".section .fixup,\"ax\"\n" \
10598 @@ -445,10 +498,10 @@ struct __large_struct { unsigned long buf[100]; };
10600 _ASM_EXTABLE(1b, 3b) \
10602 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10603 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10605 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10606 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10607 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10609 _ASM_EXTABLE(1b, 2b - 1b) \
10610 : : ltype(x), "m" (__m(addr)))
10611 @@ -487,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
10612 * On error, the variable @x is set to zero.
10615 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10616 +#define __get_user(x, ptr) get_user((x), (ptr))
10618 #define __get_user(x, ptr) \
10619 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10623 * __put_user: - Write a simple value into user space, with less checking.
10624 @@ -510,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
10625 * Returns zero on success, or -EFAULT on error.
10628 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10629 +#define __put_user(x, ptr) put_user((x), (ptr))
10631 #define __put_user(x, ptr) \
10632 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10635 #define __get_user_unaligned __get_user
10636 #define __put_user_unaligned __put_user
10637 @@ -529,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
10638 #define get_user_ex(x, ptr) do { \
10639 unsigned long __gue_val; \
10640 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10641 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
10642 + (x) = (__typeof__(*(ptr)))__gue_val; \
10645 #ifdef CONFIG_X86_WP_WORKS_OK
10646 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
10647 index 566e803..89f1e60 100644
10648 --- a/arch/x86/include/asm/uaccess_32.h
10649 +++ b/arch/x86/include/asm/uaccess_32.h
10650 @@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
10651 static __always_inline unsigned long __must_check
10652 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10654 + pax_track_stack();
10659 if (__builtin_constant_p(n)) {
10662 @@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10666 + if (!__builtin_constant_p(n))
10667 + check_object_size(from, n, true);
10668 return __copy_to_user_ll(to, from, n);
10671 @@ -82,12 +89,16 @@ static __always_inline unsigned long __must_check
10672 __copy_to_user(void __user *to, const void *from, unsigned long n)
10676 return __copy_to_user_inatomic(to, from, n);
10679 static __always_inline unsigned long
10680 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10685 /* Avoid zeroing the tail if the copy fails..
10686 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10687 * but as the zeroing behaviour is only significant when n is not
10688 @@ -137,6 +148,12 @@ static __always_inline unsigned long
10689 __copy_from_user(void *to, const void __user *from, unsigned long n)
10693 + pax_track_stack();
10698 if (__builtin_constant_p(n)) {
10701 @@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
10705 + if (!__builtin_constant_p(n))
10706 + check_object_size(to, n, false);
10707 return __copy_from_user_ll(to, from, n);
10710 @@ -159,6 +178,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
10711 const void __user *from, unsigned long n)
10718 if (__builtin_constant_p(n)) {
10721 @@ -181,15 +204,19 @@ static __always_inline unsigned long
10722 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
10725 - return __copy_from_user_ll_nocache_nozero(to, from, n);
10729 + return __copy_from_user_ll_nocache_nozero(to, from, n);
10732 -unsigned long __must_check copy_to_user(void __user *to,
10733 - const void *from, unsigned long n);
10734 -unsigned long __must_check _copy_from_user(void *to,
10735 - const void __user *from,
10736 - unsigned long n);
10738 +extern void copy_to_user_overflow(void)
10739 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10740 + __compiletime_error("copy_to_user() buffer size is not provably correct")
10742 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
10746 extern void copy_from_user_overflow(void)
10747 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
10748 @@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void)
10752 -static inline unsigned long __must_check copy_from_user(void *to,
10753 - const void __user *from,
10756 + * copy_to_user: - Copy a block of data into user space.
10757 + * @to: Destination address, in user space.
10758 + * @from: Source address, in kernel space.
10759 + * @n: Number of bytes to copy.
10761 + * Context: User context only. This function may sleep.
10763 + * Copy data from kernel space to user space.
10765 + * Returns number of bytes that could not be copied.
10766 + * On success, this will be zero.
10768 +static inline unsigned long __must_check
10769 +copy_to_user(void __user *to, const void *from, unsigned long n)
10771 + int sz = __compiletime_object_size(from);
10773 + if (unlikely(sz != -1 && sz < n))
10774 + copy_to_user_overflow();
10775 + else if (access_ok(VERIFY_WRITE, to, n))
10776 + n = __copy_to_user(to, from, n);
10781 + * copy_from_user: - Copy a block of data from user space.
10782 + * @to: Destination address, in kernel space.
10783 + * @from: Source address, in user space.
10784 + * @n: Number of bytes to copy.
10786 + * Context: User context only. This function may sleep.
10788 + * Copy data from user space to kernel space.
10790 + * Returns number of bytes that could not be copied.
10791 + * On success, this will be zero.
10793 + * If some data could not be copied, this function will pad the copied
10794 + * data to the requested size using zero bytes.
10796 +static inline unsigned long __must_check
10797 +copy_from_user(void *to, const void __user *from, unsigned long n)
10799 int sz = __compiletime_object_size(to);
10801 - if (likely(sz == -1 || sz >= n))
10802 - n = _copy_from_user(to, from, n);
10804 + if (unlikely(sz != -1 && sz < n))
10805 copy_from_user_overflow();
10807 + else if (access_ok(VERIFY_READ, from, n))
10808 + n = __copy_from_user(to, from, n);
10809 + else if ((long)n > 0) {
10810 + if (!__builtin_constant_p(n))
10811 + check_object_size(to, n, false);
10812 + memset(to, 0, n);
10817 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
10818 index 1c66d30..59bd7d4 100644
10819 --- a/arch/x86/include/asm/uaccess_64.h
10820 +++ b/arch/x86/include/asm/uaccess_64.h
10822 #include <asm/alternative.h>
10823 #include <asm/cpufeature.h>
10824 #include <asm/page.h>
10825 +#include <asm/pgtable.h>
10827 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
10830 * Copy To/From Userspace
10831 @@ -17,12 +20,12 @@
10833 /* Handles exceptions in both to and from, but doesn't do access_ok */
10834 __must_check unsigned long
10835 -copy_user_generic_string(void *to, const void *from, unsigned len);
10836 +copy_user_generic_string(void *to, const void *from, unsigned long len);
10837 __must_check unsigned long
10838 -copy_user_generic_unrolled(void *to, const void *from, unsigned len);
10839 +copy_user_generic_unrolled(void *to, const void *from, unsigned long len);
10841 static __always_inline __must_check unsigned long
10842 -copy_user_generic(void *to, const void *from, unsigned len)
10843 +copy_user_generic(void *to, const void *from, unsigned long len)
10847 @@ -36,138 +39,226 @@ copy_user_generic(void *to, const void *from, unsigned len)
10851 +static __always_inline __must_check unsigned long
10852 +__copy_to_user(void __user *to, const void *from, unsigned long len);
10853 +static __always_inline __must_check unsigned long
10854 +__copy_from_user(void *to, const void __user *from, unsigned long len);
10855 __must_check unsigned long
10856 -_copy_to_user(void __user *to, const void *from, unsigned len);
10857 -__must_check unsigned long
10858 -_copy_from_user(void *to, const void __user *from, unsigned len);
10859 -__must_check unsigned long
10860 -copy_in_user(void __user *to, const void __user *from, unsigned len);
10861 +copy_in_user(void __user *to, const void __user *from, unsigned long len);
10863 static inline unsigned long __must_check copy_from_user(void *to,
10864 const void __user *from,
10868 - int sz = __compiletime_object_size(to);
10871 - if (likely(sz == -1 || sz >= n))
10872 - n = _copy_from_user(to, from, n);
10873 -#ifdef CONFIG_DEBUG_VM
10875 - WARN(1, "Buffer overflow detected!\n");
10878 + if (access_ok(VERIFY_READ, from, n))
10879 + n = __copy_from_user(to, from, n);
10880 + else if (n < INT_MAX) {
10881 + if (!__builtin_constant_p(n))
10882 + check_object_size(to, n, false);
10883 + memset(to, 0, n);
10888 static __always_inline __must_check
10889 -int copy_to_user(void __user *dst, const void *src, unsigned size)
10890 +int copy_to_user(void __user *dst, const void *src, unsigned long size)
10894 - return _copy_to_user(dst, src, size);
10895 + if (access_ok(VERIFY_WRITE, dst, size))
10896 + size = __copy_to_user(dst, src, size);
10900 static __always_inline __must_check
10901 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
10902 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
10905 + int sz = __compiletime_object_size(dst);
10906 + unsigned ret = 0;
10909 - if (!__builtin_constant_p(size))
10910 - return copy_user_generic(dst, (__force void *)src, size);
10912 + pax_track_stack();
10914 + if (size > INT_MAX)
10917 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10918 + if (!__access_ok(VERIFY_READ, src, size))
10922 + if (unlikely(sz != -1 && sz < size)) {
10923 +#ifdef CONFIG_DEBUG_VM
10924 + WARN(1, "Buffer overflow detected!\n");
10929 + if (!__builtin_constant_p(size)) {
10930 + check_object_size(dst, size, false);
10932 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10933 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10934 + src += PAX_USER_SHADOW_BASE;
10937 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
10940 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
10941 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
10942 ret, "b", "b", "=q", 1);
10944 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
10945 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
10946 ret, "w", "w", "=r", 2);
10948 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
10949 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
10950 ret, "l", "k", "=r", 4);
10952 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
10953 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10954 ret, "q", "", "=r", 8);
10957 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10958 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10959 ret, "q", "", "=r", 10);
10962 __get_user_asm(*(u16 *)(8 + (char *)dst),
10963 - (u16 __user *)(8 + (char __user *)src),
10964 + (const u16 __user *)(8 + (const char __user *)src),
10965 ret, "w", "w", "=r", 2);
10968 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10969 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10970 ret, "q", "", "=r", 16);
10973 __get_user_asm(*(u64 *)(8 + (char *)dst),
10974 - (u64 __user *)(8 + (char __user *)src),
10975 + (const u64 __user *)(8 + (const char __user *)src),
10976 ret, "q", "", "=r", 8);
10979 - return copy_user_generic(dst, (__force void *)src, size);
10981 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10982 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10983 + src += PAX_USER_SHADOW_BASE;
10986 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
10990 static __always_inline __must_check
10991 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
10992 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
10995 + int sz = __compiletime_object_size(src);
10996 + unsigned ret = 0;
10999 - if (!__builtin_constant_p(size))
11000 - return copy_user_generic((__force void *)dst, src, size);
11002 + pax_track_stack();
11004 + if (size > INT_MAX)
11007 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11008 + if (!__access_ok(VERIFY_WRITE, dst, size))
11012 + if (unlikely(sz != -1 && sz < size)) {
11013 +#ifdef CONFIG_DEBUG_VM
11014 + WARN(1, "Buffer overflow detected!\n");
11019 + if (!__builtin_constant_p(size)) {
11020 + check_object_size(src, size, true);
11022 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11023 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11024 + dst += PAX_USER_SHADOW_BASE;
11027 + return copy_user_generic((__force_kernel void *)dst, src, size);
11030 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11031 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11032 ret, "b", "b", "iq", 1);
11034 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11035 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11036 ret, "w", "w", "ir", 2);
11038 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11039 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11040 ret, "l", "k", "ir", 4);
11042 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11043 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11044 ret, "q", "", "er", 8);
11047 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11048 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11049 ret, "q", "", "er", 10);
11052 asm("":::"memory");
11053 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11054 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11055 ret, "w", "w", "ir", 2);
11058 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11059 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11060 ret, "q", "", "er", 16);
11063 asm("":::"memory");
11064 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11065 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11066 ret, "q", "", "er", 8);
11069 - return copy_user_generic((__force void *)dst, src, size);
11071 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11072 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11073 + dst += PAX_USER_SHADOW_BASE;
11076 + return copy_user_generic((__force_kernel void *)dst, src, size);
11080 static __always_inline __must_check
11081 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11082 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
11085 + unsigned ret = 0;
11088 - if (!__builtin_constant_p(size))
11089 - return copy_user_generic((__force void *)dst,
11090 - (__force void *)src, size);
11092 + if (size > INT_MAX)
11095 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11096 + if (!__access_ok(VERIFY_READ, src, size))
11098 + if (!__access_ok(VERIFY_WRITE, dst, size))
11102 + if (!__builtin_constant_p(size)) {
11104 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11105 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11106 + src += PAX_USER_SHADOW_BASE;
11107 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11108 + dst += PAX_USER_SHADOW_BASE;
11111 + return copy_user_generic((__force_kernel void *)dst,
11112 + (__force_kernel const void *)src, size);
11117 - __get_user_asm(tmp, (u8 __user *)src,
11118 + __get_user_asm(tmp, (const u8 __user *)src,
11119 ret, "b", "b", "=q", 1);
11121 __put_user_asm(tmp, (u8 __user *)dst,
11122 @@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11126 - __get_user_asm(tmp, (u16 __user *)src,
11127 + __get_user_asm(tmp, (const u16 __user *)src,
11128 ret, "w", "w", "=r", 2);
11130 __put_user_asm(tmp, (u16 __user *)dst,
11131 @@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11135 - __get_user_asm(tmp, (u32 __user *)src,
11136 + __get_user_asm(tmp, (const u32 __user *)src,
11137 ret, "l", "k", "=r", 4);
11139 __put_user_asm(tmp, (u32 __user *)dst,
11140 @@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11144 - __get_user_asm(tmp, (u64 __user *)src,
11145 + __get_user_asm(tmp, (const u64 __user *)src,
11146 ret, "q", "", "=r", 8);
11148 __put_user_asm(tmp, (u64 __user *)dst,
11149 @@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11153 - return copy_user_generic((__force void *)dst,
11154 - (__force void *)src, size);
11156 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11157 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11158 + src += PAX_USER_SHADOW_BASE;
11159 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11160 + dst += PAX_USER_SHADOW_BASE;
11163 + return copy_user_generic((__force_kernel void *)dst,
11164 + (__force_kernel const void *)src, size);
11168 @@ -219,35 +318,74 @@ __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11169 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11171 static __must_check __always_inline int
11172 -__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11173 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
11175 - return copy_user_generic(dst, (__force const void *)src, size);
11176 + pax_track_stack();
11178 + if (size > INT_MAX)
11181 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11182 + if (!__access_ok(VERIFY_READ, src, size))
11185 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11186 + src += PAX_USER_SHADOW_BASE;
11189 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11192 -static __must_check __always_inline int
11193 -__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11194 +static __must_check __always_inline unsigned long
11195 +__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
11197 - return copy_user_generic((__force void *)dst, src, size);
11198 + if (size > INT_MAX)
11201 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11202 + if (!__access_ok(VERIFY_WRITE, dst, size))
11205 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11206 + dst += PAX_USER_SHADOW_BASE;
11209 + return copy_user_generic((__force_kernel void *)dst, src, size);
11212 -extern long __copy_user_nocache(void *dst, const void __user *src,
11213 - unsigned size, int zerorest);
11214 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11215 + unsigned long size, int zerorest);
11218 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11219 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
11223 + if (size > INT_MAX)
11226 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11227 + if (!__access_ok(VERIFY_READ, src, size))
11231 return __copy_user_nocache(dst, src, size, 1);
11235 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11237 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11238 + unsigned long size)
11240 + if (size > INT_MAX)
11243 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11244 + if (!__access_ok(VERIFY_READ, src, size))
11248 return __copy_user_nocache(dst, src, size, 0);
11252 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11253 +extern unsigned long
11254 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest);
11256 #endif /* _ASM_X86_UACCESS_64_H */
11257 diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
11258 index bb05228..d763d5b 100644
11259 --- a/arch/x86/include/asm/vdso.h
11260 +++ b/arch/x86/include/asm/vdso.h
11261 @@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
11262 #define VDSO32_SYMBOL(base, name) \
11264 extern const char VDSO32_##name[]; \
11265 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11266 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11270 diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
11271 index d3d8590..d296b5f 100644
11272 --- a/arch/x86/include/asm/x86_init.h
11273 +++ b/arch/x86/include/asm/x86_init.h
11274 @@ -28,7 +28,7 @@ struct x86_init_mpparse {
11275 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11276 void (*find_smp_config)(void);
11277 void (*get_smp_config)(unsigned int early);
11282 * struct x86_init_resources - platform specific resource related ops
11283 @@ -42,7 +42,7 @@ struct x86_init_resources {
11284 void (*probe_roms)(void);
11285 void (*reserve_resources)(void);
11286 char *(*memory_setup)(void);
11291 * struct x86_init_irqs - platform specific interrupt setup
11292 @@ -55,7 +55,7 @@ struct x86_init_irqs {
11293 void (*pre_vector_init)(void);
11294 void (*intr_init)(void);
11295 void (*trap_init)(void);
11300 * struct x86_init_oem - oem platform specific customizing functions
11301 @@ -65,7 +65,7 @@ struct x86_init_irqs {
11302 struct x86_init_oem {
11303 void (*arch_setup)(void);
11304 void (*banner)(void);
11309 * struct x86_init_mapping - platform specific initial kernel pagetable setup
11310 @@ -76,7 +76,7 @@ struct x86_init_oem {
11312 struct x86_init_mapping {
11313 void (*pagetable_reserve)(u64 start, u64 end);
11318 * struct x86_init_paging - platform specific paging functions
11319 @@ -86,7 +86,7 @@ struct x86_init_mapping {
11320 struct x86_init_paging {
11321 void (*pagetable_setup_start)(pgd_t *base);
11322 void (*pagetable_setup_done)(pgd_t *base);
11327 * struct x86_init_timers - platform specific timer setup
11328 @@ -101,7 +101,7 @@ struct x86_init_timers {
11329 void (*tsc_pre_init)(void);
11330 void (*timer_init)(void);
11331 void (*wallclock_init)(void);
11336 * struct x86_init_iommu - platform specific iommu setup
11337 @@ -109,7 +109,7 @@ struct x86_init_timers {
11339 struct x86_init_iommu {
11340 int (*iommu_init)(void);
11345 * struct x86_init_pci - platform specific pci init functions
11346 @@ -123,7 +123,7 @@ struct x86_init_pci {
11348 void (*init_irq)(void);
11349 void (*fixup_irqs)(void);
11354 * struct x86_init_ops - functions for platform specific setup
11355 @@ -139,7 +139,7 @@ struct x86_init_ops {
11356 struct x86_init_timers timers;
11357 struct x86_init_iommu iommu;
11358 struct x86_init_pci pci;
11363 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11364 @@ -147,7 +147,7 @@ struct x86_init_ops {
11366 struct x86_cpuinit_ops {
11367 void (*setup_percpu_clockev)(void);
11372 * struct x86_platform_ops - platform specific runtime functions
11373 @@ -166,7 +166,7 @@ struct x86_platform_ops {
11374 bool (*is_untracked_pat_range)(u64 start, u64 end);
11375 void (*nmi_init)(void);
11376 int (*i8042_detect)(void);
11382 @@ -174,7 +174,7 @@ struct x86_msi_ops {
11383 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
11384 void (*teardown_msi_irq)(unsigned int irq);
11385 void (*teardown_msi_irqs)(struct pci_dev *dev);
11389 extern struct x86_init_ops x86_init;
11390 extern struct x86_cpuinit_ops x86_cpuinit;
11391 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
11392 index c6ce245..ffbdab7 100644
11393 --- a/arch/x86/include/asm/xsave.h
11394 +++ b/arch/x86/include/asm/xsave.h
11395 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11399 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11400 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11401 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11405 * Clear the xsave header first, so that reserved fields are
11406 * initialized to zero.
11407 @@ -96,10 +101,15 @@ static inline int xsave_user(struct xsave_struct __user *buf)
11408 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11411 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11412 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11414 u32 hmask = mask >> 32;
11416 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11417 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11418 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11421 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11423 ".section .fixup,\"ax\"\n"
11424 diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
11425 index 6a564ac..9b1340c 100644
11426 --- a/arch/x86/kernel/acpi/realmode/Makefile
11427 +++ b/arch/x86/kernel/acpi/realmode/Makefile
11428 @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
11429 $(call cc-option, -fno-stack-protector) \
11430 $(call cc-option, -mpreferred-stack-boundary=2)
11431 KBUILD_CFLAGS += $(call cc-option, -m32)
11432 +ifdef CONSTIFY_PLUGIN
11433 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
11435 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
11438 diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
11439 index b4fd836..4358fe3 100644
11440 --- a/arch/x86/kernel/acpi/realmode/wakeup.S
11441 +++ b/arch/x86/kernel/acpi/realmode/wakeup.S
11442 @@ -108,6 +108,9 @@ wakeup_code:
11443 /* Do any other stuff... */
11445 #ifndef CONFIG_64BIT
11446 + /* Recheck NX bit overrides (64bit path does this in trampoline */
11449 /* This could also be done in C code... */
11450 movl pmode_cr3, %eax
11452 @@ -131,6 +134,7 @@ wakeup_code:
11453 movl pmode_cr0, %eax
11456 +# include "../../verify_cpu.S"
11459 pushw trampoline_segment
11460 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
11461 index 103b6ab..2004d0a 100644
11462 --- a/arch/x86/kernel/acpi/sleep.c
11463 +++ b/arch/x86/kernel/acpi/sleep.c
11464 @@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
11465 header->trampoline_segment = trampoline_address() >> 4;
11467 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
11469 + pax_open_kernel();
11470 early_gdt_descr.address =
11471 (unsigned long)get_cpu_gdt_table(smp_processor_id());
11472 + pax_close_kernel();
11474 initial_gs = per_cpu_offset(smp_processor_id());
11476 initial_code = (unsigned long)wakeup_long64;
11477 diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
11478 index 13ab720..95d5442 100644
11479 --- a/arch/x86/kernel/acpi/wakeup_32.S
11480 +++ b/arch/x86/kernel/acpi/wakeup_32.S
11481 @@ -30,13 +30,11 @@ wakeup_pmode_return:
11482 # and restore the stack ... but you need gdt for this to work
11483 movl saved_context_esp, %esp
11485 - movl %cs:saved_magic, %eax
11486 - cmpl $0x12345678, %eax
11487 + cmpl $0x12345678, saved_magic
11490 # jump to place where we left off
11491 - movl saved_eip, %eax
11497 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
11498 index c638228..16dfa8d 100644
11499 --- a/arch/x86/kernel/alternative.c
11500 +++ b/arch/x86/kernel/alternative.c
11501 @@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
11503 for (a = start; a < end; a++) {
11504 instr = (u8 *)&a->instr_offset + a->instr_offset;
11506 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11507 + instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11508 + if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
11509 + instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11512 replacement = (u8 *)&a->repl_offset + a->repl_offset;
11513 BUG_ON(a->replacementlen > a->instrlen);
11514 BUG_ON(a->instrlen > sizeof(insnbuf));
11515 @@ -307,10 +314,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
11516 for (poff = start; poff < end; poff++) {
11517 u8 *ptr = (u8 *)poff + *poff;
11519 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11520 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11521 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11522 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11525 if (!*poff || ptr < text || ptr >= text_end)
11527 /* turn DS segment override prefix into lock prefix */
11528 - if (*ptr == 0x3e)
11529 + if (*ktla_ktva(ptr) == 0x3e)
11530 text_poke(ptr, ((unsigned char []){0xf0}), 1);
11532 mutex_unlock(&text_mutex);
11533 @@ -328,10 +341,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
11534 for (poff = start; poff < end; poff++) {
11535 u8 *ptr = (u8 *)poff + *poff;
11537 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
11538 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11539 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
11540 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
11543 if (!*poff || ptr < text || ptr >= text_end)
11545 /* turn lock prefix into DS segment override prefix */
11546 - if (*ptr == 0xf0)
11547 + if (*ktla_ktva(ptr) == 0xf0)
11548 text_poke(ptr, ((unsigned char []){0x3E}), 1);
11550 mutex_unlock(&text_mutex);
11551 @@ -500,7 +519,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
11553 BUG_ON(p->len > MAX_PATCH_LEN);
11554 /* prep the buffer with the original instructions */
11555 - memcpy(insnbuf, p->instr, p->len);
11556 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
11557 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
11558 (unsigned long)p->instr, p->len);
11560 @@ -568,7 +587,7 @@ void __init alternative_instructions(void)
11562 free_init_pages("SMP alternatives",
11563 (unsigned long)__smp_locks,
11564 - (unsigned long)__smp_locks_end);
11565 + PAGE_ALIGN((unsigned long)__smp_locks_end));
11569 @@ -585,13 +604,17 @@ void __init alternative_instructions(void)
11570 * instructions. And on the local CPU you need to be protected again NMI or MCE
11571 * handlers seeing an inconsistent instruction while you patch.
11573 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
11574 +void *__kprobes text_poke_early(void *addr, const void *opcode,
11577 unsigned long flags;
11578 local_irq_save(flags);
11579 - memcpy(addr, opcode, len);
11581 + pax_open_kernel();
11582 + memcpy(ktla_ktva(addr), opcode, len);
11584 + pax_close_kernel();
11586 local_irq_restore(flags);
11587 /* Could also do a CLFLUSH here to speed up CPU recovery; but
11588 that causes hangs on some VIA CPUs. */
11589 @@ -613,36 +636,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
11591 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
11593 - unsigned long flags;
11595 + unsigned char *vaddr = ktla_ktva(addr);
11596 struct page *pages[2];
11600 if (!core_kernel_text((unsigned long)addr)) {
11601 - pages[0] = vmalloc_to_page(addr);
11602 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
11603 + pages[0] = vmalloc_to_page(vaddr);
11604 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
11606 - pages[0] = virt_to_page(addr);
11607 + pages[0] = virt_to_page(vaddr);
11608 WARN_ON(!PageReserved(pages[0]));
11609 - pages[1] = virt_to_page(addr + PAGE_SIZE);
11610 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
11613 - local_irq_save(flags);
11614 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
11616 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
11617 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
11618 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
11619 - clear_fixmap(FIX_TEXT_POKE0);
11621 - clear_fixmap(FIX_TEXT_POKE1);
11622 - local_flush_tlb();
11624 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
11625 - that causes hangs on some VIA CPUs. */
11626 + text_poke_early(addr, opcode, len);
11627 for (i = 0; i < len; i++)
11628 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
11629 - local_irq_restore(flags);
11630 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
11634 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
11635 index 52fa563..5de9d9c 100644
11636 --- a/arch/x86/kernel/apic/apic.c
11637 +++ b/arch/x86/kernel/apic/apic.c
11638 @@ -174,7 +174,7 @@ int first_system_vector = 0xfe;
11640 * Debug level, exported for io_apic.c
11642 -unsigned int apic_verbosity;
11643 +int apic_verbosity;
11647 @@ -1835,7 +1835,7 @@ void smp_error_interrupt(struct pt_regs *regs)
11648 apic_write(APIC_ESR, 0);
11649 v1 = apic_read(APIC_ESR);
11651 - atomic_inc(&irq_err_count);
11652 + atomic_inc_unchecked(&irq_err_count);
11654 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
11655 smp_processor_id(), v0 , v1);
11656 @@ -2209,6 +2209,8 @@ static int __cpuinit apic_cluster_num(void)
11657 u16 *bios_cpu_apicid;
11658 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
11660 + pax_track_stack();
11662 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
11663 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
11665 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
11666 index 8eb863e..32e6934 100644
11667 --- a/arch/x86/kernel/apic/io_apic.c
11668 +++ b/arch/x86/kernel/apic/io_apic.c
11669 @@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
11671 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
11673 -void lock_vector_lock(void)
11674 +void lock_vector_lock(void) __acquires(vector_lock)
11676 /* Used to the online set of cpus does not change
11677 * during assign_irq_vector.
11678 @@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
11679 raw_spin_lock(&vector_lock);
11682 -void unlock_vector_lock(void)
11683 +void unlock_vector_lock(void) __releases(vector_lock)
11685 raw_spin_unlock(&vector_lock);
11687 @@ -2405,7 +2405,7 @@ static void ack_apic_edge(struct irq_data *data)
11691 -atomic_t irq_mis_count;
11692 +atomic_unchecked_t irq_mis_count;
11695 * IO-APIC versions below 0x20 don't support EOI register.
11696 @@ -2513,7 +2513,7 @@ static void ack_apic_level(struct irq_data *data)
11699 if (!(v & (1 << (i & 0x1f)))) {
11700 - atomic_inc(&irq_mis_count);
11701 + atomic_inc_unchecked(&irq_mis_count);
11703 eoi_ioapic_irq(irq, cfg);
11705 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
11706 index 0371c48..54cdf63 100644
11707 --- a/arch/x86/kernel/apm_32.c
11708 +++ b/arch/x86/kernel/apm_32.c
11709 @@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
11710 * This is for buggy BIOS's that refer to (real mode) segment 0x40
11711 * even though they are called in protected mode.
11713 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
11714 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
11715 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
11717 static const char driver_version[] = "1.16ac"; /* no spaces */
11718 @@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
11720 gdt = get_cpu_gdt_table(cpu);
11721 save_desc_40 = gdt[0x40 / 8];
11723 + pax_open_kernel();
11724 gdt[0x40 / 8] = bad_bios_desc;
11725 + pax_close_kernel();
11727 apm_irq_save(flags);
11729 @@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
11731 APM_DO_RESTORE_SEGS;
11732 apm_irq_restore(flags);
11734 + pax_open_kernel();
11735 gdt[0x40 / 8] = save_desc_40;
11736 + pax_close_kernel();
11740 return call->eax & 0xff;
11741 @@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void *_call)
11743 gdt = get_cpu_gdt_table(cpu);
11744 save_desc_40 = gdt[0x40 / 8];
11746 + pax_open_kernel();
11747 gdt[0x40 / 8] = bad_bios_desc;
11748 + pax_close_kernel();
11750 apm_irq_save(flags);
11752 @@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void *_call)
11754 APM_DO_RESTORE_SEGS;
11755 apm_irq_restore(flags);
11757 + pax_open_kernel();
11758 gdt[0x40 / 8] = save_desc_40;
11759 + pax_close_kernel();
11764 @@ -2349,12 +2363,15 @@ static int __init apm_init(void)
11765 * code to that CPU.
11767 gdt = get_cpu_gdt_table(0);
11769 + pax_open_kernel();
11770 set_desc_base(&gdt[APM_CS >> 3],
11771 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
11772 set_desc_base(&gdt[APM_CS_16 >> 3],
11773 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
11774 set_desc_base(&gdt[APM_DS >> 3],
11775 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
11776 + pax_close_kernel();
11778 proc_create("apm", 0, NULL, &apm_file_ops);
11780 diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
11781 index 4f13faf..87db5d2 100644
11782 --- a/arch/x86/kernel/asm-offsets.c
11783 +++ b/arch/x86/kernel/asm-offsets.c
11784 @@ -33,6 +33,8 @@ void common(void) {
11785 OFFSET(TI_status, thread_info, status);
11786 OFFSET(TI_addr_limit, thread_info, addr_limit);
11787 OFFSET(TI_preempt_count, thread_info, preempt_count);
11788 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
11789 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
11792 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
11793 @@ -53,8 +55,26 @@ void common(void) {
11794 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
11795 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
11796 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
11798 +#ifdef CONFIG_PAX_KERNEXEC
11799 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
11802 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11803 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
11804 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
11805 +#ifdef CONFIG_X86_64
11806 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
11813 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
11814 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
11815 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
11819 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
11820 diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
11821 index e72a119..6e2955d 100644
11822 --- a/arch/x86/kernel/asm-offsets_64.c
11823 +++ b/arch/x86/kernel/asm-offsets_64.c
11824 @@ -69,6 +69,7 @@ int main(void)
11828 + DEFINE(TSS_size, sizeof(struct tss_struct));
11829 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
11832 diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
11833 index 6042981..e638266 100644
11834 --- a/arch/x86/kernel/cpu/Makefile
11835 +++ b/arch/x86/kernel/cpu/Makefile
11836 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11837 CFLAGS_REMOVE_perf_event.o = -pg
11840 -# Make sure load_percpu_segment has no stackprotector
11841 -nostackp := $(call cc-option, -fno-stack-protector)
11842 -CFLAGS_common.o := $(nostackp)
11844 obj-y := intel_cacheinfo.o scattered.o topology.o
11845 obj-y += proc.o capflags.o powerflags.o common.o
11846 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11847 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
11848 index b13ed39..603286c 100644
11849 --- a/arch/x86/kernel/cpu/amd.c
11850 +++ b/arch/x86/kernel/cpu/amd.c
11851 @@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
11854 /* AMD errata T13 (order #21922) */
11855 - if ((c->x86 == 6)) {
11856 + if (c->x86 == 6) {
11858 if (c->x86_model == 3 && c->x86_mask == 0)
11860 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
11861 index 6218439..0f1addc 100644
11862 --- a/arch/x86/kernel/cpu/common.c
11863 +++ b/arch/x86/kernel/cpu/common.c
11864 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
11866 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
11868 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
11869 -#ifdef CONFIG_X86_64
11871 - * We need valid kernel segments for data and code in long mode too
11872 - * IRET will check the segment types kkeil 2000/10/28
11873 - * Also sysret mandates a special GDT layout
11875 - * TLS descriptors are currently at a different place compared to i386.
11876 - * Hopefully nobody expects them at a fixed place (Wine?)
11878 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
11879 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
11880 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
11881 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
11882 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
11883 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
11885 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
11886 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11887 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
11888 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
11890 - * Segments used for calling PnP BIOS have byte granularity.
11891 - * They code segments and data segments have fixed 64k limits,
11892 - * the transfer segment sizes are set at run time.
11894 - /* 32-bit code */
11895 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11896 - /* 16-bit code */
11897 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11898 - /* 16-bit data */
11899 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
11900 - /* 16-bit data */
11901 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
11902 - /* 16-bit data */
11903 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
11905 - * The APM segments have byte granularity and their bases
11906 - * are set at run time. All have 64k limits.
11908 - /* 32-bit code */
11909 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
11910 - /* 16-bit code */
11911 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
11913 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
11915 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11916 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
11917 - GDT_STACK_CANARY_INIT
11920 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
11922 static int __init x86_xsave_setup(char *s)
11924 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
11925 @@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
11927 struct desc_ptr gdt_descr;
11929 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
11930 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
11931 gdt_descr.size = GDT_SIZE - 1;
11932 load_gdt(&gdt_descr);
11933 /* Reload the per-cpu base */
11934 @@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
11935 /* Filter out anything that depends on CPUID levels we don't have */
11936 filter_cpuid_features(c, true);
11938 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
11939 + setup_clear_cpu_cap(X86_FEATURE_SEP);
11942 /* If the model name is still unset, do table lookup. */
11943 if (!c->x86_model_id[0]) {
11945 @@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(char *arg)
11947 __setup("clearcpuid=", setup_disablecpuid);
11949 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
11950 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
11952 #ifdef CONFIG_X86_64
11953 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
11955 @@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
11956 EXPORT_PER_CPU_SYMBOL(current_task);
11958 DEFINE_PER_CPU(unsigned long, kernel_stack) =
11959 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
11960 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
11961 EXPORT_PER_CPU_SYMBOL(kernel_stack);
11963 DEFINE_PER_CPU(char *, irq_stack_ptr) =
11964 @@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
11966 memset(regs, 0, sizeof(struct pt_regs));
11967 regs->fs = __KERNEL_PERCPU;
11968 - regs->gs = __KERNEL_STACK_CANARY;
11969 + savesegment(gs, regs->gs);
11973 @@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
11976 cpu = stack_smp_processor_id();
11977 - t = &per_cpu(init_tss, cpu);
11978 + t = init_tss + cpu;
11979 oist = &per_cpu(orig_ist, cpu);
11982 @@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
11983 switch_to_new_gdt(cpu);
11984 loadsegment(fs, 0);
11986 - load_idt((const struct desc_ptr *)&idt_descr);
11987 + load_idt(&idt_descr);
11989 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
11991 @@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
11992 wrmsrl(MSR_KERNEL_GS_BASE, 0);
11995 - x86_configure_nx();
11999 @@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
12001 int cpu = smp_processor_id();
12002 struct task_struct *curr = current;
12003 - struct tss_struct *t = &per_cpu(init_tss, cpu);
12004 + struct tss_struct *t = init_tss + cpu;
12005 struct thread_struct *thread = &curr->thread;
12007 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12008 diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
12009 index ed6086e..a1dcf29 100644
12010 --- a/arch/x86/kernel/cpu/intel.c
12011 +++ b/arch/x86/kernel/cpu/intel.c
12012 @@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug(void)
12013 * Update the IDT descriptor and reload the IDT so that
12014 * it uses the read-only mapped virtual address.
12016 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12017 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12018 load_idt(&idt_descr);
12021 diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12022 index 0ed633c..82cef2a 100644
12023 --- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
12024 +++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
12025 @@ -215,7 +215,9 @@ static int inject_init(void)
12026 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
12028 printk(KERN_INFO "Machine check injector initialized\n");
12029 - mce_chrdev_ops.write = mce_write;
12030 + pax_open_kernel();
12031 + *(void **)&mce_chrdev_ops.write = mce_write;
12032 + pax_close_kernel();
12033 register_die_notifier(&mce_raise_nb);
12036 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
12037 index 08363b0..ee26113 100644
12038 --- a/arch/x86/kernel/cpu/mcheck/mce.c
12039 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
12041 #include <asm/processor.h>
12042 #include <asm/mce.h>
12043 #include <asm/msr.h>
12044 +#include <asm/local.h>
12046 #include "mce-internal.h"
12048 @@ -205,7 +206,7 @@ static void print_mce(struct mce *m)
12049 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12052 - if (m->cs == __KERNEL_CS)
12053 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12054 print_symbol("{%s}", m->ip);
12057 @@ -233,10 +234,10 @@ static void print_mce(struct mce *m)
12059 #define PANIC_TIMEOUT 5 /* 5 seconds */
12061 -static atomic_t mce_paniced;
12062 +static atomic_unchecked_t mce_paniced;
12064 static int fake_panic;
12065 -static atomic_t mce_fake_paniced;
12066 +static atomic_unchecked_t mce_fake_paniced;
12068 /* Panic in progress. Enable interrupts and wait for final IPI */
12069 static void wait_for_panic(void)
12070 @@ -260,7 +261,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12072 * Make sure only one CPU runs in machine check panic
12074 - if (atomic_inc_return(&mce_paniced) > 1)
12075 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12079 @@ -268,7 +269,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
12082 /* Don't log too much for fake panic */
12083 - if (atomic_inc_return(&mce_fake_paniced) > 1)
12084 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12087 /* First print corrected ones that are still unlogged */
12088 @@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t)
12089 * might have been modified by someone else.
12092 - if (atomic_read(&mce_paniced))
12093 + if (atomic_read_unchecked(&mce_paniced))
12095 if (!monarch_timeout)
12097 @@ -1392,7 +1393,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
12100 /* Call the installed machine check handler for this CPU setup. */
12101 -void (*machine_check_vector)(struct pt_regs *, long error_code) =
12102 +void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
12103 unexpected_machine_check;
12106 @@ -1415,7 +1416,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12110 + pax_open_kernel();
12111 machine_check_vector = do_machine_check;
12112 + pax_close_kernel();
12114 __mcheck_cpu_init_generic();
12115 __mcheck_cpu_init_vendor(c);
12116 @@ -1429,7 +1432,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
12119 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
12120 -static int mce_chrdev_open_count; /* #times opened */
12121 +static local_t mce_chrdev_open_count; /* #times opened */
12122 static int mce_chrdev_open_exclu; /* already open exclusive? */
12124 static int mce_chrdev_open(struct inode *inode, struct file *file)
12125 @@ -1437,7 +1440,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12126 spin_lock(&mce_chrdev_state_lock);
12128 if (mce_chrdev_open_exclu ||
12129 - (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
12130 + (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
12131 spin_unlock(&mce_chrdev_state_lock);
12134 @@ -1445,7 +1448,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
12136 if (file->f_flags & O_EXCL)
12137 mce_chrdev_open_exclu = 1;
12138 - mce_chrdev_open_count++;
12139 + local_inc(&mce_chrdev_open_count);
12141 spin_unlock(&mce_chrdev_state_lock);
12143 @@ -1456,7 +1459,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
12145 spin_lock(&mce_chrdev_state_lock);
12147 - mce_chrdev_open_count--;
12148 + local_dec(&mce_chrdev_open_count);
12149 mce_chrdev_open_exclu = 0;
12151 spin_unlock(&mce_chrdev_state_lock);
12152 @@ -2147,7 +2150,7 @@ struct dentry *mce_get_debugfs_dir(void)
12153 static void mce_reset(void)
12156 - atomic_set(&mce_fake_paniced, 0);
12157 + atomic_set_unchecked(&mce_fake_paniced, 0);
12158 atomic_set(&mce_executing, 0);
12159 atomic_set(&mce_callin, 0);
12160 atomic_set(&global_nwo, 0);
12161 diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
12162 index 5c0e653..1e82c7c 100644
12163 --- a/arch/x86/kernel/cpu/mcheck/p5.c
12164 +++ b/arch/x86/kernel/cpu/mcheck/p5.c
12165 @@ -50,7 +50,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
12166 if (!cpu_has(c, X86_FEATURE_MCE))
12169 + pax_open_kernel();
12170 machine_check_vector = pentium_machine_check;
12171 + pax_close_kernel();
12172 /* Make sure the vector pointer is visible before we enable MCEs: */
12175 diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
12176 index 54060f5..e6ba93d 100644
12177 --- a/arch/x86/kernel/cpu/mcheck/winchip.c
12178 +++ b/arch/x86/kernel/cpu/mcheck/winchip.c
12179 @@ -24,7 +24,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
12183 + pax_open_kernel();
12184 machine_check_vector = winchip_machine_check;
12185 + pax_close_kernel();
12186 /* Make sure the vector pointer is visible before we enable MCEs: */
12189 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
12190 index 6b96110..0da73eb 100644
12191 --- a/arch/x86/kernel/cpu/mtrr/main.c
12192 +++ b/arch/x86/kernel/cpu/mtrr/main.c
12193 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
12194 u64 size_or_mask, size_and_mask;
12195 static bool mtrr_aps_delayed_init;
12197 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12198 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12200 const struct mtrr_ops *mtrr_if;
12202 diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
12203 index df5e41f..816c719 100644
12204 --- a/arch/x86/kernel/cpu/mtrr/mtrr.h
12205 +++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
12206 @@ -25,7 +25,7 @@ struct mtrr_ops {
12207 int (*validate_add_page)(unsigned long base, unsigned long size,
12208 unsigned int type);
12209 int (*have_wrcomb)(void);
12213 extern int generic_get_free_region(unsigned long base, unsigned long size,
12215 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
12216 index cfa62ec..9250dd7 100644
12217 --- a/arch/x86/kernel/cpu/perf_event.c
12218 +++ b/arch/x86/kernel/cpu/perf_event.c
12219 @@ -795,6 +795,8 @@ static int x86_schedule_events(struct cpu_hw_events *cpuc, int n, int *assign)
12220 int i, j, w, wmax, num = 0;
12221 struct hw_perf_event *hwc;
12223 + pax_track_stack();
12225 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
12227 for (i = 0; i < n; i++) {
12228 @@ -1919,7 +1921,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
12231 perf_callchain_store(entry, frame.return_address);
12232 - fp = frame.next_frame;
12233 + fp = (const void __force_user *)frame.next_frame;
12237 diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
12238 index 764c7c2..c5d9c7b 100644
12239 --- a/arch/x86/kernel/crash.c
12240 +++ b/arch/x86/kernel/crash.c
12241 @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
12244 #ifdef CONFIG_X86_32
12245 - if (!user_mode_vm(regs)) {
12246 + if (!user_mode(regs)) {
12247 crash_fixup_ss_esp(&fixed_regs, regs);
12248 regs = &fixed_regs;
12250 diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
12251 index 37250fe..bf2ec74 100644
12252 --- a/arch/x86/kernel/doublefault_32.c
12253 +++ b/arch/x86/kernel/doublefault_32.c
12256 #define DOUBLEFAULT_STACKSIZE (1024)
12257 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
12258 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
12259 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
12261 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
12263 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
12264 unsigned long gdt, tss;
12266 store_gdt(&gdt_desc);
12267 - gdt = gdt_desc.address;
12268 + gdt = (unsigned long)gdt_desc.address;
12270 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
12272 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
12273 /* 0x2 bit is always set */
12274 .flags = X86_EFLAGS_SF | 0x2,
12277 + .es = __KERNEL_DS,
12281 + .ds = __KERNEL_DS,
12282 .fs = __KERNEL_PERCPU,
12284 .__cr3 = __pa_nodebug(swapper_pg_dir),
12285 diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
12286 index 1aae78f..aab3a3d 100644
12287 --- a/arch/x86/kernel/dumpstack.c
12288 +++ b/arch/x86/kernel/dumpstack.c
12290 * Copyright (C) 1991, 1992 Linus Torvalds
12291 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
12293 +#ifdef CONFIG_GRKERNSEC_HIDESYM
12294 +#define __INCLUDED_BY_HIDESYM 1
12296 #include <linux/kallsyms.h>
12297 #include <linux/kprobes.h>
12298 #include <linux/uaccess.h>
12299 @@ -35,9 +38,8 @@ void printk_address(unsigned long address, int reliable)
12301 print_ftrace_graph_addr(unsigned long addr, void *data,
12302 const struct stacktrace_ops *ops,
12303 - struct thread_info *tinfo, int *graph)
12304 + struct task_struct *task, int *graph)
12306 - struct task_struct *task = tinfo->task;
12307 unsigned long ret_addr;
12308 int index = task->curr_ret_stack;
12310 @@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12312 print_ftrace_graph_addr(unsigned long addr, void *data,
12313 const struct stacktrace_ops *ops,
12314 - struct thread_info *tinfo, int *graph)
12315 + struct task_struct *task, int *graph)
12319 @@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
12320 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
12323 -static inline int valid_stack_ptr(struct thread_info *tinfo,
12324 - void *p, unsigned int size, void *end)
12325 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
12329 if (p < end && p >= (end-THREAD_SIZE))
12331 @@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
12335 -print_context_stack(struct thread_info *tinfo,
12336 +print_context_stack(struct task_struct *task, void *stack_start,
12337 unsigned long *stack, unsigned long bp,
12338 const struct stacktrace_ops *ops, void *data,
12339 unsigned long *end, int *graph)
12341 struct stack_frame *frame = (struct stack_frame *)bp;
12343 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
12344 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
12345 unsigned long addr;
12348 @@ -102,7 +102,7 @@ print_context_stack(struct thread_info *tinfo,
12350 ops->address(data, addr, 0);
12352 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12353 + print_ftrace_graph_addr(addr, data, ops, task, graph);
12357 @@ -111,7 +111,7 @@ print_context_stack(struct thread_info *tinfo,
12358 EXPORT_SYMBOL_GPL(print_context_stack);
12361 -print_context_stack_bp(struct thread_info *tinfo,
12362 +print_context_stack_bp(struct task_struct *task, void *stack_start,
12363 unsigned long *stack, unsigned long bp,
12364 const struct stacktrace_ops *ops, void *data,
12365 unsigned long *end, int *graph)
12366 @@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12367 struct stack_frame *frame = (struct stack_frame *)bp;
12368 unsigned long *ret_addr = &frame->return_address;
12370 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
12371 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
12372 unsigned long addr = *ret_addr;
12374 if (!__kernel_text_address(addr))
12375 @@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_info *tinfo,
12376 ops->address(data, addr, 1);
12377 frame = frame->next_frame;
12378 ret_addr = &frame->return_address;
12379 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12380 + print_ftrace_graph_addr(addr, data, ops, task, graph);
12383 return (unsigned long)frame;
12384 @@ -186,7 +186,7 @@ void dump_stack(void)
12386 bp = stack_frame(current, NULL);
12387 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
12388 - current->pid, current->comm, print_tainted(),
12389 + task_pid_nr(current), current->comm, print_tainted(),
12390 init_utsname()->release,
12391 (int)strcspn(init_utsname()->version, " "),
12392 init_utsname()->version);
12393 @@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
12395 EXPORT_SYMBOL_GPL(oops_begin);
12397 +extern void gr_handle_kernel_exploit(void);
12399 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12401 if (regs && kexec_should_crash(current))
12402 @@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
12403 panic("Fatal exception in interrupt");
12405 panic("Fatal exception");
12408 + gr_handle_kernel_exploit();
12410 + do_group_exit(signr);
12413 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12414 @@ -269,7 +274,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
12416 show_registers(regs);
12417 #ifdef CONFIG_X86_32
12418 - if (user_mode_vm(regs)) {
12419 + if (user_mode(regs)) {
12421 ss = regs->ss & 0xffff;
12423 @@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs *regs, long err)
12424 unsigned long flags = oops_begin();
12427 - if (!user_mode_vm(regs))
12428 + if (!user_mode(regs))
12429 report_bug(regs->ip, regs);
12431 if (__die(str, regs, err))
12432 diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
12433 index 3b97a80..667ce7a 100644
12434 --- a/arch/x86/kernel/dumpstack_32.c
12435 +++ b/arch/x86/kernel/dumpstack_32.c
12436 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12437 bp = stack_frame(task, regs);
12440 - struct thread_info *context;
12441 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12443 - context = (struct thread_info *)
12444 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
12445 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
12446 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12448 - stack = (unsigned long *)context->previous_esp;
12450 + if (stack_start == task_stack_page(task))
12452 + stack = *(unsigned long **)stack_start;
12453 if (ops->stack(data, "IRQ") < 0)
12455 touch_nmi_watchdog();
12456 @@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs)
12457 * When in-kernel, we also print out the stack and code at the
12458 * time of the fault..
12460 - if (!user_mode_vm(regs)) {
12461 + if (!user_mode(regs)) {
12462 unsigned int code_prologue = code_bytes * 43 / 64;
12463 unsigned int code_len = code_bytes;
12466 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
12468 printk(KERN_EMERG "Stack:\n");
12469 show_stack_log_lvl(NULL, regs, ®s->sp, 0, KERN_EMERG);
12471 printk(KERN_EMERG "Code: ");
12473 - ip = (u8 *)regs->ip - code_prologue;
12474 + ip = (u8 *)regs->ip - code_prologue + cs_base;
12475 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
12476 /* try starting at IP */
12477 - ip = (u8 *)regs->ip;
12478 + ip = (u8 *)regs->ip + cs_base;
12479 code_len = code_len - code_prologue + 1;
12481 for (i = 0; i < code_len; i++, ip++) {
12482 @@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs)
12483 printk(" Bad EIP value.");
12486 - if (ip == (u8 *)regs->ip)
12487 + if (ip == (u8 *)regs->ip + cs_base)
12488 printk("<%02x> ", c);
12490 printk("%02x ", c);
12491 @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
12493 unsigned short ud2;
12495 + ip = ktla_ktva(ip);
12496 if (ip < PAGE_OFFSET)
12498 if (probe_kernel_address((unsigned short *)ip, ud2))
12499 @@ -139,3 +139,15 @@ int is_valid_bugaddr(unsigned long ip)
12501 return ud2 == 0x0b0f;
12504 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12505 +void pax_check_alloca(unsigned long size)
12507 + unsigned long sp = (unsigned long)&sp, stack_left;
12509 + /* all kernel stacks are of the same size */
12510 + stack_left = sp & (THREAD_SIZE - 1);
12511 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
12513 +EXPORT_SYMBOL(pax_check_alloca);
12515 diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
12516 index 19853ad..508ca79 100644
12517 --- a/arch/x86/kernel/dumpstack_64.c
12518 +++ b/arch/x86/kernel/dumpstack_64.c
12519 @@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12520 unsigned long *irq_stack_end =
12521 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
12523 - struct thread_info *tinfo;
12525 unsigned long dummy;
12526 + void *stack_start;
12530 @@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12531 * current stack address. If the stacks consist of nested
12534 - tinfo = task_thread_info(task);
12537 unsigned long *estack_end;
12539 estack_end = in_exception_stack(cpu, (unsigned long)stack,
12542 @@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12543 if (ops->stack(data, id) < 0)
12546 - bp = ops->walk_stack(tinfo, stack, bp, ops,
12547 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
12548 data, estack_end, &graph);
12549 ops->stack(data, "<EOE>");
12551 @@ -172,7 +172,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12552 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
12553 if (ops->stack(data, "IRQ") < 0)
12555 - bp = ops->walk_stack(tinfo, stack, bp,
12556 + bp = ops->walk_stack(task, irq_stack, stack, bp,
12557 ops, data, irq_stack_end, &graph);
12559 * We link to the next stack (which would be
12560 @@ -191,7 +191,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
12562 * This handles the process stack:
12564 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
12565 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12566 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12569 EXPORT_SYMBOL(dump_trace);
12570 @@ -305,3 +306,50 @@ int is_valid_bugaddr(unsigned long ip)
12572 return ud2 == 0x0b0f;
12575 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12576 +void pax_check_alloca(unsigned long size)
12578 + unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
12579 + unsigned cpu, used;
12582 + /* check the process stack first */
12583 + stack_start = (unsigned long)task_stack_page(current);
12584 + stack_end = stack_start + THREAD_SIZE;
12585 + if (likely(stack_start <= sp && sp < stack_end)) {
12586 + unsigned long stack_left = sp & (THREAD_SIZE - 1);
12587 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
12593 + /* check the irq stacks */
12594 + stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
12595 + stack_start = stack_end - IRQ_STACK_SIZE;
12596 + if (stack_start <= sp && sp < stack_end) {
12597 + unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
12599 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
12603 + /* check the exception stacks */
12605 + stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
12606 + stack_start = stack_end - EXCEPTION_STKSZ;
12607 + if (stack_end && stack_start <= sp && sp < stack_end) {
12608 + unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
12610 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
12616 + /* unknown stack */
12619 +EXPORT_SYMBOL(pax_check_alloca);
12621 diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
12622 index cd28a35..2601699 100644
12623 --- a/arch/x86/kernel/early_printk.c
12624 +++ b/arch/x86/kernel/early_printk.c
12626 #include <linux/pci_regs.h>
12627 #include <linux/pci_ids.h>
12628 #include <linux/errno.h>
12629 +#include <linux/sched.h>
12630 #include <asm/io.h>
12631 #include <asm/processor.h>
12632 #include <asm/fcntl.h>
12633 @@ -179,6 +180,8 @@ asmlinkage void early_printk(const char *fmt, ...)
12637 + pax_track_stack();
12640 n = vscnprintf(buf, sizeof(buf), fmt, ap);
12641 early_console->write(early_console, buf, n);
12642 diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
12643 index f3f6f53..0841b66 100644
12644 --- a/arch/x86/kernel/entry_32.S
12645 +++ b/arch/x86/kernel/entry_32.S
12646 @@ -186,13 +186,146 @@
12647 /*CFI_REL_OFFSET gs, PT_GS*/
12649 .macro SET_KERNEL_GS reg
12651 +#ifdef CONFIG_CC_STACKPROTECTOR
12652 movl $(__KERNEL_STACK_CANARY), \reg
12653 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
12654 + movl $(__USER_DS), \reg
12662 #endif /* CONFIG_X86_32_LAZY_GS */
12665 +.macro pax_enter_kernel
12666 +#ifdef CONFIG_PAX_KERNEXEC
12667 + call pax_enter_kernel
12671 +.macro pax_exit_kernel
12672 +#ifdef CONFIG_PAX_KERNEXEC
12673 + call pax_exit_kernel
12677 +#ifdef CONFIG_PAX_KERNEXEC
12678 +ENTRY(pax_enter_kernel)
12679 +#ifdef CONFIG_PARAVIRT
12682 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
12690 + cmp $__KERNEL_CS, %esi
12692 + ljmp $__KERNEL_CS, $3f
12693 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
12695 +#ifdef CONFIG_PARAVIRT
12697 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
12702 +#ifdef CONFIG_PARAVIRT
12707 +ENDPROC(pax_enter_kernel)
12709 +ENTRY(pax_exit_kernel)
12710 +#ifdef CONFIG_PARAVIRT
12715 + cmp $__KERNEXEC_KERNEL_CS, %esi
12717 +#ifdef CONFIG_PARAVIRT
12718 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
12724 + ljmp $__KERNEL_CS, $1f
12726 +#ifdef CONFIG_PARAVIRT
12728 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
12733 +#ifdef CONFIG_PARAVIRT
12738 +ENDPROC(pax_exit_kernel)
12741 +.macro pax_erase_kstack
12742 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12743 + call pax_erase_kstack
12747 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12749 + * ebp: thread_info
12750 + * ecx, edx: can be clobbered
12752 +ENTRY(pax_erase_kstack)
12756 + mov TI_lowest_stack(%ebp), %edi
12757 + mov $-0xBEEF, %eax
12761 + and $THREAD_SIZE_asm - 1, %ecx
12780 + mov TI_task_thread_sp0(%ebp), %edi
12782 + mov %edi, TI_lowest_stack(%ebp)
12787 +ENDPROC(pax_erase_kstack)
12790 +.macro __SAVE_ALL _DS
12794 @@ -215,7 +348,7 @@
12795 CFI_REL_OFFSET ecx, 0
12797 CFI_REL_OFFSET ebx, 0
12798 - movl $(__USER_DS), %edx
12802 movl $(__KERNEL_PERCPU), %edx
12803 @@ -223,6 +356,15 @@
12808 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
12809 + __SAVE_ALL __KERNEL_DS
12812 + __SAVE_ALL __USER_DS
12816 .macro RESTORE_INT_REGS
12819 @@ -308,7 +450,7 @@ ENTRY(ret_from_fork)
12823 -END(ret_from_fork)
12824 +ENDPROC(ret_from_fork)
12827 * Interrupt exit functions should be protected against kprobes
12828 @@ -333,7 +475,15 @@ check_userspace:
12829 movb PT_CS(%esp), %al
12830 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
12831 cmpl $USER_RPL, %eax
12833 +#ifdef CONFIG_PAX_KERNEXEC
12834 + jae resume_userspace
12837 + jmp resume_kernel
12839 jb resume_kernel # not returning to v8086 or userspace
12842 ENTRY(resume_userspace)
12844 @@ -345,8 +495,8 @@ ENTRY(resume_userspace)
12845 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
12846 # int/exception return?
12849 -END(ret_from_exception)
12850 + jmp restore_all_pax
12851 +ENDPROC(ret_from_exception)
12853 #ifdef CONFIG_PREEMPT
12854 ENTRY(resume_kernel)
12855 @@ -361,7 +511,7 @@ need_resched:
12857 call preempt_schedule_irq
12859 -END(resume_kernel)
12860 +ENDPROC(resume_kernel)
12864 @@ -395,23 +545,34 @@ sysenter_past_esp:
12865 /*CFI_REL_OFFSET cs, 0*/
12867 * Push current_thread_info()->sysenter_return to the stack.
12868 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
12869 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
12871 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
12873 CFI_REL_OFFSET eip, 0
12877 + GET_THREAD_INFO(%ebp)
12878 + movl TI_sysenter_return(%ebp),%ebp
12879 + movl %ebp,PT_EIP(%esp)
12880 ENABLE_INTERRUPTS(CLBR_NONE)
12883 * Load the potential sixth argument from user stack.
12884 * Careful about security.
12886 + movl PT_OLDESP(%esp),%ebp
12888 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12889 + mov PT_OLDSS(%esp),%ds
12890 +1: movl %ds:(%ebp),%ebp
12894 cmpl $__PAGE_OFFSET-3,%ebp
12896 1: movl (%ebp),%ebp
12899 movl %ebp,PT_EBP(%esp)
12900 .section __ex_table,"a"
12902 @@ -434,12 +595,24 @@ sysenter_do_call:
12903 testl $_TIF_ALLWORK_MASK, %ecx
12907 +#ifdef CONFIG_PAX_RANDKSTACK
12910 + call pax_randomize_kstack
12916 /* if something modifies registers it must also disable sysexit */
12917 movl PT_EIP(%esp), %edx
12918 movl PT_OLDESP(%esp), %ecx
12921 1: mov PT_FS(%esp), %fs
12922 +2: mov PT_DS(%esp), %ds
12923 +3: mov PT_ES(%esp), %es
12925 ENABLE_INTERRUPTS_SYSEXIT
12927 @@ -456,6 +629,9 @@ sysenter_audit:
12928 movl %eax,%edx /* 2nd arg: syscall number */
12929 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
12930 call audit_syscall_entry
12935 movl PT_EAX(%esp),%eax /* reload syscall number */
12936 jmp sysenter_do_call
12937 @@ -482,11 +658,17 @@ sysexit_audit:
12940 .pushsection .fixup,"ax"
12941 -2: movl $0,PT_FS(%esp)
12942 +4: movl $0,PT_FS(%esp)
12944 +5: movl $0,PT_DS(%esp)
12946 +6: movl $0,PT_ES(%esp)
12948 .section __ex_table,"a"
12956 ENDPROC(ia32_sysenter_target)
12957 @@ -519,6 +701,15 @@ syscall_exit:
12958 testl $_TIF_ALLWORK_MASK, %ecx # current->work
12959 jne syscall_exit_work
12963 +#ifdef CONFIG_PAX_RANDKSTACK
12965 + call pax_randomize_kstack
12972 restore_all_notrace:
12973 @@ -578,14 +769,34 @@ ldt_ss:
12974 * compensating for the offset by changing to the ESPFIX segment with
12975 * a base address that matches for the difference.
12977 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
12978 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
12979 mov %esp, %edx /* load kernel esp */
12980 mov PT_OLDESP(%esp), %eax /* load userspace esp */
12981 mov %dx, %ax /* eax: new kernel esp */
12982 sub %eax, %edx /* offset (low word is 0) */
12984 + movl PER_CPU_VAR(cpu_number), %ebx
12985 + shll $PAGE_SHIFT_asm, %ebx
12986 + addl $cpu_gdt_table, %ebx
12988 + movl $cpu_gdt_table, %ebx
12991 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
12992 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
12994 +#ifdef CONFIG_PAX_KERNEXEC
13000 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13001 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13003 +#ifdef CONFIG_PAX_KERNEXEC
13008 pushl_cfi $__ESPFIX_SS
13009 pushl_cfi %eax /* new kernel esp */
13010 /* Disable interrupts, but do not irqtrace this section: we
13011 @@ -614,34 +825,28 @@ work_resched:
13012 movl TI_flags(%ebp), %ecx
13013 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13014 # than syscall tracing?
13016 + jz restore_all_pax
13017 testb $_TIF_NEED_RESCHED, %cl
13020 work_notifysig: # deal with pending signals and
13021 # notify-resume requests
13024 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13026 - jne work_notifysig_v86 # returning to kernel-space or
13027 + jz 1f # returning to kernel-space or
13030 - call do_notify_resume
13031 - jmp resume_userspace_sig
13034 -work_notifysig_v86:
13035 pushl_cfi %ecx # save ti_flags for do_notify_resume
13036 call save_v86_state # %eax contains pt_regs pointer
13044 call do_notify_resume
13045 jmp resume_userspace_sig
13047 +ENDPROC(work_pending)
13049 # perform syscall exit tracing
13051 @@ -649,11 +854,14 @@ syscall_trace_entry:
13052 movl $-ENOSYS,PT_EAX(%esp)
13054 call syscall_trace_enter
13058 /* What it returned is what we'll actually use. */
13059 cmpl $(nr_syscalls), %eax
13062 -END(syscall_trace_entry)
13063 +ENDPROC(syscall_trace_entry)
13065 # perform syscall exit tracing
13067 @@ -666,20 +874,24 @@ syscall_exit_work:
13069 call syscall_trace_leave
13070 jmp resume_userspace
13071 -END(syscall_exit_work)
13072 +ENDPROC(syscall_exit_work)
13075 RING0_INT_FRAME # can't unwind into user space anyway
13077 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13081 GET_THREAD_INFO(%ebp)
13082 movl $-EFAULT,PT_EAX(%esp)
13083 jmp resume_userspace
13084 -END(syscall_fault)
13085 +ENDPROC(syscall_fault)
13088 movl $-ENOSYS,PT_EAX(%esp)
13089 jmp resume_userspace
13090 -END(syscall_badsys)
13091 +ENDPROC(syscall_badsys)
13094 * End of kprobes section
13095 @@ -753,6 +965,36 @@ ptregs_clone:
13097 ENDPROC(ptregs_clone)
13100 +ENTRY(kernel_execve)
13103 + sub $PT_OLDSS+4,%esp
13107 + lea 3*4(%esp),%edi
13108 + mov $PT_OLDSS/4+1,%ecx
13114 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13118 + CFI_ADJUST_CFA_OFFSET -4
13119 + GET_THREAD_INFO(%ebp)
13122 + add $PT_OLDSS+4,%esp
13123 + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13127 +ENDPROC(kernel_execve)
13129 .macro FIXUP_ESPFIX_STACK
13131 * Switch back for ESPFIX stack to the normal zerobased stack
13132 @@ -762,8 +1004,15 @@ ENDPROC(ptregs_clone)
13133 * normal stack and adjusts ESP with the matching offset.
13135 /* fixup the stack */
13136 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13137 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13139 + movl PER_CPU_VAR(cpu_number), %ebx
13140 + shll $PAGE_SHIFT_asm, %ebx
13141 + addl $cpu_gdt_table, %ebx
13143 + movl $cpu_gdt_table, %ebx
13145 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13146 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
13148 addl %esp, %eax /* the adjusted stack pointer */
13149 pushl_cfi $__KERNEL_DS
13150 @@ -816,7 +1065,7 @@ vector=vector+1
13152 2: jmp common_interrupt
13154 -END(irq_entries_start)
13155 +ENDPROC(irq_entries_start)
13159 @@ -864,7 +1113,7 @@ ENTRY(coprocessor_error)
13160 pushl_cfi $do_coprocessor_error
13163 -END(coprocessor_error)
13164 +ENDPROC(coprocessor_error)
13166 ENTRY(simd_coprocessor_error)
13168 @@ -885,7 +1134,7 @@ ENTRY(simd_coprocessor_error)
13172 -END(simd_coprocessor_error)
13173 +ENDPROC(simd_coprocessor_error)
13175 ENTRY(device_not_available)
13177 @@ -893,7 +1142,7 @@ ENTRY(device_not_available)
13178 pushl_cfi $do_device_not_available
13181 -END(device_not_available)
13182 +ENDPROC(device_not_available)
13184 #ifdef CONFIG_PARAVIRT
13186 @@ -902,12 +1151,12 @@ ENTRY(native_iret)
13188 .long native_iret, iret_exc
13191 +ENDPROC(native_iret)
13193 ENTRY(native_irq_enable_sysexit)
13196 -END(native_irq_enable_sysexit)
13197 +ENDPROC(native_irq_enable_sysexit)
13201 @@ -916,7 +1165,7 @@ ENTRY(overflow)
13202 pushl_cfi $do_overflow
13210 @@ -924,7 +1173,7 @@ ENTRY(bounds)
13211 pushl_cfi $do_bounds
13219 @@ -932,7 +1181,7 @@ ENTRY(invalid_op)
13220 pushl_cfi $do_invalid_op
13224 +ENDPROC(invalid_op)
13226 ENTRY(coprocessor_segment_overrun)
13228 @@ -940,35 +1189,35 @@ ENTRY(coprocessor_segment_overrun)
13229 pushl_cfi $do_coprocessor_segment_overrun
13232 -END(coprocessor_segment_overrun)
13233 +ENDPROC(coprocessor_segment_overrun)
13237 pushl_cfi $do_invalid_TSS
13241 +ENDPROC(invalid_TSS)
13243 ENTRY(segment_not_present)
13245 pushl_cfi $do_segment_not_present
13248 -END(segment_not_present)
13249 +ENDPROC(segment_not_present)
13251 ENTRY(stack_segment)
13253 pushl_cfi $do_stack_segment
13256 -END(stack_segment)
13257 +ENDPROC(stack_segment)
13259 ENTRY(alignment_check)
13261 pushl_cfi $do_alignment_check
13264 -END(alignment_check)
13265 +ENDPROC(alignment_check)
13267 ENTRY(divide_error)
13269 @@ -976,7 +1225,7 @@ ENTRY(divide_error)
13270 pushl_cfi $do_divide_error
13274 +ENDPROC(divide_error)
13276 #ifdef CONFIG_X86_MCE
13277 ENTRY(machine_check)
13278 @@ -985,7 +1234,7 @@ ENTRY(machine_check)
13279 pushl_cfi machine_check_vector
13282 -END(machine_check)
13283 +ENDPROC(machine_check)
13286 ENTRY(spurious_interrupt_bug)
13287 @@ -994,7 +1243,7 @@ ENTRY(spurious_interrupt_bug)
13288 pushl_cfi $do_spurious_interrupt_bug
13291 -END(spurious_interrupt_bug)
13292 +ENDPROC(spurious_interrupt_bug)
13294 * End of kprobes section
13296 @@ -1109,7 +1358,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
13303 ENTRY(ftrace_caller)
13304 cmpl $0, function_trace_stop
13305 @@ -1138,7 +1387,7 @@ ftrace_graph_call:
13309 -END(ftrace_caller)
13310 +ENDPROC(ftrace_caller)
13312 #else /* ! CONFIG_DYNAMIC_FTRACE */
13314 @@ -1174,7 +1423,7 @@ trace:
13320 #endif /* CONFIG_DYNAMIC_FTRACE */
13321 #endif /* CONFIG_FUNCTION_TRACER */
13323 @@ -1195,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
13327 -END(ftrace_graph_caller)
13328 +ENDPROC(ftrace_graph_caller)
13330 .globl return_to_handler
13332 @@ -1209,7 +1458,6 @@ return_to_handler:
13336 -.section .rodata,"a"
13337 #include "syscall_table_32.S"
13339 syscall_table_size=(.-sys_call_table)
13340 @@ -1255,15 +1503,18 @@ error_code:
13341 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13344 - movl $(__USER_DS), %ecx
13345 + movl $(__KERNEL_DS), %ecx
13352 movl %esp,%eax # pt_regs pointer
13354 jmp ret_from_exception
13357 +ENDPROC(page_fault)
13360 * Debug traps and NMI can happen at the one SYSENTER instruction
13361 @@ -1305,7 +1556,7 @@ debug_stack_correct:
13363 jmp ret_from_exception
13369 * NMI is doubly nasty. It can happen _while_ we're handling
13370 @@ -1342,6 +1593,9 @@ nmi_stack_correct:
13371 xorl %edx,%edx # zero error code
13372 movl %esp,%eax # pt_regs pointer
13377 jmp restore_all_notrace
13380 @@ -1378,12 +1632,15 @@ nmi_espfix_stack:
13381 FIXUP_ESPFIX_STACK # %eax == %esp
13382 xorl %edx,%edx # zero error code
13388 lss 12+4(%esp), %esp # back to espfix stack
13389 CFI_ADJUST_CFA_OFFSET -24
13397 @@ -1395,14 +1652,14 @@ ENTRY(int3)
13399 jmp ret_from_exception
13404 ENTRY(general_protection)
13406 pushl_cfi $do_general_protection
13409 -END(general_protection)
13410 +ENDPROC(general_protection)
13412 #ifdef CONFIG_KVM_GUEST
13413 ENTRY(async_page_fault)
13414 @@ -1410,7 +1667,7 @@ ENTRY(async_page_fault)
13415 pushl_cfi $do_async_page_fault
13418 -END(async_page_fault)
13419 +ENDPROC(async_page_fault)
13423 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
13424 index 6419bb0..00440bf 100644
13425 --- a/arch/x86/kernel/entry_64.S
13426 +++ b/arch/x86/kernel/entry_64.S
13428 #include <asm/paravirt.h>
13429 #include <asm/ftrace.h>
13430 #include <asm/percpu.h>
13431 +#include <asm/pgtable.h>
13432 +#include <asm/alternative-asm.h>
13434 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
13435 #include <linux/elf-em.h>
13437 #ifdef CONFIG_FUNCTION_TRACER
13438 #ifdef CONFIG_DYNAMIC_FTRACE
13440 + pax_force_retaddr
13445 ENTRY(ftrace_caller)
13446 cmpl $0, function_trace_stop
13447 @@ -92,8 +95,9 @@ GLOBAL(ftrace_graph_call)
13450 GLOBAL(ftrace_stub)
13451 + pax_force_retaddr
13453 -END(ftrace_caller)
13454 +ENDPROC(ftrace_caller)
13456 #else /* ! CONFIG_DYNAMIC_FTRACE */
13458 @@ -112,6 +116,7 @@ ENTRY(mcount)
13461 GLOBAL(ftrace_stub)
13462 + pax_force_retaddr
13466 @@ -121,12 +126,13 @@ trace:
13468 subq $MCOUNT_INSN_SIZE, %rdi
13470 + pax_force_fptr ftrace_trace_function
13471 call *ftrace_trace_function
13473 MCOUNT_RESTORE_FRAME
13478 #endif /* CONFIG_DYNAMIC_FTRACE */
13479 #endif /* CONFIG_FUNCTION_TRACER */
13481 @@ -146,8 +152,9 @@ ENTRY(ftrace_graph_caller)
13483 MCOUNT_RESTORE_FRAME
13485 + pax_force_retaddr
13487 -END(ftrace_graph_caller)
13488 +ENDPROC(ftrace_graph_caller)
13490 GLOBAL(return_to_handler)
13492 @@ -163,6 +170,7 @@ GLOBAL(return_to_handler)
13496 + pax_force_fptr %rdi
13500 @@ -178,6 +186,282 @@ ENTRY(native_usergs_sysret64)
13501 ENDPROC(native_usergs_sysret64)
13502 #endif /* CONFIG_PARAVIRT */
13504 + .macro ljmpq sel, off
13505 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
13506 + .byte 0x48; ljmp *1234f(%rip)
13507 + .pushsection .rodata
13509 + 1234: .quad \off; .word \sel
13518 + .macro pax_enter_kernel
13519 + pax_set_fptr_mask
13520 +#ifdef CONFIG_PAX_KERNEXEC
13521 + call pax_enter_kernel
13525 + .macro pax_exit_kernel
13526 +#ifdef CONFIG_PAX_KERNEXEC
13527 + call pax_exit_kernel
13531 +#ifdef CONFIG_PAX_KERNEXEC
13532 +ENTRY(pax_enter_kernel)
13535 +#ifdef CONFIG_PARAVIRT
13536 + PV_SAVE_REGS(CLBR_RDI)
13543 + cmp $__KERNEL_CS,%edi
13547 +#ifdef CONFIG_PARAVIRT
13548 + PV_RESTORE_REGS(CLBR_RDI)
13552 + pax_force_retaddr
13555 +2: ljmpq __KERNEL_CS,1f
13556 +3: ljmpq __KERNEXEC_KERNEL_CS,4f
13557 +4: SET_RDI_INTO_CR0
13559 +ENDPROC(pax_enter_kernel)
13561 +ENTRY(pax_exit_kernel)
13564 +#ifdef CONFIG_PARAVIRT
13565 + PV_SAVE_REGS(CLBR_RDI)
13569 + cmp $__KERNEXEC_KERNEL_CS,%edi
13573 +#ifdef CONFIG_PARAVIRT
13574 + PV_RESTORE_REGS(CLBR_RDI);
13578 + pax_force_retaddr
13581 +2: GET_CR0_INTO_RDI
13583 + ljmpq __KERNEL_CS,3f
13584 +3: SET_RDI_INTO_CR0
13586 +#ifdef CONFIG_PARAVIRT
13587 + PV_RESTORE_REGS(CLBR_RDI);
13591 + pax_force_retaddr
13593 +ENDPROC(pax_exit_kernel)
13596 + .macro pax_enter_kernel_user
13597 + pax_set_fptr_mask
13598 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13599 + call pax_enter_kernel_user
13603 + .macro pax_exit_kernel_user
13604 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13605 + call pax_exit_kernel_user
13607 +#ifdef CONFIG_PAX_RANDKSTACK
13609 + call pax_randomize_kstack
13614 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13615 +ENTRY(pax_enter_kernel_user)
13619 +#ifdef CONFIG_PARAVIRT
13620 + PV_SAVE_REGS(CLBR_RDI)
13625 + add $__START_KERNEL_map,%rbx
13626 + sub phys_base(%rip),%rbx
13628 +#ifdef CONFIG_PARAVIRT
13630 + cmpl $0, pv_info+PARAVIRT_enabled
13633 + .rept USER_PGD_PTRS
13634 + mov i*8(%rbx),%rsi
13636 + lea i*8(%rbx),%rdi
13637 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13645 + .rept USER_PGD_PTRS
13646 + movb $0,i*8(%rbx)
13650 +#ifdef CONFIG_PARAVIRT
13655 +#ifdef CONFIG_PAX_KERNEXEC
13661 +#ifdef CONFIG_PARAVIRT
13662 + PV_RESTORE_REGS(CLBR_RDI)
13667 + pax_force_retaddr
13669 +ENDPROC(pax_enter_kernel_user)
13671 +ENTRY(pax_exit_kernel_user)
13674 +#ifdef CONFIG_PARAVIRT
13676 + PV_SAVE_REGS(CLBR_RDI)
13679 +#ifdef CONFIG_PAX_KERNEXEC
13686 + add $__START_KERNEL_map,%rdi
13687 + sub phys_base(%rip),%rdi
13689 +#ifdef CONFIG_PARAVIRT
13690 + cmpl $0, pv_info+PARAVIRT_enabled
13694 + .rept USER_PGD_PTRS
13695 + mov i*8(%rbx),%rsi
13697 + lea i*8(%rbx),%rdi
13698 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13706 + .rept USER_PGD_PTRS
13707 + movb $0x67,i*8(%rdi)
13711 +#ifdef CONFIG_PARAVIRT
13712 +2: PV_RESTORE_REGS(CLBR_RDI)
13717 + pax_force_retaddr
13719 +ENDPROC(pax_exit_kernel_user)
13722 +.macro pax_erase_kstack
13723 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13724 + call pax_erase_kstack
13728 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13730 + * r11: thread_info
13731 + * rcx, rdx: can be clobbered
13733 +ENTRY(pax_erase_kstack)
13738 + GET_THREAD_INFO(%r11)
13739 + mov TI_lowest_stack(%r11), %rdi
13740 + mov $-0xBEEF, %rax
13744 + and $THREAD_SIZE_asm - 1, %ecx
13761 + cmp $THREAD_SIZE_asm, %rcx
13769 + mov TI_task_thread_sp0(%r11), %rdi
13771 + mov %rdi, TI_lowest_stack(%r11)
13776 + pax_force_retaddr
13778 +ENDPROC(pax_erase_kstack)
13781 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
13782 #ifdef CONFIG_TRACE_IRQFLAGS
13783 @@ -231,8 +515,8 @@ ENDPROC(native_usergs_sysret64)
13786 .macro UNFAKE_STACK_FRAME
13788 - CFI_ADJUST_CFA_OFFSET -(6*8)
13789 + addq $8*6 + ARG_SKIP, %rsp
13790 + CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
13794 @@ -319,7 +603,7 @@ ENDPROC(native_usergs_sysret64)
13797 leaq -RBP(%rsp),%rdi /* arg1 for handler */
13798 - testl $3, CS(%rdi)
13799 + testb $3, CS(%rdi)
13803 @@ -350,9 +634,10 @@ ENTRY(save_rest)
13804 movq_cfi r15, R15+16
13805 movq %r11, 8(%rsp) /* return address */
13806 FIXUP_TOP_OF_STACK %r11, 16
13807 + pax_force_retaddr
13811 +ENDPROC(save_rest)
13813 /* save complete stack frame */
13814 .pushsection .kprobes.text, "ax"
13815 @@ -381,9 +666,10 @@ ENTRY(save_paranoid)
13816 js 1f /* negative -> in kernel */
13820 +1: pax_force_retaddr_bts
13823 -END(save_paranoid)
13824 +ENDPROC(save_paranoid)
13828 @@ -405,7 +691,7 @@ ENTRY(ret_from_fork)
13832 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13833 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
13834 je int_ret_from_sys_call
13836 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
13837 @@ -415,7 +701,7 @@ ENTRY(ret_from_fork)
13838 jmp ret_from_sys_call # go to the SYSRET fastpath
13841 -END(ret_from_fork)
13842 +ENDPROC(ret_from_fork)
13845 * System call entry. Up to 6 arguments in registers are supported.
13846 @@ -451,7 +737,7 @@ END(ret_from_fork)
13848 CFI_STARTPROC simple
13850 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
13851 + CFI_DEF_CFA rsp,0
13852 CFI_REGISTER rip,rcx
13853 /*CFI_REGISTER rflags,r11*/
13854 SWAPGS_UNSAFE_STACK
13855 @@ -464,12 +750,13 @@ ENTRY(system_call_after_swapgs)
13857 movq %rsp,PER_CPU_VAR(old_rsp)
13858 movq PER_CPU_VAR(kernel_stack),%rsp
13860 + pax_enter_kernel_user
13862 * No need to follow this irqs off/on section - it's straight
13865 ENABLE_INTERRUPTS(CLBR_NONE)
13867 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
13868 movq %rcx,RIP-ARGOFFSET(%rsp)
13869 CFI_REL_OFFSET rip,RIP-ARGOFFSET
13870 @@ -479,7 +766,7 @@ ENTRY(system_call_after_swapgs)
13871 system_call_fastpath:
13872 cmpq $__NR_syscall_max,%rax
13875 + movq R10-ARGOFFSET(%rsp),%rcx
13876 call *sys_call_table(,%rax,8) # XXX: rip relative
13877 movq %rax,RAX-ARGOFFSET(%rsp)
13879 @@ -498,6 +785,8 @@ sysret_check:
13883 + pax_exit_kernel_user
13886 * sysretq will re-enable interrupts:
13888 @@ -549,14 +838,18 @@ badsys:
13889 * jump back to the normal fast path.
13892 - movq %r10,%r9 /* 6th arg: 4th syscall arg */
13893 + movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
13894 movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
13895 movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
13896 movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
13897 movq %rax,%rsi /* 2nd arg: syscall number */
13898 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
13899 call audit_syscall_entry
13903 LOAD_ARGS 0 /* reload call-clobbered registers */
13904 + pax_set_fptr_mask
13905 jmp system_call_fastpath
13908 @@ -586,16 +879,20 @@ tracesys:
13909 FIXUP_TOP_OF_STACK %rdi
13911 call syscall_trace_enter
13916 * Reload arg registers from stack in case ptrace changed them.
13917 * We don't reload %rax because syscall_trace_enter() returned
13918 * the value it wants us to use in the table lookup.
13920 LOAD_ARGS ARGOFFSET, 1
13921 + pax_set_fptr_mask
13923 cmpq $__NR_syscall_max,%rax
13924 ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
13925 - movq %r10,%rcx /* fixup for C */
13926 + movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
13927 call *sys_call_table(,%rax,8)
13928 movq %rax,RAX-ARGOFFSET(%rsp)
13929 /* Use IRET because user could have changed frame */
13930 @@ -607,7 +904,7 @@ tracesys:
13931 GLOBAL(int_ret_from_sys_call)
13932 DISABLE_INTERRUPTS(CLBR_NONE)
13934 - testl $3,CS-ARGOFFSET(%rsp)
13935 + testb $3,CS-ARGOFFSET(%rsp)
13936 je retint_restore_args
13937 movl $_TIF_ALLWORK_MASK,%edi
13938 /* edi: mask to check */
13939 @@ -664,7 +961,7 @@ int_restore_rest:
13944 +ENDPROC(system_call)
13947 * Certain special system calls that need to save a complete full stack frame.
13948 @@ -680,7 +977,7 @@ ENTRY(\label)
13950 jmp ptregscall_common
13956 PTREGSCALL stub_clone, sys_clone, %r8
13957 @@ -698,9 +995,10 @@ ENTRY(ptregscall_common)
13958 movq_cfi_restore R12+8, r12
13959 movq_cfi_restore RBP+8, rbp
13960 movq_cfi_restore RBX+8, rbx
13961 + pax_force_retaddr
13962 ret $REST_SKIP /* pop extended registers */
13964 -END(ptregscall_common)
13965 +ENDPROC(ptregscall_common)
13969 @@ -715,7 +1013,7 @@ ENTRY(stub_execve)
13971 jmp int_ret_from_sys_call
13974 +ENDPROC(stub_execve)
13977 * sigreturn is special because it needs to restore all registers on return.
13978 @@ -733,7 +1031,7 @@ ENTRY(stub_rt_sigreturn)
13980 jmp int_ret_from_sys_call
13982 -END(stub_rt_sigreturn)
13983 +ENDPROC(stub_rt_sigreturn)
13986 * Build the entry stubs and pointer table with some assembler magic.
13987 @@ -768,7 +1066,7 @@ vector=vector+1
13988 2: jmp common_interrupt
13991 -END(irq_entries_start)
13992 +ENDPROC(irq_entries_start)
13996 @@ -789,6 +1087,16 @@ END(interrupt)
13997 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14000 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14001 + testb $3, CS(%rdi)
14005 +1: pax_enter_kernel_user
14013 @@ -820,7 +1128,7 @@ ret_from_intr:
14016 GET_THREAD_INFO(%rcx)
14017 - testl $3,CS-ARGOFFSET(%rsp)
14018 + testb $3,CS-ARGOFFSET(%rsp)
14021 /* Interrupt came from user space */
14022 @@ -842,12 +1150,16 @@ retint_swapgs: /* return to user-space */
14023 * The iretq could re-enable interrupts:
14025 DISABLE_INTERRUPTS(CLBR_ANY)
14026 + pax_exit_kernel_user
14032 retint_restore_args: /* return to kernel space */
14033 DISABLE_INTERRUPTS(CLBR_ANY)
14035 + pax_force_retaddr RIP-ARGOFFSET
14037 * The iretq could re-enable interrupts:
14039 @@ -936,7 +1248,7 @@ ENTRY(retint_kernel)
14043 -END(common_interrupt)
14044 +ENDPROC(common_interrupt)
14046 * End of kprobes section
14048 @@ -952,7 +1264,7 @@ ENTRY(\sym)
14057 @@ -1017,12 +1329,22 @@ ENTRY(\sym)
14058 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14061 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14062 + testb $3, CS(%rsp)
14066 +1: pax_enter_kernel_user
14071 movq %rsp,%rdi /* pt_regs pointer */
14072 xorl %esi,%esi /* no error code */
14074 jmp error_exit /* %ebx: no swapgs flag */
14080 .macro paranoidzeroentry sym do_sym
14081 @@ -1034,15 +1356,25 @@ ENTRY(\sym)
14082 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14085 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14086 + testb $3, CS(%rsp)
14090 +1: pax_enter_kernel_user
14095 movq %rsp,%rdi /* pt_regs pointer */
14096 xorl %esi,%esi /* no error code */
14098 jmp paranoid_exit /* %ebx: no swapgs flag */
14104 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14105 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14106 .macro paranoidzeroentry_ist sym do_sym ist
14109 @@ -1052,14 +1384,30 @@ ENTRY(\sym)
14110 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14113 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14114 + testb $3, CS(%rsp)
14118 +1: pax_enter_kernel_user
14123 movq %rsp,%rdi /* pt_regs pointer */
14124 xorl %esi,%esi /* no error code */
14126 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14127 + lea init_tss(%r12), %r12
14129 + lea init_tss(%rip), %r12
14131 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14133 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14134 jmp paranoid_exit /* %ebx: no swapgs flag */
14140 .macro errorentry sym do_sym
14141 @@ -1070,13 +1418,23 @@ ENTRY(\sym)
14142 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14145 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14146 + testb $3, CS(%rsp)
14150 +1: pax_enter_kernel_user
14155 movq %rsp,%rdi /* pt_regs pointer */
14156 movq ORIG_RAX(%rsp),%rsi /* get error code */
14157 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14159 jmp error_exit /* %ebx: no swapgs flag */
14165 /* error code is on the stack already */
14166 @@ -1089,13 +1447,23 @@ ENTRY(\sym)
14170 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14171 + testb $3, CS(%rsp)
14175 +1: pax_enter_kernel_user
14180 movq %rsp,%rdi /* pt_regs pointer */
14181 movq ORIG_RAX(%rsp),%rsi /* get error code */
14182 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14184 jmp paranoid_exit /* %ebx: no swapgs flag */
14190 zeroentry divide_error do_divide_error
14191 @@ -1125,9 +1493,10 @@ gs_change:
14192 2: mfence /* workaround */
14195 + pax_force_retaddr
14198 -END(native_load_gs_index)
14199 +ENDPROC(native_load_gs_index)
14201 .section __ex_table,"a"
14203 @@ -1149,13 +1518,14 @@ ENTRY(kernel_thread_helper)
14204 * Here we are in the child and the registers are set as they were
14205 * at kernel_thread() invocation in the parent.
14207 + pax_force_fptr %rsi
14212 ud2 # padding for call trace
14214 -END(kernel_thread_helper)
14215 +ENDPROC(kernel_thread_helper)
14218 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
14219 @@ -1182,11 +1552,11 @@ ENTRY(kernel_execve)
14222 je int_ret_from_sys_call
14225 + pax_force_retaddr
14228 -END(kernel_execve)
14229 +ENDPROC(kernel_execve)
14231 /* Call softirq on interrupt stack. Interrupts are off. */
14232 ENTRY(call_softirq)
14233 @@ -1204,9 +1574,10 @@ ENTRY(call_softirq)
14234 CFI_DEF_CFA_REGISTER rsp
14235 CFI_ADJUST_CFA_OFFSET -8
14236 decl PER_CPU_VAR(irq_count)
14237 + pax_force_retaddr
14241 +ENDPROC(call_softirq)
14244 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
14245 @@ -1244,7 +1615,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
14246 decl PER_CPU_VAR(irq_count)
14249 -END(xen_do_hypervisor_callback)
14250 +ENDPROC(xen_do_hypervisor_callback)
14253 * Hypervisor uses this for application faults while it executes.
14254 @@ -1303,7 +1674,7 @@ ENTRY(xen_failsafe_callback)
14258 -END(xen_failsafe_callback)
14259 +ENDPROC(xen_failsafe_callback)
14261 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
14262 xen_hvm_callback_vector xen_evtchn_do_upcall
14263 @@ -1352,16 +1723,31 @@ ENTRY(paranoid_exit)
14265 testl %ebx,%ebx /* swapgs needed? */
14266 jnz paranoid_restore
14267 - testl $3,CS(%rsp)
14268 + testb $3,CS(%rsp)
14269 jnz paranoid_userspace
14270 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14272 + TRACE_IRQS_IRETQ 0
14273 + SWAPGS_UNSAFE_STACK
14275 + pax_force_retaddr_bts
14279 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14280 + pax_exit_kernel_user
14285 SWAPGS_UNSAFE_STACK
14292 + pax_force_retaddr_bts
14294 paranoid_userspace:
14295 GET_THREAD_INFO(%rcx)
14296 @@ -1390,7 +1776,7 @@ paranoid_schedule:
14298 jmp paranoid_userspace
14300 -END(paranoid_exit)
14301 +ENDPROC(paranoid_exit)
14304 * Exception entry point. This expects an error code/orig_rax on the stack.
14305 @@ -1417,12 +1803,13 @@ ENTRY(error_entry)
14306 movq_cfi r14, R14+8
14307 movq_cfi r15, R15+8
14309 - testl $3,CS+8(%rsp)
14310 + testb $3,CS+8(%rsp)
14311 je error_kernelspace
14316 + pax_force_retaddr_bts
14320 @@ -1449,7 +1836,7 @@ bstep_iret:
14321 movq %rcx,RIP+8(%rsp)
14325 +ENDPROC(error_entry)
14328 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
14329 @@ -1469,7 +1856,7 @@ ENTRY(error_exit)
14334 +ENDPROC(error_exit)
14337 /* runs on exception stack */
14338 @@ -1481,6 +1868,16 @@ ENTRY(nmi)
14339 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14342 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14343 + testb $3, CS(%rsp)
14347 +1: pax_enter_kernel_user
14352 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14355 @@ -1491,12 +1888,28 @@ ENTRY(nmi)
14356 DISABLE_INTERRUPTS(CLBR_NONE)
14357 testl %ebx,%ebx /* swapgs needed? */
14359 - testl $3,CS(%rsp)
14360 + testb $3,CS(%rsp)
14362 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14364 + SWAPGS_UNSAFE_STACK
14366 + pax_force_retaddr_bts
14370 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14371 + pax_exit_kernel_user
14375 SWAPGS_UNSAFE_STACK
14381 + pax_force_retaddr_bts
14384 GET_THREAD_INFO(%rcx)
14385 @@ -1525,14 +1938,14 @@ nmi_schedule:
14392 ENTRY(ignore_sysret)
14397 -END(ignore_sysret)
14398 +ENDPROC(ignore_sysret)
14401 * End of kprobes section
14402 diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
14403 index c9a281f..ce2f317 100644
14404 --- a/arch/x86/kernel/ftrace.c
14405 +++ b/arch/x86/kernel/ftrace.c
14406 @@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the IP to write to */
14407 static const void *mod_code_newcode; /* holds the text to write to the IP */
14409 static unsigned nmi_wait_count;
14410 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
14411 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14413 int ftrace_arch_read_dyn_info(char *buf, int size)
14415 @@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
14417 r = snprintf(buf, size, "%u %u",
14419 - atomic_read(&nmi_update_count));
14420 + atomic_read_unchecked(&nmi_update_count));
14424 @@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14426 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14428 + pax_open_kernel();
14430 - atomic_inc(&nmi_update_count);
14431 + pax_close_kernel();
14432 + atomic_inc_unchecked(&nmi_update_count);
14434 /* Must have previous changes seen before executions */
14436 @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
14438 unsigned char replaced[MCOUNT_INSN_SIZE];
14440 + ip = ktla_ktva(ip);
14443 * Note: Due to modules and __init, code can
14444 * disappear and change, we need to protect against faulting
14445 @@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
14446 unsigned char old[MCOUNT_INSN_SIZE], *new;
14449 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14450 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14451 new = ftrace_call_replace(ip, (unsigned long)func);
14452 ret = ftrace_modify_code(ip, old, new);
14454 @@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long ip,
14456 unsigned char code[MCOUNT_INSN_SIZE];
14458 + ip = ktla_ktva(ip);
14460 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14463 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
14464 index 3bb0850..55a56f4 100644
14465 --- a/arch/x86/kernel/head32.c
14466 +++ b/arch/x86/kernel/head32.c
14468 #include <asm/io_apic.h>
14469 #include <asm/bios_ebda.h>
14470 #include <asm/tlbflush.h>
14471 +#include <asm/boot.h>
14473 static void __init i386_default_early_setup(void)
14475 @@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
14479 - memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14480 + memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14482 #ifdef CONFIG_BLK_DEV_INITRD
14483 /* Reserve INITRD */
14484 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
14485 index ce0be7c..c41476e 100644
14486 --- a/arch/x86/kernel/head_32.S
14487 +++ b/arch/x86/kernel/head_32.S
14489 /* Physical address */
14490 #define pa(X) ((X) - __PAGE_OFFSET)
14492 +#ifdef CONFIG_PAX_KERNEXEC
14495 +#define ta(X) ((X) - __PAGE_OFFSET)
14499 * References to members of the new_cpu_data structure.
14502 * and small than max_low_pfn, otherwise will waste some page table entries
14505 -#if PTRS_PER_PMD > 1
14506 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14508 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14510 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14512 /* Number of possible pages in the lowmem region */
14513 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14514 @@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
14515 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14518 + * Real beginning of normal "text" segment
14524 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14525 * %esi points to the real-mode code as a 32-bit pointer.
14526 * CS and DS must be 4 GB flat segments, but we don't depend on
14527 @@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14532 +#ifdef CONFIG_PAX_KERNEXEC
14534 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14535 +.fill PAGE_SIZE-5,1,0xcc
14539 movl pa(stack_start),%ecx
14541 @@ -105,6 +120,57 @@ ENTRY(startup_32)
14543 leal -__PAGE_OFFSET(%ecx),%esp
14546 + movl $pa(cpu_gdt_table),%edi
14547 + movl $__per_cpu_load,%eax
14548 + movw %ax,__KERNEL_PERCPU + 2(%edi)
14550 + movb %al,__KERNEL_PERCPU + 4(%edi)
14551 + movb %ah,__KERNEL_PERCPU + 7(%edi)
14552 + movl $__per_cpu_end - 1,%eax
14553 + subl $__per_cpu_start,%eax
14554 + movw %ax,__KERNEL_PERCPU + 0(%edi)
14557 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14558 + movl $NR_CPUS,%ecx
14559 + movl $pa(cpu_gdt_table),%edi
14561 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14562 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14563 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14564 + addl $PAGE_SIZE_asm,%edi
14568 +#ifdef CONFIG_PAX_KERNEXEC
14569 + movl $pa(boot_gdt),%edi
14570 + movl $__LOAD_PHYSICAL_ADDR,%eax
14571 + movw %ax,__BOOT_CS + 2(%edi)
14573 + movb %al,__BOOT_CS + 4(%edi)
14574 + movb %ah,__BOOT_CS + 7(%edi)
14577 + ljmp $(__BOOT_CS),$1f
14580 + movl $NR_CPUS,%ecx
14581 + movl $pa(cpu_gdt_table),%edi
14582 + addl $__PAGE_OFFSET,%eax
14584 + movw %ax,__KERNEL_CS + 2(%edi)
14585 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14587 + movb %al,__KERNEL_CS + 4(%edi)
14588 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14589 + movb %ah,__KERNEL_CS + 7(%edi)
14590 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14592 + addl $PAGE_SIZE_asm,%edi
14597 * Clear BSS first so that there are no surprises...
14599 @@ -195,8 +261,11 @@ ENTRY(startup_32)
14600 movl %eax, pa(max_pfn_mapped)
14602 /* Do early initialization of the fixmap area */
14603 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14604 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14605 +#ifdef CONFIG_COMPAT_VDSO
14606 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14608 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14610 #else /* Not PAE */
14612 page_pde_offset = (__PAGE_OFFSET >> 20);
14613 @@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14614 movl %eax, pa(max_pfn_mapped)
14616 /* Do early initialization of the fixmap area */
14617 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14618 - movl %eax,pa(initial_page_table+0xffc)
14619 +#ifdef CONFIG_COMPAT_VDSO
14620 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14622 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14626 #ifdef CONFIG_PARAVIRT
14627 @@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14628 cmpl $num_subarch_entries, %eax
14631 - movl pa(subarch_entries)(,%eax,4), %eax
14632 - subl $__PAGE_OFFSET, %eax
14634 + jmp *pa(subarch_entries)(,%eax,4)
14638 @@ -255,10 +325,10 @@ WEAK(xen_entry)
14642 - .long default_entry /* normal x86/PC */
14643 - .long lguest_entry /* lguest hypervisor */
14644 - .long xen_entry /* Xen hypervisor */
14645 - .long default_entry /* Moorestown MID */
14646 + .long ta(default_entry) /* normal x86/PC */
14647 + .long ta(lguest_entry) /* lguest hypervisor */
14648 + .long ta(xen_entry) /* Xen hypervisor */
14649 + .long ta(default_entry) /* Moorestown MID */
14650 num_subarch_entries = (. - subarch_entries) / 4
14653 @@ -312,6 +382,7 @@ default_entry:
14657 +#ifdef CONFIG_X86_PAE
14658 testb $X86_CR4_PAE, %al # check if PAE is enabled
14661 @@ -340,6 +411,9 @@ default_entry:
14662 /* Make changes effective */
14665 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14671 @@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14672 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14673 movl %eax,%ss # after changing gdt.
14675 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
14676 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14680 @@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14684 - movl $gdt_page,%eax
14685 + movl $cpu_gdt_table,%eax
14686 movl $stack_canary,%ecx
14688 + addl $__per_cpu_load,%ecx
14690 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14692 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14693 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14696 movl $(__KERNEL_STACK_CANARY),%eax
14697 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14698 + movl $(__USER_DS),%eax
14704 xorl %eax,%eax # Clear LDT
14705 @@ -558,22 +639,22 @@ early_page_fault:
14710 #ifdef CONFIG_PRINTK
14711 + cmpl $1,%ss:early_recursion_flag
14713 + incl %ss:early_recursion_flag
14716 movl $(__KERNEL_DS),%eax
14719 - cmpl $2,early_recursion_flag
14721 - incl early_recursion_flag
14724 pushl %edx /* trapno */
14733 @@ -581,8 +662,11 @@ hlt_loop:
14734 /* This is the default interrupt "handler" :-) */
14738 #ifdef CONFIG_PRINTK
14739 + cmpl $2,%ss:early_recursion_flag
14741 + incl %ss:early_recursion_flag
14746 @@ -591,9 +675,6 @@ ignore_int:
14747 movl $(__KERNEL_DS),%eax
14750 - cmpl $2,early_recursion_flag
14752 - incl early_recursion_flag
14756 @@ -622,29 +703,43 @@ ENTRY(initial_code)
14760 -__PAGE_ALIGNED_BSS
14762 #ifdef CONFIG_X86_PAE
14763 +.section .initial_pg_pmd,"a",@progbits
14765 .fill 1024*KPMDS,4,0
14767 +.section .initial_page_table,"a",@progbits
14768 ENTRY(initial_page_table)
14771 +.section .initial_pg_fixmap,"a",@progbits
14774 +.section .empty_zero_page,"a",@progbits
14775 ENTRY(empty_zero_page)
14777 +.section .swapper_pg_dir,"a",@progbits
14778 ENTRY(swapper_pg_dir)
14779 +#ifdef CONFIG_X86_PAE
14786 + * The IDT has to be page-aligned to simplify the Pentium
14787 + * F0 0F bug workaround.. We have a special link segment
14790 +.section .idt,"a",@progbits
14795 * This starts the data section.
14797 #ifdef CONFIG_X86_PAE
14798 -__PAGE_ALIGNED_DATA
14799 - /* Page-aligned for the benefit of paravirt? */
14801 +.section .initial_page_table,"a",@progbits
14802 ENTRY(initial_page_table)
14803 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
14805 @@ -663,18 +758,27 @@ ENTRY(initial_page_table)
14806 # error "Kernel PMDs should be 1, 2 or 3"
14808 .align PAGE_SIZE /* needs to be page-sized too */
14810 +#ifdef CONFIG_PAX_PER_CPU_PGD
14822 - .long init_thread_union+THREAD_SIZE
14823 + .long init_thread_union+THREAD_SIZE-8
14827 +.section .rodata,"a",@progbits
14828 early_recursion_flag:
14834 .asciz "Unknown interrupt or fault at: %p %p %p\n"
14836 @@ -707,7 +811,7 @@ fault_msg:
14837 .word 0 # 32 bit align gdt_desc.address
14840 - .long boot_gdt - __PAGE_OFFSET
14841 + .long pa(boot_gdt)
14843 .word 0 # 32-bit align idt_desc.address
14845 @@ -718,7 +822,7 @@ idt_descr:
14846 .word 0 # 32 bit align gdt_desc.address
14847 ENTRY(early_gdt_descr)
14848 .word GDT_ENTRIES*8-1
14849 - .long gdt_page /* Overwritten for secondary CPUs */
14850 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
14853 * The boot_gdt must mirror the equivalent in setup.S and is
14854 @@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
14855 .align L1_CACHE_BYTES
14857 .fill GDT_ENTRY_BOOT_CS,8,0
14858 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
14859 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
14860 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
14861 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
14863 + .align PAGE_SIZE_asm
14864 +ENTRY(cpu_gdt_table)
14866 + .quad 0x0000000000000000 /* NULL descriptor */
14867 + .quad 0x0000000000000000 /* 0x0b reserved */
14868 + .quad 0x0000000000000000 /* 0x13 reserved */
14869 + .quad 0x0000000000000000 /* 0x1b reserved */
14871 +#ifdef CONFIG_PAX_KERNEXEC
14872 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
14874 + .quad 0x0000000000000000 /* 0x20 unused */
14877 + .quad 0x0000000000000000 /* 0x28 unused */
14878 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
14879 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
14880 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
14881 + .quad 0x0000000000000000 /* 0x4b reserved */
14882 + .quad 0x0000000000000000 /* 0x53 reserved */
14883 + .quad 0x0000000000000000 /* 0x5b reserved */
14885 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
14886 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
14887 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
14888 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
14890 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
14891 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
14894 + * Segments used for calling PnP BIOS have byte granularity.
14895 + * The code segments and data segments have fixed 64k limits,
14896 + * the transfer segment sizes are set at run time.
14898 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
14899 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
14900 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
14901 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
14902 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
14905 + * The APM segments have byte granularity and their bases
14906 + * are set at run time. All have 64k limits.
14908 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
14909 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
14910 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
14912 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
14913 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
14914 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
14915 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
14916 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
14917 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
14919 + /* Be sure this is zeroed to avoid false validations in Xen */
14920 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
14922 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
14923 index e11e394..9aebc5d 100644
14924 --- a/arch/x86/kernel/head_64.S
14925 +++ b/arch/x86/kernel/head_64.S
14927 #include <asm/cache.h>
14928 #include <asm/processor-flags.h>
14929 #include <asm/percpu.h>
14930 +#include <asm/cpufeature.h>
14931 +#include <asm/alternative-asm.h>
14933 #ifdef CONFIG_PARAVIRT
14934 #include <asm/asm-offsets.h>
14935 @@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
14936 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
14937 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
14938 L3_START_KERNEL = pud_index(__START_KERNEL_map)
14939 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
14940 +L3_VMALLOC_START = pud_index(VMALLOC_START)
14941 +L4_VMALLOC_END = pgd_index(VMALLOC_END)
14942 +L3_VMALLOC_END = pud_index(VMALLOC_END)
14943 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
14944 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
14948 @@ -85,35 +93,23 @@ startup_64:
14950 addq %rbp, init_level4_pgt + 0(%rip)
14951 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
14952 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
14953 + addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
14954 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
14955 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
14957 addq %rbp, level3_ident_pgt + 0(%rip)
14958 +#ifndef CONFIG_XEN
14959 + addq %rbp, level3_ident_pgt + 8(%rip)
14962 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
14963 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
14964 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
14966 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
14967 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
14969 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
14971 - /* Add an Identity mapping if I am above 1G */
14972 - leaq _text(%rip), %rdi
14973 - andq $PMD_PAGE_MASK, %rdi
14976 - shrq $PUD_SHIFT, %rax
14977 - andq $(PTRS_PER_PUD - 1), %rax
14978 - jz ident_complete
14980 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
14981 - leaq level3_ident_pgt(%rip), %rbx
14982 - movq %rdx, 0(%rbx, %rax, 8)
14985 - shrq $PMD_SHIFT, %rax
14986 - andq $(PTRS_PER_PMD - 1), %rax
14987 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
14988 - leaq level2_spare_pgt(%rip), %rbx
14989 - movq %rdx, 0(%rbx, %rax, 8)
14991 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
14994 * Fixup the kernel text+data virtual addresses. Note that
14995 @@ -160,8 +156,8 @@ ENTRY(secondary_startup_64)
14996 * after the boot processor executes this code.
14999 - /* Enable PAE mode and PGE */
15000 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15001 + /* Enable PAE mode and PSE/PGE */
15002 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15005 /* Setup early boot stage 4 level pagetables. */
15006 @@ -183,9 +179,17 @@ ENTRY(secondary_startup_64)
15007 movl $MSR_EFER, %ecx
15009 btsl $_EFER_SCE, %eax /* Enable System Call */
15010 - btl $20,%edi /* No Execute supported? */
15011 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15013 btsl $_EFER_NX, %eax
15014 + leaq init_level4_pgt(%rip), %rdi
15015 +#ifndef CONFIG_EFI
15016 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15018 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15019 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
15020 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15021 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15022 1: wrmsr /* Make changes effective */
15025 @@ -247,6 +251,7 @@ ENTRY(secondary_startup_64)
15026 * jump. In addition we need to ensure %cs is set so we make this
15029 + pax_set_fptr_mask
15030 movq initial_code(%rip),%rax
15031 pushq $0 # fake return address to stop unwinder
15032 pushq $__KERNEL_CS # set correct cs
15033 @@ -269,7 +274,7 @@ ENTRY(secondary_startup_64)
15037 - .section ".init.text","ax"
15039 #ifdef CONFIG_EARLY_PRINTK
15040 .globl early_idt_handlers
15041 early_idt_handlers:
15042 @@ -314,18 +319,23 @@ ENTRY(early_idt_handler)
15043 #endif /* EARLY_PRINTK */
15048 #ifdef CONFIG_EARLY_PRINTK
15050 early_recursion_flag:
15054 + .section .rodata,"a",@progbits
15056 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15060 #endif /* CONFIG_EARLY_PRINTK */
15063 + .section .rodata,"a",@progbits
15064 #define NEXT_PAGE(name) \
15065 .balign PAGE_SIZE; \
15067 @@ -338,7 +348,6 @@ ENTRY(name)
15073 * This default setting generates an ident mapping at address 0x100000
15074 * and a mapping for the kernel that precisely maps virtual address
15075 @@ -349,13 +358,41 @@ NEXT_PAGE(init_level4_pgt)
15076 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15077 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15078 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15079 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
15080 + .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
15081 + .org init_level4_pgt + L4_VMALLOC_END*8, 0
15082 + .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
15083 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15084 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15085 .org init_level4_pgt + L4_START_KERNEL*8, 0
15086 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15087 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15089 +#ifdef CONFIG_PAX_PER_CPU_PGD
15090 +NEXT_PAGE(cpu_pgd)
15096 NEXT_PAGE(level3_ident_pgt)
15097 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15101 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15105 +NEXT_PAGE(level3_vmalloc_start_pgt)
15108 +NEXT_PAGE(level3_vmalloc_end_pgt)
15111 +NEXT_PAGE(level3_vmemmap_pgt)
15112 + .fill L3_VMEMMAP_START,8,0
15113 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15115 NEXT_PAGE(level3_kernel_pgt)
15116 .fill L3_START_KERNEL,8,0
15117 @@ -363,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt)
15118 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15119 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15121 +NEXT_PAGE(level2_vmemmap_pgt)
15124 NEXT_PAGE(level2_fixmap_pgt)
15126 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15127 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15130 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15131 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15134 -NEXT_PAGE(level1_fixmap_pgt)
15135 +NEXT_PAGE(level1_vsyscall_pgt)
15138 -NEXT_PAGE(level2_ident_pgt)
15139 - /* Since I easily can, map the first 1G.
15140 + /* Since I easily can, map the first 2G.
15141 * Don't set NX because code runs from these pages.
15143 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15144 +NEXT_PAGE(level2_ident_pgt)
15145 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15147 NEXT_PAGE(level2_kernel_pgt)
15149 @@ -389,33 +429,55 @@ NEXT_PAGE(level2_kernel_pgt)
15150 * If you want to increase this then increase MODULES_VADDR
15153 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15154 - KERNEL_IMAGE_SIZE/PMD_SIZE)
15156 -NEXT_PAGE(level2_spare_pgt)
15158 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15165 +ENTRY(cpu_gdt_table)
15167 + .quad 0x0000000000000000 /* NULL descriptor */
15168 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15169 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
15170 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
15171 + .quad 0x00cffb000000ffff /* __USER32_CS */
15172 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15173 + .quad 0x00affb000000ffff /* __USER_CS */
15175 +#ifdef CONFIG_PAX_KERNEXEC
15176 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15178 + .quad 0x0 /* unused */
15181 + .quad 0,0 /* TSS */
15182 + .quad 0,0 /* LDT */
15183 + .quad 0,0,0 /* three TLS descriptors */
15184 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
15185 + /* asm/segment.h:GDT_ENTRIES must match this */
15187 + /* zero the remaining page */
15188 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15192 .globl early_gdt_descr
15194 .word GDT_ENTRIES*8-1
15195 early_gdt_descr_base:
15196 - .quad INIT_PER_CPU_VAR(gdt_page)
15197 + .quad cpu_gdt_table
15200 /* This must match the first entry in level2_kernel_pgt */
15201 .quad 0x0000000000000000
15203 #include "../../x86/xen/xen-head.S"
15205 - .section .bss, "aw", @nobits
15207 + .section .rodata,"a",@progbits
15208 .align L1_CACHE_BYTES
15210 - .skip IDT_ENTRIES * 16
15215 diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
15216 index 9c3bd4a..e1d9b35 100644
15217 --- a/arch/x86/kernel/i386_ksyms_32.c
15218 +++ b/arch/x86/kernel/i386_ksyms_32.c
15219 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15220 EXPORT_SYMBOL(cmpxchg8b_emu);
15223 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
15225 /* Networking helper routines. */
15226 EXPORT_SYMBOL(csum_partial_copy_generic);
15227 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15228 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15230 EXPORT_SYMBOL(__get_user_1);
15231 EXPORT_SYMBOL(__get_user_2);
15232 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15234 EXPORT_SYMBOL(csum_partial);
15235 EXPORT_SYMBOL(empty_zero_page);
15237 +#ifdef CONFIG_PAX_KERNEXEC
15238 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15240 diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
15241 index 6104852..6114160 100644
15242 --- a/arch/x86/kernel/i8259.c
15243 +++ b/arch/x86/kernel/i8259.c
15244 @@ -210,7 +210,7 @@ spurious_8259A_irq:
15245 "spurious 8259A interrupt: IRQ%d.\n", irq);
15246 spurious_irq_mask |= irqmask;
15248 - atomic_inc(&irq_err_count);
15249 + atomic_inc_unchecked(&irq_err_count);
15251 * Theoretically we do not have to handle this IRQ,
15252 * but in Linux this does not cause problems and is
15253 diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
15254 index 43e9ccf..44ccf6f 100644
15255 --- a/arch/x86/kernel/init_task.c
15256 +++ b/arch/x86/kernel/init_task.c
15257 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
15258 * way process stacks are handled. This is done by having a special
15259 * "init_task" linker map entry..
15261 -union thread_union init_thread_union __init_task_data =
15262 - { INIT_THREAD_INFO(init_task) };
15263 +union thread_union init_thread_union __init_task_data;
15266 * Initial task structure.
15267 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15268 * section. Since TSS's are completely CPU-local, we want them
15269 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15271 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15273 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15274 +EXPORT_SYMBOL(init_tss);
15275 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
15276 index 8c96897..be66bfa 100644
15277 --- a/arch/x86/kernel/ioport.c
15278 +++ b/arch/x86/kernel/ioport.c
15280 #include <linux/sched.h>
15281 #include <linux/kernel.h>
15282 #include <linux/capability.h>
15283 +#include <linux/security.h>
15284 #include <linux/errno.h>
15285 #include <linux/types.h>
15286 #include <linux/ioport.h>
15287 @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15289 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15291 +#ifdef CONFIG_GRKERNSEC_IO
15292 + if (turn_on && grsec_disable_privio) {
15293 + gr_handle_ioperm();
15297 if (turn_on && !capable(CAP_SYS_RAWIO))
15300 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
15301 * because the ->io_bitmap_max value must match the bitmap
15304 - tss = &per_cpu(init_tss, get_cpu());
15305 + tss = init_tss + get_cpu();
15308 bitmap_clear(t->io_bitmap_ptr, from, num);
15309 @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct pt_regs *regs)
15311 /* Trying to gain more privileges? */
15313 +#ifdef CONFIG_GRKERNSEC_IO
15314 + if (grsec_disable_privio) {
15315 + gr_handle_iopl();
15319 if (!capable(CAP_SYS_RAWIO))
15322 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
15323 index 6c0802e..bea25ae 100644
15324 --- a/arch/x86/kernel/irq.c
15325 +++ b/arch/x86/kernel/irq.c
15327 #include <asm/mce.h>
15328 #include <asm/hw_irq.h>
15330 -atomic_t irq_err_count;
15331 +atomic_unchecked_t irq_err_count;
15333 /* Function pointer for generic interrupt vector handling */
15334 void (*x86_platform_ipi_callback)(void) = NULL;
15335 @@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
15336 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15337 seq_printf(p, " Machine check polls\n");
15339 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15340 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15341 #if defined(CONFIG_X86_IO_APIC)
15342 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15343 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15347 @@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15349 u64 arch_irq_stat(void)
15351 - u64 sum = atomic_read(&irq_err_count);
15352 + u64 sum = atomic_read_unchecked(&irq_err_count);
15354 #ifdef CONFIG_X86_IO_APIC
15355 - sum += atomic_read(&irq_mis_count);
15356 + sum += atomic_read_unchecked(&irq_mis_count);
15360 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
15361 index 7209070..cbcd71a 100644
15362 --- a/arch/x86/kernel/irq_32.c
15363 +++ b/arch/x86/kernel/irq_32.c
15364 @@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15365 __asm__ __volatile__("andl %%esp,%0" :
15366 "=r" (sp) : "0" (THREAD_SIZE - 1));
15368 - return sp < (sizeof(struct thread_info) + STACK_WARN);
15369 + return sp < STACK_WARN;
15372 static void print_stack_overflow(void)
15373 @@ -54,8 +54,8 @@ static inline void print_stack_overflow(void) { }
15374 * per-CPU IRQ handling contexts (thread information and stack)
15377 - struct thread_info tinfo;
15378 - u32 stack[THREAD_SIZE/sizeof(u32)];
15379 + unsigned long previous_esp;
15380 + u32 stack[THREAD_SIZE/sizeof(u32)];
15381 } __attribute__((aligned(THREAD_SIZE)));
15383 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15384 @@ -75,10 +75,9 @@ static void call_on_stack(void *func, void *stack)
15386 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15388 - union irq_ctx *curctx, *irqctx;
15389 + union irq_ctx *irqctx;
15390 u32 *isp, arg1, arg2;
15392 - curctx = (union irq_ctx *) current_thread_info();
15393 irqctx = __this_cpu_read(hardirq_ctx);
15396 @@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15397 * handler) we can't do that and just have to keep using the
15398 * current stack (which is the irq stack already after all)
15400 - if (unlikely(curctx == irqctx))
15401 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15404 /* build the stack frame on the IRQ stack */
15405 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15406 - irqctx->tinfo.task = curctx->tinfo.task;
15407 - irqctx->tinfo.previous_esp = current_stack_pointer;
15408 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15409 + irqctx->previous_esp = current_stack_pointer;
15412 - * Copy the softirq bits in preempt_count so that the
15413 - * softirq checks work in the hardirq context.
15415 - irqctx->tinfo.preempt_count =
15416 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15417 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15418 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15419 + __set_fs(MAKE_MM_SEG(0));
15422 if (unlikely(overflow))
15423 call_on_stack(print_stack_overflow, isp);
15424 @@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15425 : "0" (irq), "1" (desc), "2" (isp),
15426 "D" (desc->handle_irq)
15427 : "memory", "cc", "ecx");
15429 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15430 + __set_fs(current_thread_info()->addr_limit);
15436 @@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15438 void __cpuinit irq_ctx_init(int cpu)
15440 - union irq_ctx *irqctx;
15442 if (per_cpu(hardirq_ctx, cpu))
15445 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15448 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15449 - irqctx->tinfo.cpu = cpu;
15450 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15451 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15453 - per_cpu(hardirq_ctx, cpu) = irqctx;
15455 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15458 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15459 - irqctx->tinfo.cpu = cpu;
15460 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15462 - per_cpu(softirq_ctx, cpu) = irqctx;
15463 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15464 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15466 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15467 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15468 @@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
15469 asmlinkage void do_softirq(void)
15471 unsigned long flags;
15472 - struct thread_info *curctx;
15473 union irq_ctx *irqctx;
15476 @@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
15477 local_irq_save(flags);
15479 if (local_softirq_pending()) {
15480 - curctx = current_thread_info();
15481 irqctx = __this_cpu_read(softirq_ctx);
15482 - irqctx->tinfo.task = curctx->task;
15483 - irqctx->tinfo.previous_esp = current_stack_pointer;
15484 + irqctx->previous_esp = current_stack_pointer;
15486 /* build the stack frame on the softirq stack */
15487 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15488 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15490 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15491 + __set_fs(MAKE_MM_SEG(0));
15494 call_on_stack(__do_softirq, isp);
15496 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15497 + __set_fs(current_thread_info()->addr_limit);
15501 * Shouldn't happen, we returned above if in_interrupt():
15503 diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
15504 index 00354d4..187ae44 100644
15505 --- a/arch/x86/kernel/kgdb.c
15506 +++ b/arch/x86/kernel/kgdb.c
15507 @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
15508 #ifdef CONFIG_X86_32
15511 - if (!user_mode_vm(regs))
15512 + if (!user_mode(regs))
15513 *(unsigned long *)mem = __KERNEL_DS;
15516 - if (!user_mode_vm(regs))
15517 + if (!user_mode(regs))
15518 *(unsigned long *)mem = kernel_stack_pointer(regs);
15521 @@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
15523 /* clear the trace bit */
15524 linux_regs->flags &= ~X86_EFLAGS_TF;
15525 - atomic_set(&kgdb_cpu_doing_single_step, -1);
15526 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15528 /* set the trace bit if we're stepping */
15529 if (remcomInBuffer[0] == 's') {
15530 linux_regs->flags |= X86_EFLAGS_TF;
15531 - atomic_set(&kgdb_cpu_doing_single_step,
15532 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15533 raw_smp_processor_id());
15536 @@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
15537 return NOTIFY_DONE;
15540 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15541 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15542 if (user_mode(regs))
15543 return single_step_cont(regs, args);
15545 diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
15546 index 794bc95..c6e29e9 100644
15547 --- a/arch/x86/kernel/kprobes.c
15548 +++ b/arch/x86/kernel/kprobes.c
15549 @@ -117,8 +117,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
15550 } __attribute__((packed)) *insn;
15552 insn = (struct __arch_relative_insn *)from;
15554 + pax_open_kernel();
15555 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15557 + pax_close_kernel();
15560 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15561 @@ -155,7 +158,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
15562 kprobe_opcode_t opcode;
15563 kprobe_opcode_t *orig_opcodes = opcodes;
15565 - if (search_exception_tables((unsigned long)opcodes))
15566 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15567 return 0; /* Page fault may occur on this address. */
15570 @@ -316,7 +319,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15573 insn_get_length(&insn);
15574 + pax_open_kernel();
15575 memcpy(dest, insn.kaddr, insn.length);
15576 + pax_close_kernel();
15578 #ifdef CONFIG_X86_64
15579 if (insn_rip_relative(&insn)) {
15580 @@ -340,7 +345,9 @@ static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
15582 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15583 disp = (u8 *) dest + insn_offset_displacement(&insn);
15584 + pax_open_kernel();
15585 *(s32 *) disp = (s32) newdisp;
15586 + pax_close_kernel();
15589 return insn.length;
15590 @@ -354,12 +361,12 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
15592 __copy_instruction(p->ainsn.insn, p->addr, 0);
15594 - if (can_boost(p->addr))
15595 + if (can_boost(ktla_ktva(p->addr)))
15596 p->ainsn.boostable = 0;
15598 p->ainsn.boostable = -1;
15600 - p->opcode = *p->addr;
15601 + p->opcode = *(ktla_ktva(p->addr));
15604 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15605 @@ -476,7 +483,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15606 * nor set current_kprobe, because it doesn't use single
15609 - regs->ip = (unsigned long)p->ainsn.insn;
15610 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15611 preempt_enable_no_resched();
15614 @@ -495,7 +502,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
15615 if (p->opcode == BREAKPOINT_INSTRUCTION)
15616 regs->ip = (unsigned long)p->addr;
15618 - regs->ip = (unsigned long)p->ainsn.insn;
15619 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15623 @@ -574,7 +581,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
15624 setup_singlestep(p, regs, kcb, 0);
15627 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
15628 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15630 * The breakpoint instruction was removed right
15631 * after we hit it. Another cpu has removed
15632 @@ -682,6 +689,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
15633 " movq %rax, 152(%rsp)\n"
15634 RESTORE_REGS_STRING
15636 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
15637 + " btsq $63,(%rsp)\n"
15642 @@ -819,7 +829,7 @@ static void __kprobes resume_execution(struct kprobe *p,
15643 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15645 unsigned long *tos = stack_addr(regs);
15646 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15647 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15648 unsigned long orig_ip = (unsigned long)p->addr;
15649 kprobe_opcode_t *insn = p->ainsn.insn;
15651 @@ -1001,7 +1011,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
15652 struct die_args *args = data;
15653 int ret = NOTIFY_DONE;
15655 - if (args->regs && user_mode_vm(args->regs))
15656 + if (args->regs && user_mode(args->regs))
15660 @@ -1383,7 +1393,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15661 * Verify if the address gap is in 2GB range, because this uses
15664 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15665 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15666 if (abs(rel) > 0x7fffffff)
15669 @@ -1404,11 +1414,11 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
15670 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15672 /* Set probe function call */
15673 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15674 + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15676 /* Set returning jmp instruction at the tail of out-of-line buffer */
15677 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15678 - (u8 *)op->kp.addr + op->optinsn.size);
15679 + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15681 flush_icache_range((unsigned long) buf,
15682 (unsigned long) buf + TMPL_END_IDX +
15683 @@ -1430,7 +1440,7 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
15684 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15686 /* Backup instructions which will be replaced by jump address */
15687 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15688 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15689 RELATIVE_ADDR_SIZE);
15691 insn_buf[0] = RELATIVEJUMP_OPCODE;
15692 diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
15693 index a9c2116..a52d4fc 100644
15694 --- a/arch/x86/kernel/kvm.c
15695 +++ b/arch/x86/kernel/kvm.c
15696 @@ -437,6 +437,7 @@ static void __init paravirt_ops_setup(void)
15697 pv_mmu_ops.set_pud = kvm_set_pud;
15698 #if PAGETABLE_LEVELS == 4
15699 pv_mmu_ops.set_pgd = kvm_set_pgd;
15700 + pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
15703 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
15704 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
15705 index ea69726..604d066 100644
15706 --- a/arch/x86/kernel/ldt.c
15707 +++ b/arch/x86/kernel/ldt.c
15708 @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
15713 + load_LDT_nolock(pc);
15714 if (!cpumask_equal(mm_cpumask(current->mm),
15715 cpumask_of(smp_processor_id())))
15716 smp_call_function(flush_ldt, current->mm, 1);
15720 + load_LDT_nolock(pc);
15724 @@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
15727 for (i = 0; i < old->size; i++)
15728 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15729 + write_ldt_entry(new->ldt, i, old->ldt + i);
15733 @@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
15734 retval = copy_ldt(&mm->context, &old_mm->context);
15735 mutex_unlock(&old_mm->context.lock);
15738 + if (tsk == current) {
15739 + mm->context.vdso = 0;
15741 +#ifdef CONFIG_X86_32
15742 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15743 + mm->context.user_cs_base = 0UL;
15744 + mm->context.user_cs_limit = ~0UL;
15746 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15747 + cpus_clear(mm->context.cpu_user_cs_mask);
15758 @@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
15762 +#ifdef CONFIG_PAX_SEGMEXEC
15763 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15769 fill_ldt(&ldt, &ldt_info);
15772 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
15773 index a3fa43b..8966f4c 100644
15774 --- a/arch/x86/kernel/machine_kexec_32.c
15775 +++ b/arch/x86/kernel/machine_kexec_32.c
15777 #include <asm/cacheflush.h>
15778 #include <asm/debugreg.h>
15780 -static void set_idt(void *newidt, __u16 limit)
15781 +static void set_idt(struct desc_struct *newidt, __u16 limit)
15783 struct desc_ptr curidt;
15785 @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16 limit)
15789 -static void set_gdt(void *newgdt, __u16 limit)
15790 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15792 struct desc_ptr curgdt;
15794 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15797 control_page = page_address(image->control_code_page);
15798 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15799 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15801 relocate_kernel_ptr = control_page;
15802 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15803 diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
15804 index 1a1b606..5c89b55 100644
15805 --- a/arch/x86/kernel/microcode_intel.c
15806 +++ b/arch/x86/kernel/microcode_intel.c
15807 @@ -440,13 +440,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
15809 static int get_ucode_user(void *to, const void *from, size_t n)
15811 - return copy_from_user(to, from, n);
15812 + return copy_from_user(to, (const void __force_user *)from, n);
15815 static enum ucode_state
15816 request_microcode_user(int cpu, const void __user *buf, size_t size)
15818 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
15819 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
15822 static void microcode_fini_cpu(int cpu)
15823 diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
15824 index 925179f..85bec6c 100644
15825 --- a/arch/x86/kernel/module.c
15826 +++ b/arch/x86/kernel/module.c
15827 @@ -36,15 +36,60 @@
15828 #define DEBUGP(fmt...)
15831 -void *module_alloc(unsigned long size)
15832 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
15834 if (PAGE_ALIGN(size) > MODULES_LEN)
15836 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
15837 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
15838 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
15839 -1, __builtin_return_address(0));
15842 +void *module_alloc(unsigned long size)
15845 +#ifdef CONFIG_PAX_KERNEXEC
15846 + return __module_alloc(size, PAGE_KERNEL);
15848 + return __module_alloc(size, PAGE_KERNEL_EXEC);
15853 +#ifdef CONFIG_PAX_KERNEXEC
15854 +#ifdef CONFIG_X86_32
15855 +void *module_alloc_exec(unsigned long size)
15857 + struct vm_struct *area;
15862 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
15863 + return area ? area->addr : NULL;
15865 +EXPORT_SYMBOL(module_alloc_exec);
15867 +void module_free_exec(struct module *mod, void *module_region)
15869 + vunmap(module_region);
15871 +EXPORT_SYMBOL(module_free_exec);
15873 +void module_free_exec(struct module *mod, void *module_region)
15875 + module_free(mod, module_region);
15877 +EXPORT_SYMBOL(module_free_exec);
15879 +void *module_alloc_exec(unsigned long size)
15881 + return __module_alloc(size, PAGE_KERNEL_RX);
15883 +EXPORT_SYMBOL(module_alloc_exec);
15887 #ifdef CONFIG_X86_32
15888 int apply_relocate(Elf32_Shdr *sechdrs,
15889 const char *strtab,
15890 @@ -55,14 +100,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15892 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
15894 - uint32_t *location;
15895 + uint32_t *plocation, location;
15897 DEBUGP("Applying relocate section %u to %u\n", relsec,
15898 sechdrs[relsec].sh_info);
15899 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
15900 /* This is where to make the change */
15901 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
15902 - + rel[i].r_offset;
15903 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
15904 + location = (uint32_t)plocation;
15905 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
15906 + plocation = ktla_ktva((void *)plocation);
15907 /* This is the symbol it is referring to. Note that all
15908 undefined symbols have been resolved. */
15909 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
15910 @@ -71,11 +118,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15911 switch (ELF32_R_TYPE(rel[i].r_info)) {
15913 /* We add the value into the location given */
15914 - *location += sym->st_value;
15915 + pax_open_kernel();
15916 + *plocation += sym->st_value;
15917 + pax_close_kernel();
15920 /* Add the value, subtract its postition */
15921 - *location += sym->st_value - (uint32_t)location;
15922 + pax_open_kernel();
15923 + *plocation += sym->st_value - location;
15924 + pax_close_kernel();
15927 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
15928 @@ -120,21 +171,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
15929 case R_X86_64_NONE:
15932 + pax_open_kernel();
15934 + pax_close_kernel();
15937 + pax_open_kernel();
15939 + pax_close_kernel();
15940 if (val != *(u32 *)loc)
15944 + pax_open_kernel();
15946 + pax_close_kernel();
15947 if ((s64)val != *(s32 *)loc)
15950 case R_X86_64_PC32:
15952 + pax_open_kernel();
15954 + pax_close_kernel();
15957 if ((s64)val != *(s32 *)loc)
15959 diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
15960 index 676b8c7..870ba04 100644
15961 --- a/arch/x86/kernel/paravirt-spinlocks.c
15962 +++ b/arch/x86/kernel/paravirt-spinlocks.c
15963 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
15964 arch_spin_lock(lock);
15967 -struct pv_lock_ops pv_lock_ops = {
15968 +struct pv_lock_ops pv_lock_ops __read_only = {
15970 .spin_is_locked = __ticket_spin_is_locked,
15971 .spin_is_contended = __ticket_spin_is_contended,
15972 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
15973 index d90272e..2d54e8e 100644
15974 --- a/arch/x86/kernel/paravirt.c
15975 +++ b/arch/x86/kernel/paravirt.c
15976 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
15980 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
15981 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
15984 void __init default_banner(void)
15986 @@ -133,6 +136,9 @@ static void *get_call_destination(u8 type)
15987 .pv_lock_ops = pv_lock_ops,
15991 + pax_track_stack();
15993 return *((void **)&tmpl + type);
15996 @@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
15997 if (opfunc == NULL)
15998 /* If there's no function, patch it with a ud2a (BUG) */
15999 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16000 - else if (opfunc == _paravirt_nop)
16001 + else if (opfunc == (void *)_paravirt_nop)
16002 /* If the operation is a nop, then nop the callsite */
16003 ret = paravirt_patch_nop();
16005 /* identity functions just return their single argument */
16006 - else if (opfunc == _paravirt_ident_32)
16007 + else if (opfunc == (void *)_paravirt_ident_32)
16008 ret = paravirt_patch_ident_32(insnbuf, len);
16009 - else if (opfunc == _paravirt_ident_64)
16010 + else if (opfunc == (void *)_paravirt_ident_64)
16011 ret = paravirt_patch_ident_64(insnbuf, len);
16012 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16013 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16014 + ret = paravirt_patch_ident_64(insnbuf, len);
16017 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16018 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16019 @@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
16020 if (insn_len > len || start == NULL)
16023 - memcpy(insnbuf, start, insn_len);
16024 + memcpy(insnbuf, ktla_ktva(start), insn_len);
16028 @@ -302,7 +312,7 @@ void arch_flush_lazy_mmu_mode(void)
16032 -struct pv_info pv_info = {
16033 +struct pv_info pv_info __read_only = {
16034 .name = "bare hardware",
16035 .paravirt_enabled = 0,
16037 @@ -313,16 +323,16 @@ struct pv_info pv_info = {
16041 -struct pv_init_ops pv_init_ops = {
16042 +struct pv_init_ops pv_init_ops __read_only = {
16043 .patch = native_patch,
16046 -struct pv_time_ops pv_time_ops = {
16047 +struct pv_time_ops pv_time_ops __read_only = {
16048 .sched_clock = native_sched_clock,
16049 .steal_clock = native_steal_clock,
16052 -struct pv_irq_ops pv_irq_ops = {
16053 +struct pv_irq_ops pv_irq_ops __read_only = {
16054 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16055 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16056 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16057 @@ -334,7 +344,7 @@ struct pv_irq_ops pv_irq_ops = {
16061 -struct pv_cpu_ops pv_cpu_ops = {
16062 +struct pv_cpu_ops pv_cpu_ops __read_only = {
16063 .cpuid = native_cpuid,
16064 .get_debugreg = native_get_debugreg,
16065 .set_debugreg = native_set_debugreg,
16066 @@ -395,21 +405,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16067 .end_context_switch = paravirt_nop,
16070 -struct pv_apic_ops pv_apic_ops = {
16071 +struct pv_apic_ops pv_apic_ops __read_only = {
16072 #ifdef CONFIG_X86_LOCAL_APIC
16073 .startup_ipi_hook = paravirt_nop,
16077 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16078 +#ifdef CONFIG_X86_32
16079 +#ifdef CONFIG_X86_PAE
16080 +/* 64-bit pagetable entries */
16081 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16083 /* 32-bit pagetable entries */
16084 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16087 /* 64-bit pagetable entries */
16088 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16091 -struct pv_mmu_ops pv_mmu_ops = {
16092 +struct pv_mmu_ops pv_mmu_ops __read_only = {
16094 .read_cr2 = native_read_cr2,
16095 .write_cr2 = native_write_cr2,
16096 @@ -459,6 +474,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16097 .make_pud = PTE_IDENT,
16099 .set_pgd = native_set_pgd,
16100 + .set_pgd_batched = native_set_pgd_batched,
16102 #endif /* PAGETABLE_LEVELS >= 3 */
16104 @@ -478,6 +494,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16107 .set_fixmap = native_set_fixmap,
16109 +#ifdef CONFIG_PAX_KERNEXEC
16110 + .pax_open_kernel = native_pax_open_kernel,
16111 + .pax_close_kernel = native_pax_close_kernel,
16116 EXPORT_SYMBOL_GPL(pv_time_ops);
16117 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
16118 index 35ccf75..67e7d4d 100644
16119 --- a/arch/x86/kernel/pci-iommu_table.c
16120 +++ b/arch/x86/kernel/pci-iommu_table.c
16122 #include <asm/iommu_table.h>
16123 #include <linux/string.h>
16124 #include <linux/kallsyms.h>
16126 +#include <linux/sched.h>
16130 @@ -51,6 +51,8 @@ void __init check_iommu_entries(struct iommu_table_entry *start,
16132 struct iommu_table_entry *p, *q, *x;
16134 + pax_track_stack();
16136 /* Simple cyclic dependency checker. */
16137 for (p = start; p < finish; p++) {
16138 q = find_dependents_of(start, finish, p);
16139 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
16140 index 30eb651..0758167 100644
16141 --- a/arch/x86/kernel/process.c
16142 +++ b/arch/x86/kernel/process.c
16143 @@ -48,16 +48,33 @@ void free_thread_xstate(struct task_struct *tsk)
16145 void free_thread_info(struct thread_info *ti)
16147 - free_thread_xstate(ti->task);
16148 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16151 +static struct kmem_cache *task_struct_cachep;
16153 void arch_task_cache_init(void)
16155 - task_xstate_cachep =
16156 - kmem_cache_create("task_xstate", xstate_size,
16157 + /* create a slab on which task_structs can be allocated */
16158 + task_struct_cachep =
16159 + kmem_cache_create("task_struct", sizeof(struct task_struct),
16160 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16162 + task_xstate_cachep =
16163 + kmem_cache_create("task_xstate", xstate_size,
16164 __alignof__(union thread_xstate),
16165 - SLAB_PANIC | SLAB_NOTRACK, NULL);
16166 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16169 +struct task_struct *alloc_task_struct_node(int node)
16171 + return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16174 +void free_task_struct(struct task_struct *task)
16176 + free_thread_xstate(task);
16177 + kmem_cache_free(task_struct_cachep, task);
16181 @@ -70,7 +87,7 @@ void exit_thread(void)
16182 unsigned long *bp = t->io_bitmap_ptr;
16185 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16186 + struct tss_struct *tss = init_tss + get_cpu();
16188 t->io_bitmap_ptr = NULL;
16189 clear_thread_flag(TIF_IO_BITMAP);
16190 @@ -106,7 +123,7 @@ void show_regs_common(void)
16192 printk(KERN_CONT "\n");
16193 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16194 - current->pid, current->comm, print_tainted(),
16195 + task_pid_nr(current), current->comm, print_tainted(),
16196 init_utsname()->release,
16197 (int)strcspn(init_utsname()->version, " "),
16198 init_utsname()->version);
16199 @@ -120,6 +137,9 @@ void flush_thread(void)
16201 struct task_struct *tsk = current;
16203 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16204 + loadsegment(gs, 0);
16206 flush_ptrace_hw_breakpoint(tsk);
16207 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16209 @@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
16210 regs.di = (unsigned long) arg;
16212 #ifdef CONFIG_X86_32
16213 - regs.ds = __USER_DS;
16214 - regs.es = __USER_DS;
16215 + regs.ds = __KERNEL_DS;
16216 + regs.es = __KERNEL_DS;
16217 regs.fs = __KERNEL_PERCPU;
16218 - regs.gs = __KERNEL_STACK_CANARY;
16219 + savesegment(gs, regs.gs);
16221 regs.ss = __KERNEL_DS;
16223 @@ -411,7 +431,8 @@ bool set_pm_idle_to_default(void)
16227 -void stop_this_cpu(void *dummy)
16229 +__noreturn void stop_this_cpu(void *dummy)
16231 local_irq_disable();
16233 @@ -653,16 +674,37 @@ static int __init idle_setup(char *str)
16235 early_param("idle", idle_setup);
16237 -unsigned long arch_align_stack(unsigned long sp)
16238 +#ifdef CONFIG_PAX_RANDKSTACK
16239 +void pax_randomize_kstack(struct pt_regs *regs)
16241 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16242 - sp -= get_random_int() % 8192;
16243 - return sp & ~0xf;
16245 + struct thread_struct *thread = ¤t->thread;
16246 + unsigned long time;
16248 -unsigned long arch_randomize_brk(struct mm_struct *mm)
16250 - unsigned long range_end = mm->brk + 0x02000000;
16251 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16253 + if (!randomize_va_space)
16256 + if (v8086_mode(regs))
16261 + /* P4 seems to return a 0 LSB, ignore it */
16262 +#ifdef CONFIG_MPENTIUM4
16265 +#elif defined(CONFIG_X86_64)
16273 + thread->sp0 ^= time;
16274 + load_sp0(init_tss + smp_processor_id(), thread);
16276 +#ifdef CONFIG_X86_64
16277 + percpu_write(kernel_stack, thread->sp0);
16281 diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
16282 index 7a3b651..5a946f6 100644
16283 --- a/arch/x86/kernel/process_32.c
16284 +++ b/arch/x86/kernel/process_32.c
16285 @@ -66,6 +66,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
16286 unsigned long thread_saved_pc(struct task_struct *tsk)
16288 return ((unsigned long *)tsk->thread.sp)[3];
16289 +//XXX return tsk->thread.eip;
16293 @@ -128,15 +129,14 @@ void __show_regs(struct pt_regs *regs, int all)
16295 unsigned short ss, gs;
16297 - if (user_mode_vm(regs)) {
16298 + if (user_mode(regs)) {
16300 ss = regs->ss & 0xffff;
16301 - gs = get_user_gs(regs);
16303 sp = kernel_stack_pointer(regs);
16304 savesegment(ss, ss);
16305 - savesegment(gs, gs);
16307 + gs = get_user_gs(regs);
16309 show_regs_common();
16311 @@ -198,13 +198,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16312 struct task_struct *tsk;
16315 - childregs = task_pt_regs(p);
16316 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16317 *childregs = *regs;
16319 childregs->sp = sp;
16321 p->thread.sp = (unsigned long) childregs;
16322 p->thread.sp0 = (unsigned long) (childregs+1);
16323 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16325 p->thread.ip = (unsigned long) ret_from_fork;
16327 @@ -294,7 +295,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16328 struct thread_struct *prev = &prev_p->thread,
16329 *next = &next_p->thread;
16330 int cpu = smp_processor_id();
16331 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16332 + struct tss_struct *tss = init_tss + cpu;
16335 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16336 @@ -329,6 +330,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16338 lazy_save_gs(prev->gs);
16340 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16341 + __set_fs(task_thread_info(next_p)->addr_limit);
16345 * Load the per-thread Thread-Local Storage descriptor.
16347 @@ -364,6 +369,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16349 arch_end_context_switch(next_p);
16351 + percpu_write(current_task, next_p);
16352 + percpu_write(current_tinfo, &next_p->tinfo);
16355 __math_state_restore();
16357 @@ -373,8 +381,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16358 if (prev->gs | next->gs)
16359 lazy_load_gs(next->gs);
16361 - percpu_write(current_task, next_p);
16366 @@ -404,4 +410,3 @@ unsigned long get_wchan(struct task_struct *p)
16367 } while (count++ < 16);
16371 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
16372 index f693e44..3c979b2 100644
16373 --- a/arch/x86/kernel/process_64.c
16374 +++ b/arch/x86/kernel/process_64.c
16375 @@ -88,7 +88,7 @@ static void __exit_idle(void)
16376 void exit_idle(void)
16378 /* idle loop has pid 0 */
16379 - if (current->pid)
16380 + if (task_pid_nr(current))
16384 @@ -262,8 +262,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16385 struct pt_regs *childregs;
16386 struct task_struct *me = current;
16388 - childregs = ((struct pt_regs *)
16389 - (THREAD_SIZE + task_stack_page(p))) - 1;
16390 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16391 *childregs = *regs;
16394 @@ -275,6 +274,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
16395 p->thread.sp = (unsigned long) childregs;
16396 p->thread.sp0 = (unsigned long) (childregs+1);
16397 p->thread.usersp = me->thread.usersp;
16398 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16400 set_tsk_thread_flag(p, TIF_FORK);
16402 @@ -377,7 +377,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16403 struct thread_struct *prev = &prev_p->thread;
16404 struct thread_struct *next = &next_p->thread;
16405 int cpu = smp_processor_id();
16406 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16407 + struct tss_struct *tss = init_tss + cpu;
16408 unsigned fsindex, gsindex;
16411 @@ -473,10 +473,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
16412 prev->usersp = percpu_read(old_rsp);
16413 percpu_write(old_rsp, next->usersp);
16414 percpu_write(current_task, next_p);
16415 + percpu_write(current_tinfo, &next_p->tinfo);
16417 - percpu_write(kernel_stack,
16418 - (unsigned long)task_stack_page(next_p) +
16419 - THREAD_SIZE - KERNEL_STACK_OFFSET);
16420 + percpu_write(kernel_stack, next->sp0);
16423 * Now maybe reload the debug registers and handle I/O bitmaps
16424 @@ -538,12 +537,11 @@ unsigned long get_wchan(struct task_struct *p)
16425 if (!p || p == current || p->state == TASK_RUNNING)
16427 stack = (unsigned long)task_stack_page(p);
16428 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16429 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16431 fp = *(u64 *)(p->thread.sp);
16433 - if (fp < (unsigned long)stack ||
16434 - fp >= (unsigned long)stack+THREAD_SIZE)
16435 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16437 ip = *(u64 *)(fp+8);
16438 if (!in_sched_functions(ip))
16439 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
16440 index 8252879..d3219e0 100644
16441 --- a/arch/x86/kernel/ptrace.c
16442 +++ b/arch/x86/kernel/ptrace.c
16443 @@ -822,7 +822,7 @@ long arch_ptrace(struct task_struct *child, long request,
16444 unsigned long addr, unsigned long data)
16447 - unsigned long __user *datap = (unsigned long __user *)data;
16448 + unsigned long __user *datap = (__force unsigned long __user *)data;
16451 /* read the word at location addr in the USER area. */
16452 @@ -907,14 +907,14 @@ long arch_ptrace(struct task_struct *child, long request,
16453 if ((int) addr < 0)
16455 ret = do_get_thread_area(child, addr,
16456 - (struct user_desc __user *)data);
16457 + (__force struct user_desc __user *) data);
16460 case PTRACE_SET_THREAD_AREA:
16461 if ((int) addr < 0)
16463 ret = do_set_thread_area(child, addr,
16464 - (struct user_desc __user *)data, 0);
16465 + (__force struct user_desc __user *) data, 0);
16469 @@ -1331,7 +1331,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
16470 memset(info, 0, sizeof(*info));
16471 info->si_signo = SIGTRAP;
16472 info->si_code = si_code;
16473 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16474 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16477 void user_single_step_siginfo(struct task_struct *tsk,
16478 diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
16479 index 42eb330..139955c 100644
16480 --- a/arch/x86/kernel/pvclock.c
16481 +++ b/arch/x86/kernel/pvclock.c
16482 @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
16486 -static atomic64_t last_value = ATOMIC64_INIT(0);
16487 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16489 void pvclock_resume(void)
16491 - atomic64_set(&last_value, 0);
16492 + atomic64_set_unchecked(&last_value, 0);
16495 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16496 @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16497 * updating at the same time, and one of them could be slightly behind,
16498 * making the assumption that last_value always go forward fail to hold.
16500 - last = atomic64_read(&last_value);
16501 + last = atomic64_read_unchecked(&last_value);
16505 - last = atomic64_cmpxchg(&last_value, last, ret);
16506 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16507 } while (unlikely(last != ret));
16510 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
16511 index d4a705f..ef8f1a9 100644
16512 --- a/arch/x86/kernel/reboot.c
16513 +++ b/arch/x86/kernel/reboot.c
16514 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16515 EXPORT_SYMBOL(pm_power_off);
16517 static const struct desc_ptr no_idt = {};
16518 -static int reboot_mode;
16519 +static unsigned short reboot_mode;
16520 enum reboot_type reboot_type = BOOT_ACPI;
16523 @@ -324,13 +324,17 @@ core_initcall(reboot_init);
16524 extern const unsigned char machine_real_restart_asm[];
16525 extern const u64 machine_real_restart_gdt[3];
16527 -void machine_real_restart(unsigned int type)
16528 +__noreturn void machine_real_restart(unsigned int type)
16531 unsigned long restart_pa;
16532 - void (*restart_lowmem)(unsigned int);
16533 + void (* __noreturn restart_lowmem)(unsigned int);
16536 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16537 + struct desc_struct *gdt;
16540 local_irq_disable();
16542 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16543 @@ -356,14 +360,14 @@ void machine_real_restart(unsigned int type)
16544 boot)". This seems like a fairly standard thing that gets set by
16545 REBOOT.COM programs, and the previous reset routine did this
16547 - *((unsigned short *)0x472) = reboot_mode;
16548 + *(unsigned short *)(__va(0x472)) = reboot_mode;
16550 /* Patch the GDT in the low memory trampoline */
16551 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16553 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16554 restart_pa = virt_to_phys(restart_va);
16555 - restart_lowmem = (void (*)(unsigned int))restart_pa;
16556 + restart_lowmem = (void *)restart_pa;
16558 /* GDT[0]: GDT self-pointer */
16560 @@ -374,7 +378,33 @@ void machine_real_restart(unsigned int type)
16561 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16563 /* Jump to the identity-mapped low memory code */
16565 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16566 + gdt = get_cpu_gdt_table(smp_processor_id());
16567 + pax_open_kernel();
16568 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16569 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16570 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16571 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16573 +#ifdef CONFIG_PAX_KERNEXEC
16574 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16575 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16576 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16577 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16578 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16579 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16581 + pax_close_kernel();
16584 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16585 + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16588 restart_lowmem(type);
16592 #ifdef CONFIG_APM_MODULE
16593 EXPORT_SYMBOL(machine_real_restart);
16594 @@ -532,7 +562,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
16595 * try to force a triple fault and then cycle between hitting the keyboard
16596 * controller and doing that
16598 -static void native_machine_emergency_restart(void)
16599 +__noreturn static void native_machine_emergency_restart(void)
16603 @@ -656,13 +686,13 @@ void native_machine_shutdown(void)
16607 -static void __machine_emergency_restart(int emergency)
16608 +static __noreturn void __machine_emergency_restart(int emergency)
16610 reboot_emergency = emergency;
16611 machine_ops.emergency_restart();
16614 -static void native_machine_restart(char *__unused)
16615 +static __noreturn void native_machine_restart(char *__unused)
16617 printk("machine restart\n");
16619 @@ -671,7 +701,7 @@ static void native_machine_restart(char *__unused)
16620 __machine_emergency_restart(0);
16623 -static void native_machine_halt(void)
16624 +static __noreturn void native_machine_halt(void)
16626 /* stop other cpus and apics */
16627 machine_shutdown();
16628 @@ -682,7 +712,7 @@ static void native_machine_halt(void)
16629 stop_this_cpu(NULL);
16632 -static void native_machine_power_off(void)
16633 +__noreturn static void native_machine_power_off(void)
16635 if (pm_power_off) {
16637 @@ -691,6 +721,7 @@ static void native_machine_power_off(void)
16639 /* a fallback in case there is no PM info available */
16640 tboot_shutdown(TB_SHUTDOWN_HALT);
16644 struct machine_ops machine_ops = {
16645 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
16646 index 7a6f3b3..bed145d7 100644
16647 --- a/arch/x86/kernel/relocate_kernel_64.S
16648 +++ b/arch/x86/kernel/relocate_kernel_64.S
16650 #include <asm/kexec.h>
16651 #include <asm/processor-flags.h>
16652 #include <asm/pgtable_types.h>
16653 +#include <asm/alternative-asm.h>
16656 * Must be relocatable PIC code callable as a C function
16657 @@ -160,13 +161,14 @@ identity_mapped:
16669 + pax_force_retaddr 0, 1
16673 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
16674 index afaf384..1a101fe 100644
16675 --- a/arch/x86/kernel/setup.c
16676 +++ b/arch/x86/kernel/setup.c
16677 @@ -447,7 +447,7 @@ static void __init parse_setup_data(void)
16679 switch (data->type) {
16680 case SETUP_E820_EXT:
16681 - parse_e820_ext(data);
16682 + parse_e820_ext((struct setup_data __force_kernel *)data);
16686 @@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16687 * area (640->1Mb) as ram even though it is not.
16690 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16691 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16692 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16695 @@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
16697 if (!boot_params.hdr.root_flags)
16698 root_mountflags &= ~MS_RDONLY;
16699 - init_mm.start_code = (unsigned long) _text;
16700 - init_mm.end_code = (unsigned long) _etext;
16701 + init_mm.start_code = ktla_ktva((unsigned long) _text);
16702 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
16703 init_mm.end_data = (unsigned long) _edata;
16704 init_mm.brk = _brk_end;
16706 - code_resource.start = virt_to_phys(_text);
16707 - code_resource.end = virt_to_phys(_etext)-1;
16708 - data_resource.start = virt_to_phys(_etext);
16709 + code_resource.start = virt_to_phys(ktla_ktva(_text));
16710 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16711 + data_resource.start = virt_to_phys(_sdata);
16712 data_resource.end = virt_to_phys(_edata)-1;
16713 bss_resource.start = virt_to_phys(&__bss_start);
16714 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16715 diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
16716 index 71f4727..16dc9f7 100644
16717 --- a/arch/x86/kernel/setup_percpu.c
16718 +++ b/arch/x86/kernel/setup_percpu.c
16719 @@ -21,19 +21,17 @@
16720 #include <asm/cpu.h>
16721 #include <asm/stackprotector.h>
16723 -DEFINE_PER_CPU(int, cpu_number);
16725 +DEFINE_PER_CPU(unsigned int, cpu_number);
16726 EXPORT_PER_CPU_SYMBOL(cpu_number);
16729 -#ifdef CONFIG_X86_64
16730 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16732 -#define BOOT_PERCPU_OFFSET 0
16735 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16736 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16738 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16739 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16740 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16742 EXPORT_SYMBOL(__per_cpu_offset);
16743 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
16745 #ifdef CONFIG_X86_32
16746 struct desc_struct gdt;
16747 + unsigned long base = per_cpu_offset(cpu);
16749 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16750 - 0x2 | DESCTYPE_S, 0x8);
16752 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16753 + 0x83 | DESCTYPE_S, 0xC);
16754 write_gdt_entry(get_cpu_gdt_table(cpu),
16755 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16757 @@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
16758 /* alrighty, percpu areas up and running */
16759 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16760 for_each_possible_cpu(cpu) {
16761 +#ifdef CONFIG_CC_STACKPROTECTOR
16762 +#ifdef CONFIG_X86_32
16763 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
16766 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
16767 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
16768 per_cpu(cpu_number, cpu) = cpu;
16769 @@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
16771 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
16773 +#ifdef CONFIG_CC_STACKPROTECTOR
16774 +#ifdef CONFIG_X86_32
16776 + per_cpu(stack_canary.canary, cpu) = canary;
16780 * Up to this point, the boot CPU has been using .init.data
16781 * area. Reload any changed state for the boot CPU.
16782 diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
16783 index 54ddaeb2..a6aa4d2 100644
16784 --- a/arch/x86/kernel/signal.c
16785 +++ b/arch/x86/kernel/signal.c
16786 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsigned long sp)
16787 * Align the stack pointer according to the i386 ABI,
16788 * i.e. so that on function entry ((sp + 4) & 15) == 0.
16790 - sp = ((sp + 4) & -16ul) - 4;
16791 + sp = ((sp - 12) & -16ul) - 4;
16792 #else /* !CONFIG_X86_32 */
16793 sp = round_down(sp, 16) - 8;
16795 @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
16796 * Return an always-bogus address instead so we will die with SIGSEGV.
16798 if (onsigstack && !likely(on_sig_stack(sp)))
16799 - return (void __user *)-1L;
16800 + return (__force void __user *)-1L;
16802 /* save i387 state */
16803 if (used_math() && save_i387_xstate(*fpstate) < 0)
16804 - return (void __user *)-1L;
16805 + return (__force void __user *)-1L;
16807 return (void __user *)sp;
16809 @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16812 if (current->mm->context.vdso)
16813 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16814 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16816 - restorer = &frame->retcode;
16817 + restorer = (void __user *)&frame->retcode;
16818 if (ka->sa.sa_flags & SA_RESTORER)
16819 restorer = ka->sa.sa_restorer;
16821 @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
16822 * reasons and because gdb uses it as a signature to notice
16823 * signal handler stack frames.
16825 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
16826 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
16830 @@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16831 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
16833 /* Set up to return from userspace. */
16834 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16835 + if (current->mm->context.vdso)
16836 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16838 + restorer = (void __user *)&frame->retcode;
16839 if (ka->sa.sa_flags & SA_RESTORER)
16840 restorer = ka->sa.sa_restorer;
16841 put_user_ex(restorer, &frame->pretcode);
16842 @@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
16843 * reasons and because gdb uses it as a signature to notice
16844 * signal handler stack frames.
16846 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
16847 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
16848 } put_user_catch(err);
16851 @@ -762,6 +765,8 @@ static void do_signal(struct pt_regs *regs)
16855 + pax_track_stack();
16858 * We want the common case to go fast, which is why we may in certain
16859 * cases get here from kernel mode. Just return without doing anything
16860 @@ -769,7 +774,7 @@ static void do_signal(struct pt_regs *regs)
16861 * X86_32: vm86 regs switched out by assembly code before reaching
16862 * here, so testing against kernel CS suffices.
16864 - if (!user_mode(regs))
16865 + if (!user_mode_novm(regs))
16868 signr = get_signal_to_deliver(&info, &ka, regs, NULL);
16869 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
16870 index 9f548cb..caf76f7 100644
16871 --- a/arch/x86/kernel/smpboot.c
16872 +++ b/arch/x86/kernel/smpboot.c
16873 @@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
16874 set_idle_for_cpu(cpu, c_idle.idle);
16876 per_cpu(current_task, cpu) = c_idle.idle;
16877 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
16878 #ifdef CONFIG_X86_32
16879 /* Stack for startup_32 can be just as for start_secondary onwards */
16882 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
16883 initial_gs = per_cpu_offset(cpu);
16884 - per_cpu(kernel_stack, cpu) =
16885 - (unsigned long)task_stack_page(c_idle.idle) -
16886 - KERNEL_STACK_OFFSET + THREAD_SIZE;
16887 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
16890 + pax_open_kernel();
16891 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
16892 + pax_close_kernel();
16894 initial_code = (unsigned long)start_secondary;
16895 stack_start = c_idle.idle->thread.sp;
16897 @@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
16899 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
16901 +#ifdef CONFIG_PAX_PER_CPU_PGD
16902 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
16903 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16904 + KERNEL_PGD_PTRS);
16907 err = do_boot_cpu(apicid, cpu);
16909 pr_debug("do_boot_cpu failed %d\n", err);
16910 diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
16911 index c346d11..d43b163 100644
16912 --- a/arch/x86/kernel/step.c
16913 +++ b/arch/x86/kernel/step.c
16914 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16915 struct desc_struct *desc;
16916 unsigned long base;
16921 mutex_lock(&child->mm->context.lock);
16922 - if (unlikely((seg >> 3) >= child->mm->context.size))
16923 + if (unlikely(seg >= child->mm->context.size))
16924 addr = -1L; /* bogus selector, access would fault */
16926 desc = child->mm->context.ldt + seg;
16927 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
16930 mutex_unlock(&child->mm->context.lock);
16932 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
16933 + addr = ktla_ktva(addr);
16937 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
16938 unsigned char opcode[15];
16939 unsigned long addr = convert_ip_to_linear(child, regs);
16941 + if (addr == -EINVAL)
16944 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
16945 for (i = 0; i < copied; i++) {
16946 switch (opcode[i]) {
16947 diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
16948 index 0b0cb5f..db6b9ed 100644
16949 --- a/arch/x86/kernel/sys_i386_32.c
16950 +++ b/arch/x86/kernel/sys_i386_32.c
16951 @@ -24,17 +24,224 @@
16953 #include <asm/syscalls.h>
16956 - * Do a system call from kernel instead of calling sys_execve so we
16957 - * end up with proper pt_regs.
16959 -int kernel_execve(const char *filename,
16960 - const char *const argv[],
16961 - const char *const envp[])
16962 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
16965 - asm volatile ("int $0x80"
16967 - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
16969 + unsigned long pax_task_size = TASK_SIZE;
16971 +#ifdef CONFIG_PAX_SEGMEXEC
16972 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
16973 + pax_task_size = SEGMEXEC_TASK_SIZE;
16976 + if (len > pax_task_size || addr > pax_task_size - len)
16983 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
16984 + unsigned long len, unsigned long pgoff, unsigned long flags)
16986 + struct mm_struct *mm = current->mm;
16987 + struct vm_area_struct *vma;
16988 + unsigned long start_addr, pax_task_size = TASK_SIZE;
16990 +#ifdef CONFIG_PAX_SEGMEXEC
16991 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
16992 + pax_task_size = SEGMEXEC_TASK_SIZE;
16995 + pax_task_size -= PAGE_SIZE;
16997 + if (len > pax_task_size)
17000 + if (flags & MAP_FIXED)
17003 +#ifdef CONFIG_PAX_RANDMMAP
17004 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17008 + addr = PAGE_ALIGN(addr);
17009 + if (pax_task_size - len >= addr) {
17010 + vma = find_vma(mm, addr);
17011 + if (check_heap_stack_gap(vma, addr, len))
17015 + if (len > mm->cached_hole_size) {
17016 + start_addr = addr = mm->free_area_cache;
17018 + start_addr = addr = mm->mmap_base;
17019 + mm->cached_hole_size = 0;
17022 +#ifdef CONFIG_PAX_PAGEEXEC
17023 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17024 + start_addr = 0x00110000UL;
17026 +#ifdef CONFIG_PAX_RANDMMAP
17027 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17028 + start_addr += mm->delta_mmap & 0x03FFF000UL;
17031 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17032 + start_addr = addr = mm->mmap_base;
17034 + addr = start_addr;
17039 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17040 + /* At this point: (!vma || addr < vma->vm_end). */
17041 + if (pax_task_size - len < addr) {
17043 + * Start a new search - just in case we missed
17046 + if (start_addr != mm->mmap_base) {
17047 + start_addr = addr = mm->mmap_base;
17048 + mm->cached_hole_size = 0;
17049 + goto full_search;
17053 + if (check_heap_stack_gap(vma, addr, len))
17055 + if (addr + mm->cached_hole_size < vma->vm_start)
17056 + mm->cached_hole_size = vma->vm_start - addr;
17057 + addr = vma->vm_end;
17058 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
17059 + start_addr = addr = mm->mmap_base;
17060 + mm->cached_hole_size = 0;
17061 + goto full_search;
17066 + * Remember the place where we stopped the search:
17068 + mm->free_area_cache = addr + len;
17073 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17074 + const unsigned long len, const unsigned long pgoff,
17075 + const unsigned long flags)
17077 + struct vm_area_struct *vma;
17078 + struct mm_struct *mm = current->mm;
17079 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17081 +#ifdef CONFIG_PAX_SEGMEXEC
17082 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17083 + pax_task_size = SEGMEXEC_TASK_SIZE;
17086 + pax_task_size -= PAGE_SIZE;
17088 + /* requested length too big for entire address space */
17089 + if (len > pax_task_size)
17092 + if (flags & MAP_FIXED)
17095 +#ifdef CONFIG_PAX_PAGEEXEC
17096 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17100 +#ifdef CONFIG_PAX_RANDMMAP
17101 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17104 + /* requesting a specific address */
17106 + addr = PAGE_ALIGN(addr);
17107 + if (pax_task_size - len >= addr) {
17108 + vma = find_vma(mm, addr);
17109 + if (check_heap_stack_gap(vma, addr, len))
17114 + /* check if free_area_cache is useful for us */
17115 + if (len <= mm->cached_hole_size) {
17116 + mm->cached_hole_size = 0;
17117 + mm->free_area_cache = mm->mmap_base;
17120 + /* either no address requested or can't fit in requested address hole */
17121 + addr = mm->free_area_cache;
17123 + /* make sure it can fit in the remaining address space */
17124 + if (addr > len) {
17125 + vma = find_vma(mm, addr-len);
17126 + if (check_heap_stack_gap(vma, addr - len, len))
17127 + /* remember the address as a hint for next time */
17128 + return (mm->free_area_cache = addr-len);
17131 + if (mm->mmap_base < len)
17134 + addr = mm->mmap_base-len;
17138 + * Lookup failure means no vma is above this address,
17139 + * else if new region fits below vma->vm_start,
17140 + * return with success:
17142 + vma = find_vma(mm, addr);
17143 + if (check_heap_stack_gap(vma, addr, len))
17144 + /* remember the address as a hint for next time */
17145 + return (mm->free_area_cache = addr);
17147 + /* remember the largest hole we saw so far */
17148 + if (addr + mm->cached_hole_size < vma->vm_start)
17149 + mm->cached_hole_size = vma->vm_start - addr;
17151 + /* try just below the current vma->vm_start */
17152 + addr = skip_heap_stack_gap(vma, len);
17153 + } while (!IS_ERR_VALUE(addr));
17157 + * A failed mmap() very likely causes application failure,
17158 + * so fall back to the bottom-up function here. This scenario
17159 + * can happen with large stack limits and large mmap()
17163 +#ifdef CONFIG_PAX_SEGMEXEC
17164 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17165 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17169 + mm->mmap_base = TASK_UNMAPPED_BASE;
17171 +#ifdef CONFIG_PAX_RANDMMAP
17172 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17173 + mm->mmap_base += mm->delta_mmap;
17176 + mm->free_area_cache = mm->mmap_base;
17177 + mm->cached_hole_size = ~0UL;
17178 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17180 + * Restore the topdown base:
17182 + mm->mmap_base = base;
17183 + mm->free_area_cache = base;
17184 + mm->cached_hole_size = ~0UL;
17188 diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
17189 index ff14a50..35626c3 100644
17190 --- a/arch/x86/kernel/sys_x86_64.c
17191 +++ b/arch/x86/kernel/sys_x86_64.c
17192 @@ -32,8 +32,8 @@ out:
17196 -static void find_start_end(unsigned long flags, unsigned long *begin,
17197 - unsigned long *end)
17198 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
17199 + unsigned long *begin, unsigned long *end)
17201 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17202 unsigned long new_begin;
17203 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
17204 *begin = new_begin;
17207 - *begin = TASK_UNMAPPED_BASE;
17208 + *begin = mm->mmap_base;
17212 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
17213 if (flags & MAP_FIXED)
17216 - find_start_end(flags, &begin, &end);
17217 + find_start_end(mm, flags, &begin, &end);
17222 +#ifdef CONFIG_PAX_RANDMMAP
17223 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17227 addr = PAGE_ALIGN(addr);
17228 vma = find_vma(mm, addr);
17229 - if (end - len >= addr &&
17230 - (!vma || addr + len <= vma->vm_start))
17231 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17234 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17235 @@ -106,7 +109,7 @@ full_search:
17239 - if (!vma || addr + len <= vma->vm_start) {
17240 + if (check_heap_stack_gap(vma, addr, len)) {
17242 * Remember the place where we stopped the search:
17244 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17246 struct vm_area_struct *vma;
17247 struct mm_struct *mm = current->mm;
17248 - unsigned long addr = addr0;
17249 + unsigned long base = mm->mmap_base, addr = addr0;
17251 /* requested length too big for entire address space */
17252 if (len > TASK_SIZE)
17253 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17254 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17257 +#ifdef CONFIG_PAX_RANDMMAP
17258 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17261 /* requesting a specific address */
17263 addr = PAGE_ALIGN(addr);
17264 - vma = find_vma(mm, addr);
17265 - if (TASK_SIZE - len >= addr &&
17266 - (!vma || addr + len <= vma->vm_start))
17268 + if (TASK_SIZE - len >= addr) {
17269 + vma = find_vma(mm, addr);
17270 + if (check_heap_stack_gap(vma, addr, len))
17275 /* check if free_area_cache is useful for us */
17276 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17277 /* make sure it can fit in the remaining address space */
17279 vma = find_vma(mm, addr-len);
17280 - if (!vma || addr <= vma->vm_start)
17281 + if (check_heap_stack_gap(vma, addr - len, len))
17282 /* remember the address as a hint for next time */
17283 return mm->free_area_cache = addr-len;
17285 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17286 * return with success:
17288 vma = find_vma(mm, addr);
17289 - if (!vma || addr+len <= vma->vm_start)
17290 + if (check_heap_stack_gap(vma, addr, len))
17291 /* remember the address as a hint for next time */
17292 return mm->free_area_cache = addr;
17294 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17295 mm->cached_hole_size = vma->vm_start - addr;
17297 /* try just below the current vma->vm_start */
17298 - addr = vma->vm_start-len;
17299 - } while (len < vma->vm_start);
17300 + addr = skip_heap_stack_gap(vma, len);
17301 + } while (!IS_ERR_VALUE(addr));
17305 @@ -198,13 +206,21 @@ bottomup:
17306 * can happen with large stack limits and large mmap()
17309 + mm->mmap_base = TASK_UNMAPPED_BASE;
17311 +#ifdef CONFIG_PAX_RANDMMAP
17312 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17313 + mm->mmap_base += mm->delta_mmap;
17316 + mm->free_area_cache = mm->mmap_base;
17317 mm->cached_hole_size = ~0UL;
17318 - mm->free_area_cache = TASK_UNMAPPED_BASE;
17319 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17321 * Restore the topdown base:
17323 - mm->free_area_cache = mm->mmap_base;
17324 + mm->mmap_base = base;
17325 + mm->free_area_cache = base;
17326 mm->cached_hole_size = ~0UL;
17329 diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
17330 index bc19be3..0f5fbf7 100644
17331 --- a/arch/x86/kernel/syscall_table_32.S
17332 +++ b/arch/x86/kernel/syscall_table_32.S
17334 +.section .rodata,"a",@progbits
17335 ENTRY(sys_call_table)
17336 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17338 diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
17339 index e07a2fc..db0369d 100644
17340 --- a/arch/x86/kernel/tboot.c
17341 +++ b/arch/x86/kernel/tboot.c
17342 @@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17344 void tboot_shutdown(u32 shutdown_type)
17346 - void (*shutdown)(void);
17347 + void (* __noreturn shutdown)(void);
17349 if (!tboot_enabled())
17351 @@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17353 switch_to_tboot_pt();
17355 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17356 + shutdown = (void *)tboot->shutdown_entry;
17359 /* should not reach here */
17360 @@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
17361 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17364 -static atomic_t ap_wfs_count;
17365 +static atomic_unchecked_t ap_wfs_count;
17367 static int tboot_wait_for_aps(int num_aps)
17369 @@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
17373 - atomic_inc(&ap_wfs_count);
17374 + atomic_inc_unchecked(&ap_wfs_count);
17375 if (num_online_cpus() == 1)
17376 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17377 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17381 @@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17383 tboot_create_trampoline();
17385 - atomic_set(&ap_wfs_count, 0);
17386 + atomic_set_unchecked(&ap_wfs_count, 0);
17387 register_hotcpu_notifier(&tboot_cpu_notifier);
17390 diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
17391 index 5a64d05..804587b 100644
17392 --- a/arch/x86/kernel/time.c
17393 +++ b/arch/x86/kernel/time.c
17394 @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
17396 unsigned long pc = instruction_pointer(regs);
17398 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17399 + if (!user_mode(regs) && in_lock_functions(pc)) {
17400 #ifdef CONFIG_FRAME_POINTER
17401 - return *(unsigned long *)(regs->bp + sizeof(long));
17402 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17404 unsigned long *sp =
17405 (unsigned long *)kernel_stack_pointer(regs);
17406 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
17407 * or above a saved flags. Eflags has bits 22-31 zero,
17408 * kernel addresses don't.
17411 +#ifdef CONFIG_PAX_KERNEXEC
17412 + return ktla_ktva(sp[0]);
17424 diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
17425 index 6bb7b85..dd853e1 100644
17426 --- a/arch/x86/kernel/tls.c
17427 +++ b/arch/x86/kernel/tls.c
17428 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
17429 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17432 +#ifdef CONFIG_PAX_SEGMEXEC
17433 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17437 set_tls_desc(p, idx, &info, 1);
17440 diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
17441 index 451c0a7..e57f551 100644
17442 --- a/arch/x86/kernel/trampoline_32.S
17443 +++ b/arch/x86/kernel/trampoline_32.S
17445 #include <asm/segment.h>
17446 #include <asm/page_types.h>
17448 +#ifdef CONFIG_PAX_KERNEXEC
17451 +#define ta(X) ((X) - __PAGE_OFFSET)
17456 .section ".x86_trampoline","a"
17457 @@ -62,7 +68,7 @@ r_base = .
17458 inc %ax # protected mode (PE) bit
17459 lmsw %ax # into protected mode
17460 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17461 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17462 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
17464 # These need to be in the same 64K segment as the above;
17465 # hence we don't use the boot_gdt_descr defined in head.S
17466 diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
17467 index 09ff517..df19fbff 100644
17468 --- a/arch/x86/kernel/trampoline_64.S
17469 +++ b/arch/x86/kernel/trampoline_64.S
17470 @@ -90,7 +90,7 @@ startup_32:
17471 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17474 - movl $X86_CR4_PAE, %eax
17475 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17476 movl %eax, %cr4 # Enable PAE mode
17478 # Setup trampoline 4 level pagetables
17479 @@ -138,7 +138,7 @@ tidt:
17480 # so the kernel can live anywhere
17483 - .short tgdt_end - tgdt # gdt limit
17484 + .short tgdt_end - tgdt - 1 # gdt limit
17485 .long tgdt - r_base
17487 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17488 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
17489 index 6913369..7e7dff6 100644
17490 --- a/arch/x86/kernel/traps.c
17491 +++ b/arch/x86/kernel/traps.c
17492 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17494 /* Do we ignore FPU interrupts ? */
17495 char ignore_fpu_irq;
17498 - * The IDT has to be page-aligned to simplify the Pentium
17499 - * F0 0F bug workaround.
17501 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17504 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17505 @@ -117,13 +111,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
17508 static void __kprobes
17509 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17510 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17511 long error_code, siginfo_t *info)
17513 struct task_struct *tsk = current;
17515 #ifdef CONFIG_X86_32
17516 - if (regs->flags & X86_VM_MASK) {
17517 + if (v8086_mode(regs)) {
17519 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17520 * On nmi (interrupt 2), do_trap should not be called.
17521 @@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17525 - if (!user_mode(regs))
17526 + if (!user_mode_novm(regs))
17529 #ifdef CONFIG_X86_32
17530 @@ -157,7 +151,7 @@ trap_signal:
17531 printk_ratelimit()) {
17533 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17534 - tsk->comm, tsk->pid, str,
17535 + tsk->comm, task_pid_nr(tsk), str,
17536 regs->ip, regs->sp, error_code);
17537 print_vma_addr(" in ", regs->ip);
17539 @@ -174,8 +168,20 @@ kernel_trap:
17540 if (!fixup_exception(regs)) {
17541 tsk->thread.error_code = error_code;
17542 tsk->thread.trap_no = trapnr;
17544 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17545 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17546 + str = "PAX: suspicious stack segment fault";
17549 die(str, regs, error_code);
17552 +#ifdef CONFIG_PAX_REFCOUNT
17554 + pax_report_refcount_overflow(regs);
17559 #ifdef CONFIG_X86_32
17560 @@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
17561 conditional_sti(regs);
17563 #ifdef CONFIG_X86_32
17564 - if (regs->flags & X86_VM_MASK)
17565 + if (v8086_mode(regs))
17570 - if (!user_mode(regs))
17571 + if (!user_mode_novm(regs))
17574 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17575 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17576 + struct mm_struct *mm = tsk->mm;
17577 + unsigned long limit;
17579 + down_write(&mm->mmap_sem);
17580 + limit = mm->context.user_cs_limit;
17581 + if (limit < TASK_SIZE) {
17582 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17583 + up_write(&mm->mmap_sem);
17586 + up_write(&mm->mmap_sem);
17590 tsk->thread.error_code = error_code;
17591 tsk->thread.trap_no = 13;
17593 @@ -304,6 +326,13 @@ gp_in_kernel:
17594 if (notify_die(DIE_GPF, "general protection fault", regs,
17595 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17598 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17599 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17600 + die("PAX: suspicious general protection fault", regs, error_code);
17604 die("general protection fault", regs, error_code);
17607 @@ -433,6 +462,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
17608 dotraplinkage notrace __kprobes void
17609 do_nmi(struct pt_regs *regs, long error_code)
17612 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17613 + if (!user_mode(regs)) {
17614 + unsigned long cs = regs->cs & 0xFFFF;
17615 + unsigned long ip = ktva_ktla(regs->ip);
17617 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
17624 inc_irq_stat(__nmi_count);
17625 @@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17626 /* It's safe to allow irq's after DR6 has been saved */
17627 preempt_conditional_sti(regs);
17629 - if (regs->flags & X86_VM_MASK) {
17630 + if (v8086_mode(regs)) {
17631 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17633 preempt_conditional_cli(regs);
17634 @@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
17635 * We already checked v86 mode above, so we can check for kernel mode
17636 * by just checking the CPL of CS.
17638 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
17639 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17640 tsk->thread.debugreg6 &= ~DR_STEP;
17641 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17642 regs->flags &= ~X86_EFLAGS_TF;
17643 @@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
17645 conditional_sti(regs);
17647 - if (!user_mode_vm(regs))
17648 + if (!user_mode(regs))
17650 if (!fixup_exception(regs)) {
17651 task->thread.error_code = error_code;
17652 @@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
17653 void __math_state_restore(void)
17655 struct thread_info *thread = current_thread_info();
17656 - struct task_struct *tsk = thread->task;
17657 + struct task_struct *tsk = current;
17660 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17661 @@ -750,8 +790,7 @@ void __math_state_restore(void)
17663 asmlinkage void math_state_restore(void)
17665 - struct thread_info *thread = current_thread_info();
17666 - struct task_struct *tsk = thread->task;
17667 + struct task_struct *tsk = current;
17669 if (!tsk_used_math(tsk)) {
17670 local_irq_enable();
17671 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
17672 index b9242ba..50c5edd 100644
17673 --- a/arch/x86/kernel/verify_cpu.S
17674 +++ b/arch/x86/kernel/verify_cpu.S
17676 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
17677 * arch/x86/kernel/trampoline_64.S: secondary processor verification
17678 * arch/x86/kernel/head_32.S: processor startup
17679 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
17681 * verify_cpu, returns the status of longmode and SSE in register %eax.
17682 * 0: Success 1: Failure
17683 diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
17684 index 863f875..4307295 100644
17685 --- a/arch/x86/kernel/vm86_32.c
17686 +++ b/arch/x86/kernel/vm86_32.c
17688 #include <linux/ptrace.h>
17689 #include <linux/audit.h>
17690 #include <linux/stddef.h>
17691 +#include <linux/grsecurity.h>
17693 #include <asm/uaccess.h>
17694 #include <asm/io.h>
17695 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
17699 - tss = &per_cpu(init_tss, get_cpu());
17700 + tss = init_tss + get_cpu();
17701 current->thread.sp0 = current->thread.saved_sp0;
17702 current->thread.sysenter_cs = __KERNEL_CS;
17703 load_sp0(tss, ¤t->thread);
17704 @@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
17705 struct task_struct *tsk;
17706 int tmp, ret = -EPERM;
17708 +#ifdef CONFIG_GRKERNSEC_VM86
17709 + if (!capable(CAP_SYS_RAWIO)) {
17710 + gr_handle_vm86();
17716 if (tsk->thread.saved_sp0)
17718 @@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
17720 struct vm86plus_struct __user *v86;
17722 +#ifdef CONFIG_GRKERNSEC_VM86
17723 + if (!capable(CAP_SYS_RAWIO)) {
17724 + gr_handle_vm86();
17732 case VM86_REQUEST_IRQ:
17733 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
17734 tsk->thread.saved_fs = info->regs32->fs;
17735 tsk->thread.saved_gs = get_user_gs(info->regs32);
17737 - tss = &per_cpu(init_tss, get_cpu());
17738 + tss = init_tss + get_cpu();
17739 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17741 tsk->thread.sysenter_cs = 0;
17742 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
17743 goto cannot_handle;
17744 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17745 goto cannot_handle;
17746 - intr_ptr = (unsigned long __user *) (i << 2);
17747 + intr_ptr = (__force unsigned long __user *) (i << 2);
17748 if (get_user(segoffs, intr_ptr))
17749 goto cannot_handle;
17750 if ((segoffs >> 16) == BIOSSEG)
17751 diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
17752 index 0f703f1..9e15f64 100644
17753 --- a/arch/x86/kernel/vmlinux.lds.S
17754 +++ b/arch/x86/kernel/vmlinux.lds.S
17756 #include <asm/page_types.h>
17757 #include <asm/cache.h>
17758 #include <asm/boot.h>
17759 +#include <asm/segment.h>
17761 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17762 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17764 +#define __KERNEL_TEXT_OFFSET 0
17767 #undef i386 /* in case the preprocessor is a 32bit one */
17769 @@ -69,30 +76,43 @@ jiffies_64 = jiffies;
17772 text PT_LOAD FLAGS(5); /* R_E */
17773 +#ifdef CONFIG_X86_32
17774 + module PT_LOAD FLAGS(5); /* R_E */
17777 + rodata PT_LOAD FLAGS(5); /* R_E */
17779 + rodata PT_LOAD FLAGS(4); /* R__ */
17781 data PT_LOAD FLAGS(6); /* RW_ */
17782 -#ifdef CONFIG_X86_64
17783 + init.begin PT_LOAD FLAGS(6); /* RW_ */
17785 percpu PT_LOAD FLAGS(6); /* RW_ */
17787 + text.init PT_LOAD FLAGS(5); /* R_E */
17788 + text.exit PT_LOAD FLAGS(5); /* R_E */
17789 init PT_LOAD FLAGS(7); /* RWE */
17791 note PT_NOTE FLAGS(0); /* ___ */
17796 #ifdef CONFIG_X86_32
17797 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
17798 - phys_startup_32 = startup_32 - LOAD_OFFSET;
17799 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
17801 - . = __START_KERNEL;
17802 - phys_startup_64 = startup_64 - LOAD_OFFSET;
17803 + . = __START_KERNEL;
17806 /* Text and read-only data */
17807 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
17809 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17810 /* bootstrapping code */
17811 +#ifdef CONFIG_X86_32
17812 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17814 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17816 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
17819 #ifdef CONFIG_X86_32
17820 . = ALIGN(PAGE_SIZE);
17821 @@ -108,13 +128,47 @@ SECTIONS
17825 - /* End of text section */
17829 - NOTES :text :note
17830 + . += __KERNEL_TEXT_OFFSET;
17832 - EXCEPTION_TABLE(16) :text = 0x9090
17833 +#ifdef CONFIG_X86_32
17834 + . = ALIGN(PAGE_SIZE);
17835 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
17837 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
17838 + MODULES_EXEC_VADDR = .;
17840 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
17841 + . = ALIGN(HPAGE_SIZE);
17842 + MODULES_EXEC_END = . - 1;
17848 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
17849 + /* End of text section */
17850 + _etext = . - __KERNEL_TEXT_OFFSET;
17853 +#ifdef CONFIG_X86_32
17854 + . = ALIGN(PAGE_SIZE);
17855 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
17857 + . = ALIGN(PAGE_SIZE);
17858 + *(.empty_zero_page)
17859 + *(.initial_pg_fixmap)
17860 + *(.initial_pg_pmd)
17861 + *(.initial_page_table)
17862 + *(.swapper_pg_dir)
17866 + . = ALIGN(PAGE_SIZE);
17867 + NOTES :rodata :note
17869 + EXCEPTION_TABLE(16) :rodata
17871 #if defined(CONFIG_DEBUG_RODATA)
17872 /* .text should occupy whole number of pages */
17873 @@ -126,16 +180,20 @@ SECTIONS
17876 .data : AT(ADDR(.data) - LOAD_OFFSET) {
17878 +#ifdef CONFIG_PAX_KERNEXEC
17879 + . = ALIGN(HPAGE_SIZE);
17881 + . = ALIGN(PAGE_SIZE);
17884 /* Start of data section */
17888 INIT_TASK_DATA(THREAD_SIZE)
17890 -#ifdef CONFIG_X86_32
17891 - /* 32 bit has nosave before _edata */
17895 PAGE_ALIGNED_DATA(PAGE_SIZE)
17897 @@ -176,12 +234,19 @@ SECTIONS
17898 #endif /* CONFIG_X86_64 */
17900 /* Init code and data - will be freed after init */
17901 - . = ALIGN(PAGE_SIZE);
17902 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
17905 +#ifdef CONFIG_PAX_KERNEXEC
17906 + . = ALIGN(HPAGE_SIZE);
17908 + . = ALIGN(PAGE_SIZE);
17911 __init_begin = .; /* paired with __init_end */
17915 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
17918 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
17919 * output PHDR, so the next output section - .init.text - should
17920 @@ -190,12 +255,27 @@ SECTIONS
17921 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
17924 - INIT_TEXT_SECTION(PAGE_SIZE)
17925 -#ifdef CONFIG_X86_64
17928 + . = ALIGN(PAGE_SIZE);
17930 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
17931 + VMLINUX_SYMBOL(_sinittext) = .;
17933 + VMLINUX_SYMBOL(_einittext) = .;
17934 + . = ALIGN(PAGE_SIZE);
17937 - INIT_DATA_SECTION(16)
17939 + * .exit.text is discard at runtime, not link time, to deal with
17940 + * references from .altinstructions and .eh_frame
17942 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
17946 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
17948 + . = ALIGN(PAGE_SIZE);
17949 + INIT_DATA_SECTION(16) :init
17952 * Code and data for a variety of lowlevel trampolines, to be
17953 @@ -269,19 +349,12 @@ SECTIONS
17958 - * .exit.text is discard at runtime, not link time, to deal with
17959 - * references from .altinstructions and .eh_frame
17961 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
17965 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
17969 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
17970 +#ifndef CONFIG_SMP
17971 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
17974 @@ -300,16 +373,10 @@ SECTIONS
17975 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
17978 - . = ALIGN(PAGE_SIZE);
17979 __smp_locks_end = .;
17980 + . = ALIGN(PAGE_SIZE);
17983 -#ifdef CONFIG_X86_64
17984 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
17990 . = ALIGN(PAGE_SIZE);
17991 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
17992 @@ -325,6 +392,7 @@ SECTIONS
17994 . += 64 * 1024; /* 64k alignment slop space */
17995 *(.brk_reservation) /* areas brk users have reserved */
17996 + . = ALIGN(HPAGE_SIZE);
18000 @@ -351,13 +419,12 @@ SECTIONS
18001 * for the boot processor.
18003 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18004 -INIT_PER_CPU(gdt_page);
18005 INIT_PER_CPU(irq_stack_union);
18008 * Build-time check on the image size:
18010 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18011 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18012 "kernel image bigger than KERNEL_IMAGE_SIZE");
18015 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
18016 index b56c65de..561a55b 100644
18017 --- a/arch/x86/kernel/vsyscall_64.c
18018 +++ b/arch/x86/kernel/vsyscall_64.c
18019 @@ -56,15 +56,13 @@ DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
18020 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
18023 -static enum { EMULATE, NATIVE, NONE } vsyscall_mode = NATIVE;
18024 +static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
18026 static int __init vsyscall_setup(char *str)
18029 if (!strcmp("emulate", str))
18030 vsyscall_mode = EMULATE;
18031 - else if (!strcmp("native", str))
18032 - vsyscall_mode = NATIVE;
18033 else if (!strcmp("none", str))
18034 vsyscall_mode = NONE;
18036 @@ -177,7 +175,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18039 if (seccomp_mode(&tsk->seccomp))
18040 - do_exit(SIGKILL);
18041 + do_group_exit(SIGKILL);
18043 switch (vsyscall_nr) {
18045 @@ -219,8 +217,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
18049 - force_sig(SIGSEGV, current);
18051 + do_group_exit(SIGKILL);
18055 @@ -273,10 +270,7 @@ void __init map_vsyscall(void)
18056 extern char __vvar_page;
18057 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
18059 - __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
18060 - vsyscall_mode == NATIVE
18061 - ? PAGE_KERNEL_VSYSCALL
18062 - : PAGE_KERNEL_VVAR);
18063 + __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
18064 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
18065 (unsigned long)VSYSCALL_START);
18067 diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
18068 index 9796c2f..f686fbf 100644
18069 --- a/arch/x86/kernel/x8664_ksyms_64.c
18070 +++ b/arch/x86/kernel/x8664_ksyms_64.c
18071 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18072 EXPORT_SYMBOL(copy_user_generic_string);
18073 EXPORT_SYMBOL(copy_user_generic_unrolled);
18074 EXPORT_SYMBOL(__copy_user_nocache);
18075 -EXPORT_SYMBOL(_copy_from_user);
18076 -EXPORT_SYMBOL(_copy_to_user);
18078 EXPORT_SYMBOL(copy_page);
18079 EXPORT_SYMBOL(clear_page);
18080 diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
18081 index a391134..d0b63b6e 100644
18082 --- a/arch/x86/kernel/xsave.c
18083 +++ b/arch/x86/kernel/xsave.c
18084 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
18085 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18088 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18089 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18090 fx_sw_user->extended_size -
18091 FP_XSTATE_MAGIC2_SIZE));
18093 @@ -267,7 +267,7 @@ fx_only:
18094 * the other extended state.
18096 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18097 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18098 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
18102 @@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf)
18104 err = restore_user_xstate(buf);
18106 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
18107 + err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
18109 if (unlikely(err)) {
18111 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
18112 index 8b4cc5f..f086b5b 100644
18113 --- a/arch/x86/kvm/emulate.c
18114 +++ b/arch/x86/kvm/emulate.c
18116 #define Src2ImmByte (2<<29)
18117 #define Src2One (3<<29)
18118 #define Src2Imm (4<<29)
18119 -#define Src2Mask (7<<29)
18120 +#define Src2Mask (7U<<29)
18122 #define X2(x...) x, x
18123 #define X3(x...) X2(x), x
18124 @@ -207,6 +207,7 @@ struct gprefix {
18126 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18128 + unsigned long _tmp; \
18129 __asm__ __volatile__ ( \
18130 _PRE_EFLAGS("0", "4", "2") \
18131 _op _suffix " %"_x"3,%1; " \
18132 @@ -220,8 +221,6 @@ struct gprefix {
18133 /* Raw emulation: instruction has two explicit operands. */
18134 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18136 - unsigned long _tmp; \
18138 switch ((_dst).bytes) { \
18140 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18141 @@ -237,7 +236,6 @@ struct gprefix {
18143 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18145 - unsigned long _tmp; \
18146 switch ((_dst).bytes) { \
18148 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18149 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
18150 index 57dcbd4..79aba9b 100644
18151 --- a/arch/x86/kvm/lapic.c
18152 +++ b/arch/x86/kvm/lapic.c
18154 #define APIC_BUS_CYCLE_NS 1
18156 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18157 -#define apic_debug(fmt, arg...)
18158 +#define apic_debug(fmt, arg...) do {} while (0)
18160 #define APIC_LVT_NUM 6
18161 /* 14 is the version for Xeon and Pentium 8.4.8*/
18162 diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
18163 index 8e8da79..13bc641 100644
18164 --- a/arch/x86/kvm/mmu.c
18165 +++ b/arch/x86/kvm/mmu.c
18166 @@ -3552,7 +3552,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18168 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18170 - invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18171 + invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18174 * Assume that the pte write on a page table of the same type
18175 @@ -3584,7 +3584,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
18178 spin_lock(&vcpu->kvm->mmu_lock);
18179 - if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18180 + if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18182 kvm_mmu_free_some_pages(vcpu);
18183 ++vcpu->kvm->stat.mmu_pte_write;
18184 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
18185 index 507e2b8..fc55f89 100644
18186 --- a/arch/x86/kvm/paging_tmpl.h
18187 +++ b/arch/x86/kvm/paging_tmpl.h
18188 @@ -197,7 +197,7 @@ retry_walk:
18189 if (unlikely(kvm_is_error_hva(host_addr)))
18192 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
18193 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
18194 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
18197 @@ -575,6 +575,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
18198 unsigned long mmu_seq;
18201 + pax_track_stack();
18203 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18205 if (unlikely(error_code & PFERR_RSVD_MASK))
18206 @@ -701,7 +703,7 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
18208 kvm_flush_remote_tlbs(vcpu->kvm);
18210 - atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18211 + atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18213 spin_unlock(&vcpu->kvm->mmu_lock);
18215 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
18216 index 475d1c9..33658ff 100644
18217 --- a/arch/x86/kvm/svm.c
18218 +++ b/arch/x86/kvm/svm.c
18219 @@ -3381,7 +3381,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
18220 int cpu = raw_smp_processor_id();
18222 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18224 + pax_open_kernel();
18225 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18226 + pax_close_kernel();
18231 @@ -3759,6 +3763,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
18235 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18236 + __set_fs(current_thread_info()->addr_limit);
18241 local_irq_disable();
18242 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
18243 index e65a158..656dc24 100644
18244 --- a/arch/x86/kvm/vmx.c
18245 +++ b/arch/x86/kvm/vmx.c
18246 @@ -1251,7 +1251,11 @@ static void reload_tss(void)
18247 struct desc_struct *descs;
18249 descs = (void *)gdt->address;
18251 + pax_open_kernel();
18252 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18253 + pax_close_kernel();
18258 @@ -2520,8 +2524,11 @@ static __init int hardware_setup(void)
18259 if (!cpu_has_vmx_flexpriority())
18260 flexpriority_enabled = 0;
18262 - if (!cpu_has_vmx_tpr_shadow())
18263 - kvm_x86_ops->update_cr8_intercept = NULL;
18264 + if (!cpu_has_vmx_tpr_shadow()) {
18265 + pax_open_kernel();
18266 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18267 + pax_close_kernel();
18270 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18271 kvm_disable_largepages();
18272 @@ -3535,7 +3542,7 @@ static void vmx_set_constant_host_state(void)
18273 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18275 asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
18276 - vmcs_writel(HOST_RIP, tmpl); /* 22.2.5 */
18277 + vmcs_writel(HOST_RIP, ktla_ktva(tmpl)); /* 22.2.5 */
18279 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
18280 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
18281 @@ -6021,6 +6028,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18282 "jmp .Lkvm_vmx_return \n\t"
18283 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18284 ".Lkvm_vmx_return: "
18286 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18287 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18288 + ".Lkvm_vmx_return2: "
18291 /* Save guest registers, load host registers, keep flags */
18292 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18294 @@ -6069,6 +6082,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18296 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18297 [wordsize]"i"(sizeof(ulong))
18299 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18300 + ,[cs]"i"(__KERNEL_CS)
18304 , R"ax", R"bx", R"di", R"si"
18305 #ifdef CONFIG_X86_64
18306 @@ -6097,7 +6115,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
18310 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18311 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18313 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18314 + loadsegment(fs, __KERNEL_PERCPU);
18317 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18318 + __set_fs(current_thread_info()->addr_limit);
18321 vmx->loaded_vmcs->launched = 1;
18323 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18324 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
18325 index 84a28ea..9326501 100644
18326 --- a/arch/x86/kvm/x86.c
18327 +++ b/arch/x86/kvm/x86.c
18328 @@ -1334,8 +1334,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
18330 struct kvm *kvm = vcpu->kvm;
18331 int lm = is_long_mode(vcpu);
18332 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18333 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18334 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
18335 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
18336 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
18337 : kvm->arch.xen_hvm_config.blob_size_32;
18338 u32 page_num = data & ~PAGE_MASK;
18339 @@ -2137,6 +2137,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
18340 if (n < msr_list.nmsrs)
18343 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18345 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18346 num_msrs_to_save * sizeof(u32)))
18348 @@ -2312,15 +2314,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
18349 struct kvm_cpuid2 *cpuid,
18350 struct kvm_cpuid_entry2 __user *entries)
18356 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18359 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18360 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18361 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18363 + for (i = 0; i < cpuid->nent; ++i) {
18364 + struct kvm_cpuid_entry2 cpuid_entry;
18365 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18367 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
18369 vcpu->arch.cpuid_nent = cpuid->nent;
18370 kvm_apic_set_version(vcpu);
18371 kvm_x86_ops->cpuid_update(vcpu);
18372 @@ -2335,15 +2342,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
18373 struct kvm_cpuid2 *cpuid,
18374 struct kvm_cpuid_entry2 __user *entries)
18380 if (cpuid->nent < vcpu->arch.cpuid_nent)
18383 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18384 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18385 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18387 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18388 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18389 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18395 @@ -2718,7 +2729,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
18396 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18397 struct kvm_interrupt *irq)
18399 - if (irq->irq < 0 || irq->irq >= 256)
18400 + if (irq->irq >= 256)
18402 if (irqchip_in_kernel(vcpu->kvm))
18404 @@ -5089,7 +5100,7 @@ static void kvm_set_mmio_spte_mask(void)
18405 kvm_mmu_set_mmio_spte_mask(mask);
18408 -int kvm_arch_init(void *opaque)
18409 +int kvm_arch_init(const void *opaque)
18412 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18413 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
18414 index 13ee258..b9632f6 100644
18415 --- a/arch/x86/lguest/boot.c
18416 +++ b/arch/x86/lguest/boot.c
18417 @@ -1184,9 +1184,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
18418 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
18419 * Launcher to reboot us.
18421 -static void lguest_restart(char *reason)
18422 +static __noreturn void lguest_restart(char *reason)
18424 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
18429 diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
18430 index 042f682..c92afb6 100644
18431 --- a/arch/x86/lib/atomic64_32.c
18432 +++ b/arch/x86/lib/atomic64_32.c
18435 long long atomic64_read_cx8(long long, const atomic64_t *v);
18436 EXPORT_SYMBOL(atomic64_read_cx8);
18437 +long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18438 +EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18439 long long atomic64_set_cx8(long long, const atomic64_t *v);
18440 EXPORT_SYMBOL(atomic64_set_cx8);
18441 +long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18442 +EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18443 long long atomic64_xchg_cx8(long long, unsigned high);
18444 EXPORT_SYMBOL(atomic64_xchg_cx8);
18445 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18446 EXPORT_SYMBOL(atomic64_add_return_cx8);
18447 +long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18448 +EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18449 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18450 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18451 +long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18452 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18453 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18454 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18455 +long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18456 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18457 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18458 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18459 +long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18460 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18461 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18462 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18463 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18464 @@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18465 #ifndef CONFIG_X86_CMPXCHG64
18466 long long atomic64_read_386(long long, const atomic64_t *v);
18467 EXPORT_SYMBOL(atomic64_read_386);
18468 +long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18469 +EXPORT_SYMBOL(atomic64_read_unchecked_386);
18470 long long atomic64_set_386(long long, const atomic64_t *v);
18471 EXPORT_SYMBOL(atomic64_set_386);
18472 +long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18473 +EXPORT_SYMBOL(atomic64_set_unchecked_386);
18474 long long atomic64_xchg_386(long long, unsigned high);
18475 EXPORT_SYMBOL(atomic64_xchg_386);
18476 long long atomic64_add_return_386(long long a, atomic64_t *v);
18477 EXPORT_SYMBOL(atomic64_add_return_386);
18478 +long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18479 +EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18480 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18481 EXPORT_SYMBOL(atomic64_sub_return_386);
18482 +long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18483 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18484 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18485 EXPORT_SYMBOL(atomic64_inc_return_386);
18486 +long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18487 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18488 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18489 EXPORT_SYMBOL(atomic64_dec_return_386);
18490 +long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18491 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18492 long long atomic64_add_386(long long a, atomic64_t *v);
18493 EXPORT_SYMBOL(atomic64_add_386);
18494 +long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18495 +EXPORT_SYMBOL(atomic64_add_unchecked_386);
18496 long long atomic64_sub_386(long long a, atomic64_t *v);
18497 EXPORT_SYMBOL(atomic64_sub_386);
18498 +long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18499 +EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18500 long long atomic64_inc_386(long long a, atomic64_t *v);
18501 EXPORT_SYMBOL(atomic64_inc_386);
18502 +long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18503 +EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18504 long long atomic64_dec_386(long long a, atomic64_t *v);
18505 EXPORT_SYMBOL(atomic64_dec_386);
18506 +long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18507 +EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18508 long long atomic64_dec_if_positive_386(atomic64_t *v);
18509 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18510 int atomic64_inc_not_zero_386(atomic64_t *v);
18511 diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
18512 index e8e7e0d..56fd1b0 100644
18513 --- a/arch/x86/lib/atomic64_386_32.S
18514 +++ b/arch/x86/lib/atomic64_386_32.S
18515 @@ -48,6 +48,10 @@ BEGIN(read)
18519 +BEGIN(read_unchecked)
18526 @@ -55,6 +59,10 @@ BEGIN(set)
18530 +BEGIN(set_unchecked)
18537 @@ -70,6 +78,20 @@ RET_ENDP
18542 +#ifdef CONFIG_PAX_REFCOUNT
18548 + _ASM_EXTABLE(0b, 0b)
18552 +BEGIN(add_unchecked)
18558 @@ -77,6 +99,24 @@ RET_ENDP
18563 +#ifdef CONFIG_PAX_REFCOUNT
18566 + _ASM_EXTABLE(1234b, 2f)
18572 +#ifdef CONFIG_PAX_REFCOUNT
18577 +BEGIN(add_return_unchecked)
18583 @@ -86,6 +126,20 @@ RET_ENDP
18588 +#ifdef CONFIG_PAX_REFCOUNT
18594 + _ASM_EXTABLE(0b, 0b)
18598 +BEGIN(sub_unchecked)
18604 @@ -96,6 +150,27 @@ BEGIN(sub_return)
18609 +#ifdef CONFIG_PAX_REFCOUNT
18612 + _ASM_EXTABLE(1234b, 2f)
18618 +#ifdef CONFIG_PAX_REFCOUNT
18623 +BEGIN(sub_return_unchecked)
18632 @@ -105,6 +180,20 @@ RET_ENDP
18637 +#ifdef CONFIG_PAX_REFCOUNT
18643 + _ASM_EXTABLE(0b, 0b)
18647 +BEGIN(inc_unchecked)
18653 @@ -114,6 +203,26 @@ BEGIN(inc_return)
18658 +#ifdef CONFIG_PAX_REFCOUNT
18661 + _ASM_EXTABLE(1234b, 2f)
18667 +#ifdef CONFIG_PAX_REFCOUNT
18672 +BEGIN(inc_return_unchecked)
18680 @@ -123,6 +232,20 @@ RET_ENDP
18685 +#ifdef CONFIG_PAX_REFCOUNT
18691 + _ASM_EXTABLE(0b, 0b)
18695 +BEGIN(dec_unchecked)
18701 @@ -132,6 +255,26 @@ BEGIN(dec_return)
18706 +#ifdef CONFIG_PAX_REFCOUNT
18709 + _ASM_EXTABLE(1234b, 2f)
18715 +#ifdef CONFIG_PAX_REFCOUNT
18720 +BEGIN(dec_return_unchecked)
18728 @@ -143,6 +286,13 @@ BEGIN(add_unless)
18733 +#ifdef CONFIG_PAX_REFCOUNT
18736 + _ASM_EXTABLE(1234b, 2f)
18742 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18747 +#ifdef CONFIG_PAX_REFCOUNT
18750 + _ASM_EXTABLE(1234b, 2f)
18756 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18761 +#ifdef CONFIG_PAX_REFCOUNT
18764 + _ASM_EXTABLE(1234b, 1f)
18770 diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
18771 index 391a083..d658e9f 100644
18772 --- a/arch/x86/lib/atomic64_cx8_32.S
18773 +++ b/arch/x86/lib/atomic64_cx8_32.S
18774 @@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
18778 + pax_force_retaddr
18781 ENDPROC(atomic64_read_cx8)
18783 +ENTRY(atomic64_read_unchecked_cx8)
18787 + pax_force_retaddr
18790 +ENDPROC(atomic64_read_unchecked_cx8)
18792 ENTRY(atomic64_set_cx8)
18795 @@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
18799 + pax_force_retaddr
18802 ENDPROC(atomic64_set_cx8)
18804 +ENTRY(atomic64_set_unchecked_cx8)
18808 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
18809 + * are atomic on 586 and newer */
18813 + pax_force_retaddr
18816 +ENDPROC(atomic64_set_unchecked_cx8)
18818 ENTRY(atomic64_xchg_cx8)
18821 @@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
18825 + pax_force_retaddr
18828 ENDPROC(atomic64_xchg_cx8)
18830 -.macro addsub_return func ins insc
18831 -ENTRY(atomic64_\func\()_return_cx8)
18832 +.macro addsub_return func ins insc unchecked=""
18833 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18837 @@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
18839 \ins\()l %esi, %ebx
18840 \insc\()l %edi, %ecx
18843 +#ifdef CONFIG_PAX_REFCOUNT
18846 + _ASM_EXTABLE(2b, 3f)
18859 +#ifdef CONFIG_PAX_REFCOUNT
18868 + pax_force_retaddr
18871 -ENDPROC(atomic64_\func\()_return_cx8)
18872 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18875 addsub_return add add adc
18876 addsub_return sub sub sbb
18877 +addsub_return add add adc _unchecked
18878 +addsub_return sub sub sbb _unchecked
18880 -.macro incdec_return func ins insc
18881 -ENTRY(atomic64_\func\()_return_cx8)
18882 +.macro incdec_return func ins insc unchecked
18883 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
18887 @@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
18893 +#ifdef CONFIG_PAX_REFCOUNT
18896 + _ASM_EXTABLE(2b, 3f)
18909 +#ifdef CONFIG_PAX_REFCOUNT
18915 + pax_force_retaddr
18918 -ENDPROC(atomic64_\func\()_return_cx8)
18919 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
18922 incdec_return inc add adc
18923 incdec_return dec sub sbb
18924 +incdec_return inc add adc _unchecked
18925 +incdec_return dec sub sbb _unchecked
18927 ENTRY(atomic64_dec_if_positive_cx8)
18929 @@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
18934 +#ifdef CONFIG_PAX_REFCOUNT
18937 + _ASM_EXTABLE(1234b, 2f)
18943 @@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
18947 + pax_force_retaddr
18950 ENDPROC(atomic64_dec_if_positive_cx8)
18951 @@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
18956 +#ifdef CONFIG_PAX_REFCOUNT
18959 + _ASM_EXTABLE(1234b, 3f)
18965 @@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
18966 CFI_ADJUST_CFA_OFFSET -8
18969 + pax_force_retaddr
18973 @@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
18978 +#ifdef CONFIG_PAX_REFCOUNT
18981 + _ASM_EXTABLE(1234b, 3f)
18987 @@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
18991 + pax_force_retaddr
18995 diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
18996 index 78d16a5..fbcf666 100644
18997 --- a/arch/x86/lib/checksum_32.S
18998 +++ b/arch/x86/lib/checksum_32.S
19000 #include <linux/linkage.h>
19001 #include <asm/dwarf2.h>
19002 #include <asm/errno.h>
19004 +#include <asm/segment.h>
19007 * computes a partial checksum, e.g. for TCP/UDP fragments
19009 @@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
19014 -ENTRY(csum_partial_copy_generic)
19016 +ENTRY(csum_partial_copy_generic_to_user)
19019 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19022 + jmp csum_partial_copy_generic
19025 +ENTRY(csum_partial_copy_generic_from_user)
19027 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19032 +ENTRY(csum_partial_copy_generic)
19034 CFI_ADJUST_CFA_OFFSET 4
19036 @@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19038 SRC(1: movw (%esi), %bx )
19040 -DST( movw %bx, (%edi) )
19041 +DST( movw %bx, %es:(%edi) )
19045 @@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19046 SRC(1: movl (%esi), %ebx )
19047 SRC( movl 4(%esi), %edx )
19049 -DST( movl %ebx, (%edi) )
19050 +DST( movl %ebx, %es:(%edi) )
19052 -DST( movl %edx, 4(%edi) )
19053 +DST( movl %edx, %es:4(%edi) )
19055 SRC( movl 8(%esi), %ebx )
19056 SRC( movl 12(%esi), %edx )
19058 -DST( movl %ebx, 8(%edi) )
19059 +DST( movl %ebx, %es:8(%edi) )
19061 -DST( movl %edx, 12(%edi) )
19062 +DST( movl %edx, %es:12(%edi) )
19064 SRC( movl 16(%esi), %ebx )
19065 SRC( movl 20(%esi), %edx )
19067 -DST( movl %ebx, 16(%edi) )
19068 +DST( movl %ebx, %es:16(%edi) )
19070 -DST( movl %edx, 20(%edi) )
19071 +DST( movl %edx, %es:20(%edi) )
19073 SRC( movl 24(%esi), %ebx )
19074 SRC( movl 28(%esi), %edx )
19076 -DST( movl %ebx, 24(%edi) )
19077 +DST( movl %ebx, %es:24(%edi) )
19079 -DST( movl %edx, 28(%edi) )
19080 +DST( movl %edx, %es:28(%edi) )
19084 @@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19085 shrl $2, %edx # This clears CF
19086 SRC(3: movl (%esi), %ebx )
19088 -DST( movl %ebx, (%edi) )
19089 +DST( movl %ebx, %es:(%edi) )
19093 @@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19095 SRC( movw (%esi), %cx )
19097 -DST( movw %cx, (%edi) )
19098 +DST( movw %cx, %es:(%edi) )
19102 SRC(5: movb (%esi), %cl )
19103 -DST( movb %cl, (%edi) )
19104 +DST( movb %cl, %es:(%edi) )
19108 @@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19111 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19112 - movl $-EFAULT, (%ebx)
19113 + movl $-EFAULT, %ss:(%ebx)
19115 # zero the complete destination - computing the rest
19117 @@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19120 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19121 - movl $-EFAULT,(%ebx)
19122 + movl $-EFAULT,%ss:(%ebx)
19134 @@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19135 popl_cfi %ecx # equivalent to addl $4,%esp
19138 -ENDPROC(csum_partial_copy_generic)
19139 +ENDPROC(csum_partial_copy_generic_to_user)
19143 /* Version for PentiumII/PPro */
19145 #define ROUND1(x) \
19147 SRC(movl x(%esi), %ebx ) ; \
19148 addl %ebx, %eax ; \
19149 - DST(movl %ebx, x(%edi) ) ;
19150 + DST(movl %ebx, %es:x(%edi)) ;
19154 SRC(movl x(%esi), %ebx ) ; \
19155 adcl %ebx, %eax ; \
19156 - DST(movl %ebx, x(%edi) ) ;
19157 + DST(movl %ebx, %es:x(%edi)) ;
19161 -ENTRY(csum_partial_copy_generic)
19163 +ENTRY(csum_partial_copy_generic_to_user)
19166 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19169 + jmp csum_partial_copy_generic
19172 +ENTRY(csum_partial_copy_generic_from_user)
19174 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19179 +ENTRY(csum_partial_copy_generic)
19181 CFI_REL_OFFSET ebx, 0
19183 @@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19187 - lea 3f(%ebx,%ebx), %ebx
19188 + lea 3f(%ebx,%ebx,2), %ebx
19192 @@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19194 SRC( movw (%esi), %dx )
19196 -DST( movw %dx, (%edi) )
19197 +DST( movw %dx, %es:(%edi) )
19202 SRC( movb (%esi), %dl )
19203 -DST( movb %dl, (%edi) )
19204 +DST( movb %dl, %es:(%edi) )
19208 .section .fixup, "ax"
19209 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19210 - movl $-EFAULT, (%ebx)
19211 + movl $-EFAULT, %ss:(%ebx)
19212 # zero the complete destination (computing the rest is too much work)
19213 movl ARGBASE+8(%esp),%edi # dst
19214 movl ARGBASE+12(%esp),%ecx # len
19215 @@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19218 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19219 - movl $-EFAULT, (%ebx)
19220 + movl $-EFAULT, %ss:(%ebx)
19224 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19234 @@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19238 -ENDPROC(csum_partial_copy_generic)
19239 +ENDPROC(csum_partial_copy_generic_to_user)
19243 diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
19244 index f2145cf..cea889d 100644
19245 --- a/arch/x86/lib/clear_page_64.S
19246 +++ b/arch/x86/lib/clear_page_64.S
19247 @@ -11,6 +11,7 @@ ENTRY(clear_page_c)
19251 + pax_force_retaddr
19254 ENDPROC(clear_page_c)
19255 @@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
19259 + pax_force_retaddr
19262 ENDPROC(clear_page_c_e)
19263 @@ -43,6 +45,7 @@ ENTRY(clear_page)
19267 + pax_force_retaddr
19271 @@ -58,7 +61,7 @@ ENDPROC(clear_page)
19273 #include <asm/cpufeature.h>
19275 - .section .altinstr_replacement,"ax"
19276 + .section .altinstr_replacement,"a"
19277 1: .byte 0xeb /* jmp <disp8> */
19278 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19279 2: .byte 0xeb /* jmp <disp8> */
19280 diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
19281 index 1e572c5..2a162cd 100644
19282 --- a/arch/x86/lib/cmpxchg16b_emu.S
19283 +++ b/arch/x86/lib/cmpxchg16b_emu.S
19284 @@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
19288 + pax_force_retaddr
19294 + pax_force_retaddr
19298 diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
19299 index 01c805b..dccb07f 100644
19300 --- a/arch/x86/lib/copy_page_64.S
19301 +++ b/arch/x86/lib/copy_page_64.S
19302 @@ -9,6 +9,7 @@ copy_page_c:
19306 + pax_force_retaddr
19309 ENDPROC(copy_page_c)
19310 @@ -39,7 +40,7 @@ ENTRY(copy_page)
19311 movq 16 (%rsi), %rdx
19312 movq 24 (%rsi), %r8
19313 movq 32 (%rsi), %r9
19314 - movq 40 (%rsi), %r10
19315 + movq 40 (%rsi), %r13
19316 movq 48 (%rsi), %r11
19317 movq 56 (%rsi), %r12
19319 @@ -50,7 +51,7 @@ ENTRY(copy_page)
19320 movq %rdx, 16 (%rdi)
19321 movq %r8, 24 (%rdi)
19322 movq %r9, 32 (%rdi)
19323 - movq %r10, 40 (%rdi)
19324 + movq %r13, 40 (%rdi)
19325 movq %r11, 48 (%rdi)
19326 movq %r12, 56 (%rdi)
19328 @@ -69,7 +70,7 @@ ENTRY(copy_page)
19329 movq 16 (%rsi), %rdx
19330 movq 24 (%rsi), %r8
19331 movq 32 (%rsi), %r9
19332 - movq 40 (%rsi), %r10
19333 + movq 40 (%rsi), %r13
19334 movq 48 (%rsi), %r11
19335 movq 56 (%rsi), %r12
19337 @@ -78,7 +79,7 @@ ENTRY(copy_page)
19338 movq %rdx, 16 (%rdi)
19339 movq %r8, 24 (%rdi)
19340 movq %r9, 32 (%rdi)
19341 - movq %r10, 40 (%rdi)
19342 + movq %r13, 40 (%rdi)
19343 movq %r11, 48 (%rdi)
19344 movq %r12, 56 (%rdi)
19346 @@ -95,6 +96,7 @@ ENTRY(copy_page)
19349 CFI_ADJUST_CFA_OFFSET -3*8
19350 + pax_force_retaddr
19354 @@ -105,7 +107,7 @@ ENDPROC(copy_page)
19356 #include <asm/cpufeature.h>
19358 - .section .altinstr_replacement,"ax"
19359 + .section .altinstr_replacement,"a"
19360 1: .byte 0xeb /* jmp <disp8> */
19361 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19363 diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
19364 index 0248402..821c786 100644
19365 --- a/arch/x86/lib/copy_user_64.S
19366 +++ b/arch/x86/lib/copy_user_64.S
19368 #include <asm/thread_info.h>
19369 #include <asm/cpufeature.h>
19370 #include <asm/alternative-asm.h>
19371 +#include <asm/pgtable.h>
19374 * By placing feature2 after feature1 in altinstructions section, we logically
19376 .byte 0xe9 /* 32bit jump */
19377 .long \orig-1f /* by default jump to orig */
19379 - .section .altinstr_replacement,"ax"
19380 + .section .altinstr_replacement,"a"
19381 2: .byte 0xe9 /* near jump with 32bit immediate */
19382 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
19383 3: .byte 0xe9 /* near jump with 32bit immediate */
19384 @@ -71,47 +72,20 @@
19388 -/* Standard copy_to_user with segment limit checking */
19389 -ENTRY(_copy_to_user)
19391 - GET_THREAD_INFO(%rax)
19395 - cmpq TI_addr_limit(%rax),%rcx
19397 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19398 - copy_user_generic_unrolled,copy_user_generic_string, \
19399 - copy_user_enhanced_fast_string
19401 -ENDPROC(_copy_to_user)
19403 -/* Standard copy_from_user with segment limit checking */
19404 -ENTRY(_copy_from_user)
19406 - GET_THREAD_INFO(%rax)
19410 - cmpq TI_addr_limit(%rax),%rcx
19412 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
19413 - copy_user_generic_unrolled,copy_user_generic_string, \
19414 - copy_user_enhanced_fast_string
19416 -ENDPROC(_copy_from_user)
19418 .section .fixup,"ax"
19419 /* must zero dest */
19420 ENTRY(bad_from_user)
19431 + pax_force_retaddr
19434 ENDPROC(bad_from_user)
19435 @@ -141,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
19438 2: movq 1*8(%rsi),%r9
19439 -3: movq 2*8(%rsi),%r10
19440 +3: movq 2*8(%rsi),%rax
19441 4: movq 3*8(%rsi),%r11
19443 6: movq %r9,1*8(%rdi)
19444 -7: movq %r10,2*8(%rdi)
19445 +7: movq %rax,2*8(%rdi)
19446 8: movq %r11,3*8(%rdi)
19447 9: movq 4*8(%rsi),%r8
19448 10: movq 5*8(%rsi),%r9
19449 -11: movq 6*8(%rsi),%r10
19450 +11: movq 6*8(%rsi),%rax
19451 12: movq 7*8(%rsi),%r11
19452 13: movq %r8,4*8(%rdi)
19453 14: movq %r9,5*8(%rdi)
19454 -15: movq %r10,6*8(%rdi)
19455 +15: movq %rax,6*8(%rdi)
19456 16: movq %r11,7*8(%rdi)
19459 @@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
19463 + pax_force_retaddr
19466 .section .fixup,"ax"
19467 @@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
19471 + pax_force_retaddr
19474 .section .fixup,"ax"
19475 @@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
19479 + pax_force_retaddr
19482 .section .fixup,"ax"
19483 diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
19484 index cb0c112..e3a6895 100644
19485 --- a/arch/x86/lib/copy_user_nocache_64.S
19486 +++ b/arch/x86/lib/copy_user_nocache_64.S
19489 #include <linux/linkage.h>
19490 #include <asm/dwarf2.h>
19491 +#include <asm/alternative-asm.h>
19493 #define FIX_ALIGNMENT 1
19495 #include <asm/current.h>
19496 #include <asm/asm-offsets.h>
19497 #include <asm/thread_info.h>
19498 +#include <asm/pgtable.h>
19500 .macro ALIGN_DESTINATION
19501 #ifdef FIX_ALIGNMENT
19504 ENTRY(__copy_user_nocache)
19507 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19508 + mov $PAX_USER_SHADOW_BASE,%rcx
19516 jb 20f /* less then 8 bytes, go to byte copy loop */
19518 @@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
19521 2: movq 1*8(%rsi),%r9
19522 -3: movq 2*8(%rsi),%r10
19523 +3: movq 2*8(%rsi),%rax
19524 4: movq 3*8(%rsi),%r11
19525 5: movnti %r8,(%rdi)
19526 6: movnti %r9,1*8(%rdi)
19527 -7: movnti %r10,2*8(%rdi)
19528 +7: movnti %rax,2*8(%rdi)
19529 8: movnti %r11,3*8(%rdi)
19530 9: movq 4*8(%rsi),%r8
19531 10: movq 5*8(%rsi),%r9
19532 -11: movq 6*8(%rsi),%r10
19533 +11: movq 6*8(%rsi),%rax
19534 12: movq 7*8(%rsi),%r11
19535 13: movnti %r8,4*8(%rdi)
19536 14: movnti %r9,5*8(%rdi)
19537 -15: movnti %r10,6*8(%rdi)
19538 +15: movnti %rax,6*8(%rdi)
19539 16: movnti %r11,7*8(%rdi)
19542 @@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
19546 + pax_force_retaddr
19549 .section .fixup,"ax"
19550 diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
19551 index fb903b7..c92b7f7 100644
19552 --- a/arch/x86/lib/csum-copy_64.S
19553 +++ b/arch/x86/lib/csum-copy_64.S
19555 #include <linux/linkage.h>
19556 #include <asm/dwarf2.h>
19557 #include <asm/errno.h>
19558 +#include <asm/alternative-asm.h>
19561 * Checksum copy with exception handling.
19562 @@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
19565 CFI_ADJUST_CFA_OFFSET -7*8
19566 + pax_force_retaddr 0, 1
19570 diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
19571 index 459b58a..9570bc7 100644
19572 --- a/arch/x86/lib/csum-wrappers_64.c
19573 +++ b/arch/x86/lib/csum-wrappers_64.c
19574 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
19578 - isum = csum_partial_copy_generic((__force const void *)src,
19580 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19581 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19582 + src += PAX_USER_SHADOW_BASE;
19585 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
19586 dst, len, isum, errp, NULL);
19587 if (unlikely(*errp))
19589 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
19593 - return csum_partial_copy_generic(src, (void __force *)dst,
19595 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19596 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19597 + dst += PAX_USER_SHADOW_BASE;
19600 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
19601 len, isum, NULL, errp);
19603 EXPORT_SYMBOL(csum_partial_copy_to_user);
19604 diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
19605 index 51f1504..ddac4c1 100644
19606 --- a/arch/x86/lib/getuser.S
19607 +++ b/arch/x86/lib/getuser.S
19608 @@ -33,15 +33,38 @@
19609 #include <asm/asm-offsets.h>
19610 #include <asm/thread_info.h>
19611 #include <asm/asm.h>
19612 +#include <asm/segment.h>
19613 +#include <asm/pgtable.h>
19614 +#include <asm/alternative-asm.h>
19616 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19617 +#define __copyuser_seg gs;
19619 +#define __copyuser_seg
19623 ENTRY(__get_user_1)
19626 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19627 GET_THREAD_INFO(%_ASM_DX)
19628 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19630 -1: movzb (%_ASM_AX),%edx
19632 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19633 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19634 + cmp %_ASM_DX,%_ASM_AX
19636 + add %_ASM_DX,%_ASM_AX
19642 +1: __copyuser_seg movzb (%_ASM_AX),%edx
19644 + pax_force_retaddr
19647 ENDPROC(__get_user_1)
19648 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
19649 ENTRY(__get_user_2)
19653 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19655 GET_THREAD_INFO(%_ASM_DX)
19656 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19658 -2: movzwl -1(%_ASM_AX),%edx
19660 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19661 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19662 + cmp %_ASM_DX,%_ASM_AX
19664 + add %_ASM_DX,%_ASM_AX
19670 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19672 + pax_force_retaddr
19675 ENDPROC(__get_user_2)
19676 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
19677 ENTRY(__get_user_4)
19681 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19683 GET_THREAD_INFO(%_ASM_DX)
19684 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19686 -3: mov -3(%_ASM_AX),%edx
19688 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19689 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19690 + cmp %_ASM_DX,%_ASM_AX
19692 + add %_ASM_DX,%_ASM_AX
19698 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
19700 + pax_force_retaddr
19703 ENDPROC(__get_user_4)
19704 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
19705 GET_THREAD_INFO(%_ASM_DX)
19706 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19709 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19710 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19711 + cmp %_ASM_DX,%_ASM_AX
19713 + add %_ASM_DX,%_ASM_AX
19717 4: movq -7(%_ASM_AX),%_ASM_DX
19719 + pax_force_retaddr
19722 ENDPROC(__get_user_8)
19723 @@ -91,6 +152,7 @@ bad_get_user:
19726 mov $(-EFAULT),%_ASM_AX
19727 + pax_force_retaddr
19731 diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
19732 index 9f33b98..dfc7678 100644
19733 --- a/arch/x86/lib/insn.c
19734 +++ b/arch/x86/lib/insn.c
19736 #include <linux/string.h>
19737 #include <asm/inat.h>
19738 #include <asm/insn.h>
19740 +#include <asm/pgtable_types.h>
19742 +#define ktla_ktva(addr) addr
19745 #define get_next(t, insn) \
19746 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19748 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19750 memset(insn, 0, sizeof(*insn));
19751 - insn->kaddr = kaddr;
19752 - insn->next_byte = kaddr;
19753 + insn->kaddr = ktla_ktva(kaddr);
19754 + insn->next_byte = ktla_ktva(kaddr);
19755 insn->x86_64 = x86_64 ? 1 : 0;
19756 insn->opnd_bytes = 4;
19758 diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
19759 index 05a95e7..326f2fa 100644
19760 --- a/arch/x86/lib/iomap_copy_64.S
19761 +++ b/arch/x86/lib/iomap_copy_64.S
19764 #include <linux/linkage.h>
19765 #include <asm/dwarf2.h>
19766 +#include <asm/alternative-asm.h>
19769 * override generic version in lib/iomap_copy.c
19770 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
19774 + pax_force_retaddr
19777 ENDPROC(__iowrite32_copy)
19778 diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
19779 index efbf2a0..8893637 100644
19780 --- a/arch/x86/lib/memcpy_64.S
19781 +++ b/arch/x86/lib/memcpy_64.S
19786 + pax_force_retaddr
19794 + pax_force_retaddr
19798 @@ -81,13 +83,13 @@ ENTRY(memcpy)
19800 movq 0*8(%rsi), %r8
19801 movq 1*8(%rsi), %r9
19802 - movq 2*8(%rsi), %r10
19803 + movq 2*8(%rsi), %rcx
19804 movq 3*8(%rsi), %r11
19805 leaq 4*8(%rsi), %rsi
19807 movq %r8, 0*8(%rdi)
19808 movq %r9, 1*8(%rdi)
19809 - movq %r10, 2*8(%rdi)
19810 + movq %rcx, 2*8(%rdi)
19811 movq %r11, 3*8(%rdi)
19812 leaq 4*8(%rdi), %rdi
19813 jae .Lcopy_forward_loop
19814 @@ -110,12 +112,12 @@ ENTRY(memcpy)
19816 movq -1*8(%rsi), %r8
19817 movq -2*8(%rsi), %r9
19818 - movq -3*8(%rsi), %r10
19819 + movq -3*8(%rsi), %rcx
19820 movq -4*8(%rsi), %r11
19821 leaq -4*8(%rsi), %rsi
19822 movq %r8, -1*8(%rdi)
19823 movq %r9, -2*8(%rdi)
19824 - movq %r10, -3*8(%rdi)
19825 + movq %rcx, -3*8(%rdi)
19826 movq %r11, -4*8(%rdi)
19827 leaq -4*8(%rdi), %rdi
19828 jae .Lcopy_backward_loop
19829 @@ -135,12 +137,13 @@ ENTRY(memcpy)
19831 movq 0*8(%rsi), %r8
19832 movq 1*8(%rsi), %r9
19833 - movq -2*8(%rsi, %rdx), %r10
19834 + movq -2*8(%rsi, %rdx), %rcx
19835 movq -1*8(%rsi, %rdx), %r11
19836 movq %r8, 0*8(%rdi)
19837 movq %r9, 1*8(%rdi)
19838 - movq %r10, -2*8(%rdi, %rdx)
19839 + movq %rcx, -2*8(%rdi, %rdx)
19840 movq %r11, -1*8(%rdi, %rdx)
19841 + pax_force_retaddr
19845 @@ -153,6 +156,7 @@ ENTRY(memcpy)
19846 movq -1*8(%rsi, %rdx), %r9
19847 movq %r8, 0*8(%rdi)
19848 movq %r9, -1*8(%rdi, %rdx)
19849 + pax_force_retaddr
19853 @@ -166,6 +170,7 @@ ENTRY(memcpy)
19854 movl -4(%rsi, %rdx), %r8d
19856 movl %r8d, -4(%rdi, %rdx)
19857 + pax_force_retaddr
19861 @@ -183,6 +188,7 @@ ENTRY(memcpy)
19865 + pax_force_retaddr
19869 diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
19870 index ee16461..c39c199 100644
19871 --- a/arch/x86/lib/memmove_64.S
19872 +++ b/arch/x86/lib/memmove_64.S
19873 @@ -61,13 +61,13 @@ ENTRY(memmove)
19876 movq 0*8(%rsi), %r11
19877 - movq 1*8(%rsi), %r10
19878 + movq 1*8(%rsi), %rcx
19879 movq 2*8(%rsi), %r9
19880 movq 3*8(%rsi), %r8
19881 leaq 4*8(%rsi), %rsi
19883 movq %r11, 0*8(%rdi)
19884 - movq %r10, 1*8(%rdi)
19885 + movq %rcx, 1*8(%rdi)
19886 movq %r9, 2*8(%rdi)
19887 movq %r8, 3*8(%rdi)
19888 leaq 4*8(%rdi), %rdi
19889 @@ -81,10 +81,10 @@ ENTRY(memmove)
19892 movq -8(%rsi, %rdx), %r11
19893 - lea -8(%rdi, %rdx), %r10
19894 + lea -8(%rdi, %rdx), %r9
19897 - movq %r11, (%r10)
19900 .Lmemmove_end_forward:
19902 @@ -95,14 +95,14 @@ ENTRY(memmove)
19908 leaq -8(%rsi, %rdx), %rsi
19909 leaq -8(%rdi, %rdx), %rdi
19914 - movq %r11, (%r10)
19919 @@ -127,13 +127,13 @@ ENTRY(memmove)
19922 movq -1*8(%rsi), %r11
19923 - movq -2*8(%rsi), %r10
19924 + movq -2*8(%rsi), %rcx
19925 movq -3*8(%rsi), %r9
19926 movq -4*8(%rsi), %r8
19927 leaq -4*8(%rsi), %rsi
19929 movq %r11, -1*8(%rdi)
19930 - movq %r10, -2*8(%rdi)
19931 + movq %rcx, -2*8(%rdi)
19932 movq %r9, -3*8(%rdi)
19933 movq %r8, -4*8(%rdi)
19934 leaq -4*8(%rdi), %rdi
19935 @@ -151,11 +151,11 @@ ENTRY(memmove)
19936 * Move data from 16 bytes to 31 bytes.
19938 movq 0*8(%rsi), %r11
19939 - movq 1*8(%rsi), %r10
19940 + movq 1*8(%rsi), %rcx
19941 movq -2*8(%rsi, %rdx), %r9
19942 movq -1*8(%rsi, %rdx), %r8
19943 movq %r11, 0*8(%rdi)
19944 - movq %r10, 1*8(%rdi)
19945 + movq %rcx, 1*8(%rdi)
19946 movq %r9, -2*8(%rdi, %rdx)
19947 movq %r8, -1*8(%rdi, %rdx)
19949 @@ -167,9 +167,9 @@ ENTRY(memmove)
19950 * Move data from 8 bytes to 15 bytes.
19952 movq 0*8(%rsi), %r11
19953 - movq -1*8(%rsi, %rdx), %r10
19954 + movq -1*8(%rsi, %rdx), %r9
19955 movq %r11, 0*8(%rdi)
19956 - movq %r10, -1*8(%rdi, %rdx)
19957 + movq %r9, -1*8(%rdi, %rdx)
19961 @@ -178,9 +178,9 @@ ENTRY(memmove)
19962 * Move data from 4 bytes to 7 bytes.
19965 - movl -4(%rsi, %rdx), %r10d
19966 + movl -4(%rsi, %rdx), %r9d
19968 - movl %r10d, -4(%rdi, %rdx)
19969 + movl %r9d, -4(%rdi, %rdx)
19973 @@ -189,9 +189,9 @@ ENTRY(memmove)
19974 * Move data from 2 bytes to 3 bytes.
19977 - movw -2(%rsi, %rdx), %r10w
19978 + movw -2(%rsi, %rdx), %r9w
19980 - movw %r10w, -2(%rdi, %rdx)
19981 + movw %r9w, -2(%rdi, %rdx)
19985 @@ -202,6 +202,7 @@ ENTRY(memmove)
19989 + pax_force_retaddr
19993 @@ -210,6 +211,7 @@ ENTRY(memmove)
19994 /* Forward moving data. */
19997 + pax_force_retaddr
19999 .Lmemmove_end_forward_efs:
20001 diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
20002 index 79bd454..dff325a 100644
20003 --- a/arch/x86/lib/memset_64.S
20004 +++ b/arch/x86/lib/memset_64.S
20009 + pax_force_retaddr
20017 + pax_force_retaddr
20021 @@ -60,13 +62,13 @@
20028 /* expand byte value */
20030 movabs $0x0101010101010101,%rax
20031 mul %rcx /* with rax, clobbers rdx */
20036 @@ -120,7 +122,8 @@ ENTRY(__memset)
20042 + pax_force_retaddr
20046 diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
20047 index c9f2d9b..e7fd2c0 100644
20048 --- a/arch/x86/lib/mmx_32.c
20049 +++ b/arch/x86/lib/mmx_32.c
20050 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20054 + unsigned long cr0;
20056 if (unlikely(in_interrupt()))
20057 return __memcpy(to, from, len);
20058 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
20059 kernel_fpu_begin();
20061 __asm__ __volatile__ (
20062 - "1: prefetch (%0)\n" /* This set is 28 bytes */
20063 - " prefetch 64(%0)\n"
20064 - " prefetch 128(%0)\n"
20065 - " prefetch 192(%0)\n"
20066 - " prefetch 256(%0)\n"
20067 + "1: prefetch (%1)\n" /* This set is 28 bytes */
20068 + " prefetch 64(%1)\n"
20069 + " prefetch 128(%1)\n"
20070 + " prefetch 192(%1)\n"
20071 + " prefetch 256(%1)\n"
20073 ".section .fixup, \"ax\"\n"
20074 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20077 +#ifdef CONFIG_PAX_KERNEXEC
20078 + " movl %%cr0, %0\n"
20079 + " movl %0, %%eax\n"
20080 + " andl $0xFFFEFFFF, %%eax\n"
20081 + " movl %%eax, %%cr0\n"
20084 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20086 +#ifdef CONFIG_PAX_KERNEXEC
20087 + " movl %0, %%cr0\n"
20092 _ASM_EXTABLE(1b, 3b)
20094 + : "=&r" (cr0) : "r" (from) : "ax");
20096 for ( ; i > 5; i--) {
20097 __asm__ __volatile__ (
20098 - "1: prefetch 320(%0)\n"
20099 - "2: movq (%0), %%mm0\n"
20100 - " movq 8(%0), %%mm1\n"
20101 - " movq 16(%0), %%mm2\n"
20102 - " movq 24(%0), %%mm3\n"
20103 - " movq %%mm0, (%1)\n"
20104 - " movq %%mm1, 8(%1)\n"
20105 - " movq %%mm2, 16(%1)\n"
20106 - " movq %%mm3, 24(%1)\n"
20107 - " movq 32(%0), %%mm0\n"
20108 - " movq 40(%0), %%mm1\n"
20109 - " movq 48(%0), %%mm2\n"
20110 - " movq 56(%0), %%mm3\n"
20111 - " movq %%mm0, 32(%1)\n"
20112 - " movq %%mm1, 40(%1)\n"
20113 - " movq %%mm2, 48(%1)\n"
20114 - " movq %%mm3, 56(%1)\n"
20115 + "1: prefetch 320(%1)\n"
20116 + "2: movq (%1), %%mm0\n"
20117 + " movq 8(%1), %%mm1\n"
20118 + " movq 16(%1), %%mm2\n"
20119 + " movq 24(%1), %%mm3\n"
20120 + " movq %%mm0, (%2)\n"
20121 + " movq %%mm1, 8(%2)\n"
20122 + " movq %%mm2, 16(%2)\n"
20123 + " movq %%mm3, 24(%2)\n"
20124 + " movq 32(%1), %%mm0\n"
20125 + " movq 40(%1), %%mm1\n"
20126 + " movq 48(%1), %%mm2\n"
20127 + " movq 56(%1), %%mm3\n"
20128 + " movq %%mm0, 32(%2)\n"
20129 + " movq %%mm1, 40(%2)\n"
20130 + " movq %%mm2, 48(%2)\n"
20131 + " movq %%mm3, 56(%2)\n"
20132 ".section .fixup, \"ax\"\n"
20133 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20136 +#ifdef CONFIG_PAX_KERNEXEC
20137 + " movl %%cr0, %0\n"
20138 + " movl %0, %%eax\n"
20139 + " andl $0xFFFEFFFF, %%eax\n"
20140 + " movl %%eax, %%cr0\n"
20143 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20145 +#ifdef CONFIG_PAX_KERNEXEC
20146 + " movl %0, %%cr0\n"
20151 _ASM_EXTABLE(1b, 3b)
20152 - : : "r" (from), "r" (to) : "memory");
20153 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20157 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20158 static void fast_copy_page(void *to, void *from)
20161 + unsigned long cr0;
20163 kernel_fpu_begin();
20165 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
20166 * but that is for later. -AV
20168 __asm__ __volatile__(
20169 - "1: prefetch (%0)\n"
20170 - " prefetch 64(%0)\n"
20171 - " prefetch 128(%0)\n"
20172 - " prefetch 192(%0)\n"
20173 - " prefetch 256(%0)\n"
20174 + "1: prefetch (%1)\n"
20175 + " prefetch 64(%1)\n"
20176 + " prefetch 128(%1)\n"
20177 + " prefetch 192(%1)\n"
20178 + " prefetch 256(%1)\n"
20180 ".section .fixup, \"ax\"\n"
20181 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20184 +#ifdef CONFIG_PAX_KERNEXEC
20185 + " movl %%cr0, %0\n"
20186 + " movl %0, %%eax\n"
20187 + " andl $0xFFFEFFFF, %%eax\n"
20188 + " movl %%eax, %%cr0\n"
20191 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20193 +#ifdef CONFIG_PAX_KERNEXEC
20194 + " movl %0, %%cr0\n"
20199 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
20200 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20202 for (i = 0; i < (4096-320)/64; i++) {
20203 __asm__ __volatile__ (
20204 - "1: prefetch 320(%0)\n"
20205 - "2: movq (%0), %%mm0\n"
20206 - " movntq %%mm0, (%1)\n"
20207 - " movq 8(%0), %%mm1\n"
20208 - " movntq %%mm1, 8(%1)\n"
20209 - " movq 16(%0), %%mm2\n"
20210 - " movntq %%mm2, 16(%1)\n"
20211 - " movq 24(%0), %%mm3\n"
20212 - " movntq %%mm3, 24(%1)\n"
20213 - " movq 32(%0), %%mm4\n"
20214 - " movntq %%mm4, 32(%1)\n"
20215 - " movq 40(%0), %%mm5\n"
20216 - " movntq %%mm5, 40(%1)\n"
20217 - " movq 48(%0), %%mm6\n"
20218 - " movntq %%mm6, 48(%1)\n"
20219 - " movq 56(%0), %%mm7\n"
20220 - " movntq %%mm7, 56(%1)\n"
20221 + "1: prefetch 320(%1)\n"
20222 + "2: movq (%1), %%mm0\n"
20223 + " movntq %%mm0, (%2)\n"
20224 + " movq 8(%1), %%mm1\n"
20225 + " movntq %%mm1, 8(%2)\n"
20226 + " movq 16(%1), %%mm2\n"
20227 + " movntq %%mm2, 16(%2)\n"
20228 + " movq 24(%1), %%mm3\n"
20229 + " movntq %%mm3, 24(%2)\n"
20230 + " movq 32(%1), %%mm4\n"
20231 + " movntq %%mm4, 32(%2)\n"
20232 + " movq 40(%1), %%mm5\n"
20233 + " movntq %%mm5, 40(%2)\n"
20234 + " movq 48(%1), %%mm6\n"
20235 + " movntq %%mm6, 48(%2)\n"
20236 + " movq 56(%1), %%mm7\n"
20237 + " movntq %%mm7, 56(%2)\n"
20238 ".section .fixup, \"ax\"\n"
20239 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20242 +#ifdef CONFIG_PAX_KERNEXEC
20243 + " movl %%cr0, %0\n"
20244 + " movl %0, %%eax\n"
20245 + " andl $0xFFFEFFFF, %%eax\n"
20246 + " movl %%eax, %%cr0\n"
20249 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20251 +#ifdef CONFIG_PAX_KERNEXEC
20252 + " movl %0, %%cr0\n"
20257 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20258 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20262 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20263 static void fast_copy_page(void *to, void *from)
20266 + unsigned long cr0;
20268 kernel_fpu_begin();
20270 __asm__ __volatile__ (
20271 - "1: prefetch (%0)\n"
20272 - " prefetch 64(%0)\n"
20273 - " prefetch 128(%0)\n"
20274 - " prefetch 192(%0)\n"
20275 - " prefetch 256(%0)\n"
20276 + "1: prefetch (%1)\n"
20277 + " prefetch 64(%1)\n"
20278 + " prefetch 128(%1)\n"
20279 + " prefetch 192(%1)\n"
20280 + " prefetch 256(%1)\n"
20282 ".section .fixup, \"ax\"\n"
20283 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20286 +#ifdef CONFIG_PAX_KERNEXEC
20287 + " movl %%cr0, %0\n"
20288 + " movl %0, %%eax\n"
20289 + " andl $0xFFFEFFFF, %%eax\n"
20290 + " movl %%eax, %%cr0\n"
20293 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20295 +#ifdef CONFIG_PAX_KERNEXEC
20296 + " movl %0, %%cr0\n"
20301 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
20302 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20304 for (i = 0; i < 4096/64; i++) {
20305 __asm__ __volatile__ (
20306 - "1: prefetch 320(%0)\n"
20307 - "2: movq (%0), %%mm0\n"
20308 - " movq 8(%0), %%mm1\n"
20309 - " movq 16(%0), %%mm2\n"
20310 - " movq 24(%0), %%mm3\n"
20311 - " movq %%mm0, (%1)\n"
20312 - " movq %%mm1, 8(%1)\n"
20313 - " movq %%mm2, 16(%1)\n"
20314 - " movq %%mm3, 24(%1)\n"
20315 - " movq 32(%0), %%mm0\n"
20316 - " movq 40(%0), %%mm1\n"
20317 - " movq 48(%0), %%mm2\n"
20318 - " movq 56(%0), %%mm3\n"
20319 - " movq %%mm0, 32(%1)\n"
20320 - " movq %%mm1, 40(%1)\n"
20321 - " movq %%mm2, 48(%1)\n"
20322 - " movq %%mm3, 56(%1)\n"
20323 + "1: prefetch 320(%1)\n"
20324 + "2: movq (%1), %%mm0\n"
20325 + " movq 8(%1), %%mm1\n"
20326 + " movq 16(%1), %%mm2\n"
20327 + " movq 24(%1), %%mm3\n"
20328 + " movq %%mm0, (%2)\n"
20329 + " movq %%mm1, 8(%2)\n"
20330 + " movq %%mm2, 16(%2)\n"
20331 + " movq %%mm3, 24(%2)\n"
20332 + " movq 32(%1), %%mm0\n"
20333 + " movq 40(%1), %%mm1\n"
20334 + " movq 48(%1), %%mm2\n"
20335 + " movq 56(%1), %%mm3\n"
20336 + " movq %%mm0, 32(%2)\n"
20337 + " movq %%mm1, 40(%2)\n"
20338 + " movq %%mm2, 48(%2)\n"
20339 + " movq %%mm3, 56(%2)\n"
20340 ".section .fixup, \"ax\"\n"
20341 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20344 +#ifdef CONFIG_PAX_KERNEXEC
20345 + " movl %%cr0, %0\n"
20346 + " movl %0, %%eax\n"
20347 + " andl $0xFFFEFFFF, %%eax\n"
20348 + " movl %%eax, %%cr0\n"
20351 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20353 +#ifdef CONFIG_PAX_KERNEXEC
20354 + " movl %0, %%cr0\n"
20359 _ASM_EXTABLE(1b, 3b)
20360 - : : "r" (from), "r" (to) : "memory");
20361 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20365 diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
20366 index 69fa106..adda88b 100644
20367 --- a/arch/x86/lib/msr-reg.S
20368 +++ b/arch/x86/lib/msr-reg.S
20370 #include <asm/dwarf2.h>
20371 #include <asm/asm.h>
20372 #include <asm/msr.h>
20373 +#include <asm/alternative-asm.h>
20375 #ifdef CONFIG_X86_64
20377 @@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
20381 - movq %rdi, %r10 /* Save pointer */
20382 + movq %rdi, %r9 /* Save pointer */
20383 xorl %r11d, %r11d /* Return value */
20386 @@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
20387 movl 28(%rdi), %edi
20390 -2: movl %eax, (%r10)
20391 +2: movl %eax, (%r9)
20392 movl %r11d, %eax /* Return value */
20393 - movl %ecx, 4(%r10)
20394 - movl %edx, 8(%r10)
20395 - movl %ebx, 12(%r10)
20396 - movl %ebp, 20(%r10)
20397 - movl %esi, 24(%r10)
20398 - movl %edi, 28(%r10)
20399 + movl %ecx, 4(%r9)
20400 + movl %edx, 8(%r9)
20401 + movl %ebx, 12(%r9)
20402 + movl %ebp, 20(%r9)
20403 + movl %esi, 24(%r9)
20404 + movl %edi, 28(%r9)
20407 + pax_force_retaddr
20411 diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
20412 index 36b0d15..d381858 100644
20413 --- a/arch/x86/lib/putuser.S
20414 +++ b/arch/x86/lib/putuser.S
20416 #include <asm/thread_info.h>
20417 #include <asm/errno.h>
20418 #include <asm/asm.h>
20420 +#include <asm/segment.h>
20421 +#include <asm/pgtable.h>
20422 +#include <asm/alternative-asm.h>
20426 @@ -29,52 +31,119 @@
20427 * as they get called from within inline assembly.
20430 -#define ENTER CFI_STARTPROC ; \
20431 - GET_THREAD_INFO(%_ASM_BX)
20432 -#define EXIT ret ; \
20433 +#define ENTER CFI_STARTPROC
20434 +#define EXIT pax_force_retaddr; ret ; \
20437 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20438 +#define _DEST %_ASM_CX,%_ASM_BX
20440 +#define _DEST %_ASM_CX
20443 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20444 +#define __copyuser_seg gs;
20446 +#define __copyuser_seg
20450 ENTRY(__put_user_1)
20453 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20454 + GET_THREAD_INFO(%_ASM_BX)
20455 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20457 -1: movb %al,(%_ASM_CX)
20459 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20460 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20461 + cmp %_ASM_BX,%_ASM_CX
20469 +1: __copyuser_seg movb %al,(_DEST)
20472 ENDPROC(__put_user_1)
20474 ENTRY(__put_user_2)
20477 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20478 + GET_THREAD_INFO(%_ASM_BX)
20479 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20481 cmp %_ASM_BX,%_ASM_CX
20483 -2: movw %ax,(%_ASM_CX)
20485 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20486 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20487 + cmp %_ASM_BX,%_ASM_CX
20495 +2: __copyuser_seg movw %ax,(_DEST)
20498 ENDPROC(__put_user_2)
20500 ENTRY(__put_user_4)
20503 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20504 + GET_THREAD_INFO(%_ASM_BX)
20505 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20507 cmp %_ASM_BX,%_ASM_CX
20509 -3: movl %eax,(%_ASM_CX)
20511 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20512 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20513 + cmp %_ASM_BX,%_ASM_CX
20521 +3: __copyuser_seg movl %eax,(_DEST)
20524 ENDPROC(__put_user_4)
20526 ENTRY(__put_user_8)
20529 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20530 + GET_THREAD_INFO(%_ASM_BX)
20531 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20533 cmp %_ASM_BX,%_ASM_CX
20535 -4: mov %_ASM_AX,(%_ASM_CX)
20537 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20538 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20539 + cmp %_ASM_BX,%_ASM_CX
20547 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
20548 #ifdef CONFIG_X86_32
20549 -5: movl %edx,4(%_ASM_CX)
20550 +5: __copyuser_seg movl %edx,4(_DEST)
20554 diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
20555 index 1cad221..de671ee 100644
20556 --- a/arch/x86/lib/rwlock.S
20557 +++ b/arch/x86/lib/rwlock.S
20558 @@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
20561 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20563 +#ifdef CONFIG_PAX_REFCOUNT
20566 + WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20569 + _ASM_EXTABLE(1234b, 1234b)
20573 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
20576 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
20578 +#ifdef CONFIG_PAX_REFCOUNT
20581 + WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
20584 + _ASM_EXTABLE(1234b, 1234b)
20589 + pax_force_retaddr
20592 END(__write_lock_failed)
20593 @@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
20596 READ_LOCK_SIZE(inc) (%__lock_ptr)
20598 +#ifdef CONFIG_PAX_REFCOUNT
20601 + READ_LOCK_SIZE(dec) (%__lock_ptr)
20604 + _ASM_EXTABLE(1234b, 1234b)
20608 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
20611 READ_LOCK_SIZE(dec) (%__lock_ptr)
20613 +#ifdef CONFIG_PAX_REFCOUNT
20616 + READ_LOCK_SIZE(inc) (%__lock_ptr)
20619 + _ASM_EXTABLE(1234b, 1234b)
20624 + pax_force_retaddr
20627 END(__read_lock_failed)
20628 diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
20629 index 5dff5f0..cadebf4 100644
20630 --- a/arch/x86/lib/rwsem.S
20631 +++ b/arch/x86/lib/rwsem.S
20632 @@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
20633 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20634 CFI_RESTORE __ASM_REG(dx)
20635 restore_common_regs
20636 + pax_force_retaddr
20639 ENDPROC(call_rwsem_down_read_failed)
20640 @@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
20642 call rwsem_down_write_failed
20643 restore_common_regs
20644 + pax_force_retaddr
20647 ENDPROC(call_rwsem_down_write_failed)
20648 @@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
20651 restore_common_regs
20653 +1: pax_force_retaddr
20656 ENDPROC(call_rwsem_wake)
20658 @@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
20659 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
20660 CFI_RESTORE __ASM_REG(dx)
20661 restore_common_regs
20662 + pax_force_retaddr
20665 ENDPROC(call_rwsem_downgrade_wake)
20666 diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
20667 index a63efd6..ccecad8 100644
20668 --- a/arch/x86/lib/thunk_64.S
20669 +++ b/arch/x86/lib/thunk_64.S
20671 #include <linux/linkage.h>
20672 #include <asm/dwarf2.h>
20673 #include <asm/calling.h>
20674 +#include <asm/alternative-asm.h>
20676 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
20677 .macro THUNK name, func, put_ret_addr_in_rdi=0
20682 + pax_force_retaddr
20685 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
20686 index e218d5d..35679b4 100644
20687 --- a/arch/x86/lib/usercopy_32.c
20688 +++ b/arch/x86/lib/usercopy_32.c
20689 @@ -43,7 +43,7 @@ do { \
20690 __asm__ __volatile__( \
20694 + "0: "__copyuser_seg"lodsb\n" \
20696 " testb %%al,%%al\n" \
20698 @@ -128,10 +128,12 @@ do { \
20701 __asm__ __volatile__( \
20702 + __COPYUSER_SET_ES \
20703 "0: rep; stosl\n" \
20705 "1: rep; stosb\n" \
20707 + __COPYUSER_RESTORE_ES \
20708 ".section .fixup,\"ax\"\n" \
20709 "3: lea 0(%2,%0,4),%0\n" \
20711 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
20714 __asm__ __volatile__(
20715 + __COPYUSER_SET_ES
20719 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
20723 + __COPYUSER_RESTORE_ES
20724 ".section .fixup,\"ax\"\n"
20725 "2: xorl %%eax,%%eax\n"
20727 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20729 #ifdef CONFIG_X86_INTEL_USERCOPY
20730 static unsigned long
20731 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
20732 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20735 __asm__ __volatile__(
20736 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20738 "3: movl 0(%4), %%eax\n"
20739 "4: movl 4(%4), %%edx\n"
20740 - "5: movl %%eax, 0(%3)\n"
20741 - "6: movl %%edx, 4(%3)\n"
20742 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20743 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20744 "7: movl 8(%4), %%eax\n"
20745 "8: movl 12(%4),%%edx\n"
20746 - "9: movl %%eax, 8(%3)\n"
20747 - "10: movl %%edx, 12(%3)\n"
20748 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20749 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20750 "11: movl 16(%4), %%eax\n"
20751 "12: movl 20(%4), %%edx\n"
20752 - "13: movl %%eax, 16(%3)\n"
20753 - "14: movl %%edx, 20(%3)\n"
20754 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20755 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20756 "15: movl 24(%4), %%eax\n"
20757 "16: movl 28(%4), %%edx\n"
20758 - "17: movl %%eax, 24(%3)\n"
20759 - "18: movl %%edx, 28(%3)\n"
20760 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20761 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20762 "19: movl 32(%4), %%eax\n"
20763 "20: movl 36(%4), %%edx\n"
20764 - "21: movl %%eax, 32(%3)\n"
20765 - "22: movl %%edx, 36(%3)\n"
20766 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20767 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20768 "23: movl 40(%4), %%eax\n"
20769 "24: movl 44(%4), %%edx\n"
20770 - "25: movl %%eax, 40(%3)\n"
20771 - "26: movl %%edx, 44(%3)\n"
20772 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20773 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20774 "27: movl 48(%4), %%eax\n"
20775 "28: movl 52(%4), %%edx\n"
20776 - "29: movl %%eax, 48(%3)\n"
20777 - "30: movl %%edx, 52(%3)\n"
20778 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20779 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20780 "31: movl 56(%4), %%eax\n"
20781 "32: movl 60(%4), %%edx\n"
20782 - "33: movl %%eax, 56(%3)\n"
20783 - "34: movl %%edx, 60(%3)\n"
20784 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20785 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20789 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
20791 " andl $3, %%eax\n"
20793 + __COPYUSER_SET_ES
20795 "36: movl %%eax, %0\n"
20798 + __COPYUSER_RESTORE_ES
20799 + ".section .fixup,\"ax\"\n"
20800 + "101: lea 0(%%eax,%0,4),%0\n"
20803 + ".section __ex_table,\"a\"\n"
20805 + " .long 1b,100b\n"
20806 + " .long 2b,100b\n"
20807 + " .long 3b,100b\n"
20808 + " .long 4b,100b\n"
20809 + " .long 5b,100b\n"
20810 + " .long 6b,100b\n"
20811 + " .long 7b,100b\n"
20812 + " .long 8b,100b\n"
20813 + " .long 9b,100b\n"
20814 + " .long 10b,100b\n"
20815 + " .long 11b,100b\n"
20816 + " .long 12b,100b\n"
20817 + " .long 13b,100b\n"
20818 + " .long 14b,100b\n"
20819 + " .long 15b,100b\n"
20820 + " .long 16b,100b\n"
20821 + " .long 17b,100b\n"
20822 + " .long 18b,100b\n"
20823 + " .long 19b,100b\n"
20824 + " .long 20b,100b\n"
20825 + " .long 21b,100b\n"
20826 + " .long 22b,100b\n"
20827 + " .long 23b,100b\n"
20828 + " .long 24b,100b\n"
20829 + " .long 25b,100b\n"
20830 + " .long 26b,100b\n"
20831 + " .long 27b,100b\n"
20832 + " .long 28b,100b\n"
20833 + " .long 29b,100b\n"
20834 + " .long 30b,100b\n"
20835 + " .long 31b,100b\n"
20836 + " .long 32b,100b\n"
20837 + " .long 33b,100b\n"
20838 + " .long 34b,100b\n"
20839 + " .long 35b,100b\n"
20840 + " .long 36b,100b\n"
20841 + " .long 37b,100b\n"
20842 + " .long 99b,101b\n"
20844 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
20845 + : "1"(to), "2"(from), "0"(size)
20846 + : "eax", "edx", "memory");
20850 +static unsigned long
20851 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20854 + __asm__ __volatile__(
20855 + " .align 2,0x90\n"
20856 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20857 + " cmpl $67, %0\n"
20859 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20860 + " .align 2,0x90\n"
20861 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20862 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20863 + "5: movl %%eax, 0(%3)\n"
20864 + "6: movl %%edx, 4(%3)\n"
20865 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20866 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20867 + "9: movl %%eax, 8(%3)\n"
20868 + "10: movl %%edx, 12(%3)\n"
20869 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20870 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20871 + "13: movl %%eax, 16(%3)\n"
20872 + "14: movl %%edx, 20(%3)\n"
20873 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20874 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20875 + "17: movl %%eax, 24(%3)\n"
20876 + "18: movl %%edx, 28(%3)\n"
20877 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20878 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20879 + "21: movl %%eax, 32(%3)\n"
20880 + "22: movl %%edx, 36(%3)\n"
20881 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20882 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20883 + "25: movl %%eax, 40(%3)\n"
20884 + "26: movl %%edx, 44(%3)\n"
20885 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20886 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20887 + "29: movl %%eax, 48(%3)\n"
20888 + "30: movl %%edx, 52(%3)\n"
20889 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20890 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20891 + "33: movl %%eax, 56(%3)\n"
20892 + "34: movl %%edx, 60(%3)\n"
20893 + " addl $-64, %0\n"
20894 + " addl $64, %4\n"
20895 + " addl $64, %3\n"
20896 + " cmpl $63, %0\n"
20898 + "35: movl %0, %%eax\n"
20900 + " andl $3, %%eax\n"
20902 + "99: rep; "__copyuser_seg" movsl\n"
20903 + "36: movl %%eax, %0\n"
20904 + "37: rep; "__copyuser_seg" movsb\n"
20906 ".section .fixup,\"ax\"\n"
20907 "101: lea 0(%%eax,%0,4),%0\n"
20909 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20911 __asm__ __volatile__(
20913 - "0: movl 32(%4), %%eax\n"
20914 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20917 - "1: movl 64(%4), %%eax\n"
20918 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20920 - "2: movl 0(%4), %%eax\n"
20921 - "21: movl 4(%4), %%edx\n"
20922 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20923 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20924 " movl %%eax, 0(%3)\n"
20925 " movl %%edx, 4(%3)\n"
20926 - "3: movl 8(%4), %%eax\n"
20927 - "31: movl 12(%4),%%edx\n"
20928 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20929 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20930 " movl %%eax, 8(%3)\n"
20931 " movl %%edx, 12(%3)\n"
20932 - "4: movl 16(%4), %%eax\n"
20933 - "41: movl 20(%4), %%edx\n"
20934 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20935 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20936 " movl %%eax, 16(%3)\n"
20937 " movl %%edx, 20(%3)\n"
20938 - "10: movl 24(%4), %%eax\n"
20939 - "51: movl 28(%4), %%edx\n"
20940 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20941 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20942 " movl %%eax, 24(%3)\n"
20943 " movl %%edx, 28(%3)\n"
20944 - "11: movl 32(%4), %%eax\n"
20945 - "61: movl 36(%4), %%edx\n"
20946 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20947 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20948 " movl %%eax, 32(%3)\n"
20949 " movl %%edx, 36(%3)\n"
20950 - "12: movl 40(%4), %%eax\n"
20951 - "71: movl 44(%4), %%edx\n"
20952 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20953 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20954 " movl %%eax, 40(%3)\n"
20955 " movl %%edx, 44(%3)\n"
20956 - "13: movl 48(%4), %%eax\n"
20957 - "81: movl 52(%4), %%edx\n"
20958 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20959 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20960 " movl %%eax, 48(%3)\n"
20961 " movl %%edx, 52(%3)\n"
20962 - "14: movl 56(%4), %%eax\n"
20963 - "91: movl 60(%4), %%edx\n"
20964 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20965 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20966 " movl %%eax, 56(%3)\n"
20967 " movl %%edx, 60(%3)\n"
20969 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
20971 " andl $3, %%eax\n"
20973 - "6: rep; movsl\n"
20974 + "6: rep; "__copyuser_seg" movsl\n"
20976 - "7: rep; movsb\n"
20977 + "7: rep; "__copyuser_seg" movsb\n"
20979 ".section .fixup,\"ax\"\n"
20980 "9: lea 0(%%eax,%0,4),%0\n"
20981 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
20983 __asm__ __volatile__(
20985 - "0: movl 32(%4), %%eax\n"
20986 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20989 - "1: movl 64(%4), %%eax\n"
20990 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20992 - "2: movl 0(%4), %%eax\n"
20993 - "21: movl 4(%4), %%edx\n"
20994 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20995 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20996 " movnti %%eax, 0(%3)\n"
20997 " movnti %%edx, 4(%3)\n"
20998 - "3: movl 8(%4), %%eax\n"
20999 - "31: movl 12(%4),%%edx\n"
21000 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21001 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21002 " movnti %%eax, 8(%3)\n"
21003 " movnti %%edx, 12(%3)\n"
21004 - "4: movl 16(%4), %%eax\n"
21005 - "41: movl 20(%4), %%edx\n"
21006 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21007 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21008 " movnti %%eax, 16(%3)\n"
21009 " movnti %%edx, 20(%3)\n"
21010 - "10: movl 24(%4), %%eax\n"
21011 - "51: movl 28(%4), %%edx\n"
21012 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21013 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21014 " movnti %%eax, 24(%3)\n"
21015 " movnti %%edx, 28(%3)\n"
21016 - "11: movl 32(%4), %%eax\n"
21017 - "61: movl 36(%4), %%edx\n"
21018 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21019 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21020 " movnti %%eax, 32(%3)\n"
21021 " movnti %%edx, 36(%3)\n"
21022 - "12: movl 40(%4), %%eax\n"
21023 - "71: movl 44(%4), %%edx\n"
21024 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21025 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21026 " movnti %%eax, 40(%3)\n"
21027 " movnti %%edx, 44(%3)\n"
21028 - "13: movl 48(%4), %%eax\n"
21029 - "81: movl 52(%4), %%edx\n"
21030 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21031 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21032 " movnti %%eax, 48(%3)\n"
21033 " movnti %%edx, 52(%3)\n"
21034 - "14: movl 56(%4), %%eax\n"
21035 - "91: movl 60(%4), %%edx\n"
21036 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21037 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21038 " movnti %%eax, 56(%3)\n"
21039 " movnti %%edx, 60(%3)\n"
21041 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
21043 " andl $3, %%eax\n"
21045 - "6: rep; movsl\n"
21046 + "6: rep; "__copyuser_seg" movsl\n"
21048 - "7: rep; movsb\n"
21049 + "7: rep; "__copyuser_seg" movsb\n"
21051 ".section .fixup,\"ax\"\n"
21052 "9: lea 0(%%eax,%0,4),%0\n"
21053 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
21055 __asm__ __volatile__(
21057 - "0: movl 32(%4), %%eax\n"
21058 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21061 - "1: movl 64(%4), %%eax\n"
21062 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21064 - "2: movl 0(%4), %%eax\n"
21065 - "21: movl 4(%4), %%edx\n"
21066 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21067 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21068 " movnti %%eax, 0(%3)\n"
21069 " movnti %%edx, 4(%3)\n"
21070 - "3: movl 8(%4), %%eax\n"
21071 - "31: movl 12(%4),%%edx\n"
21072 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21073 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21074 " movnti %%eax, 8(%3)\n"
21075 " movnti %%edx, 12(%3)\n"
21076 - "4: movl 16(%4), %%eax\n"
21077 - "41: movl 20(%4), %%edx\n"
21078 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21079 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21080 " movnti %%eax, 16(%3)\n"
21081 " movnti %%edx, 20(%3)\n"
21082 - "10: movl 24(%4), %%eax\n"
21083 - "51: movl 28(%4), %%edx\n"
21084 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21085 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21086 " movnti %%eax, 24(%3)\n"
21087 " movnti %%edx, 28(%3)\n"
21088 - "11: movl 32(%4), %%eax\n"
21089 - "61: movl 36(%4), %%edx\n"
21090 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21091 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21092 " movnti %%eax, 32(%3)\n"
21093 " movnti %%edx, 36(%3)\n"
21094 - "12: movl 40(%4), %%eax\n"
21095 - "71: movl 44(%4), %%edx\n"
21096 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21097 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21098 " movnti %%eax, 40(%3)\n"
21099 " movnti %%edx, 44(%3)\n"
21100 - "13: movl 48(%4), %%eax\n"
21101 - "81: movl 52(%4), %%edx\n"
21102 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21103 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21104 " movnti %%eax, 48(%3)\n"
21105 " movnti %%edx, 52(%3)\n"
21106 - "14: movl 56(%4), %%eax\n"
21107 - "91: movl 60(%4), %%edx\n"
21108 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21109 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21110 " movnti %%eax, 56(%3)\n"
21111 " movnti %%edx, 60(%3)\n"
21113 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
21115 " andl $3, %%eax\n"
21117 - "6: rep; movsl\n"
21118 + "6: rep; "__copyuser_seg" movsl\n"
21120 - "7: rep; movsb\n"
21121 + "7: rep; "__copyuser_seg" movsb\n"
21123 ".section .fixup,\"ax\"\n"
21124 "9: lea 0(%%eax,%0,4),%0\n"
21125 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
21127 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21128 unsigned long size);
21129 -unsigned long __copy_user_intel(void __user *to, const void *from,
21130 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21131 + unsigned long size);
21132 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
21133 unsigned long size);
21134 unsigned long __copy_user_zeroing_intel_nocache(void *to,
21135 const void __user *from, unsigned long size);
21136 #endif /* CONFIG_X86_INTEL_USERCOPY */
21138 /* Generic arbitrary sized copy. */
21139 -#define __copy_user(to, from, size) \
21140 +#define __copy_user(to, from, size, prefix, set, restore) \
21142 int __d0, __d1, __d2; \
21143 __asm__ __volatile__( \
21151 - "4: rep; movsb\n" \
21152 + "4: rep; "prefix"movsb\n" \
21156 " .align 2,0x90\n" \
21157 - "0: rep; movsl\n" \
21158 + "0: rep; "prefix"movsl\n" \
21160 - "1: rep; movsb\n" \
21161 + "1: rep; "prefix"movsb\n" \
21164 ".section .fixup,\"ax\"\n" \
21165 "5: addl %3,%0\n" \
21167 @@ -682,14 +799,14 @@ do { \
21171 - "4: rep; movsb\n" \
21172 + "4: rep; "__copyuser_seg"movsb\n" \
21176 " .align 2,0x90\n" \
21177 - "0: rep; movsl\n" \
21178 + "0: rep; "__copyuser_seg"movsl\n" \
21180 - "1: rep; movsb\n" \
21181 + "1: rep; "__copyuser_seg"movsb\n" \
21183 ".section .fixup,\"ax\"\n" \
21184 "5: addl %3,%0\n" \
21185 @@ -775,9 +892,9 @@ survive:
21188 if (movsl_is_ok(to, from, n))
21189 - __copy_user(to, from, n);
21190 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
21192 - n = __copy_user_intel(to, from, n);
21193 + n = __generic_copy_to_user_intel(to, from, n);
21196 EXPORT_SYMBOL(__copy_to_user_ll);
21197 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
21200 if (movsl_is_ok(to, from, n))
21201 - __copy_user(to, from, n);
21202 + __copy_user(to, from, n, __copyuser_seg, "", "");
21204 - n = __copy_user_intel((void __user *)to,
21205 - (const void *)from, n);
21206 + n = __generic_copy_from_user_intel(to, from, n);
21209 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21210 @@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
21211 if (n > 64 && cpu_has_xmm2)
21212 n = __copy_user_intel_nocache(to, from, n);
21214 - __copy_user(to, from, n);
21215 + __copy_user(to, from, n, __copyuser_seg, "", "");
21217 - __copy_user(to, from, n);
21218 + __copy_user(to, from, n, __copyuser_seg, "", "");
21222 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21225 - * copy_to_user: - Copy a block of data into user space.
21226 - * @to: Destination address, in user space.
21227 - * @from: Source address, in kernel space.
21228 - * @n: Number of bytes to copy.
21230 - * Context: User context only. This function may sleep.
21232 - * Copy data from kernel space to user space.
21234 - * Returns number of bytes that could not be copied.
21235 - * On success, this will be zero.
21238 -copy_to_user(void __user *to, const void *from, unsigned long n)
21240 - if (access_ok(VERIFY_WRITE, to, n))
21241 - n = __copy_to_user(to, from, n);
21244 -EXPORT_SYMBOL(copy_to_user);
21247 - * copy_from_user: - Copy a block of data from user space.
21248 - * @to: Destination address, in kernel space.
21249 - * @from: Source address, in user space.
21250 - * @n: Number of bytes to copy.
21252 - * Context: User context only. This function may sleep.
21254 - * Copy data from user space to kernel space.
21256 - * Returns number of bytes that could not be copied.
21257 - * On success, this will be zero.
21259 - * If some data could not be copied, this function will pad the copied
21260 - * data to the requested size using zero bytes.
21263 -_copy_from_user(void *to, const void __user *from, unsigned long n)
21265 - if (access_ok(VERIFY_READ, from, n))
21266 - n = __copy_from_user(to, from, n);
21268 - memset(to, 0, n);
21271 -EXPORT_SYMBOL(_copy_from_user);
21273 void copy_from_user_overflow(void)
21275 WARN(1, "Buffer overflow detected!\n");
21277 EXPORT_SYMBOL(copy_from_user_overflow);
21279 +void copy_to_user_overflow(void)
21281 + WARN(1, "Buffer overflow detected!\n");
21283 +EXPORT_SYMBOL(copy_to_user_overflow);
21285 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21286 +void __set_fs(mm_segment_t x)
21290 + loadsegment(gs, 0);
21292 + case TASK_SIZE_MAX:
21293 + loadsegment(gs, __USER_DS);
21296 + loadsegment(gs, __KERNEL_DS);
21303 +EXPORT_SYMBOL(__set_fs);
21305 +void set_fs(mm_segment_t x)
21307 + current_thread_info()->addr_limit = x;
21310 +EXPORT_SYMBOL(set_fs);
21312 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
21313 index b7c2849..8633ad8 100644
21314 --- a/arch/x86/lib/usercopy_64.c
21315 +++ b/arch/x86/lib/usercopy_64.c
21316 @@ -42,6 +42,12 @@ long
21317 __strncpy_from_user(char *dst, const char __user *src, long count)
21321 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21322 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21323 + src += PAX_USER_SHADOW_BASE;
21326 __do_strncpy_from_user(dst, src, count, res);
21329 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
21334 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21335 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21336 + addr += PAX_USER_SHADOW_BASE;
21339 /* no memory constraint because it doesn't change any memory gcc knows
21342 @@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
21344 EXPORT_SYMBOL(strlen_user);
21346 -unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21347 +unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
21349 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21350 - return copy_user_generic((__force void *)to, (__force void *)from, len);
21353 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21355 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21356 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21357 + to += PAX_USER_SHADOW_BASE;
21358 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21359 + from += PAX_USER_SHADOW_BASE;
21362 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
21366 EXPORT_SYMBOL(copy_in_user);
21368 @@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
21369 * it is not necessary to optimize tail handling.
21372 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
21373 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
21377 diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
21378 index d0474ad..36e9257 100644
21379 --- a/arch/x86/mm/extable.c
21380 +++ b/arch/x86/mm/extable.c
21381 @@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs)
21382 const struct exception_table_entry *fixup;
21384 #ifdef CONFIG_PNPBIOS
21385 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21386 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21387 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21388 extern u32 pnp_bios_is_utter_crap;
21389 pnp_bios_is_utter_crap = 1;
21390 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
21391 index 0d17c8c..4f4764f 100644
21392 --- a/arch/x86/mm/fault.c
21393 +++ b/arch/x86/mm/fault.c
21394 @@ -13,11 +13,18 @@
21395 #include <linux/perf_event.h> /* perf_sw_event */
21396 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21397 #include <linux/prefetch.h> /* prefetchw */
21398 +#include <linux/unistd.h>
21399 +#include <linux/compiler.h>
21401 #include <asm/traps.h> /* dotraplinkage, ... */
21402 #include <asm/pgalloc.h> /* pgd_*(), ... */
21403 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21404 #include <asm/vsyscall.h>
21405 +#include <asm/tlbflush.h>
21407 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21408 +#include <asm/stacktrace.h>
21412 * Page fault error code bits:
21413 @@ -55,7 +62,7 @@ static inline int __kprobes notify_page_fault(struct pt_regs *regs)
21416 /* kprobe_running() needs smp_processor_id() */
21417 - if (kprobes_built_in() && !user_mode_vm(regs)) {
21418 + if (kprobes_built_in() && !user_mode(regs)) {
21420 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21422 @@ -116,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
21423 return !instr_lo || (instr_lo>>1) == 1;
21425 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21426 - if (probe_kernel_address(instr, opcode))
21427 + if (user_mode(regs)) {
21428 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21430 + } else if (probe_kernel_address(instr, opcode))
21433 *prefetch = (instr_lo == 0xF) &&
21434 @@ -150,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
21435 while (instr < max_instr) {
21436 unsigned char opcode;
21438 - if (probe_kernel_address(instr, opcode))
21439 + if (user_mode(regs)) {
21440 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21442 + } else if (probe_kernel_address(instr, opcode))
21446 @@ -181,6 +194,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
21447 force_sig_info(si_signo, &info, tsk);
21450 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21451 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
21454 +#ifdef CONFIG_PAX_EMUTRAMP
21455 +static int pax_handle_fetch_fault(struct pt_regs *regs);
21458 +#ifdef CONFIG_PAX_PAGEEXEC
21459 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21465 + pgd = pgd_offset(mm, address);
21466 + if (!pgd_present(*pgd))
21468 + pud = pud_offset(pgd, address);
21469 + if (!pud_present(*pud))
21471 + pmd = pmd_offset(pud, address);
21472 + if (!pmd_present(*pmd))
21478 DEFINE_SPINLOCK(pgd_lock);
21479 LIST_HEAD(pgd_list);
21481 @@ -231,10 +272,22 @@ void vmalloc_sync_all(void)
21482 for (address = VMALLOC_START & PMD_MASK;
21483 address >= TASK_SIZE && address < FIXADDR_TOP;
21484 address += PMD_SIZE) {
21486 +#ifdef CONFIG_PAX_PER_CPU_PGD
21487 + unsigned long cpu;
21492 spin_lock(&pgd_lock);
21494 +#ifdef CONFIG_PAX_PER_CPU_PGD
21495 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21496 + pgd_t *pgd = get_cpu_pgd(cpu);
21499 list_for_each_entry(page, &pgd_list, lru) {
21500 + pgd_t *pgd = page_address(page);
21501 spinlock_t *pgt_lock;
21504 @@ -242,8 +295,13 @@ void vmalloc_sync_all(void)
21505 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21507 spin_lock(pgt_lock);
21508 - ret = vmalloc_sync_one(page_address(page), address);
21511 + ret = vmalloc_sync_one(pgd, address);
21513 +#ifndef CONFIG_PAX_PER_CPU_PGD
21514 spin_unlock(pgt_lock);
21519 @@ -277,6 +335,11 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21520 * an interrupt in the middle of a task switch..
21522 pgd_paddr = read_cr3();
21524 +#ifdef CONFIG_PAX_PER_CPU_PGD
21525 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21528 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21531 @@ -372,7 +435,14 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
21532 * happen within a race in page table update. In the later
21536 +#ifdef CONFIG_PAX_PER_CPU_PGD
21537 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21538 + pgd = pgd_offset_cpu(smp_processor_id(), address);
21540 pgd = pgd_offset(current->active_mm, address);
21543 pgd_ref = pgd_offset_k(address);
21544 if (pgd_none(*pgd_ref))
21546 @@ -534,7 +604,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
21547 static int is_errata100(struct pt_regs *regs, unsigned long address)
21549 #ifdef CONFIG_X86_64
21550 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21551 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21555 @@ -561,7 +631,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
21558 static const char nx_warning[] = KERN_CRIT
21559 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21560 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21563 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21564 @@ -570,15 +640,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21565 if (!oops_may_print())
21568 - if (error_code & PF_INSTR) {
21569 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21570 unsigned int level;
21572 pte_t *pte = lookup_address(address, &level);
21574 if (pte && pte_present(*pte) && !pte_exec(*pte))
21575 - printk(nx_warning, current_uid());
21576 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21579 +#ifdef CONFIG_PAX_KERNEXEC
21580 + if (init_mm.start_code <= address && address < init_mm.end_code) {
21581 + if (current->signal->curr_ip)
21582 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21583 + ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21585 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21586 + current->comm, task_pid_nr(current), current_uid(), current_euid());
21590 printk(KERN_ALERT "BUG: unable to handle kernel ");
21591 if (address < PAGE_SIZE)
21592 printk(KERN_CONT "NULL pointer dereference");
21593 @@ -733,6 +814,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
21597 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21598 + if (pax_is_fetch_fault(regs, error_code, address)) {
21600 +#ifdef CONFIG_PAX_EMUTRAMP
21601 + switch (pax_handle_fetch_fault(regs)) {
21607 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21608 + do_group_exit(SIGKILL);
21612 if (unlikely(show_unhandled_signals))
21613 show_signal_msg(regs, error_code, address, tsk);
21615 @@ -829,7 +925,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
21616 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
21618 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
21619 - tsk->comm, tsk->pid, address);
21620 + tsk->comm, task_pid_nr(tsk), address);
21621 code = BUS_MCEERR_AR;
21624 @@ -884,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
21628 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21629 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21634 + unsigned char pte_mask;
21636 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21637 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
21640 + /* PaX: it's our fault, let's handle it if we can */
21642 + /* PaX: take a look at read faults before acquiring any locks */
21643 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21644 + /* instruction fetch attempt from a protected page in user mode */
21645 + up_read(&mm->mmap_sem);
21647 +#ifdef CONFIG_PAX_EMUTRAMP
21648 + switch (pax_handle_fetch_fault(regs)) {
21654 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21655 + do_group_exit(SIGKILL);
21658 + pmd = pax_get_pmd(mm, address);
21659 + if (unlikely(!pmd))
21662 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21663 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21664 + pte_unmap_unlock(pte, ptl);
21668 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21669 + /* write attempt to a protected page in user mode */
21670 + pte_unmap_unlock(pte, ptl);
21675 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21677 + if (likely(address > get_limit(regs->cs)))
21680 + set_pte(pte, pte_mkread(*pte));
21681 + __flush_tlb_one(address);
21682 + pte_unmap_unlock(pte, ptl);
21683 + up_read(&mm->mmap_sem);
21687 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21690 + * PaX: fill DTLB with user rights and retry
21692 + __asm__ __volatile__ (
21694 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21696 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21697 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21698 + * page fault when examined during a TLB load attempt. this is true not only
21699 + * for PTEs holding a non-present entry but also present entries that will
21700 + * raise a page fault (such as those set up by PaX, or the copy-on-write
21701 + * mechanism). in effect it means that we do *not* need to flush the TLBs
21702 + * for our target pages since their PTEs are simply not in the TLBs at all.
21704 + * the best thing in omitting it is that we gain around 15-20% speed in the
21705 + * fast path of the page fault handler and can get rid of tracing since we
21706 + * can no longer flush unintended entries.
21710 + __copyuser_seg"testb $0,(%0)\n"
21713 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21714 + : "memory", "cc");
21715 + pte_unmap_unlock(pte, ptl);
21716 + up_read(&mm->mmap_sem);
21722 * Handle a spurious fault caused by a stale TLB entry.
21724 @@ -956,6 +1145,9 @@ int show_unhandled_signals = 1;
21726 access_error(unsigned long error_code, struct vm_area_struct *vma)
21728 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21731 if (error_code & PF_WRITE) {
21732 /* write, present and write, not present: */
21733 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21734 @@ -989,18 +1181,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21736 struct vm_area_struct *vma;
21737 struct task_struct *tsk;
21738 - unsigned long address;
21739 struct mm_struct *mm;
21741 int write = error_code & PF_WRITE;
21742 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
21743 (write ? FAULT_FLAG_WRITE : 0);
21748 /* Get the faulting address: */
21749 - address = read_cr2();
21750 + unsigned long address = read_cr2();
21752 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21753 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21754 + if (!search_exception_tables(regs->ip)) {
21755 + bad_area_nosemaphore(regs, error_code, address);
21758 + if (address < PAX_USER_SHADOW_BASE) {
21759 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21760 + printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
21761 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21763 + address -= PAX_USER_SHADOW_BASE;
21771 * Detect and handle instructions that would cause a page fault for
21772 @@ -1061,7 +1267,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
21773 * User-mode registers count as a user access even for any
21774 * potential system fault or CPU buglet:
21776 - if (user_mode_vm(regs)) {
21777 + if (user_mode(regs)) {
21778 local_irq_enable();
21779 error_code |= PF_USER;
21781 @@ -1116,6 +1322,11 @@ retry:
21785 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21786 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21790 vma = find_vma(mm, address);
21791 if (unlikely(!vma)) {
21792 bad_area(regs, error_code, address);
21793 @@ -1127,18 +1338,24 @@ retry:
21794 bad_area(regs, error_code, address);
21797 - if (error_code & PF_USER) {
21799 - * Accessing the stack below %sp is always a bug.
21800 - * The large cushion allows instructions like enter
21801 - * and pusha to work. ("enter $65535, $31" pushes
21802 - * 32 pointers and then decrements %sp by 65535.)
21804 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21805 - bad_area(regs, error_code, address);
21809 + * Accessing the stack below %sp is always a bug.
21810 + * The large cushion allows instructions like enter
21811 + * and pusha to work. ("enter $65535, $31" pushes
21812 + * 32 pointers and then decrements %sp by 65535.)
21814 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21815 + bad_area(regs, error_code, address);
21819 +#ifdef CONFIG_PAX_SEGMEXEC
21820 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21821 + bad_area(regs, error_code, address);
21826 if (unlikely(expand_stack(vma, address))) {
21827 bad_area(regs, error_code, address);
21829 @@ -1193,3 +1410,240 @@ good_area:
21831 up_read(&mm->mmap_sem);
21834 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21835 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
21837 + struct mm_struct *mm = current->mm;
21838 + unsigned long ip = regs->ip;
21840 + if (v8086_mode(regs))
21841 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21843 +#ifdef CONFIG_PAX_PAGEEXEC
21844 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
21845 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
21847 + if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
21853 +#ifdef CONFIG_PAX_SEGMEXEC
21854 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
21855 + if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
21865 +#ifdef CONFIG_PAX_EMUTRAMP
21866 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21870 + do { /* PaX: gcc trampoline emulation #1 */
21871 + unsigned char mov1, mov2;
21872 + unsigned short jmp;
21873 + unsigned int addr1, addr2;
21875 +#ifdef CONFIG_X86_64
21876 + if ((regs->ip + 11) >> 32)
21880 + err = get_user(mov1, (unsigned char __user *)regs->ip);
21881 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21882 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21883 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21884 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21889 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21890 + regs->cx = addr1;
21891 + regs->ax = addr2;
21892 + regs->ip = addr2;
21897 + do { /* PaX: gcc trampoline emulation #2 */
21898 + unsigned char mov, jmp;
21899 + unsigned int addr1, addr2;
21901 +#ifdef CONFIG_X86_64
21902 + if ((regs->ip + 9) >> 32)
21906 + err = get_user(mov, (unsigned char __user *)regs->ip);
21907 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21908 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21909 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21914 + if (mov == 0xB9 && jmp == 0xE9) {
21915 + regs->cx = addr1;
21916 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21921 + return 1; /* PaX in action */
21924 +#ifdef CONFIG_X86_64
21925 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21929 + do { /* PaX: gcc trampoline emulation #1 */
21930 + unsigned short mov1, mov2, jmp1;
21931 + unsigned char jmp2;
21932 + unsigned int addr1;
21933 + unsigned long addr2;
21935 + err = get_user(mov1, (unsigned short __user *)regs->ip);
21936 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21937 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21938 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21939 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21940 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21945 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21946 + regs->r11 = addr1;
21947 + regs->r10 = addr2;
21948 + regs->ip = addr1;
21953 + do { /* PaX: gcc trampoline emulation #2 */
21954 + unsigned short mov1, mov2, jmp1;
21955 + unsigned char jmp2;
21956 + unsigned long addr1, addr2;
21958 + err = get_user(mov1, (unsigned short __user *)regs->ip);
21959 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21960 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21961 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21962 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21963 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21968 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21969 + regs->r11 = addr1;
21970 + regs->r10 = addr2;
21971 + regs->ip = addr1;
21976 + return 1; /* PaX in action */
21981 + * PaX: decide what to do with offenders (regs->ip = fault address)
21983 + * returns 1 when task should be killed
21984 + * 2 when gcc trampoline was detected
21986 +static int pax_handle_fetch_fault(struct pt_regs *regs)
21988 + if (v8086_mode(regs))
21991 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21994 +#ifdef CONFIG_X86_32
21995 + return pax_handle_fetch_fault_32(regs);
21997 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21998 + return pax_handle_fetch_fault_32(regs);
22000 + return pax_handle_fetch_fault_64(regs);
22005 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22006 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
22010 + printk(KERN_ERR "PAX: bytes at PC: ");
22011 + for (i = 0; i < 20; i++) {
22013 + if (get_user(c, (unsigned char __force_user *)pc+i))
22014 + printk(KERN_CONT "?? ");
22016 + printk(KERN_CONT "%02x ", c);
22020 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22021 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
22023 + if (get_user(c, (unsigned long __force_user *)sp+i)) {
22024 +#ifdef CONFIG_X86_32
22025 + printk(KERN_CONT "???????? ");
22027 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
22028 + printk(KERN_CONT "???????? ???????? ");
22030 + printk(KERN_CONT "???????????????? ");
22033 +#ifdef CONFIG_X86_64
22034 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
22035 + printk(KERN_CONT "%08x ", (unsigned int)c);
22036 + printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
22039 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
22047 + * probe_kernel_write(): safely attempt to write to a location
22048 + * @dst: address to write to
22049 + * @src: pointer to the data that shall be written
22050 + * @size: size of the data chunk
22052 + * Safely write to address @dst from the buffer at @src. If a kernel fault
22053 + * happens, handle that and return -EFAULT.
22055 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
22058 + mm_segment_t old_fs = get_fs();
22060 + set_fs(KERNEL_DS);
22061 + pagefault_disable();
22062 + pax_open_kernel();
22063 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
22064 + pax_close_kernel();
22065 + pagefault_enable();
22068 + return ret ? -EFAULT : 0;
22070 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
22071 index dd74e46..7d26398 100644
22072 --- a/arch/x86/mm/gup.c
22073 +++ b/arch/x86/mm/gup.c
22074 @@ -255,7 +255,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
22076 len = (unsigned long) nr_pages << PAGE_SHIFT;
22078 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22079 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22080 (void __user *)start, len)))
22083 diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
22084 index f4f29b1..5cac4fb 100644
22085 --- a/arch/x86/mm/highmem_32.c
22086 +++ b/arch/x86/mm/highmem_32.c
22087 @@ -44,7 +44,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
22088 idx = type + KM_TYPE_NR*smp_processor_id();
22089 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22090 BUG_ON(!pte_none(*(kmap_pte-idx)));
22092 + pax_open_kernel();
22093 set_pte(kmap_pte-idx, mk_pte(page, prot));
22094 + pax_close_kernel();
22096 arch_flush_lazy_mmu_mode();
22098 return (void *)vaddr;
22099 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
22100 index f581a18..29efd37 100644
22101 --- a/arch/x86/mm/hugetlbpage.c
22102 +++ b/arch/x86/mm/hugetlbpage.c
22103 @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
22104 struct hstate *h = hstate_file(file);
22105 struct mm_struct *mm = current->mm;
22106 struct vm_area_struct *vma;
22107 - unsigned long start_addr;
22108 + unsigned long start_addr, pax_task_size = TASK_SIZE;
22110 +#ifdef CONFIG_PAX_SEGMEXEC
22111 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22112 + pax_task_size = SEGMEXEC_TASK_SIZE;
22115 + pax_task_size -= PAGE_SIZE;
22117 if (len > mm->cached_hole_size) {
22118 - start_addr = mm->free_area_cache;
22119 + start_addr = mm->free_area_cache;
22121 - start_addr = TASK_UNMAPPED_BASE;
22122 - mm->cached_hole_size = 0;
22123 + start_addr = mm->mmap_base;
22124 + mm->cached_hole_size = 0;
22128 @@ -280,26 +287,27 @@ full_search:
22130 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
22131 /* At this point: (!vma || addr < vma->vm_end). */
22132 - if (TASK_SIZE - len < addr) {
22133 + if (pax_task_size - len < addr) {
22135 * Start a new search - just in case we missed
22138 - if (start_addr != TASK_UNMAPPED_BASE) {
22139 - start_addr = TASK_UNMAPPED_BASE;
22140 + if (start_addr != mm->mmap_base) {
22141 + start_addr = mm->mmap_base;
22142 mm->cached_hole_size = 0;
22147 - if (!vma || addr + len <= vma->vm_start) {
22148 - mm->free_area_cache = addr + len;
22151 + if (check_heap_stack_gap(vma, addr, len))
22153 if (addr + mm->cached_hole_size < vma->vm_start)
22154 mm->cached_hole_size = vma->vm_start - addr;
22155 addr = ALIGN(vma->vm_end, huge_page_size(h));
22158 + mm->free_area_cache = addr + len;
22162 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22163 @@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22165 struct hstate *h = hstate_file(file);
22166 struct mm_struct *mm = current->mm;
22167 - struct vm_area_struct *vma, *prev_vma;
22168 - unsigned long base = mm->mmap_base, addr = addr0;
22169 + struct vm_area_struct *vma;
22170 + unsigned long base = mm->mmap_base, addr;
22171 unsigned long largest_hole = mm->cached_hole_size;
22172 - int first_time = 1;
22174 /* don't allow allocations above current base */
22175 if (mm->free_area_cache > base)
22176 @@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22178 mm->free_area_cache = base;
22182 /* make sure it can fit in the remaining address space */
22183 if (mm->free_area_cache < len)
22186 /* either no address requested or can't fit in requested address hole */
22187 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
22188 + addr = (mm->free_area_cache - len);
22190 + addr &= huge_page_mask(h);
22191 + vma = find_vma(mm, addr);
22193 * Lookup failure means no vma is above this address,
22194 * i.e. return with success:
22196 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22200 * new region fits between prev_vma->vm_end and
22201 * vma->vm_start, use it:
22203 - if (addr + len <= vma->vm_start &&
22204 - (!prev_vma || (addr >= prev_vma->vm_end))) {
22205 + if (check_heap_stack_gap(vma, addr, len)) {
22206 /* remember the address as a hint for next time */
22207 - mm->cached_hole_size = largest_hole;
22208 - return (mm->free_area_cache = addr);
22210 - /* pull free_area_cache down to the first hole */
22211 - if (mm->free_area_cache == vma->vm_end) {
22212 - mm->free_area_cache = vma->vm_start;
22213 - mm->cached_hole_size = largest_hole;
22215 + mm->cached_hole_size = largest_hole;
22216 + return (mm->free_area_cache = addr);
22218 + /* pull free_area_cache down to the first hole */
22219 + if (mm->free_area_cache == vma->vm_end) {
22220 + mm->free_area_cache = vma->vm_start;
22221 + mm->cached_hole_size = largest_hole;
22224 /* remember the largest hole we saw so far */
22225 if (addr + largest_hole < vma->vm_start)
22226 - largest_hole = vma->vm_start - addr;
22227 + largest_hole = vma->vm_start - addr;
22229 /* try just below the current vma->vm_start */
22230 - addr = (vma->vm_start - len) & huge_page_mask(h);
22231 - } while (len <= vma->vm_start);
22232 + addr = skip_heap_stack_gap(vma, len);
22233 + } while (!IS_ERR_VALUE(addr));
22237 - * if hint left us with no space for the requested
22238 - * mapping then try again:
22240 - if (first_time) {
22241 - mm->free_area_cache = base;
22242 - largest_hole = 0;
22247 * A failed mmap() very likely causes application failure,
22248 * so fall back to the bottom-up function here. This scenario
22249 * can happen with large stack limits and large mmap()
22252 - mm->free_area_cache = TASK_UNMAPPED_BASE;
22254 +#ifdef CONFIG_PAX_SEGMEXEC
22255 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22256 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22260 + mm->mmap_base = TASK_UNMAPPED_BASE;
22262 +#ifdef CONFIG_PAX_RANDMMAP
22263 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22264 + mm->mmap_base += mm->delta_mmap;
22267 + mm->free_area_cache = mm->mmap_base;
22268 mm->cached_hole_size = ~0UL;
22269 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22270 len, pgoff, flags);
22271 @@ -386,6 +392,7 @@ fail:
22273 * Restore the topdown base:
22275 + mm->mmap_base = base;
22276 mm->free_area_cache = base;
22277 mm->cached_hole_size = ~0UL;
22279 @@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22280 struct hstate *h = hstate_file(file);
22281 struct mm_struct *mm = current->mm;
22282 struct vm_area_struct *vma;
22283 + unsigned long pax_task_size = TASK_SIZE;
22285 if (len & ~huge_page_mask(h))
22287 - if (len > TASK_SIZE)
22289 +#ifdef CONFIG_PAX_SEGMEXEC
22290 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22291 + pax_task_size = SEGMEXEC_TASK_SIZE;
22294 + pax_task_size -= PAGE_SIZE;
22296 + if (len > pax_task_size)
22299 if (flags & MAP_FIXED) {
22300 @@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
22302 addr = ALIGN(addr, huge_page_size(h));
22303 vma = find_vma(mm, addr);
22304 - if (TASK_SIZE - len >= addr &&
22305 - (!vma || addr + len <= vma->vm_start))
22306 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22309 if (mm->get_unmapped_area == arch_get_unmapped_area)
22310 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
22311 index 87488b9..7129f32 100644
22312 --- a/arch/x86/mm/init.c
22313 +++ b/arch/x86/mm/init.c
22314 @@ -31,7 +31,7 @@ int direct_gbpages
22315 static void __init find_early_table_space(unsigned long end, int use_pse,
22318 - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22319 + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22322 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22323 @@ -312,8 +312,29 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
22325 int devmem_is_allowed(unsigned long pagenr)
22327 +#ifdef CONFIG_GRKERNSEC_KMEM
22332 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22337 +#ifdef CONFIG_VM86
22338 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22343 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22345 +#ifdef CONFIG_GRKERNSEC_KMEM
22346 + /* throw out everything else below 1MB */
22351 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22353 if (!page_is_ram(pagenr))
22354 @@ -372,6 +393,86 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
22356 void free_initmem(void)
22359 +#ifdef CONFIG_PAX_KERNEXEC
22360 +#ifdef CONFIG_X86_32
22361 + /* PaX: limit KERNEL_CS to actual size */
22362 + unsigned long addr, limit;
22363 + struct desc_struct d;
22366 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22367 + limit = (limit - 1UL) >> PAGE_SHIFT;
22369 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22370 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
22371 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22372 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22375 + /* PaX: make KERNEL_CS read-only */
22376 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22377 + if (!paravirt_enabled())
22378 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22380 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22381 + pgd = pgd_offset_k(addr);
22382 + pud = pud_offset(pgd, addr);
22383 + pmd = pmd_offset(pud, addr);
22384 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22387 +#ifdef CONFIG_X86_PAE
22388 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22390 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22391 + pgd = pgd_offset_k(addr);
22392 + pud = pud_offset(pgd, addr);
22393 + pmd = pmd_offset(pud, addr);
22394 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22399 +#ifdef CONFIG_MODULES
22400 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22407 + unsigned long addr, end;
22409 + /* PaX: make kernel code/rodata read-only, rest non-executable */
22410 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22411 + pgd = pgd_offset_k(addr);
22412 + pud = pud_offset(pgd, addr);
22413 + pmd = pmd_offset(pud, addr);
22414 + if (!pmd_present(*pmd))
22416 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22417 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22419 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22422 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22423 + end = addr + KERNEL_IMAGE_SIZE;
22424 + for (; addr < end; addr += PMD_SIZE) {
22425 + pgd = pgd_offset_k(addr);
22426 + pud = pud_offset(pgd, addr);
22427 + pmd = pmd_offset(pud, addr);
22428 + if (!pmd_present(*pmd))
22430 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22431 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22438 free_init_pages("unused kernel memory",
22439 (unsigned long)(&__init_begin),
22440 (unsigned long)(&__init_end));
22441 diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
22442 index 29f7c6d..b46b35b 100644
22443 --- a/arch/x86/mm/init_32.c
22444 +++ b/arch/x86/mm/init_32.c
22445 @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
22449 - * Creates a middle page table and puts a pointer to it in the
22450 - * given global directory entry. This only returns the gd entry
22451 - * in non-PAE compilation mode, since the middle layer is folded.
22453 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
22456 - pmd_t *pmd_table;
22458 -#ifdef CONFIG_X86_PAE
22459 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22460 - if (after_bootmem)
22461 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22463 - pmd_table = (pmd_t *)alloc_low_page();
22464 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22465 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22466 - pud = pud_offset(pgd, 0);
22467 - BUG_ON(pmd_table != pmd_offset(pud, 0));
22469 - return pmd_table;
22472 - pud = pud_offset(pgd, 0);
22473 - pmd_table = pmd_offset(pud, 0);
22475 - return pmd_table;
22479 * Create a page table and place a pointer to it in a middle page
22482 @@ -123,13 +93,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
22483 page_table = (pte_t *)alloc_low_page();
22485 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22486 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22487 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22489 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22491 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22494 return pte_offset_kernel(pmd, 0);
22497 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
22500 + pmd_t *pmd_table;
22502 + pud = pud_offset(pgd, 0);
22503 + pmd_table = pmd_offset(pud, 0);
22505 + return pmd_table;
22508 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22510 int pgd_idx = pgd_index(vaddr);
22511 @@ -203,6 +188,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22512 int pgd_idx, pmd_idx;
22513 unsigned long vaddr;
22519 @@ -212,8 +198,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22520 pgd = pgd_base + pgd_idx;
22522 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22523 - pmd = one_md_table_init(pgd);
22524 - pmd = pmd + pmd_index(vaddr);
22525 + pud = pud_offset(pgd, vaddr);
22526 + pmd = pmd_offset(pud, vaddr);
22528 +#ifdef CONFIG_X86_PAE
22529 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22532 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22533 pmd++, pmd_idx++) {
22534 pte = page_table_kmap_check(one_page_table_init(pmd),
22535 @@ -225,11 +216,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
22539 -static inline int is_kernel_text(unsigned long addr)
22540 +static inline int is_kernel_text(unsigned long start, unsigned long end)
22542 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22545 + if ((start > ktla_ktva((unsigned long)_etext) ||
22546 + end <= ktla_ktva((unsigned long)_stext)) &&
22547 + (start > ktla_ktva((unsigned long)_einittext) ||
22548 + end <= ktla_ktva((unsigned long)_sinittext)) &&
22550 +#ifdef CONFIG_ACPI_SLEEP
22551 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22554 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22560 @@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned long start,
22561 unsigned long last_map_addr = end;
22562 unsigned long start_pfn, end_pfn;
22563 pgd_t *pgd_base = swapper_pg_dir;
22564 - int pgd_idx, pmd_idx, pte_ofs;
22565 + unsigned int pgd_idx, pmd_idx, pte_ofs;
22571 unsigned pages_2m, pages_4k;
22572 @@ -281,8 +282,13 @@ repeat:
22574 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22575 pgd = pgd_base + pgd_idx;
22576 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22577 - pmd = one_md_table_init(pgd);
22578 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22579 + pud = pud_offset(pgd, 0);
22580 + pmd = pmd_offset(pud, 0);
22582 +#ifdef CONFIG_X86_PAE
22583 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22586 if (pfn >= end_pfn)
22588 @@ -294,14 +300,13 @@ repeat:
22590 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22591 pmd++, pmd_idx++) {
22592 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22593 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22596 * Map with big pages if possible, otherwise
22597 * create normal page tables:
22600 - unsigned int addr2;
22601 pgprot_t prot = PAGE_KERNEL_LARGE;
22603 * first pass will use the same initial
22604 @@ -311,11 +316,7 @@ repeat:
22605 __pgprot(PTE_IDENT_ATTR |
22608 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22609 - PAGE_OFFSET + PAGE_SIZE-1;
22611 - if (is_kernel_text(addr) ||
22612 - is_kernel_text(addr2))
22613 + if (is_kernel_text(address, address + PMD_SIZE))
22614 prot = PAGE_KERNEL_LARGE_EXEC;
22617 @@ -332,7 +333,7 @@ repeat:
22618 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22620 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22621 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22622 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22623 pgprot_t prot = PAGE_KERNEL;
22625 * first pass will use the same initial
22626 @@ -340,7 +341,7 @@ repeat:
22628 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22630 - if (is_kernel_text(addr))
22631 + if (is_kernel_text(address, address + PAGE_SIZE))
22632 prot = PAGE_KERNEL_EXEC;
22635 @@ -472,7 +473,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
22637 pud = pud_offset(pgd, va);
22638 pmd = pmd_offset(pud, va);
22639 - if (!pmd_present(*pmd))
22640 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
22643 pte = pte_offset_kernel(pmd, va);
22644 @@ -524,12 +525,10 @@ void __init early_ioremap_page_table_range_init(void)
22646 static void __init pagetable_init(void)
22648 - pgd_t *pgd_base = swapper_pg_dir;
22650 - permanent_kmaps_init(pgd_base);
22651 + permanent_kmaps_init(swapper_pg_dir);
22654 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22655 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22656 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22658 /* user-defined highmem size */
22659 @@ -757,6 +756,12 @@ void __init mem_init(void)
22663 +#ifdef CONFIG_PAX_PER_CPU_PGD
22664 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22665 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22666 + KERNEL_PGD_PTRS);
22669 #ifdef CONFIG_FLATMEM
22672 @@ -774,7 +779,7 @@ void __init mem_init(void)
22673 set_highmem_pages_init();
22675 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22676 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22677 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22678 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22680 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22681 @@ -815,10 +820,10 @@ void __init mem_init(void)
22682 ((unsigned long)&__init_end -
22683 (unsigned long)&__init_begin) >> 10,
22685 - (unsigned long)&_etext, (unsigned long)&_edata,
22686 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22687 + (unsigned long)&_sdata, (unsigned long)&_edata,
22688 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22690 - (unsigned long)&_text, (unsigned long)&_etext,
22691 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22692 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22695 @@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
22696 if (!kernel_set_to_readonly)
22699 + start = ktla_ktva(start);
22700 pr_debug("Set kernel text: %lx - %lx for read write\n",
22701 start, start+size);
22703 @@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
22704 if (!kernel_set_to_readonly)
22707 + start = ktla_ktva(start);
22708 pr_debug("Set kernel text: %lx - %lx for read only\n",
22709 start, start+size);
22711 @@ -938,6 +945,7 @@ void mark_rodata_ro(void)
22712 unsigned long start = PFN_ALIGN(_text);
22713 unsigned long size = PFN_ALIGN(_etext) - start;
22715 + start = ktla_ktva(start);
22716 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22717 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22719 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
22720 index bbaaa00..16dffad 100644
22721 --- a/arch/x86/mm/init_64.c
22722 +++ b/arch/x86/mm/init_64.c
22723 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
22724 * around without checking the pgd every time.
22727 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22728 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22729 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22731 int force_personality32;
22732 @@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22734 for (address = start; address <= end; address += PGDIR_SIZE) {
22735 const pgd_t *pgd_ref = pgd_offset_k(address);
22737 +#ifdef CONFIG_PAX_PER_CPU_PGD
22738 + unsigned long cpu;
22743 if (pgd_none(*pgd_ref))
22746 spin_lock(&pgd_lock);
22748 +#ifdef CONFIG_PAX_PER_CPU_PGD
22749 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22750 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
22752 list_for_each_entry(page, &pgd_list, lru) {
22754 spinlock_t *pgt_lock;
22755 @@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22756 /* the pgt_lock only for Xen */
22757 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22758 spin_lock(pgt_lock);
22761 if (pgd_none(*pgd))
22762 set_pgd(pgd, *pgd_ref);
22763 @@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
22764 BUG_ON(pgd_page_vaddr(*pgd)
22765 != pgd_page_vaddr(*pgd_ref));
22767 +#ifndef CONFIG_PAX_PER_CPU_PGD
22768 spin_unlock(pgt_lock);
22772 spin_unlock(&pgd_lock);
22774 @@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
22775 pmd = fill_pmd(pud, vaddr);
22776 pte = fill_pte(pmd, vaddr);
22778 + pax_open_kernel();
22779 set_pte(pte, new_pte);
22780 + pax_close_kernel();
22783 * It's enough to flush this one mapping.
22784 @@ -262,14 +278,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
22785 pgd = pgd_offset_k((unsigned long)__va(phys));
22786 if (pgd_none(*pgd)) {
22787 pud = (pud_t *) spp_getpage();
22788 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22790 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22792 pud = pud_offset(pgd, (unsigned long)__va(phys));
22793 if (pud_none(*pud)) {
22794 pmd = (pmd_t *) spp_getpage();
22795 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22797 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22799 pmd = pmd_offset(pud, phys);
22800 BUG_ON(!pmd_none(*pmd));
22801 @@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
22802 if (pfn >= pgt_buf_top)
22803 panic("alloc_low_page: ran out of memory");
22805 - adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22806 + adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
22808 *phys = pfn * PAGE_SIZE;
22810 @@ -346,7 +360,7 @@ static __ref void *map_low_page(void *virt)
22813 left = phys & (PAGE_SIZE - 1);
22814 - adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22815 + adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
22816 adr = (void *)(((unsigned long)adr) | left);
22819 @@ -693,6 +707,12 @@ void __init mem_init(void)
22823 +#ifdef CONFIG_PAX_PER_CPU_PGD
22824 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22825 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22826 + KERNEL_PGD_PTRS);
22829 /* clear_bss() already clear the empty_zero_page */
22832 @@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
22833 static struct vm_area_struct gate_vma = {
22834 .vm_start = VSYSCALL_START,
22835 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22836 - .vm_page_prot = PAGE_READONLY_EXEC,
22837 - .vm_flags = VM_READ | VM_EXEC
22838 + .vm_page_prot = PAGE_READONLY,
22839 + .vm_flags = VM_READ
22842 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22843 @@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long addr)
22845 const char *arch_vma_name(struct vm_area_struct *vma)
22847 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22848 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22850 if (vma == &gate_vma)
22851 return "[vsyscall]";
22852 diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
22853 index 7b179b4..6bd1777 100644
22854 --- a/arch/x86/mm/iomap_32.c
22855 +++ b/arch/x86/mm/iomap_32.c
22856 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
22857 type = kmap_atomic_idx_push();
22858 idx = type + KM_TYPE_NR * smp_processor_id();
22859 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22861 + pax_open_kernel();
22862 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22863 + pax_close_kernel();
22865 arch_flush_lazy_mmu_mode();
22867 return (void *)vaddr;
22868 diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
22869 index be1ef57..9680edc 100644
22870 --- a/arch/x86/mm/ioremap.c
22871 +++ b/arch/x86/mm/ioremap.c
22872 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
22873 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22874 int is_ram = page_is_ram(pfn);
22876 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22877 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22879 WARN_ON_ONCE(is_ram);
22881 @@ -344,7 +344,7 @@ static int __init early_ioremap_debug_setup(char *str)
22882 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22884 static __initdata int after_paging_init;
22885 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22886 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22888 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22890 @@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22891 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22893 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22894 - memset(bm_pte, 0, sizeof(bm_pte));
22895 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
22896 + pmd_populate_user(&init_mm, pmd, bm_pte);
22899 * The boot-ioremap range spans multiple pmds, for which
22900 diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
22901 index d87dd6d..bf3fa66 100644
22902 --- a/arch/x86/mm/kmemcheck/kmemcheck.c
22903 +++ b/arch/x86/mm/kmemcheck/kmemcheck.c
22904 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
22905 * memory (e.g. tracked pages)? For now, we need this to avoid
22906 * invoking kmemcheck for PnP BIOS calls.
22908 - if (regs->flags & X86_VM_MASK)
22909 + if (v8086_mode(regs))
22911 - if (regs->cs != __KERNEL_CS)
22912 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22915 pte = kmemcheck_pte_lookup(address);
22916 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
22917 index 1dab519..60a7e5f 100644
22918 --- a/arch/x86/mm/mmap.c
22919 +++ b/arch/x86/mm/mmap.c
22920 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
22921 * Leave an at least ~128 MB hole with possible stack randomization.
22923 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22924 -#define MAX_GAP (TASK_SIZE/6*5)
22925 +#define MAX_GAP (pax_task_size/6*5)
22928 * True on X86_32 or when emulating IA32 on X86_64
22929 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22930 return rnd << PAGE_SHIFT;
22933 -static unsigned long mmap_base(void)
22934 +static unsigned long mmap_base(struct mm_struct *mm)
22936 unsigned long gap = rlimit(RLIMIT_STACK);
22937 + unsigned long pax_task_size = TASK_SIZE;
22939 +#ifdef CONFIG_PAX_SEGMEXEC
22940 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22941 + pax_task_size = SEGMEXEC_TASK_SIZE;
22946 else if (gap > MAX_GAP)
22949 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22950 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22954 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22955 * does, but not when emulating X86_32
22957 -static unsigned long mmap_legacy_base(void)
22958 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
22960 - if (mmap_is_ia32())
22961 + if (mmap_is_ia32()) {
22963 +#ifdef CONFIG_PAX_SEGMEXEC
22964 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22965 + return SEGMEXEC_TASK_UNMAPPED_BASE;
22969 return TASK_UNMAPPED_BASE;
22972 return TASK_UNMAPPED_BASE + mmap_rnd();
22975 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
22976 void arch_pick_mmap_layout(struct mm_struct *mm)
22978 if (mmap_is_legacy()) {
22979 - mm->mmap_base = mmap_legacy_base();
22980 + mm->mmap_base = mmap_legacy_base(mm);
22982 +#ifdef CONFIG_PAX_RANDMMAP
22983 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22984 + mm->mmap_base += mm->delta_mmap;
22987 mm->get_unmapped_area = arch_get_unmapped_area;
22988 mm->unmap_area = arch_unmap_area;
22990 - mm->mmap_base = mmap_base();
22991 + mm->mmap_base = mmap_base(mm);
22993 +#ifdef CONFIG_PAX_RANDMMAP
22994 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22995 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22998 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22999 mm->unmap_area = arch_unmap_area_topdown;
23001 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
23002 index 67421f3..8d6b107 100644
23003 --- a/arch/x86/mm/mmio-mod.c
23004 +++ b/arch/x86/mm/mmio-mod.c
23005 @@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
23009 - unsigned char *ip = (unsigned char *)instptr;
23010 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23011 my_trace->opcode = MMIO_UNKNOWN_OP;
23012 my_trace->width = 0;
23013 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23014 @@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
23015 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23016 void __iomem *addr)
23018 - static atomic_t next_id;
23019 + static atomic_unchecked_t next_id;
23020 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23021 /* These are page-unaligned. */
23022 struct mmiotrace_map map = {
23023 @@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23027 - .id = atomic_inc_return(&next_id)
23028 + .id = atomic_inc_return_unchecked(&next_id)
23030 map.map_id = trace->id;
23032 diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
23033 index b008656..773eac2 100644
23034 --- a/arch/x86/mm/pageattr-test.c
23035 +++ b/arch/x86/mm/pageattr-test.c
23036 @@ -36,7 +36,7 @@ enum {
23038 static int pte_testbit(pte_t pte)
23040 - return pte_flags(pte) & _PAGE_UNUSED1;
23041 + return pte_flags(pte) & _PAGE_CPA_TEST;
23044 struct split_state {
23045 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
23046 index f9e5267..6f6e27f 100644
23047 --- a/arch/x86/mm/pageattr.c
23048 +++ b/arch/x86/mm/pageattr.c
23049 @@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23051 #ifdef CONFIG_PCI_BIOS
23052 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23053 - pgprot_val(forbidden) |= _PAGE_NX;
23054 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23058 @@ -269,9 +269,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23059 * Does not cover __inittext since that is gone later on. On
23060 * 64bit we do not enforce !NX on the low mapping
23062 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
23063 - pgprot_val(forbidden) |= _PAGE_NX;
23064 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
23065 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23067 +#ifdef CONFIG_DEBUG_RODATA
23069 * The .rodata section needs to be read-only. Using the pfn
23070 * catches all aliases.
23071 @@ -279,6 +280,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23072 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
23073 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
23074 pgprot_val(forbidden) |= _PAGE_RW;
23077 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
23079 @@ -317,6 +319,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
23083 +#ifdef CONFIG_PAX_KERNEXEC
23084 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
23085 + pgprot_val(forbidden) |= _PAGE_RW;
23086 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23090 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
23093 @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
23094 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
23096 /* change init_mm */
23097 + pax_open_kernel();
23098 set_pte_atomic(kpte, pte);
23100 #ifdef CONFIG_X86_32
23101 if (!SHARED_KERNEL_PMD) {
23103 +#ifdef CONFIG_PAX_PER_CPU_PGD
23104 + unsigned long cpu;
23109 +#ifdef CONFIG_PAX_PER_CPU_PGD
23110 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
23111 + pgd_t *pgd = get_cpu_pgd(cpu);
23113 list_for_each_entry(page, &pgd_list, lru) {
23115 + pgd_t *pgd = (pgd_t *)page_address(page);
23121 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
23122 + pgd += pgd_index(address);
23123 pud = pud_offset(pgd, address);
23124 pmd = pmd_offset(pud, address);
23125 set_pte_atomic((pte_t *)pmd, pte);
23129 + pax_close_kernel();
23133 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
23134 index f6ff57b..481690f 100644
23135 --- a/arch/x86/mm/pat.c
23136 +++ b/arch/x86/mm/pat.c
23137 @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
23140 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
23141 - current->comm, current->pid, start, end);
23142 + current->comm, task_pid_nr(current), start, end);
23146 @@ -492,8 +492,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
23147 while (cursor < to) {
23148 if (!devmem_is_allowed(pfn)) {
23150 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
23151 - current->comm, from, to);
23152 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
23153 + current->comm, from, to, cursor);
23156 cursor += PAGE_SIZE;
23157 @@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
23159 "%s:%d ioremap_change_attr failed %s "
23161 - current->comm, current->pid,
23162 + current->comm, task_pid_nr(current),
23164 base, (unsigned long long)(base + size));
23166 @@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23167 if (want_flags != flags) {
23168 printk(KERN_WARNING
23169 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
23170 - current->comm, current->pid,
23171 + current->comm, task_pid_nr(current),
23172 cattr_name(want_flags),
23173 (unsigned long long)paddr,
23174 (unsigned long long)(paddr + size),
23175 @@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
23176 free_memtype(paddr, paddr + size);
23177 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23178 " for %Lx-%Lx, got %s\n",
23179 - current->comm, current->pid,
23180 + current->comm, task_pid_nr(current),
23181 cattr_name(want_flags),
23182 (unsigned long long)paddr,
23183 (unsigned long long)(paddr + size),
23184 diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
23185 index 9f0614d..92ae64a 100644
23186 --- a/arch/x86/mm/pf_in.c
23187 +++ b/arch/x86/mm/pf_in.c
23188 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
23190 enum reason_type rv = OTHERS;
23192 - p = (unsigned char *)ins_addr;
23193 + p = (unsigned char *)ktla_ktva(ins_addr);
23194 p += skip_prefix(p, &prf);
23195 p += get_opcode(p, &opcode);
23197 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
23198 struct prefix_bits prf;
23201 - p = (unsigned char *)ins_addr;
23202 + p = (unsigned char *)ktla_ktva(ins_addr);
23203 p += skip_prefix(p, &prf);
23204 p += get_opcode(p, &opcode);
23206 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
23207 struct prefix_bits prf;
23210 - p = (unsigned char *)ins_addr;
23211 + p = (unsigned char *)ktla_ktva(ins_addr);
23212 p += skip_prefix(p, &prf);
23213 p += get_opcode(p, &opcode);
23215 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
23216 struct prefix_bits prf;
23219 - p = (unsigned char *)ins_addr;
23220 + p = (unsigned char *)ktla_ktva(ins_addr);
23221 p += skip_prefix(p, &prf);
23222 p += get_opcode(p, &opcode);
23223 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
23224 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
23225 struct prefix_bits prf;
23228 - p = (unsigned char *)ins_addr;
23229 + p = (unsigned char *)ktla_ktva(ins_addr);
23230 p += skip_prefix(p, &prf);
23231 p += get_opcode(p, &opcode);
23232 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
23233 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
23234 index 8573b83..6372501 100644
23235 --- a/arch/x86/mm/pgtable.c
23236 +++ b/arch/x86/mm/pgtable.c
23237 @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *pgd)
23238 list_del(&page->lru);
23241 -#define UNSHARED_PTRS_PER_PGD \
23242 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23243 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23244 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23246 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23249 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23253 +#ifdef CONFIG_PAX_PER_CPU_PGD
23254 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23258 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23259 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23267 +#ifdef CONFIG_X86_64
23268 +#define pxd_t pud_t
23269 +#define pyd_t pgd_t
23270 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23271 +#define pxd_free(mm, pud) pud_free((mm), (pud))
23272 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23273 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23274 +#define PYD_SIZE PGDIR_SIZE
23276 +#define pxd_t pmd_t
23277 +#define pyd_t pud_t
23278 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23279 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
23280 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23281 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
23282 +#define PYD_SIZE PUD_SIZE
23285 +#ifdef CONFIG_PAX_PER_CPU_PGD
23286 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
23287 +static inline void pgd_dtor(pgd_t *pgd) {}
23289 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
23291 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
23292 @@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
23294 spin_unlock(&pgd_lock);
23299 * List of all pgd's needed for non-PAE so it can invalidate entries
23300 @@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
23304 -#ifdef CONFIG_X86_PAE
23305 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23307 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23308 * updating the top-level pagetable entries to guarantee the
23309 @@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
23310 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23311 * and initialize the kernel pmds here.
23313 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23314 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23316 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23318 @@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23322 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23323 +#define PREALLOCATED_PXDS USER_PGD_PTRS
23324 #else /* !CONFIG_X86_PAE */
23326 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23327 -#define PREALLOCATED_PMDS 0
23328 +#define PREALLOCATED_PXDS 0
23330 #endif /* CONFIG_X86_PAE */
23332 -static void free_pmds(pmd_t *pmds[])
23333 +static void free_pxds(pxd_t *pxds[])
23337 - for(i = 0; i < PREALLOCATED_PMDS; i++)
23339 - free_page((unsigned long)pmds[i]);
23340 + for(i = 0; i < PREALLOCATED_PXDS; i++)
23342 + free_page((unsigned long)pxds[i]);
23345 -static int preallocate_pmds(pmd_t *pmds[])
23346 +static int preallocate_pxds(pxd_t *pxds[])
23349 bool failed = false;
23351 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
23352 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23354 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
23355 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23368 @@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[])
23369 * preallocate which never got a corresponding vma will need to be
23372 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23373 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23377 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
23378 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
23379 pgd_t pgd = pgdp[i];
23381 if (pgd_val(pgd) != 0) {
23382 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23383 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23385 - pgdp[i] = native_make_pgd(0);
23386 + set_pgd(pgdp + i, native_make_pgd(0));
23388 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23389 - pmd_free(mm, pmd);
23390 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23391 + pxd_free(mm, pxd);
23396 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23397 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23401 unsigned long addr;
23404 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23405 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23408 - pud = pud_offset(pgd, 0);
23409 +#ifdef CONFIG_X86_64
23410 + pyd = pyd_offset(mm, 0L);
23412 + pyd = pyd_offset(pgd, 0L);
23415 - for (addr = i = 0; i < PREALLOCATED_PMDS;
23416 - i++, pud++, addr += PUD_SIZE) {
23417 - pmd_t *pmd = pmds[i];
23418 + for (addr = i = 0; i < PREALLOCATED_PXDS;
23419 + i++, pyd++, addr += PYD_SIZE) {
23420 + pxd_t *pxd = pxds[i];
23422 if (i >= KERNEL_PGD_BOUNDARY)
23423 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23424 - sizeof(pmd_t) * PTRS_PER_PMD);
23425 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23426 + sizeof(pxd_t) * PTRS_PER_PMD);
23428 - pud_populate(mm, pud, pmd);
23429 + pyd_populate(mm, pyd, pxd);
23433 pgd_t *pgd_alloc(struct mm_struct *mm)
23436 - pmd_t *pmds[PREALLOCATED_PMDS];
23437 + pxd_t *pxds[PREALLOCATED_PXDS];
23439 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23441 @@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23445 - if (preallocate_pmds(pmds) != 0)
23446 + if (preallocate_pxds(pxds) != 0)
23449 if (paravirt_pgd_alloc(mm) != 0)
23450 - goto out_free_pmds;
23451 + goto out_free_pxds;
23454 * Make sure that pre-populating the pmds is atomic with
23455 @@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23456 spin_lock(&pgd_lock);
23459 - pgd_prepopulate_pmd(mm, pgd, pmds);
23460 + pgd_prepopulate_pxd(mm, pgd, pxds);
23462 spin_unlock(&pgd_lock);
23471 free_page((unsigned long)pgd);
23473 @@ -295,7 +344,7 @@ out:
23475 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23477 - pgd_mop_up_pmds(mm, pgd);
23478 + pgd_mop_up_pxds(mm, pgd);
23480 paravirt_pgd_free(mm, pgd);
23481 free_page((unsigned long)pgd);
23482 diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
23483 index cac7184..09a39fa 100644
23484 --- a/arch/x86/mm/pgtable_32.c
23485 +++ b/arch/x86/mm/pgtable_32.c
23486 @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
23489 pte = pte_offset_kernel(pmd, vaddr);
23491 + pax_open_kernel();
23492 if (pte_val(pteval))
23493 set_pte_at(&init_mm, vaddr, pte, pteval);
23495 pte_clear(&init_mm, vaddr, pte);
23496 + pax_close_kernel();
23499 * It's enough to flush this one mapping.
23500 diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
23501 index 410531d..0f16030 100644
23502 --- a/arch/x86/mm/setup_nx.c
23503 +++ b/arch/x86/mm/setup_nx.c
23505 #include <asm/pgtable.h>
23506 #include <asm/proto.h>
23508 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23509 static int disable_nx __cpuinitdata;
23511 +#ifndef CONFIG_PAX_PAGEEXEC
23515 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
23518 early_param("noexec", noexec_setup);
23523 void __cpuinit x86_configure_nx(void)
23525 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23526 if (cpu_has_nx && !disable_nx)
23527 __supported_pte_mask |= _PAGE_NX;
23530 __supported_pte_mask &= ~_PAGE_NX;
23533 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
23534 index d6c0418..06a0ad5 100644
23535 --- a/arch/x86/mm/tlb.c
23536 +++ b/arch/x86/mm/tlb.c
23537 @@ -65,7 +65,11 @@ void leave_mm(int cpu)
23539 cpumask_clear_cpu(cpu,
23540 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23542 +#ifndef CONFIG_PAX_PER_CPU_PGD
23543 load_cr3(swapper_pg_dir);
23547 EXPORT_SYMBOL_GPL(leave_mm);
23549 diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
23550 index 6687022..ceabcfa 100644
23551 --- a/arch/x86/net/bpf_jit.S
23552 +++ b/arch/x86/net/bpf_jit.S
23555 #include <linux/linkage.h>
23556 #include <asm/dwarf2.h>
23557 +#include <asm/alternative-asm.h>
23560 * Calling convention :
23561 @@ -35,6 +36,7 @@ sk_load_word:
23562 jle bpf_slow_path_word
23563 mov (SKBDATA,%rsi),%eax
23564 bswap %eax /* ntohl() */
23565 + pax_force_retaddr
23569 @@ -53,6 +55,7 @@ sk_load_half:
23570 jle bpf_slow_path_half
23571 movzwl (SKBDATA,%rsi),%eax
23572 rol $8,%ax # ntohs()
23573 + pax_force_retaddr
23577 @@ -66,6 +69,7 @@ sk_load_byte:
23578 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
23579 jle bpf_slow_path_byte
23580 movzbl (SKBDATA,%rsi),%eax
23581 + pax_force_retaddr
23585 @@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
23586 movzbl (SKBDATA,%rsi),%ebx
23589 + pax_force_retaddr
23592 ENDPROC(sk_load_byte_msh)
23593 @@ -91,6 +96,7 @@ bpf_error:
23597 + pax_force_retaddr
23600 /* rsi contains offset and can be scratched */
23601 @@ -113,6 +119,7 @@ bpf_slow_path_word:
23605 + pax_force_retaddr
23608 bpf_slow_path_half:
23609 @@ -121,12 +128,14 @@ bpf_slow_path_half:
23613 + pax_force_retaddr
23616 bpf_slow_path_byte:
23617 bpf_slow_path_common(1)
23619 movzbl -12(%rbp),%eax
23620 + pax_force_retaddr
23623 bpf_slow_path_byte_msh:
23624 @@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
23628 + pax_force_retaddr
23630 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
23631 index bfab3fa..05aac3a 100644
23632 --- a/arch/x86/net/bpf_jit_comp.c
23633 +++ b/arch/x86/net/bpf_jit_comp.c
23634 @@ -117,6 +117,10 @@ static inline void bpf_flush_icache(void *start, void *end)
23638 +struct bpf_jit_work {
23639 + struct work_struct work;
23643 void bpf_jit_compile(struct sk_filter *fp)
23645 @@ -141,6 +145,10 @@ void bpf_jit_compile(struct sk_filter *fp)
23649 + fp->work = kmalloc(sizeof(*fp->work), GFP_KERNEL);
23653 /* Before first pass, make a rough estimation of addrs[]
23654 * each bpf instruction is translated to less than 64 bytes
23656 @@ -585,11 +593,12 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23658 if (unlikely(proglen + ilen > oldproglen)) {
23659 pr_err("bpb_jit_compile fatal error\n");
23661 - module_free(NULL, image);
23663 + module_free_exec(NULL, image);
23666 + pax_open_kernel();
23667 memcpy(image + proglen, temp, ilen);
23668 + pax_close_kernel();
23671 addrs[i] = proglen;
23672 @@ -609,7 +618,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23675 if (proglen == oldproglen) {
23676 - image = module_alloc(max_t(unsigned int,
23677 + image = module_alloc_exec(max_t(unsigned int,
23679 sizeof(struct work_struct)));
23681 @@ -631,24 +640,27 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
23682 fp->bpf_func = (void *)image;
23690 static void jit_free_defer(struct work_struct *arg)
23692 - module_free(NULL, arg);
23693 + module_free_exec(NULL, ((struct bpf_jit_work*)arg)->image);
23697 /* run from softirq, we must use a work_struct to call
23698 - * module_free() from process context
23699 + * module_free_exec() from process context
23701 void bpf_jit_free(struct sk_filter *fp)
23703 if (fp->bpf_func != sk_run_filter) {
23704 - struct work_struct *work = (struct work_struct *)fp->bpf_func;
23705 + struct work_struct *work = &fp->work->work;
23707 INIT_WORK(work, jit_free_defer);
23708 + fp->work->image = fp->bpf_func;
23709 schedule_work(work);
23712 diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
23713 index bff89df..377758a 100644
23714 --- a/arch/x86/oprofile/backtrace.c
23715 +++ b/arch/x86/oprofile/backtrace.c
23716 @@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
23717 struct stack_frame_ia32 *fp;
23718 unsigned long bytes;
23720 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23721 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23722 if (bytes != sizeof(bufhead))
23725 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
23726 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
23728 oprofile_add_trace(bufhead[0].return_address);
23730 @@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
23731 struct stack_frame bufhead[2];
23732 unsigned long bytes;
23734 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
23735 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
23736 if (bytes != sizeof(bufhead))
23739 @@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
23741 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23743 - if (!user_mode_vm(regs)) {
23744 + if (!user_mode(regs)) {
23745 unsigned long stack = kernel_stack_pointer(regs);
23747 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23748 diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
23749 index cb29191..036766d 100644
23750 --- a/arch/x86/pci/mrst.c
23751 +++ b/arch/x86/pci/mrst.c
23752 @@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
23753 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
23754 pci_mmcfg_late_init();
23755 pcibios_enable_irq = mrst_pci_irq_enable;
23756 - pci_root_ops = pci_mrst_ops;
23757 + pax_open_kernel();
23758 + memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
23759 + pax_close_kernel();
23760 /* Continue with standard init */
23763 diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
23764 index f685535..2b76a81 100644
23765 --- a/arch/x86/pci/pcbios.c
23766 +++ b/arch/x86/pci/pcbios.c
23767 @@ -79,50 +79,93 @@ union bios32 {
23769 unsigned long address;
23770 unsigned short segment;
23771 -} bios32_indirect = { 0, __KERNEL_CS };
23772 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23775 * Returns the entry point for the given service, NULL on error
23778 -static unsigned long bios32_service(unsigned long service)
23779 +static unsigned long __devinit bios32_service(unsigned long service)
23781 unsigned char return_code; /* %al */
23782 unsigned long address; /* %ebx */
23783 unsigned long length; /* %ecx */
23784 unsigned long entry; /* %edx */
23785 unsigned long flags;
23786 + struct desc_struct d, *gdt;
23788 local_irq_save(flags);
23789 - __asm__("lcall *(%%edi); cld"
23791 + gdt = get_cpu_gdt_table(smp_processor_id());
23793 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23794 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23795 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23796 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23798 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23799 : "=a" (return_code),
23805 - "D" (&bios32_indirect));
23806 + "D" (&bios32_indirect),
23807 + "r"(__PCIBIOS_DS)
23810 + pax_open_kernel();
23811 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23812 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23813 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23814 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23815 + pax_close_kernel();
23817 local_irq_restore(flags);
23819 switch (return_code) {
23821 - return address + entry;
23822 - case 0x80: /* Not present */
23823 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23825 - default: /* Shouldn't happen */
23826 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23827 - service, return_code);
23830 + unsigned char flags;
23832 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23833 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23834 + printk(KERN_WARNING "bios32_service: not valid\n");
23837 + address = address + PAGE_OFFSET;
23838 + length += 16UL; /* some BIOSs underreport this... */
23840 + if (length >= 64*1024*1024) {
23841 + length >>= PAGE_SHIFT;
23845 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
23846 + gdt = get_cpu_gdt_table(cpu);
23847 + pack_descriptor(&d, address, length, 0x9b, flags);
23848 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23849 + pack_descriptor(&d, address, length, 0x93, flags);
23850 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23854 + case 0x80: /* Not present */
23855 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23857 + default: /* Shouldn't happen */
23858 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23859 + service, return_code);
23865 unsigned long address;
23866 unsigned short segment;
23867 -} pci_indirect = { 0, __KERNEL_CS };
23868 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23870 -static int pci_bios_present;
23871 +static int pci_bios_present __read_only;
23873 static int __devinit check_pcibios(void)
23875 @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23876 unsigned long flags, pcibios_entry;
23878 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23879 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23880 + pci_indirect.address = pcibios_entry;
23882 local_irq_save(flags);
23884 - "lcall *(%%edi); cld\n\t"
23885 + __asm__("movw %w6, %%ds\n\t"
23886 + "lcall *%%ss:(%%edi); cld\n\t"
23892 @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23895 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23896 - "D" (&pci_indirect)
23897 + "D" (&pci_indirect),
23898 + "r" (__PCIBIOS_DS)
23900 local_irq_restore(flags);
23902 @@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23906 - __asm__("lcall *(%%esi); cld\n\t"
23907 + __asm__("movw %w6, %%ds\n\t"
23908 + "lcall *%%ss:(%%esi); cld\n\t"
23914 @@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23915 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23918 - "S" (&pci_indirect));
23919 + "S" (&pci_indirect),
23920 + "r" (__PCIBIOS_DS));
23922 * Zero-extend the result beyond 8 bits, do not trust the
23923 * BIOS having done it:
23924 @@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23928 - __asm__("lcall *(%%esi); cld\n\t"
23929 + __asm__("movw %w6, %%ds\n\t"
23930 + "lcall *%%ss:(%%esi); cld\n\t"
23936 @@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23937 : "1" (PCIBIOS_READ_CONFIG_WORD),
23940 - "S" (&pci_indirect));
23941 + "S" (&pci_indirect),
23942 + "r" (__PCIBIOS_DS));
23944 * Zero-extend the result beyond 16 bits, do not trust the
23945 * BIOS having done it:
23946 @@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23950 - __asm__("lcall *(%%esi); cld\n\t"
23951 + __asm__("movw %w6, %%ds\n\t"
23952 + "lcall *%%ss:(%%esi); cld\n\t"
23958 @@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
23959 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23962 - "S" (&pci_indirect));
23963 + "S" (&pci_indirect),
23964 + "r" (__PCIBIOS_DS));
23968 @@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23972 - __asm__("lcall *(%%esi); cld\n\t"
23973 + __asm__("movw %w6, %%ds\n\t"
23974 + "lcall *%%ss:(%%esi); cld\n\t"
23980 @@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
23984 - "S" (&pci_indirect));
23985 + "S" (&pci_indirect),
23986 + "r" (__PCIBIOS_DS));
23989 - __asm__("lcall *(%%esi); cld\n\t"
23990 + __asm__("movw %w6, %%ds\n\t"
23991 + "lcall *%%ss:(%%esi); cld\n\t"
23997 @@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24001 - "S" (&pci_indirect));
24002 + "S" (&pci_indirect),
24003 + "r" (__PCIBIOS_DS));
24006 - __asm__("lcall *(%%esi); cld\n\t"
24007 + __asm__("movw %w6, %%ds\n\t"
24008 + "lcall *%%ss:(%%esi); cld\n\t"
24014 @@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
24018 - "S" (&pci_indirect));
24019 + "S" (&pci_indirect),
24020 + "r" (__PCIBIOS_DS));
24024 @@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24026 DBG("PCI: Fetching IRQ routing table... ");
24027 __asm__("push %%es\n\t"
24028 + "movw %w8, %%ds\n\t"
24031 - "lcall *(%%esi); cld\n\t"
24032 + "lcall *%%ss:(%%esi); cld\n\t"
24039 @@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
24042 "S" (&pci_indirect),
24045 + "r" (__PCIBIOS_DS)
24047 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24049 @@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24053 - __asm__("lcall *(%%esi); cld\n\t"
24054 + __asm__("movw %w5, %%ds\n\t"
24055 + "lcall *%%ss:(%%esi); cld\n\t"
24061 @@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
24062 : "0" (PCIBIOS_SET_PCI_HW_INT),
24063 "b" ((dev->bus->number << 8) | dev->devfn),
24064 "c" ((irq << 8) | (pin + 10)),
24065 - "S" (&pci_indirect));
24066 + "S" (&pci_indirect),
24067 + "r" (__PCIBIOS_DS));
24068 return !(ret & 0xff00);
24070 EXPORT_SYMBOL(pcibios_set_irq_routing);
24071 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
24072 index 5cab48e..b025f9b 100644
24073 --- a/arch/x86/platform/efi/efi_32.c
24074 +++ b/arch/x86/platform/efi/efi_32.c
24075 @@ -38,70 +38,56 @@
24078 static unsigned long efi_rt_eflags;
24079 -static pgd_t efi_bak_pg_dir_pointer[2];
24080 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
24082 -void efi_call_phys_prelog(void)
24083 +void __init efi_call_phys_prelog(void)
24085 - unsigned long cr4;
24086 - unsigned long temp;
24087 struct desc_ptr gdt_descr;
24089 +#ifdef CONFIG_PAX_KERNEXEC
24090 + struct desc_struct d;
24093 local_irq_save(efi_rt_eflags);
24096 - * If I don't have PAE, I should just duplicate two entries in page
24097 - * directory. If I have PAE, I just need to duplicate one entry in
24098 - * page directory.
24100 - cr4 = read_cr4_safe();
24102 - if (cr4 & X86_CR4_PAE) {
24103 - efi_bak_pg_dir_pointer[0].pgd =
24104 - swapper_pg_dir[pgd_index(0)].pgd;
24105 - swapper_pg_dir[0].pgd =
24106 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24108 - efi_bak_pg_dir_pointer[0].pgd =
24109 - swapper_pg_dir[pgd_index(0)].pgd;
24110 - efi_bak_pg_dir_pointer[1].pgd =
24111 - swapper_pg_dir[pgd_index(0x400000)].pgd;
24112 - swapper_pg_dir[pgd_index(0)].pgd =
24113 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
24114 - temp = PAGE_OFFSET + 0x400000;
24115 - swapper_pg_dir[pgd_index(0x400000)].pgd =
24116 - swapper_pg_dir[pgd_index(temp)].pgd;
24118 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
24119 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
24120 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
24123 * After the lock is released, the original page table is restored.
24127 +#ifdef CONFIG_PAX_KERNEXEC
24128 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
24129 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24130 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
24131 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24134 gdt_descr.address = __pa(get_cpu_gdt_table(0));
24135 gdt_descr.size = GDT_SIZE - 1;
24136 load_gdt(&gdt_descr);
24139 -void efi_call_phys_epilog(void)
24140 +void __init efi_call_phys_epilog(void)
24142 - unsigned long cr4;
24143 struct desc_ptr gdt_descr;
24145 +#ifdef CONFIG_PAX_KERNEXEC
24146 + struct desc_struct d;
24148 + memset(&d, 0, sizeof d);
24149 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
24150 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
24153 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
24154 gdt_descr.size = GDT_SIZE - 1;
24155 load_gdt(&gdt_descr);
24157 - cr4 = read_cr4_safe();
24159 - if (cr4 & X86_CR4_PAE) {
24160 - swapper_pg_dir[pgd_index(0)].pgd =
24161 - efi_bak_pg_dir_pointer[0].pgd;
24163 - swapper_pg_dir[pgd_index(0)].pgd =
24164 - efi_bak_pg_dir_pointer[0].pgd;
24165 - swapper_pg_dir[pgd_index(0x400000)].pgd =
24166 - efi_bak_pg_dir_pointer[1].pgd;
24168 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
24171 * After the lock is released, the original page table is restored.
24172 diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
24173 index fbe66e6..c5c0dd2 100644
24174 --- a/arch/x86/platform/efi/efi_stub_32.S
24175 +++ b/arch/x86/platform/efi/efi_stub_32.S
24179 #include <linux/linkage.h>
24180 +#include <linux/init.h>
24181 #include <asm/page_types.h>
24182 +#include <asm/segment.h>
24185 * efi_call_phys(void *, ...) is a function with variable parameters.
24187 * service functions will comply with gcc calling convention, too.
24192 ENTRY(efi_call_phys)
24194 * 0. The function can only be called in Linux kernel. So CS has been
24195 @@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
24196 * The mapping of lower virtual memory has been created in prelog and
24200 - subl $__PAGE_OFFSET, %edx
24202 + movl $(__KERNEXEC_EFI_DS), %edx
24206 + ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
24210 @@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
24211 * parameter 2, ..., param n. To make things easy, we save the return
24212 * address of efi_call_phys in a global variable.
24215 - movl %edx, saved_return_addr
24216 - /* get the function pointer into ECX*/
24218 - movl %ecx, efi_rt_function_ptr
24220 - subl $__PAGE_OFFSET, %edx
24222 + popl (saved_return_addr)
24223 + popl (efi_rt_function_ptr)
24226 * 3. Clear PG bit in %CR0.
24227 @@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
24229 * 5. Call the physical function.
24232 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
24236 * 6. After EFI runtime service returns, control will return to
24237 * following instruction. We'd better readjust stack pointer first.
24238 @@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
24240 orl $0x80000000, %edx
24246 * 8. Now restore the virtual mode from flat mode by
24247 * adding EIP with PAGE_OFFSET.
24251 + ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
24253 + movl $(__KERNEL_DS), %edx
24259 * 9. Balance the stack. And because EAX contain the return value,
24260 * we'd better not clobber it.
24262 - leal efi_rt_function_ptr, %edx
24263 - movl (%edx), %ecx
24265 + pushl (efi_rt_function_ptr)
24268 - * 10. Push the saved return address onto the stack and return.
24269 + * 10. Return to the saved return address.
24271 - leal saved_return_addr, %edx
24272 - movl (%edx), %ecx
24275 + jmpl *(saved_return_addr)
24276 ENDPROC(efi_call_phys)
24283 efi_rt_function_ptr:
24284 diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
24285 index 4c07cca..2c8427d 100644
24286 --- a/arch/x86/platform/efi/efi_stub_64.S
24287 +++ b/arch/x86/platform/efi/efi_stub_64.S
24291 #include <linux/linkage.h>
24292 +#include <asm/alternative-asm.h>
24296 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
24300 + pax_force_retaddr 0, 1
24304 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
24308 + pax_force_retaddr 0, 1
24312 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
24316 + pax_force_retaddr 0, 1
24320 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
24324 + pax_force_retaddr 0, 1
24328 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
24332 + pax_force_retaddr 0, 1
24336 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
24340 + pax_force_retaddr 0, 1
24344 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
24348 + pax_force_retaddr 0, 1
24351 diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
24352 index fe73276..70fe25a 100644
24353 --- a/arch/x86/platform/mrst/mrst.c
24354 +++ b/arch/x86/platform/mrst/mrst.c
24355 @@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
24358 /* Reboot and power off are handled by the SCU on a MID device */
24359 -static void mrst_power_off(void)
24360 +static __noreturn void mrst_power_off(void)
24362 intel_scu_ipc_simple_command(0xf1, 1);
24366 -static void mrst_reboot(void)
24367 +static __noreturn void mrst_reboot(void)
24369 intel_scu_ipc_simple_command(0xf1, 0);
24374 diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
24375 index 5b55219..b326540 100644
24376 --- a/arch/x86/platform/uv/tlb_uv.c
24377 +++ b/arch/x86/platform/uv/tlb_uv.c
24378 @@ -377,6 +377,8 @@ static void reset_with_ipi(struct pnmask *distribution, struct bau_control *bcp)
24379 struct bau_control *smaster = bcp->socket_master;
24380 struct reset_args reset_args;
24382 + pax_track_stack();
24384 reset_args.sender = sender;
24386 /* find a single cpu for each uvhub in this distribution mask */
24387 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
24388 index 87bb35e..eff2da8 100644
24389 --- a/arch/x86/power/cpu.c
24390 +++ b/arch/x86/power/cpu.c
24391 @@ -130,7 +130,7 @@ static void do_fpu_end(void)
24392 static void fix_processor_context(void)
24394 int cpu = smp_processor_id();
24395 - struct tss_struct *t = &per_cpu(init_tss, cpu);
24396 + struct tss_struct *t = init_tss + cpu;
24398 set_tss_desc(cpu, t); /*
24399 * This just modifies memory; should not be
24400 @@ -140,7 +140,9 @@ static void fix_processor_context(void)
24403 #ifdef CONFIG_X86_64
24404 + pax_open_kernel();
24405 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24406 + pax_close_kernel();
24408 syscall_init(); /* This sets MSR_*STAR and related */
24410 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
24411 index 5d17950..2253fc9 100644
24412 --- a/arch/x86/vdso/Makefile
24413 +++ b/arch/x86/vdso/Makefile
24414 @@ -137,7 +137,7 @@ quiet_cmd_vdso = VDSO $@
24415 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
24416 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
24418 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24419 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24423 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
24424 index 468d591..8e80a0a 100644
24425 --- a/arch/x86/vdso/vdso32-setup.c
24426 +++ b/arch/x86/vdso/vdso32-setup.c
24428 #include <asm/tlbflush.h>
24429 #include <asm/vdso.h>
24430 #include <asm/proto.h>
24431 +#include <asm/mman.h>
24435 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
24436 void enable_sep_cpu(void)
24438 int cpu = get_cpu();
24439 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
24440 + struct tss_struct *tss = init_tss + cpu;
24442 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24444 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24445 gate_vma.vm_start = FIXADDR_USER_START;
24446 gate_vma.vm_end = FIXADDR_USER_END;
24447 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24448 - gate_vma.vm_page_prot = __P101;
24449 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24451 * Make sure the vDSO gets into every core dump.
24452 * Dumping its contents makes post-mortem fully interpretable later
24453 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24455 addr = VDSO_HIGH_BASE;
24457 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24458 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24459 if (IS_ERR_VALUE(addr)) {
24465 - current->mm->context.vdso = (void *)addr;
24466 + current->mm->context.vdso = addr;
24468 if (compat_uses_vma || !compat) {
24470 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24473 current_thread_info()->sysenter_return =
24474 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24475 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24479 - current->mm->context.vdso = NULL;
24480 + current->mm->context.vdso = 0;
24482 up_write(&mm->mmap_sem);
24484 @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24486 const char *arch_vma_name(struct vm_area_struct *vma)
24488 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24489 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24492 +#ifdef CONFIG_PAX_SEGMEXEC
24493 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24500 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
24501 * Check to see if the corresponding task was created in compat vdso
24504 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24505 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24509 diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
24510 index 316fbca..4638633 100644
24511 --- a/arch/x86/vdso/vma.c
24512 +++ b/arch/x86/vdso/vma.c
24514 #include <asm/vdso.h>
24515 #include <asm/page.h>
24517 -unsigned int __read_mostly vdso_enabled = 1;
24519 extern char vdso_start[], vdso_end[];
24520 extern unsigned short vdso_sync_cpuid;
24522 @@ -97,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
24523 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24525 struct mm_struct *mm = current->mm;
24526 - unsigned long addr;
24527 + unsigned long addr = 0;
24530 - if (!vdso_enabled)
24533 down_write(&mm->mmap_sem);
24535 +#ifdef CONFIG_PAX_RANDMMAP
24536 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
24539 addr = vdso_addr(mm->start_stack, vdso_size);
24540 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
24541 if (IS_ERR_VALUE(addr)) {
24542 @@ -111,26 +111,18 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
24546 - current->mm->context.vdso = (void *)addr;
24547 + mm->context.vdso = addr;
24549 ret = install_special_mapping(mm, addr, vdso_size,
24551 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
24555 - current->mm->context.vdso = NULL;
24560 + mm->context.vdso = 0;
24563 up_write(&mm->mmap_sem);
24567 -static __init int vdso_setup(char *s)
24569 - vdso_enabled = simple_strtoul(s, NULL, 0);
24572 -__setup("vdso=", vdso_setup);
24573 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
24574 index 46c8069..6330d3c 100644
24575 --- a/arch/x86/xen/enlighten.c
24576 +++ b/arch/x86/xen/enlighten.c
24577 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24579 struct shared_info xen_dummy_shared_info;
24581 -void *xen_initial_gdt;
24583 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24584 __read_mostly int xen_have_vector_callback;
24585 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24586 @@ -1028,7 +1026,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
24590 -static void xen_reboot(int reason)
24591 +static __noreturn void xen_reboot(int reason)
24593 struct sched_shutdown r = { .reason = reason };
24595 @@ -1036,17 +1034,17 @@ static void xen_reboot(int reason)
24599 -static void xen_restart(char *msg)
24600 +static __noreturn void xen_restart(char *msg)
24602 xen_reboot(SHUTDOWN_reboot);
24605 -static void xen_emergency_restart(void)
24606 +static __noreturn void xen_emergency_restart(void)
24608 xen_reboot(SHUTDOWN_reboot);
24611 -static void xen_machine_halt(void)
24612 +static __noreturn void xen_machine_halt(void)
24614 xen_reboot(SHUTDOWN_poweroff);
24616 @@ -1152,7 +1150,17 @@ asmlinkage void __init xen_start_kernel(void)
24617 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24619 /* Work out if we support NX */
24620 - x86_configure_nx();
24621 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24622 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24623 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24626 + __supported_pte_mask |= _PAGE_NX;
24627 + rdmsr(MSR_EFER, l, h);
24629 + wrmsr(MSR_EFER, l, h);
24633 xen_setup_features();
24635 @@ -1183,13 +1191,6 @@ asmlinkage void __init xen_start_kernel(void)
24637 machine_ops = xen_machine_ops;
24640 - * The only reliable way to retain the initial address of the
24641 - * percpu gdt_page is to remember it here, so we can go and
24642 - * mark it RW later, when the initial percpu area is freed.
24644 - xen_initial_gdt = &per_cpu(gdt_page, 0);
24648 #ifdef CONFIG_ACPI_NUMA
24649 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
24650 index 3dd53f9..5aa5df3 100644
24651 --- a/arch/x86/xen/mmu.c
24652 +++ b/arch/x86/xen/mmu.c
24653 @@ -1768,6 +1768,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24654 convert_pfn_mfn(init_level4_pgt);
24655 convert_pfn_mfn(level3_ident_pgt);
24656 convert_pfn_mfn(level3_kernel_pgt);
24657 + convert_pfn_mfn(level3_vmalloc_start_pgt);
24658 + convert_pfn_mfn(level3_vmalloc_end_pgt);
24659 + convert_pfn_mfn(level3_vmemmap_pgt);
24661 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24662 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24663 @@ -1786,7 +1789,11 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
24664 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24665 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24666 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24667 + set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
24668 + set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
24669 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24670 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24671 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24672 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24673 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24675 @@ -2000,6 +2007,7 @@ static void __init xen_post_allocator_init(void)
24676 pv_mmu_ops.set_pud = xen_set_pud;
24677 #if PAGETABLE_LEVELS == 4
24678 pv_mmu_ops.set_pgd = xen_set_pgd;
24679 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
24682 /* This will work as long as patching hasn't happened yet
24683 @@ -2081,6 +2089,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
24684 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
24685 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
24686 .set_pgd = xen_set_pgd_hyper,
24687 + .set_pgd_batched = xen_set_pgd_hyper,
24689 .alloc_pud = xen_alloc_pmd_init,
24690 .release_pud = xen_release_pmd_init,
24691 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
24692 index 041d4fe..7666b7e 100644
24693 --- a/arch/x86/xen/smp.c
24694 +++ b/arch/x86/xen/smp.c
24695 @@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
24697 BUG_ON(smp_processor_id() != 0);
24698 native_smp_prepare_boot_cpu();
24700 - /* We've switched to the "real" per-cpu gdt, so make sure the
24701 - old memory can be recycled */
24702 - make_lowmem_page_readwrite(xen_initial_gdt);
24704 xen_filter_cpu_maps();
24705 xen_setup_vcpu_info_placement();
24707 @@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
24708 gdt = get_cpu_gdt_table(cpu);
24710 ctxt->flags = VGCF_IN_KERNEL;
24711 - ctxt->user_regs.ds = __USER_DS;
24712 - ctxt->user_regs.es = __USER_DS;
24713 + ctxt->user_regs.ds = __KERNEL_DS;
24714 + ctxt->user_regs.es = __KERNEL_DS;
24715 ctxt->user_regs.ss = __KERNEL_DS;
24716 #ifdef CONFIG_X86_32
24717 ctxt->user_regs.fs = __KERNEL_PERCPU;
24718 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24719 + savesegment(gs, ctxt->user_regs.gs);
24721 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24723 @@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
24726 per_cpu(current_task, cpu) = idle;
24727 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
24728 #ifdef CONFIG_X86_32
24731 clear_tsk_thread_flag(idle, TIF_FORK);
24732 - per_cpu(kernel_stack, cpu) =
24733 - (unsigned long)task_stack_page(idle) -
24734 - KERNEL_STACK_OFFSET + THREAD_SIZE;
24735 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24737 xen_setup_runstate_info(cpu);
24738 xen_setup_timer(cpu);
24739 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
24740 index b040b0e..8cc4fe0 100644
24741 --- a/arch/x86/xen/xen-asm_32.S
24742 +++ b/arch/x86/xen/xen-asm_32.S
24743 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
24744 ESP_OFFSET=4 # bytes pushed onto stack
24747 - * Store vcpu_info pointer for easy access. Do it this way to
24748 - * avoid having to reload %fs
24749 + * Store vcpu_info pointer for easy access.
24752 - GET_THREAD_INFO(%eax)
24753 - movl TI_cpu(%eax), %eax
24754 - movl __per_cpu_offset(,%eax,4), %eax
24755 - mov xen_vcpu(%eax), %eax
24757 + mov $(__KERNEL_PERCPU), %eax
24759 + mov PER_CPU_VAR(xen_vcpu), %eax
24762 movl xen_vcpu, %eax
24764 diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
24765 index aaa7291..3f77960 100644
24766 --- a/arch/x86/xen/xen-head.S
24767 +++ b/arch/x86/xen/xen-head.S
24768 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
24769 #ifdef CONFIG_X86_32
24770 mov %esi,xen_start_info
24771 mov $init_thread_union+THREAD_SIZE,%esp
24773 + movl $cpu_gdt_table,%edi
24774 + movl $__per_cpu_load,%eax
24775 + movw %ax,__KERNEL_PERCPU + 2(%edi)
24777 + movb %al,__KERNEL_PERCPU + 4(%edi)
24778 + movb %ah,__KERNEL_PERCPU + 7(%edi)
24779 + movl $__per_cpu_end - 1,%eax
24780 + subl $__per_cpu_start,%eax
24781 + movw %ax,__KERNEL_PERCPU + 0(%edi)
24784 mov %rsi,xen_start_info
24785 mov $init_thread_union+THREAD_SIZE,%rsp
24786 diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
24787 index b095739..8c17bcd 100644
24788 --- a/arch/x86/xen/xen-ops.h
24789 +++ b/arch/x86/xen/xen-ops.h
24791 extern const char xen_hypervisor_callback[];
24792 extern const char xen_failsafe_callback[];
24794 -extern void *xen_initial_gdt;
24797 void xen_copy_trap_info(struct trap_info *traps);
24799 diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
24800 index 58916af..9cb880b 100644
24801 --- a/block/blk-iopoll.c
24802 +++ b/block/blk-iopoll.c
24803 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
24805 EXPORT_SYMBOL(blk_iopoll_complete);
24807 -static void blk_iopoll_softirq(struct softirq_action *h)
24808 +static void blk_iopoll_softirq(void)
24810 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24811 int rearm = 0, budget = blk_iopoll_budget;
24812 diff --git a/block/blk-map.c b/block/blk-map.c
24813 index 164cd00..6d96fc1 100644
24814 --- a/block/blk-map.c
24815 +++ b/block/blk-map.c
24816 @@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
24820 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24821 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24823 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24825 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
24826 index 1366a89..e17f54b 100644
24827 --- a/block/blk-softirq.c
24828 +++ b/block/blk-softirq.c
24829 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
24830 * Softirq action handler - move entries to local list and loop over them
24831 * while passing them to the queue registered handler.
24833 -static void blk_done_softirq(struct softirq_action *h)
24834 +static void blk_done_softirq(void)
24836 struct list_head *cpu_list, local_list;
24838 diff --git a/block/bsg.c b/block/bsg.c
24839 index 702f131..37808bf 100644
24842 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
24843 struct sg_io_v4 *hdr, struct bsg_device *bd,
24844 fmode_t has_write_perm)
24846 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24847 + unsigned char *cmdptr;
24849 if (hdr->request_len > BLK_MAX_CDB) {
24850 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24854 + cmdptr = rq->cmd;
24858 - if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
24859 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
24863 + if (cmdptr != rq->cmd)
24864 + memcpy(rq->cmd, cmdptr, hdr->request_len);
24866 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24867 if (blk_verify_command(rq->cmd, has_write_perm))
24869 diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
24870 index 7b72502..646105c 100644
24871 --- a/block/compat_ioctl.c
24872 +++ b/block/compat_ioctl.c
24873 @@ -340,7 +340,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
24874 err |= __get_user(f->spec1, &uf->spec1);
24875 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
24876 err |= __get_user(name, &uf->name);
24877 - f->name = compat_ptr(name);
24878 + f->name = (void __force_kernel *)compat_ptr(name);
24882 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
24883 index 4f4230b..0feae9a 100644
24884 --- a/block/scsi_ioctl.c
24885 +++ b/block/scsi_ioctl.c
24886 @@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24887 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24888 struct sg_io_hdr *hdr, fmode_t mode)
24890 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24891 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24892 + unsigned char *cmdptr;
24894 + if (rq->cmd != rq->__cmd)
24895 + cmdptr = rq->cmd;
24899 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24902 + if (cmdptr != rq->cmd)
24903 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24905 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24908 @@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24910 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24911 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24912 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24913 + unsigned char *cmdptr;
24917 @@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
24920 rq->cmd_len = cmdlen;
24921 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
24923 + if (rq->cmd != rq->__cmd)
24924 + cmdptr = rq->cmd;
24928 + if (copy_from_user(cmdptr, sic->data, cmdlen))
24931 + if (rq->cmd != cmdptr)
24932 + memcpy(rq->cmd, cmdptr, cmdlen);
24934 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24937 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
24938 index 671d4d6..5f24030 100644
24939 --- a/crypto/cryptd.c
24940 +++ b/crypto/cryptd.c
24941 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
24943 struct cryptd_blkcipher_request_ctx {
24944 crypto_completion_t complete;
24948 struct cryptd_hash_ctx {
24949 struct crypto_shash *child;
24950 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
24952 struct cryptd_aead_request_ctx {
24953 crypto_completion_t complete;
24957 static void cryptd_queue_worker(struct work_struct *work);
24959 diff --git a/crypto/serpent.c b/crypto/serpent.c
24960 index b651a55..a9ddd79b 100644
24961 --- a/crypto/serpent.c
24962 +++ b/crypto/serpent.c
24963 @@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
24964 u32 r0,r1,r2,r3,r4;
24967 + pax_track_stack();
24969 /* Copy key, add padding */
24971 for (i = 0; i < keylen; ++i)
24972 diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
24973 index 5d41894..22021e4 100644
24974 --- a/drivers/acpi/apei/cper.c
24975 +++ b/drivers/acpi/apei/cper.c
24976 @@ -38,12 +38,12 @@
24978 u64 cper_next_record_id(void)
24980 - static atomic64_t seq;
24981 + static atomic64_unchecked_t seq;
24983 - if (!atomic64_read(&seq))
24984 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
24985 + if (!atomic64_read_unchecked(&seq))
24986 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24988 - return atomic64_inc_return(&seq);
24989 + return atomic64_inc_return_unchecked(&seq);
24991 EXPORT_SYMBOL_GPL(cper_next_record_id);
24993 diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
24994 index 22f918b..9fafb84 100644
24995 --- a/drivers/acpi/ec_sys.c
24996 +++ b/drivers/acpi/ec_sys.c
24998 #include <linux/kernel.h>
24999 #include <linux/acpi.h>
25000 #include <linux/debugfs.h>
25001 +#include <asm/uaccess.h>
25002 #include "internal.h"
25004 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
25005 @@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25006 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
25008 unsigned int size = EC_SPACE_SIZE;
25009 - u8 *data = (u8 *) buf;
25011 loff_t init_off = *off;
25014 @@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
25018 - err = ec_read(*off, &data[*off - init_off]);
25019 + err = ec_read(*off, &data);
25022 + if (put_user(data, &buf[*off - init_off]))
25027 @@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25029 unsigned int size = count;
25030 loff_t init_off = *off;
25031 - u8 *data = (u8 *) buf;
25034 if (*off >= EC_SPACE_SIZE)
25035 @@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
25039 - u8 byte_write = data[*off - init_off];
25041 + if (get_user(byte_write, &buf[*off - init_off]))
25043 err = ec_write(*off, byte_write);
25046 diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
25047 index f5f9869..da87aeb 100644
25048 --- a/drivers/acpi/proc.c
25049 +++ b/drivers/acpi/proc.c
25050 @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct file *file,
25051 size_t count, loff_t * ppos)
25053 struct list_head *node, *next;
25055 - char str[5] = "";
25056 - unsigned int len = count;
25057 + char strbuf[5] = {0};
25064 + if (copy_from_user(strbuf, buffer, count))
25067 - if (copy_from_user(strbuf, buffer, len))
25069 - strbuf[len] = '\0';
25070 - sscanf(strbuf, "%s", str);
25071 + strbuf[count] = '\0';
25073 mutex_lock(&acpi_device_lock);
25074 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
25075 @@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct file *file,
25076 if (!dev->wakeup.flags.valid)
25079 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
25080 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
25081 if (device_can_wakeup(&dev->dev)) {
25082 bool enable = !device_may_wakeup(&dev->dev);
25083 device_set_wakeup_enable(&dev->dev, enable);
25084 diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
25085 index a4e0f1b..9793b28 100644
25086 --- a/drivers/acpi/processor_driver.c
25087 +++ b/drivers/acpi/processor_driver.c
25088 @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
25092 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
25093 + BUG_ON(pr->id >= nr_cpu_ids);
25097 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
25098 index 4a3a5ae..cbee192 100644
25099 --- a/drivers/ata/libata-core.c
25100 +++ b/drivers/ata/libata-core.c
25101 @@ -4733,7 +4733,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
25102 struct ata_port *ap;
25105 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25106 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25110 @@ -4749,7 +4749,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
25111 struct ata_port *ap;
25112 struct ata_link *link;
25114 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25115 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25116 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25118 link = qc->dev->link;
25119 @@ -5754,6 +5754,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25123 + pax_open_kernel();
25125 for (cur = ops->inherits; cur; cur = cur->inherits) {
25126 void **inherit = (void **)cur;
25127 @@ -5767,8 +5768,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
25131 - ops->inherits = NULL;
25132 + *(struct ata_port_operations **)&ops->inherits = NULL;
25134 + pax_close_kernel();
25135 spin_unlock(&lock);
25138 diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
25139 index ed16fbe..fc92cb8 100644
25140 --- a/drivers/ata/libata-eh.c
25141 +++ b/drivers/ata/libata-eh.c
25142 @@ -2515,6 +2515,8 @@ void ata_eh_report(struct ata_port *ap)
25144 struct ata_link *link;
25146 + pax_track_stack();
25148 ata_for_each_link(link, ap, HOST_FIRST)
25149 ata_eh_link_report(link);
25151 diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
25152 index 719bb73..79ce858 100644
25153 --- a/drivers/ata/pata_arasan_cf.c
25154 +++ b/drivers/ata/pata_arasan_cf.c
25155 @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
25156 /* Handle platform specific quirks */
25157 if (pdata->quirk) {
25158 if (pdata->quirk & CF_BROKEN_PIO) {
25159 - ap->ops->set_piomode = NULL;
25160 + pax_open_kernel();
25161 + *(void **)&ap->ops->set_piomode = NULL;
25162 + pax_close_kernel();
25165 if (pdata->quirk & CF_BROKEN_MWDMA)
25166 diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
25167 index f9b983a..887b9d8 100644
25168 --- a/drivers/atm/adummy.c
25169 +++ b/drivers/atm/adummy.c
25170 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
25171 vcc->pop(vcc, skb);
25173 dev_kfree_skb_any(skb);
25174 - atomic_inc(&vcc->stats->tx);
25175 + atomic_inc_unchecked(&vcc->stats->tx);
25179 diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
25180 index f8f41e0..1f987dd 100644
25181 --- a/drivers/atm/ambassador.c
25182 +++ b/drivers/atm/ambassador.c
25183 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
25184 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
25187 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25188 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25190 // free the descriptor
25192 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25193 dump_skb ("<<<", vc, skb);
25196 - atomic_inc(&atm_vcc->stats->rx);
25197 + atomic_inc_unchecked(&atm_vcc->stats->rx);
25198 __net_timestamp(skb);
25199 // end of our responsibility
25200 atm_vcc->push (atm_vcc, skb);
25201 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
25203 PRINTK (KERN_INFO, "dropped over-size frame");
25204 // should we count this?
25205 - atomic_inc(&atm_vcc->stats->rx_drop);
25206 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25210 @@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
25213 if (check_area (skb->data, skb->len)) {
25214 - atomic_inc(&atm_vcc->stats->tx_err);
25215 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
25216 return -ENOMEM; // ?
25219 diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
25220 index b22d71c..d6e1049 100644
25221 --- a/drivers/atm/atmtcp.c
25222 +++ b/drivers/atm/atmtcp.c
25223 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25224 if (vcc->pop) vcc->pop(vcc,skb);
25225 else dev_kfree_skb(skb);
25226 if (dev_data) return 0;
25227 - atomic_inc(&vcc->stats->tx_err);
25228 + atomic_inc_unchecked(&vcc->stats->tx_err);
25231 size = skb->len+sizeof(struct atmtcp_hdr);
25232 @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25234 if (vcc->pop) vcc->pop(vcc,skb);
25235 else dev_kfree_skb(skb);
25236 - atomic_inc(&vcc->stats->tx_err);
25237 + atomic_inc_unchecked(&vcc->stats->tx_err);
25240 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
25241 @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
25242 if (vcc->pop) vcc->pop(vcc,skb);
25243 else dev_kfree_skb(skb);
25244 out_vcc->push(out_vcc,new_skb);
25245 - atomic_inc(&vcc->stats->tx);
25246 - atomic_inc(&out_vcc->stats->rx);
25247 + atomic_inc_unchecked(&vcc->stats->tx);
25248 + atomic_inc_unchecked(&out_vcc->stats->rx);
25252 @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25253 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
25254 read_unlock(&vcc_sklist_lock);
25256 - atomic_inc(&vcc->stats->tx_err);
25257 + atomic_inc_unchecked(&vcc->stats->tx_err);
25260 skb_pull(skb,sizeof(struct atmtcp_hdr));
25261 @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
25262 __net_timestamp(new_skb);
25263 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
25264 out_vcc->push(out_vcc,new_skb);
25265 - atomic_inc(&vcc->stats->tx);
25266 - atomic_inc(&out_vcc->stats->rx);
25267 + atomic_inc_unchecked(&vcc->stats->tx);
25268 + atomic_inc_unchecked(&out_vcc->stats->rx);
25270 if (vcc->pop) vcc->pop(vcc,skb);
25271 else dev_kfree_skb(skb);
25272 diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
25273 index 9307141..d8521bf 100644
25274 --- a/drivers/atm/eni.c
25275 +++ b/drivers/atm/eni.c
25276 @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
25277 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
25280 - atomic_inc(&vcc->stats->rx_err);
25281 + atomic_inc_unchecked(&vcc->stats->rx_err);
25284 length = ATM_CELL_SIZE-1; /* no HEC */
25285 @@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25289 - atomic_inc(&vcc->stats->rx_err);
25290 + atomic_inc_unchecked(&vcc->stats->rx_err);
25293 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
25294 @@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
25295 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
25296 vcc->dev->number,vcc->vci,length,size << 2,descr);
25298 - atomic_inc(&vcc->stats->rx_err);
25299 + atomic_inc_unchecked(&vcc->stats->rx_err);
25302 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
25303 @@ -771,7 +771,7 @@ rx_dequeued++;
25304 vcc->push(vcc,skb);
25307 - atomic_inc(&vcc->stats->rx);
25308 + atomic_inc_unchecked(&vcc->stats->rx);
25310 wake_up(&eni_dev->rx_wait);
25312 @@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *dev)
25314 if (vcc->pop) vcc->pop(vcc,skb);
25315 else dev_kfree_skb_irq(skb);
25316 - atomic_inc(&vcc->stats->tx);
25317 + atomic_inc_unchecked(&vcc->stats->tx);
25318 wake_up(&eni_dev->tx_wait);
25321 @@ -1568,7 +1568,7 @@ tx_complete++;
25322 /*--------------------------------- entries ---------------------------------*/
25325 -static const char *media_name[] __devinitdata = {
25326 +static const char *media_name[] __devinitconst = {
25327 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
25328 "UTP", "05?", "06?", "07?", /* 4- 7 */
25329 "TAXI","09?", "10?", "11?", /* 8-11 */
25330 diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
25331 index 5072f8a..fa52520 100644
25332 --- a/drivers/atm/firestream.c
25333 +++ b/drivers/atm/firestream.c
25334 @@ -750,7 +750,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
25338 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25339 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25341 fs_dprintk (FS_DEBUG_TXMEM, "i");
25342 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
25343 @@ -817,7 +817,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25345 skb_put (skb, qe->p1 & 0xffff);
25346 ATM_SKB(skb)->vcc = atm_vcc;
25347 - atomic_inc(&atm_vcc->stats->rx);
25348 + atomic_inc_unchecked(&atm_vcc->stats->rx);
25349 __net_timestamp(skb);
25350 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
25351 atm_vcc->push (atm_vcc, skb);
25352 @@ -838,12 +838,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
25356 - atomic_inc(&atm_vcc->stats->rx_drop);
25357 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25359 case 0x1f: /* Reassembly abort: no buffers. */
25360 /* Silently increment error counter. */
25362 - atomic_inc(&atm_vcc->stats->rx_drop);
25363 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
25365 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
25366 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
25367 diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
25368 index 361f5ae..7fc552d 100644
25369 --- a/drivers/atm/fore200e.c
25370 +++ b/drivers/atm/fore200e.c
25371 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
25373 /* check error condition */
25374 if (*entry->status & STATUS_ERROR)
25375 - atomic_inc(&vcc->stats->tx_err);
25376 + atomic_inc_unchecked(&vcc->stats->tx_err);
25378 - atomic_inc(&vcc->stats->tx);
25379 + atomic_inc_unchecked(&vcc->stats->tx);
25383 @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25385 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
25387 - atomic_inc(&vcc->stats->rx_drop);
25388 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25392 @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
25394 dev_kfree_skb_any(skb);
25396 - atomic_inc(&vcc->stats->rx_drop);
25397 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25401 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25403 vcc->push(vcc, skb);
25404 - atomic_inc(&vcc->stats->rx);
25405 + atomic_inc_unchecked(&vcc->stats->rx);
25407 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
25409 @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
25410 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
25411 fore200e->atm_dev->number,
25412 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
25413 - atomic_inc(&vcc->stats->rx_err);
25414 + atomic_inc_unchecked(&vcc->stats->rx_err);
25418 @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
25422 - atomic_inc(&vcc->stats->tx_err);
25423 + atomic_inc_unchecked(&vcc->stats->tx_err);
25425 fore200e->tx_sat++;
25426 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
25427 diff --git a/drivers/atm/he.c b/drivers/atm/he.c
25428 index 9a51df4..f3bb5f8 100644
25429 --- a/drivers/atm/he.c
25430 +++ b/drivers/atm/he.c
25431 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25433 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
25434 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
25435 - atomic_inc(&vcc->stats->rx_drop);
25436 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25437 goto return_host_buffers;
25440 @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25441 RBRQ_LEN_ERR(he_dev->rbrq_head)
25443 vcc->vpi, vcc->vci);
25444 - atomic_inc(&vcc->stats->rx_err);
25445 + atomic_inc_unchecked(&vcc->stats->rx_err);
25446 goto return_host_buffers;
25449 @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
25450 vcc->push(vcc, skb);
25451 spin_lock(&he_dev->global_lock);
25453 - atomic_inc(&vcc->stats->rx);
25454 + atomic_inc_unchecked(&vcc->stats->rx);
25456 return_host_buffers:
25458 @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
25459 tpd->vcc->pop(tpd->vcc, tpd->skb);
25461 dev_kfree_skb_any(tpd->skb);
25462 - atomic_inc(&tpd->vcc->stats->tx_err);
25463 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
25465 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
25467 @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25468 vcc->pop(vcc, skb);
25470 dev_kfree_skb_any(skb);
25471 - atomic_inc(&vcc->stats->tx_err);
25472 + atomic_inc_unchecked(&vcc->stats->tx_err);
25476 @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25477 vcc->pop(vcc, skb);
25479 dev_kfree_skb_any(skb);
25480 - atomic_inc(&vcc->stats->tx_err);
25481 + atomic_inc_unchecked(&vcc->stats->tx_err);
25485 @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25486 vcc->pop(vcc, skb);
25488 dev_kfree_skb_any(skb);
25489 - atomic_inc(&vcc->stats->tx_err);
25490 + atomic_inc_unchecked(&vcc->stats->tx_err);
25491 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25494 @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25495 vcc->pop(vcc, skb);
25497 dev_kfree_skb_any(skb);
25498 - atomic_inc(&vcc->stats->tx_err);
25499 + atomic_inc_unchecked(&vcc->stats->tx_err);
25500 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25503 @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
25504 __enqueue_tpd(he_dev, tpd, cid);
25505 spin_unlock_irqrestore(&he_dev->global_lock, flags);
25507 - atomic_inc(&vcc->stats->tx);
25508 + atomic_inc_unchecked(&vcc->stats->tx);
25512 diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
25513 index b812103..e391a49 100644
25514 --- a/drivers/atm/horizon.c
25515 +++ b/drivers/atm/horizon.c
25516 @@ -1035,7 +1035,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
25518 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
25520 - atomic_inc(&vcc->stats->rx);
25521 + atomic_inc_unchecked(&vcc->stats->rx);
25522 __net_timestamp(skb);
25523 // end of our responsibility
25524 vcc->push (vcc, skb);
25525 @@ -1187,7 +1187,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
25526 dev->tx_iovec = NULL;
25529 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
25530 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
25533 hrz_kfree_skb (skb);
25534 diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
25535 index db06f34..dcebb61 100644
25536 --- a/drivers/atm/idt77252.c
25537 +++ b/drivers/atm/idt77252.c
25538 @@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
25540 dev_kfree_skb(skb);
25542 - atomic_inc(&vcc->stats->tx);
25543 + atomic_inc_unchecked(&vcc->stats->tx);
25546 atomic_dec(&scq->used);
25547 @@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25548 if ((sb = dev_alloc_skb(64)) == NULL) {
25549 printk("%s: Can't allocate buffers for aal0.\n",
25551 - atomic_add(i, &vcc->stats->rx_drop);
25552 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
25555 if (!atm_charge(vcc, sb->truesize)) {
25556 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
25558 - atomic_add(i - 1, &vcc->stats->rx_drop);
25559 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
25563 @@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25564 ATM_SKB(sb)->vcc = vcc;
25565 __net_timestamp(sb);
25566 vcc->push(vcc, sb);
25567 - atomic_inc(&vcc->stats->rx);
25568 + atomic_inc_unchecked(&vcc->stats->rx);
25570 cell += ATM_CELL_PAYLOAD;
25572 @@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25574 card->name, len, rpp->len, readl(SAR_REG_CDC));
25575 recycle_rx_pool_skb(card, rpp);
25576 - atomic_inc(&vcc->stats->rx_err);
25577 + atomic_inc_unchecked(&vcc->stats->rx_err);
25580 if (stat & SAR_RSQE_CRC) {
25581 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
25582 recycle_rx_pool_skb(card, rpp);
25583 - atomic_inc(&vcc->stats->rx_err);
25584 + atomic_inc_unchecked(&vcc->stats->rx_err);
25587 if (skb_queue_len(&rpp->queue) > 1) {
25588 @@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25589 RXPRINTK("%s: Can't alloc RX skb.\n",
25591 recycle_rx_pool_skb(card, rpp);
25592 - atomic_inc(&vcc->stats->rx_err);
25593 + atomic_inc_unchecked(&vcc->stats->rx_err);
25596 if (!atm_charge(vcc, skb->truesize)) {
25597 @@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25598 __net_timestamp(skb);
25600 vcc->push(vcc, skb);
25601 - atomic_inc(&vcc->stats->rx);
25602 + atomic_inc_unchecked(&vcc->stats->rx);
25606 @@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
25607 __net_timestamp(skb);
25609 vcc->push(vcc, skb);
25610 - atomic_inc(&vcc->stats->rx);
25611 + atomic_inc_unchecked(&vcc->stats->rx);
25613 if (skb->truesize > SAR_FB_SIZE_3)
25614 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
25615 @@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
25616 if (vcc->qos.aal != ATM_AAL0) {
25617 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
25618 card->name, vpi, vci);
25619 - atomic_inc(&vcc->stats->rx_drop);
25620 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25624 if ((sb = dev_alloc_skb(64)) == NULL) {
25625 printk("%s: Can't allocate buffers for AAL0.\n",
25627 - atomic_inc(&vcc->stats->rx_err);
25628 + atomic_inc_unchecked(&vcc->stats->rx_err);
25632 @@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
25633 ATM_SKB(sb)->vcc = vcc;
25634 __net_timestamp(sb);
25635 vcc->push(vcc, sb);
25636 - atomic_inc(&vcc->stats->rx);
25637 + atomic_inc_unchecked(&vcc->stats->rx);
25640 skb_pull(queue, 64);
25641 @@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25644 printk("%s: NULL connection in send().\n", card->name);
25645 - atomic_inc(&vcc->stats->tx_err);
25646 + atomic_inc_unchecked(&vcc->stats->tx_err);
25647 dev_kfree_skb(skb);
25650 if (!test_bit(VCF_TX, &vc->flags)) {
25651 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
25652 - atomic_inc(&vcc->stats->tx_err);
25653 + atomic_inc_unchecked(&vcc->stats->tx_err);
25654 dev_kfree_skb(skb);
25657 @@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25660 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
25661 - atomic_inc(&vcc->stats->tx_err);
25662 + atomic_inc_unchecked(&vcc->stats->tx_err);
25663 dev_kfree_skb(skb);
25667 if (skb_shinfo(skb)->nr_frags != 0) {
25668 printk("%s: No scatter-gather yet.\n", card->name);
25669 - atomic_inc(&vcc->stats->tx_err);
25670 + atomic_inc_unchecked(&vcc->stats->tx_err);
25671 dev_kfree_skb(skb);
25674 @@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
25676 err = queue_skb(card, vc, skb, oam);
25678 - atomic_inc(&vcc->stats->tx_err);
25679 + atomic_inc_unchecked(&vcc->stats->tx_err);
25680 dev_kfree_skb(skb);
25683 @@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
25684 skb = dev_alloc_skb(64);
25686 printk("%s: Out of memory in send_oam().\n", card->name);
25687 - atomic_inc(&vcc->stats->tx_err);
25688 + atomic_inc_unchecked(&vcc->stats->tx_err);
25691 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
25692 diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
25693 index cb90f7a..bd33566 100644
25694 --- a/drivers/atm/iphase.c
25695 +++ b/drivers/atm/iphase.c
25696 @@ -1121,7 +1121,7 @@ static int rx_pkt(struct atm_dev *dev)
25697 status = (u_short) (buf_desc_ptr->desc_mode);
25698 if (status & (RX_CER | RX_PTE | RX_OFL))
25700 - atomic_inc(&vcc->stats->rx_err);
25701 + atomic_inc_unchecked(&vcc->stats->rx_err);
25702 IF_ERR(printk("IA: bad packet, dropping it");)
25703 if (status & RX_CER) {
25704 IF_ERR(printk(" cause: packet CRC error\n");)
25705 @@ -1144,7 +1144,7 @@ static int rx_pkt(struct atm_dev *dev)
25706 len = dma_addr - buf_addr;
25707 if (len > iadev->rx_buf_sz) {
25708 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
25709 - atomic_inc(&vcc->stats->rx_err);
25710 + atomic_inc_unchecked(&vcc->stats->rx_err);
25711 goto out_free_desc;
25714 @@ -1294,7 +1294,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25715 ia_vcc = INPH_IA_VCC(vcc);
25716 if (ia_vcc == NULL)
25718 - atomic_inc(&vcc->stats->rx_err);
25719 + atomic_inc_unchecked(&vcc->stats->rx_err);
25720 dev_kfree_skb_any(skb);
25721 atm_return(vcc, atm_guess_pdu2truesize(len));
25723 @@ -1306,7 +1306,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25724 if ((length > iadev->rx_buf_sz) || (length >
25725 (skb->len - sizeof(struct cpcs_trailer))))
25727 - atomic_inc(&vcc->stats->rx_err);
25728 + atomic_inc_unchecked(&vcc->stats->rx_err);
25729 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
25730 length, skb->len);)
25731 dev_kfree_skb_any(skb);
25732 @@ -1322,7 +1322,7 @@ static void rx_dle_intr(struct atm_dev *dev)
25734 IF_RX(printk("rx_dle_intr: skb push");)
25735 vcc->push(vcc,skb);
25736 - atomic_inc(&vcc->stats->rx);
25737 + atomic_inc_unchecked(&vcc->stats->rx);
25738 iadev->rx_pkt_cnt++;
25741 @@ -2802,15 +2802,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
25743 struct k_sonet_stats *stats;
25744 stats = &PRIV(_ia_dev[board])->sonet_stats;
25745 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
25746 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
25747 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
25748 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
25749 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
25750 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
25751 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
25752 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
25753 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
25754 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
25755 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
25756 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
25757 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
25758 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
25759 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
25760 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
25761 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
25762 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
25764 ia_cmds.status = 0;
25766 @@ -2915,7 +2915,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25767 if ((desc == 0) || (desc > iadev->num_tx_desc))
25769 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
25770 - atomic_inc(&vcc->stats->tx);
25771 + atomic_inc_unchecked(&vcc->stats->tx);
25773 vcc->pop(vcc, skb);
25775 @@ -3020,14 +3020,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
25776 ATM_DESC(skb) = vcc->vci;
25777 skb_queue_tail(&iadev->tx_dma_q, skb);
25779 - atomic_inc(&vcc->stats->tx);
25780 + atomic_inc_unchecked(&vcc->stats->tx);
25781 iadev->tx_pkt_cnt++;
25782 /* Increment transaction counter */
25783 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
25786 /* add flow control logic */
25787 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
25788 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
25789 if (iavcc->vc_desc_cnt > 10) {
25790 vcc->tx_quota = vcc->tx_quota * 3 / 4;
25791 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
25792 diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
25793 index e828c54..ae83976 100644
25794 --- a/drivers/atm/lanai.c
25795 +++ b/drivers/atm/lanai.c
25796 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
25797 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
25798 lanai_endtx(lanai, lvcc);
25799 lanai_free_skb(lvcc->tx.atmvcc, skb);
25800 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
25801 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
25804 /* Try to fill the buffer - don't call unless there is backlog */
25805 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
25806 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
25807 __net_timestamp(skb);
25808 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
25809 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
25810 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
25812 lvcc->rx.buf.ptr = end;
25813 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
25814 @@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25815 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
25816 "vcc %d\n", lanai->number, (unsigned int) s, vci);
25817 lanai->stats.service_rxnotaal5++;
25818 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25819 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25822 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
25823 @@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25825 read_unlock(&vcc_sklist_lock);
25826 DPRINTK("got trashed rx pdu on vci %d\n", vci);
25827 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25828 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25829 lvcc->stats.x.aal5.service_trash++;
25830 bytes = (SERVICE_GET_END(s) * 16) -
25831 (((unsigned long) lvcc->rx.buf.ptr) -
25832 @@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25834 if (s & SERVICE_STREAM) {
25835 read_unlock(&vcc_sklist_lock);
25836 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25837 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25838 lvcc->stats.x.aal5.service_stream++;
25839 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
25840 "PDU on VCI %d!\n", lanai->number, vci);
25841 @@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
25844 DPRINTK("got rx crc error on vci %d\n", vci);
25845 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
25846 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
25847 lvcc->stats.x.aal5.service_rxcrc++;
25848 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
25849 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
25850 diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
25851 index 1c70c45..300718d 100644
25852 --- a/drivers/atm/nicstar.c
25853 +++ b/drivers/atm/nicstar.c
25854 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25855 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
25856 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
25858 - atomic_inc(&vcc->stats->tx_err);
25859 + atomic_inc_unchecked(&vcc->stats->tx_err);
25860 dev_kfree_skb_any(skb);
25863 @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25865 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
25867 - atomic_inc(&vcc->stats->tx_err);
25868 + atomic_inc_unchecked(&vcc->stats->tx_err);
25869 dev_kfree_skb_any(skb);
25872 @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25873 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
25874 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
25876 - atomic_inc(&vcc->stats->tx_err);
25877 + atomic_inc_unchecked(&vcc->stats->tx_err);
25878 dev_kfree_skb_any(skb);
25882 if (skb_shinfo(skb)->nr_frags != 0) {
25883 printk("nicstar%d: No scatter-gather yet.\n", card->index);
25884 - atomic_inc(&vcc->stats->tx_err);
25885 + atomic_inc_unchecked(&vcc->stats->tx_err);
25886 dev_kfree_skb_any(skb);
25889 @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
25892 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
25893 - atomic_inc(&vcc->stats->tx_err);
25894 + atomic_inc_unchecked(&vcc->stats->tx_err);
25895 dev_kfree_skb_any(skb);
25898 - atomic_inc(&vcc->stats->tx);
25899 + atomic_inc_unchecked(&vcc->stats->tx);
25903 @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25905 ("nicstar%d: Can't allocate buffers for aal0.\n",
25907 - atomic_add(i, &vcc->stats->rx_drop);
25908 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
25911 if (!atm_charge(vcc, sb->truesize)) {
25913 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
25915 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25916 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
25917 dev_kfree_skb_any(sb);
25920 @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25921 ATM_SKB(sb)->vcc = vcc;
25922 __net_timestamp(sb);
25923 vcc->push(vcc, sb);
25924 - atomic_inc(&vcc->stats->rx);
25925 + atomic_inc_unchecked(&vcc->stats->rx);
25926 cell += ATM_CELL_PAYLOAD;
25929 @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25930 if (iovb == NULL) {
25931 printk("nicstar%d: Out of iovec buffers.\n",
25933 - atomic_inc(&vcc->stats->rx_drop);
25934 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25935 recycle_rx_buf(card, skb);
25938 @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25939 small or large buffer itself. */
25940 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
25941 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
25942 - atomic_inc(&vcc->stats->rx_err);
25943 + atomic_inc_unchecked(&vcc->stats->rx_err);
25944 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25946 NS_PRV_IOVCNT(iovb) = 0;
25947 @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25948 ("nicstar%d: Expected a small buffer, and this is not one.\n",
25950 which_list(card, skb);
25951 - atomic_inc(&vcc->stats->rx_err);
25952 + atomic_inc_unchecked(&vcc->stats->rx_err);
25953 recycle_rx_buf(card, skb);
25955 recycle_iov_buf(card, iovb);
25956 @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25957 ("nicstar%d: Expected a large buffer, and this is not one.\n",
25959 which_list(card, skb);
25960 - atomic_inc(&vcc->stats->rx_err);
25961 + atomic_inc_unchecked(&vcc->stats->rx_err);
25962 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25963 NS_PRV_IOVCNT(iovb));
25965 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25966 printk(" - PDU size mismatch.\n");
25969 - atomic_inc(&vcc->stats->rx_err);
25970 + atomic_inc_unchecked(&vcc->stats->rx_err);
25971 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
25972 NS_PRV_IOVCNT(iovb));
25974 @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25975 /* skb points to a small buffer */
25976 if (!atm_charge(vcc, skb->truesize)) {
25977 push_rxbufs(card, skb);
25978 - atomic_inc(&vcc->stats->rx_drop);
25979 + atomic_inc_unchecked(&vcc->stats->rx_drop);
25982 dequeue_sm_buf(card, skb);
25983 @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25984 ATM_SKB(skb)->vcc = vcc;
25985 __net_timestamp(skb);
25986 vcc->push(vcc, skb);
25987 - atomic_inc(&vcc->stats->rx);
25988 + atomic_inc_unchecked(&vcc->stats->rx);
25990 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
25991 struct sk_buff *sb;
25992 @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
25993 if (len <= NS_SMBUFSIZE) {
25994 if (!atm_charge(vcc, sb->truesize)) {
25995 push_rxbufs(card, sb);
25996 - atomic_inc(&vcc->stats->rx_drop);
25997 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26000 dequeue_sm_buf(card, sb);
26001 @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26002 ATM_SKB(sb)->vcc = vcc;
26003 __net_timestamp(sb);
26004 vcc->push(vcc, sb);
26005 - atomic_inc(&vcc->stats->rx);
26006 + atomic_inc_unchecked(&vcc->stats->rx);
26009 push_rxbufs(card, skb);
26010 @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26012 if (!atm_charge(vcc, skb->truesize)) {
26013 push_rxbufs(card, skb);
26014 - atomic_inc(&vcc->stats->rx_drop);
26015 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26017 dequeue_lg_buf(card, skb);
26018 #ifdef NS_USE_DESTRUCTORS
26019 @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26020 ATM_SKB(skb)->vcc = vcc;
26021 __net_timestamp(skb);
26022 vcc->push(vcc, skb);
26023 - atomic_inc(&vcc->stats->rx);
26024 + atomic_inc_unchecked(&vcc->stats->rx);
26027 push_rxbufs(card, sb);
26028 @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26030 ("nicstar%d: Out of huge buffers.\n",
26032 - atomic_inc(&vcc->stats->rx_drop);
26033 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26034 recycle_iovec_rx_bufs(card,
26037 @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26038 card->hbpool.count++;
26040 dev_kfree_skb_any(hb);
26041 - atomic_inc(&vcc->stats->rx_drop);
26042 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26044 /* Copy the small buffer to the huge buffer */
26045 sb = (struct sk_buff *)iov->iov_base;
26046 @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
26047 #endif /* NS_USE_DESTRUCTORS */
26048 __net_timestamp(hb);
26049 vcc->push(vcc, hb);
26050 - atomic_inc(&vcc->stats->rx);
26051 + atomic_inc_unchecked(&vcc->stats->rx);
26055 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
26056 index 5d1d076..4f31f42 100644
26057 --- a/drivers/atm/solos-pci.c
26058 +++ b/drivers/atm/solos-pci.c
26059 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
26061 atm_charge(vcc, skb->truesize);
26062 vcc->push(vcc, skb);
26063 - atomic_inc(&vcc->stats->rx);
26064 + atomic_inc_unchecked(&vcc->stats->rx);
26068 @@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *buf)
26072 + pax_track_stack();
26075 for (i = 0; i < len; i++){
26077 @@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_card *card)
26078 vcc = SKB_CB(oldskb)->vcc;
26081 - atomic_inc(&vcc->stats->tx);
26082 + atomic_inc_unchecked(&vcc->stats->tx);
26083 solos_pop(vcc, oldskb);
26085 dev_kfree_skb_irq(oldskb);
26086 diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
26087 index 90f1ccc..04c4a1e 100644
26088 --- a/drivers/atm/suni.c
26089 +++ b/drivers/atm/suni.c
26090 @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
26093 #define ADD_LIMITED(s,v) \
26094 - atomic_add((v),&stats->s); \
26095 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
26096 + atomic_add_unchecked((v),&stats->s); \
26097 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
26100 static void suni_hz(unsigned long from_timer)
26101 diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
26102 index 5120a96..e2572bd 100644
26103 --- a/drivers/atm/uPD98402.c
26104 +++ b/drivers/atm/uPD98402.c
26105 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
26106 struct sonet_stats tmp;
26109 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26110 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
26111 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
26112 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
26113 if (zero && !error) {
26114 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
26117 #define ADD_LIMITED(s,v) \
26118 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
26119 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
26120 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26121 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
26122 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
26123 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
26126 static void stat_event(struct atm_dev *dev)
26127 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
26128 if (reason & uPD98402_INT_PFM) stat_event(dev);
26129 if (reason & uPD98402_INT_PCO) {
26130 (void) GET(PCOCR); /* clear interrupt cause */
26131 - atomic_add(GET(HECCT),
26132 + atomic_add_unchecked(GET(HECCT),
26133 &PRIV(dev)->sonet_stats.uncorr_hcs);
26135 if ((reason & uPD98402_INT_RFO) &&
26136 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
26137 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
26138 uPD98402_INT_LOS),PIMR); /* enable them */
26139 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
26140 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26141 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
26142 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
26143 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
26144 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
26145 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
26149 diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
26150 index d889f56..17eb71e 100644
26151 --- a/drivers/atm/zatm.c
26152 +++ b/drivers/atm/zatm.c
26153 @@ -460,7 +460,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26156 dev_kfree_skb_irq(skb);
26157 - if (vcc) atomic_inc(&vcc->stats->rx_err);
26158 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
26161 if (!atm_charge(vcc,skb->truesize)) {
26162 @@ -470,7 +470,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
26164 ATM_SKB(skb)->vcc = vcc;
26165 vcc->push(vcc,skb);
26166 - atomic_inc(&vcc->stats->rx);
26167 + atomic_inc_unchecked(&vcc->stats->rx);
26169 zout(pos & 0xffff,MTA(mbx));
26170 #if 0 /* probably a stupid idea */
26171 @@ -734,7 +734,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
26172 skb_queue_head(&zatm_vcc->backlog,skb);
26175 - atomic_inc(&vcc->stats->tx);
26176 + atomic_inc_unchecked(&vcc->stats->tx);
26177 wake_up(&zatm_vcc->tx_wait);
26180 diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
26181 index a4760e0..51283cf 100644
26182 --- a/drivers/base/devtmpfs.c
26183 +++ b/drivers/base/devtmpfs.c
26184 @@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir)
26188 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
26189 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
26191 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
26193 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
26194 index 84f7c7d..37cfd87 100644
26195 --- a/drivers/base/power/wakeup.c
26196 +++ b/drivers/base/power/wakeup.c
26197 @@ -29,14 +29,14 @@ bool events_check_enabled;
26198 * They need to be modified together atomically, so it's better to use one
26199 * atomic variable to hold them both.
26201 -static atomic_t combined_event_count = ATOMIC_INIT(0);
26202 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
26204 #define IN_PROGRESS_BITS (sizeof(int) * 4)
26205 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
26207 static void split_counters(unsigned int *cnt, unsigned int *inpr)
26209 - unsigned int comb = atomic_read(&combined_event_count);
26210 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
26212 *cnt = (comb >> IN_PROGRESS_BITS);
26213 *inpr = comb & MAX_IN_PROGRESS;
26214 @@ -350,7 +350,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
26215 ws->last_time = ktime_get();
26217 /* Increment the counter of events in progress. */
26218 - atomic_inc(&combined_event_count);
26219 + atomic_inc_unchecked(&combined_event_count);
26223 @@ -440,7 +440,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
26224 * Increment the counter of registered wakeup events and decrement the
26225 * couter of wakeup events in progress simultaneously.
26227 - atomic_add(MAX_IN_PROGRESS, &combined_event_count);
26228 + atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
26232 diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
26233 index e086fbb..398e1fe 100644
26234 --- a/drivers/block/DAC960.c
26235 +++ b/drivers/block/DAC960.c
26236 @@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
26237 unsigned long flags;
26238 int Channel, TargetID;
26240 + pax_track_stack();
26242 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
26243 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
26244 sizeof(DAC960_SCSI_Inquiry_T) +
26245 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
26246 index c2f9b3e..5911988 100644
26247 --- a/drivers/block/cciss.c
26248 +++ b/drivers/block/cciss.c
26249 @@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
26253 + memset(&arg64, 0, sizeof(arg64));
26257 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
26258 @@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
26259 while (!list_empty(&h->reqQ)) {
26260 c = list_entry(h->reqQ.next, CommandList_struct, list);
26261 /* can't do anything if fifo is full */
26262 - if ((h->access.fifo_full(h))) {
26263 + if ((h->access->fifo_full(h))) {
26264 dev_warn(&h->pdev->dev, "fifo full\n");
26267 @@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
26270 /* Tell the controller execute command */
26271 - h->access.submit_command(h, c);
26272 + h->access->submit_command(h, c);
26274 /* Put job onto the completed Q */
26276 @@ -3422,17 +3424,17 @@ startio:
26278 static inline unsigned long get_next_completion(ctlr_info_t *h)
26280 - return h->access.command_completed(h);
26281 + return h->access->command_completed(h);
26284 static inline int interrupt_pending(ctlr_info_t *h)
26286 - return h->access.intr_pending(h);
26287 + return h->access->intr_pending(h);
26290 static inline long interrupt_not_for_us(ctlr_info_t *h)
26292 - return ((h->access.intr_pending(h) == 0) ||
26293 + return ((h->access->intr_pending(h) == 0) ||
26294 (h->interrupts_enabled == 0));
26297 @@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info_t *h)
26300 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
26301 - return h->access.command_completed(h);
26302 + return h->access->command_completed(h);
26304 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
26305 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
26306 @@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
26307 trans_support & CFGTBL_Trans_use_short_tags);
26309 /* Change the access methods to the performant access methods */
26310 - h->access = SA5_performant_access;
26311 + h->access = &SA5_performant_access;
26312 h->transMethod = CFGTBL_Trans_Performant;
26315 @@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *h)
26316 if (prod_index < 0)
26318 h->product_name = products[prod_index].product_name;
26319 - h->access = *(products[prod_index].access);
26320 + h->access = products[prod_index].access;
26322 if (cciss_board_disabled(h)) {
26323 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
26324 @@ -5009,7 +5011,7 @@ reinit_after_soft_reset:
26327 /* make sure the board interrupts are off */
26328 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
26329 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
26330 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
26333 @@ -5061,7 +5063,7 @@ reinit_after_soft_reset:
26334 * fake ones to scoop up any residual completions.
26336 spin_lock_irqsave(&h->lock, flags);
26337 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
26338 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
26339 spin_unlock_irqrestore(&h->lock, flags);
26340 free_irq(h->intr[PERF_MODE_INT], h);
26341 rc = cciss_request_irq(h, cciss_msix_discard_completions,
26342 @@ -5081,9 +5083,9 @@ reinit_after_soft_reset:
26343 dev_info(&h->pdev->dev, "Board READY.\n");
26344 dev_info(&h->pdev->dev,
26345 "Waiting for stale completions to drain.\n");
26346 - h->access.set_intr_mask(h, CCISS_INTR_ON);
26347 + h->access->set_intr_mask(h, CCISS_INTR_ON);
26349 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
26350 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
26352 rc = controller_reset_failed(h->cfgtable);
26354 @@ -5106,7 +5108,7 @@ reinit_after_soft_reset:
26355 cciss_scsi_setup(h);
26357 /* Turn the interrupts on so we can service requests */
26358 - h->access.set_intr_mask(h, CCISS_INTR_ON);
26359 + h->access->set_intr_mask(h, CCISS_INTR_ON);
26361 /* Get the firmware version */
26362 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
26363 @@ -5178,7 +5180,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
26365 if (return_code != IO_OK)
26366 dev_warn(&h->pdev->dev, "Error flushing cache\n");
26367 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
26368 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
26369 free_irq(h->intr[PERF_MODE_INT], h);
26372 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
26373 index c049548..a09cb6e 100644
26374 --- a/drivers/block/cciss.h
26375 +++ b/drivers/block/cciss.h
26376 @@ -100,7 +100,7 @@ struct ctlr_info
26377 /* information about each logical volume */
26378 drive_info_struct *drv[CISS_MAX_LUN];
26380 - struct access_method access;
26381 + struct access_method *access;
26383 /* queue and queue Info */
26384 struct list_head reqQ;
26385 diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
26386 index b2fceb5..87fec83 100644
26387 --- a/drivers/block/cpqarray.c
26388 +++ b/drivers/block/cpqarray.c
26389 @@ -404,7 +404,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26390 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
26393 - hba[i]->access.set_intr_mask(hba[i], 0);
26394 + hba[i]->access->set_intr_mask(hba[i], 0);
26395 if (request_irq(hba[i]->intr, do_ida_intr,
26396 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
26398 @@ -459,7 +459,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
26399 add_timer(&hba[i]->timer);
26401 /* Enable IRQ now that spinlock and rate limit timer are set up */
26402 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26403 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
26405 for(j=0; j<NWD; j++) {
26406 struct gendisk *disk = ida_gendisk[i][j];
26407 @@ -694,7 +694,7 @@ DBGINFO(
26408 for(i=0; i<NR_PRODUCTS; i++) {
26409 if (board_id == products[i].board_id) {
26410 c->product_name = products[i].product_name;
26411 - c->access = *(products[i].access);
26412 + c->access = products[i].access;
26416 @@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detect(void)
26417 hba[ctlr]->intr = intr;
26418 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
26419 hba[ctlr]->product_name = products[j].product_name;
26420 - hba[ctlr]->access = *(products[j].access);
26421 + hba[ctlr]->access = products[j].access;
26422 hba[ctlr]->ctlr = ctlr;
26423 hba[ctlr]->board_id = board_id;
26424 hba[ctlr]->pci_dev = NULL; /* not PCI */
26425 @@ -911,6 +911,8 @@ static void do_ida_request(struct request_queue *q)
26426 struct scatterlist tmp_sg[SG_MAX];
26429 + pax_track_stack();
26432 creq = blk_peek_request(q);
26434 @@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
26436 while((c = h->reqQ) != NULL) {
26437 /* Can't do anything if we're busy */
26438 - if (h->access.fifo_full(h) == 0)
26439 + if (h->access->fifo_full(h) == 0)
26442 /* Get the first entry from the request Q */
26443 @@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
26446 /* Tell the controller to do our bidding */
26447 - h->access.submit_command(h, c);
26448 + h->access->submit_command(h, c);
26450 /* Get onto the completion Q */
26452 @@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26453 unsigned long flags;
26456 - istat = h->access.intr_pending(h);
26457 + istat = h->access->intr_pending(h);
26458 /* Is this interrupt for us? */
26461 @@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
26463 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
26464 if (istat & FIFO_NOT_EMPTY) {
26465 - while((a = h->access.command_completed(h))) {
26466 + while((a = h->access->command_completed(h))) {
26468 if ((c = h->cmpQ) == NULL)
26470 @@ -1449,11 +1451,11 @@ static int sendcmd(
26472 * Disable interrupt
26474 - info_p->access.set_intr_mask(info_p, 0);
26475 + info_p->access->set_intr_mask(info_p, 0);
26476 /* Make sure there is room in the command FIFO */
26477 /* Actually it should be completely empty at this time. */
26478 for (i = 200000; i > 0; i--) {
26479 - temp = info_p->access.fifo_full(info_p);
26480 + temp = info_p->access->fifo_full(info_p);
26484 @@ -1466,7 +1468,7 @@ DBG(
26488 - info_p->access.submit_command(info_p, c);
26489 + info_p->access->submit_command(info_p, c);
26490 complete = pollcomplete(ctlr);
26492 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
26493 @@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t *host)
26494 * we check the new geometry. Then turn interrupts back on when
26497 - host->access.set_intr_mask(host, 0);
26498 + host->access->set_intr_mask(host, 0);
26500 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
26501 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
26503 for(i=0; i<NWD; i++) {
26504 struct gendisk *disk = ida_gendisk[ctlr][i];
26505 @@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
26506 /* Wait (up to 2 seconds) for a command to complete */
26508 for (i = 200000; i > 0; i--) {
26509 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
26510 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
26512 udelay(10); /* a short fixed delay */
26514 diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
26515 index be73e9d..7fbf140 100644
26516 --- a/drivers/block/cpqarray.h
26517 +++ b/drivers/block/cpqarray.h
26518 @@ -99,7 +99,7 @@ struct ctlr_info {
26519 drv_info_t drv[NWD];
26520 struct proc_dir_entry *proc;
26522 - struct access_method access;
26523 + struct access_method *access;
26527 diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
26528 index ef2ceed..c9cb18e 100644
26529 --- a/drivers/block/drbd/drbd_int.h
26530 +++ b/drivers/block/drbd/drbd_int.h
26531 @@ -737,7 +737,7 @@ struct drbd_request;
26532 struct drbd_epoch {
26533 struct list_head list;
26534 unsigned int barrier_nr;
26535 - atomic_t epoch_size; /* increased on every request added. */
26536 + atomic_unchecked_t epoch_size; /* increased on every request added. */
26537 atomic_t active; /* increased on every req. added, and dec on every finished. */
26538 unsigned long flags;
26540 @@ -1109,7 +1109,7 @@ struct drbd_conf {
26543 wait_queue_head_t seq_wait;
26544 - atomic_t packet_seq;
26545 + atomic_unchecked_t packet_seq;
26546 unsigned int peer_seq;
26547 spinlock_t peer_seq_lock;
26548 unsigned int minor;
26549 @@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
26551 static inline void drbd_tcp_cork(struct socket *sock)
26553 - int __user val = 1;
26555 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26556 - (char __user *)&val, sizeof(val));
26557 + (char __force_user *)&val, sizeof(val));
26560 static inline void drbd_tcp_uncork(struct socket *sock)
26562 - int __user val = 0;
26564 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
26565 - (char __user *)&val, sizeof(val));
26566 + (char __force_user *)&val, sizeof(val));
26569 static inline void drbd_tcp_nodelay(struct socket *sock)
26571 - int __user val = 1;
26573 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
26574 - (char __user *)&val, sizeof(val));
26575 + (char __force_user *)&val, sizeof(val));
26578 static inline void drbd_tcp_quickack(struct socket *sock)
26580 - int __user val = 2;
26582 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
26583 - (char __user *)&val, sizeof(val));
26584 + (char __force_user *)&val, sizeof(val));
26587 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
26588 diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
26589 index 0358e55..bc33689 100644
26590 --- a/drivers/block/drbd/drbd_main.c
26591 +++ b/drivers/block/drbd/drbd_main.c
26592 @@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd,
26594 p.block_id = block_id;
26595 p.blksize = blksize;
26596 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
26597 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
26599 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
26601 @@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
26602 p.sector = cpu_to_be64(req->sector);
26603 p.block_id = (unsigned long)req;
26604 p.seq_num = cpu_to_be32(req->seq_num =
26605 - atomic_add_return(1, &mdev->packet_seq));
26606 + atomic_add_return_unchecked(1, &mdev->packet_seq));
26608 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
26610 @@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev)
26611 atomic_set(&mdev->unacked_cnt, 0);
26612 atomic_set(&mdev->local_cnt, 0);
26613 atomic_set(&mdev->net_cnt, 0);
26614 - atomic_set(&mdev->packet_seq, 0);
26615 + atomic_set_unchecked(&mdev->packet_seq, 0);
26616 atomic_set(&mdev->pp_in_use, 0);
26617 atomic_set(&mdev->pp_in_use_by_net, 0);
26618 atomic_set(&mdev->rs_sect_in, 0);
26619 @@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev)
26620 mdev->receiver.t_state);
26622 /* no need to lock it, I'm the only thread alive */
26623 - if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
26624 - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
26625 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
26626 + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
26627 mdev->al_writ_cnt =
26628 mdev->bm_writ_cnt =
26630 diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
26631 index 0feab26..5d9b3dd 100644
26632 --- a/drivers/block/drbd/drbd_nl.c
26633 +++ b/drivers/block/drbd/drbd_nl.c
26634 @@ -2359,7 +2359,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
26635 module_put(THIS_MODULE);
26638 -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26639 +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
26641 static unsigned short *
26642 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
26643 @@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state)
26644 cn_reply->id.idx = CN_IDX_DRBD;
26645 cn_reply->id.val = CN_VAL_DRBD;
26647 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26648 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26649 cn_reply->ack = 0; /* not used here. */
26650 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26651 (int)((char *)tl - (char *)reply->tag_list);
26652 @@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
26653 cn_reply->id.idx = CN_IDX_DRBD;
26654 cn_reply->id.val = CN_VAL_DRBD;
26656 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26657 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26658 cn_reply->ack = 0; /* not used here. */
26659 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26660 (int)((char *)tl - (char *)reply->tag_list);
26661 @@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev,
26662 cn_reply->id.idx = CN_IDX_DRBD;
26663 cn_reply->id.val = CN_VAL_DRBD;
26665 - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
26666 + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
26667 cn_reply->ack = 0; // not used here.
26668 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26669 (int)((char*)tl - (char*)reply->tag_list);
26670 @@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev)
26671 cn_reply->id.idx = CN_IDX_DRBD;
26672 cn_reply->id.val = CN_VAL_DRBD;
26674 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
26675 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
26676 cn_reply->ack = 0; /* not used here. */
26677 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
26678 (int)((char *)tl - (char *)reply->tag_list);
26679 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
26680 index 43beaca..4a5b1dd 100644
26681 --- a/drivers/block/drbd/drbd_receiver.c
26682 +++ b/drivers/block/drbd/drbd_receiver.c
26683 @@ -894,7 +894,7 @@ retry:
26684 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
26685 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
26687 - atomic_set(&mdev->packet_seq, 0);
26688 + atomic_set_unchecked(&mdev->packet_seq, 0);
26689 mdev->peer_seq = 0;
26691 drbd_thread_start(&mdev->asender);
26692 @@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26696 - epoch_size = atomic_read(&epoch->epoch_size);
26697 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
26699 switch (ev & ~EV_CLEANUP) {
26701 @@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
26705 - atomic_set(&epoch->epoch_size, 0);
26706 + atomic_set_unchecked(&epoch->epoch_size, 0);
26707 /* atomic_set(&epoch->active, 0); is already zero */
26708 if (rv == FE_STILL_LIVE)
26710 @@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26711 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
26714 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
26715 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26716 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
26721 epoch = mdev->current_epoch;
26722 - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
26723 + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
26725 D_ASSERT(atomic_read(&epoch->active) == 0);
26726 D_ASSERT(epoch->flags == 0);
26727 @@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
26731 - atomic_set(&epoch->epoch_size, 0);
26732 + atomic_set_unchecked(&epoch->epoch_size, 0);
26733 atomic_set(&epoch->active, 0);
26735 spin_lock(&mdev->epoch_lock);
26736 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
26737 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
26738 list_add(&epoch->list, &mdev->current_epoch->list);
26739 mdev->current_epoch = epoch;
26741 @@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26742 spin_unlock(&mdev->peer_seq_lock);
26744 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
26745 - atomic_inc(&mdev->current_epoch->epoch_size);
26746 + atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
26747 return drbd_drain_block(mdev, data_size);
26750 @@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
26752 spin_lock(&mdev->epoch_lock);
26753 e->epoch = mdev->current_epoch;
26754 - atomic_inc(&e->epoch->epoch_size);
26755 + atomic_inc_unchecked(&e->epoch->epoch_size);
26756 atomic_inc(&e->epoch->active);
26757 spin_unlock(&mdev->epoch_lock);
26759 @@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
26760 D_ASSERT(list_empty(&mdev->done_ee));
26762 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
26763 - atomic_set(&mdev->current_epoch->epoch_size, 0);
26764 + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
26765 D_ASSERT(list_empty(&mdev->current_epoch->list));
26768 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
26769 index 4720c7a..2c49af1 100644
26770 --- a/drivers/block/loop.c
26771 +++ b/drivers/block/loop.c
26772 @@ -283,7 +283,7 @@ static int __do_lo_send_write(struct file *file,
26773 mm_segment_t old_fs = get_fs();
26776 - bw = file->f_op->write(file, buf, len, &pos);
26777 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
26779 if (likely(bw == len))
26781 diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
26782 index f533f33..6177bcb 100644
26783 --- a/drivers/block/nbd.c
26784 +++ b/drivers/block/nbd.c
26785 @@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
26787 sigset_t blocked, oldset;
26789 + pax_track_stack();
26791 if (unlikely(!sock)) {
26792 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
26793 lo->disk->disk_name, (send ? "send" : "recv"));
26794 @@ -572,6 +574,8 @@ static void do_nbd_request(struct request_queue *q)
26795 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
26796 unsigned int cmd, unsigned long arg)
26798 + pax_track_stack();
26801 case NBD_DISCONNECT: {
26802 struct request sreq;
26803 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
26804 index 423fd56..06d3be0 100644
26805 --- a/drivers/char/Kconfig
26806 +++ b/drivers/char/Kconfig
26807 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
26810 bool "/dev/kmem virtual device support"
26813 + depends on !GRKERNSEC_KMEM
26815 Say Y here if you want to support the /dev/kmem device. The
26816 /dev/kmem device is rarely used, but can be used for certain
26817 @@ -596,6 +597,7 @@ config DEVPORT
26820 depends on ISA || PCI
26821 + depends on !GRKERNSEC_KMEM
26824 source "drivers/s390/char/Kconfig"
26825 diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
26826 index 2e04433..22afc64 100644
26827 --- a/drivers/char/agp/frontend.c
26828 +++ b/drivers/char/agp/frontend.c
26829 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
26830 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
26833 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
26834 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
26837 client = agp_find_client_by_pid(reserve.pid);
26838 diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
26839 index 095ab90..afad0a4 100644
26840 --- a/drivers/char/briq_panel.c
26841 +++ b/drivers/char/briq_panel.c
26843 #include <linux/types.h>
26844 #include <linux/errno.h>
26845 #include <linux/tty.h>
26846 +#include <linux/mutex.h>
26847 #include <linux/timer.h>
26848 #include <linux/kernel.h>
26849 #include <linux/wait.h>
26850 @@ -34,6 +35,7 @@ static int vfd_is_open;
26851 static unsigned char vfd[40];
26852 static int vfd_cursor;
26853 static unsigned char ledpb, led;
26854 +static DEFINE_MUTEX(vfd_mutex);
26856 static void update_vfd(void)
26858 @@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26862 + mutex_lock(&vfd_mutex);
26867 - if (get_user(c, buf))
26868 + if (get_user(c, buf)) {
26869 + mutex_unlock(&vfd_mutex);
26875 @@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
26879 + mutex_unlock(&vfd_mutex);
26883 diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
26884 index f773a9d..65cd683 100644
26885 --- a/drivers/char/genrtc.c
26886 +++ b/drivers/char/genrtc.c
26887 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
26891 + memset(&pll, 0, sizeof(pll));
26892 if (get_rtc_pll(&pll))
26895 diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
26896 index 0833896..cccce52 100644
26897 --- a/drivers/char/hpet.c
26898 +++ b/drivers/char/hpet.c
26899 @@ -572,7 +572,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
26903 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
26904 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
26905 struct hpet_info *info)
26907 struct hpet_timer __iomem *timer;
26908 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
26909 index 58c0e63..25aed94 100644
26910 --- a/drivers/char/ipmi/ipmi_msghandler.c
26911 +++ b/drivers/char/ipmi/ipmi_msghandler.c
26912 @@ -415,7 +415,7 @@ struct ipmi_smi {
26913 struct proc_dir_entry *proc_dir;
26914 char proc_dir_name[10];
26916 - atomic_t stats[IPMI_NUM_STATS];
26917 + atomic_unchecked_t stats[IPMI_NUM_STATS];
26920 * run_to_completion duplicate of smb_info, smi_info
26921 @@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
26924 #define ipmi_inc_stat(intf, stat) \
26925 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
26926 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
26927 #define ipmi_get_stat(intf, stat) \
26928 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
26929 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
26931 static int is_lan_addr(struct ipmi_addr *addr)
26933 @@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
26934 INIT_LIST_HEAD(&intf->cmd_rcvrs);
26935 init_waitqueue_head(&intf->waitq);
26936 for (i = 0; i < IPMI_NUM_STATS; i++)
26937 - atomic_set(&intf->stats[i], 0);
26938 + atomic_set_unchecked(&intf->stats[i], 0);
26940 intf->proc_dir = NULL;
26942 @@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
26943 struct ipmi_smi_msg smi_msg;
26944 struct ipmi_recv_msg recv_msg;
26946 + pax_track_stack();
26948 si = (struct ipmi_system_interface_addr *) &addr;
26949 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
26950 si->channel = IPMI_BMC_CHANNEL;
26951 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
26952 index 9397ab4..d01bee1 100644
26953 --- a/drivers/char/ipmi/ipmi_si_intf.c
26954 +++ b/drivers/char/ipmi/ipmi_si_intf.c
26955 @@ -277,7 +277,7 @@ struct smi_info {
26956 unsigned char slave_addr;
26958 /* Counters and things for the proc filesystem. */
26959 - atomic_t stats[SI_NUM_STATS];
26960 + atomic_unchecked_t stats[SI_NUM_STATS];
26962 struct task_struct *thread;
26964 @@ -286,9 +286,9 @@ struct smi_info {
26967 #define smi_inc_stat(smi, stat) \
26968 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
26969 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
26970 #define smi_get_stat(smi, stat) \
26971 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
26972 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
26974 #define SI_MAX_PARMS 4
26976 @@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info *new_smi)
26977 atomic_set(&new_smi->req_events, 0);
26978 new_smi->run_to_completion = 0;
26979 for (i = 0; i < SI_NUM_STATS; i++)
26980 - atomic_set(&new_smi->stats[i], 0);
26981 + atomic_set_unchecked(&new_smi->stats[i], 0);
26983 new_smi->interrupt_disabled = 1;
26984 atomic_set(&new_smi->stop_operation, 0);
26985 diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
26986 index 1aeaaba..e018570 100644
26987 --- a/drivers/char/mbcs.c
26988 +++ b/drivers/char/mbcs.c
26989 @@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *dev)
26993 -static const struct cx_device_id __devinitdata mbcs_id_table[] = {
26994 +static const struct cx_device_id __devinitconst mbcs_id_table[] = {
26996 .part_num = MBCS_PART_NUM,
26997 .mfg_num = MBCS_MFG_NUM,
26998 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
26999 index 8fc04b4..cebdeec 100644
27000 --- a/drivers/char/mem.c
27001 +++ b/drivers/char/mem.c
27003 #include <linux/raw.h>
27004 #include <linux/tty.h>
27005 #include <linux/capability.h>
27006 +#include <linux/security.h>
27007 #include <linux/ptrace.h>
27008 #include <linux/device.h>
27009 #include <linux/highmem.h>
27011 # include <linux/efi.h>
27014 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27015 +extern const struct file_operations grsec_fops;
27018 static inline unsigned long size_inside_page(unsigned long start,
27019 unsigned long size)
27021 @@ -65,9 +70,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27023 while (cursor < to) {
27024 if (!devmem_is_allowed(pfn)) {
27025 +#ifdef CONFIG_GRKERNSEC_KMEM
27026 + gr_handle_mem_readwrite(from, to);
27029 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
27030 current->comm, from, to);
27034 cursor += PAGE_SIZE;
27035 @@ -75,6 +84,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27039 +#elif defined(CONFIG_GRKERNSEC_KMEM)
27040 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27045 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
27047 @@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27049 while (count > 0) {
27050 unsigned long remaining;
27053 sz = size_inside_page(p, count);
27055 @@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
27059 - remaining = copy_to_user(buf, ptr, sz);
27060 +#ifdef CONFIG_PAX_USERCOPY
27061 + temp = kmalloc(sz, GFP_KERNEL);
27063 + unxlate_dev_mem_ptr(p, ptr);
27066 + memcpy(temp, ptr, sz);
27071 + remaining = copy_to_user(buf, temp, sz);
27073 +#ifdef CONFIG_PAX_USERCOPY
27077 unxlate_dev_mem_ptr(p, ptr);
27080 @@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27081 size_t count, loff_t *ppos)
27083 unsigned long p = *ppos;
27084 - ssize_t low_count, read, sz;
27085 + ssize_t low_count, read, sz, err = 0;
27086 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
27090 if (p < (unsigned long) high_memory) {
27091 @@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27094 while (low_count > 0) {
27097 sz = size_inside_page(p, low_count);
27100 @@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
27102 kbuf = xlate_dev_kmem_ptr((char *)p);
27104 - if (copy_to_user(buf, kbuf, sz))
27105 +#ifdef CONFIG_PAX_USERCOPY
27106 + temp = kmalloc(sz, GFP_KERNEL);
27109 + memcpy(temp, kbuf, sz);
27114 + err = copy_to_user(buf, temp, sz);
27116 +#ifdef CONFIG_PAX_USERCOPY
27124 @@ -866,6 +913,9 @@ static const struct memdev {
27125 #ifdef CONFIG_CRASH_DUMP
27126 [12] = { "oldmem", 0, &oldmem_fops, NULL },
27128 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
27129 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
27133 static int memory_open(struct inode *inode, struct file *filp)
27134 diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
27135 index da3cfee..a5a6606 100644
27136 --- a/drivers/char/nvram.c
27137 +++ b/drivers/char/nvram.c
27138 @@ -248,7 +248,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
27140 spin_unlock_irq(&rtc_lock);
27142 - if (copy_to_user(buf, contents, tmp - contents))
27143 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
27147 diff --git a/drivers/char/random.c b/drivers/char/random.c
27148 index c35a785..6d82202 100644
27149 --- a/drivers/char/random.c
27150 +++ b/drivers/char/random.c
27151 @@ -261,8 +261,13 @@
27153 * Configuration information
27155 +#ifdef CONFIG_GRKERNSEC_RANDNET
27156 +#define INPUT_POOL_WORDS 512
27157 +#define OUTPUT_POOL_WORDS 128
27159 #define INPUT_POOL_WORDS 128
27160 #define OUTPUT_POOL_WORDS 32
27162 #define SEC_XFER_SIZE 512
27163 #define EXTRACT_SIZE 10
27165 @@ -300,10 +305,17 @@ static struct poolinfo {
27167 int tap1, tap2, tap3, tap4, tap5;
27168 } poolinfo_table[] = {
27169 +#ifdef CONFIG_GRKERNSEC_RANDNET
27170 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
27171 + { 512, 411, 308, 208, 104, 1 },
27172 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
27173 + { 128, 103, 76, 51, 25, 1 },
27175 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
27176 { 128, 103, 76, 51, 25, 1 },
27177 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
27178 { 32, 26, 20, 14, 7, 1 },
27181 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
27182 { 2048, 1638, 1231, 819, 411, 1 },
27183 @@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
27185 extract_buf(r, tmp);
27186 i = min_t(int, nbytes, EXTRACT_SIZE);
27187 - if (copy_to_user(buf, tmp, i)) {
27188 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
27192 @@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
27193 #include <linux/sysctl.h>
27195 static int min_read_thresh = 8, min_write_thresh;
27196 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
27197 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
27198 static int max_write_thresh = INPUT_POOL_WORDS * 32;
27199 static char sysctl_bootid[16];
27201 diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
27202 index 1ee8ce7..b778bef 100644
27203 --- a/drivers/char/sonypi.c
27204 +++ b/drivers/char/sonypi.c
27206 #include <asm/uaccess.h>
27207 #include <asm/io.h>
27208 #include <asm/system.h>
27209 +#include <asm/local.h>
27211 #include <linux/sonypi.h>
27213 @@ -491,7 +492,7 @@ static struct sonypi_device {
27214 spinlock_t fifo_lock;
27215 wait_queue_head_t fifo_proc_list;
27216 struct fasync_struct *fifo_async;
27218 + local_t open_count;
27220 struct input_dev *input_jog_dev;
27221 struct input_dev *input_key_dev;
27222 @@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
27223 static int sonypi_misc_release(struct inode *inode, struct file *file)
27225 mutex_lock(&sonypi_device.lock);
27226 - sonypi_device.open_count--;
27227 + local_dec(&sonypi_device.open_count);
27228 mutex_unlock(&sonypi_device.lock);
27231 @@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
27233 mutex_lock(&sonypi_device.lock);
27234 /* Flush input queue on first open */
27235 - if (!sonypi_device.open_count)
27236 + if (!local_read(&sonypi_device.open_count))
27237 kfifo_reset(&sonypi_device.fifo);
27238 - sonypi_device.open_count++;
27239 + local_inc(&sonypi_device.open_count);
27240 mutex_unlock(&sonypi_device.lock);
27243 diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
27244 index 9ca5c02..7ce352c 100644
27245 --- a/drivers/char/tpm/tpm.c
27246 +++ b/drivers/char/tpm/tpm.c
27247 @@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
27248 chip->vendor.req_complete_val)
27251 - if ((status == chip->vendor.req_canceled)) {
27252 + if (status == chip->vendor.req_canceled) {
27253 dev_err(chip->dev, "Operation Canceled\n");
27256 @@ -862,6 +862,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
27258 struct tpm_chip *chip = dev_get_drvdata(dev);
27260 + pax_track_stack();
27262 tpm_cmd.header.in = tpm_readpubek_header;
27263 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
27264 "attempting to read the PUBEK");
27265 diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
27266 index 0636520..169c1d0 100644
27267 --- a/drivers/char/tpm/tpm_bios.c
27268 +++ b/drivers/char/tpm/tpm_bios.c
27269 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
27272 if ((event->event_type == 0 && event->event_size == 0) ||
27273 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
27274 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
27278 @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
27281 if ((event->event_type == 0 && event->event_size == 0) ||
27282 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
27283 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
27287 @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
27290 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
27291 - seq_putc(m, data[i]);
27292 + if (!seq_putc(m, data[i]))
27297 @@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log *log)
27298 log->bios_event_log_end = log->bios_event_log + len;
27300 virt = acpi_os_map_memory(start, len);
27302 + kfree(log->bios_event_log);
27303 + log->bios_event_log = NULL;
27307 - memcpy(log->bios_event_log, virt, len);
27308 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
27310 acpi_os_unmap_memory(virt, len);
27312 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
27313 index fb68b12..0f6c6ca 100644
27314 --- a/drivers/char/virtio_console.c
27315 +++ b/drivers/char/virtio_console.c
27316 @@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
27320 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
27321 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
27325 @@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
27326 if (!port_has_data(port) && !port->host_connected)
27329 - return fill_readbuf(port, ubuf, count, true);
27330 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
27333 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
27334 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
27335 index a84250a..68c725e 100644
27336 --- a/drivers/crypto/hifn_795x.c
27337 +++ b/drivers/crypto/hifn_795x.c
27338 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
27339 0xCA, 0x34, 0x2B, 0x2E};
27340 struct scatterlist sg;
27342 + pax_track_stack();
27344 memset(src, 0, sizeof(src));
27345 memset(ctx.key, 0, sizeof(ctx.key));
27347 diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
27348 index db33d30..7823369 100644
27349 --- a/drivers/crypto/padlock-aes.c
27350 +++ b/drivers/crypto/padlock-aes.c
27351 @@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
27352 struct crypto_aes_ctx gen_aes;
27355 + pax_track_stack();
27358 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
27360 diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
27361 index 9a8bebc..b1e4989 100644
27362 --- a/drivers/edac/amd64_edac.c
27363 +++ b/drivers/edac/amd64_edac.c
27364 @@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
27365 * PCI core identifies what devices are on a system during boot, and then
27366 * inquiry this table to see if this driver is for a given device found.
27368 -static const struct pci_device_id amd64_pci_table[] __devinitdata = {
27369 +static const struct pci_device_id amd64_pci_table[] __devinitconst = {
27371 .vendor = PCI_VENDOR_ID_AMD,
27372 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
27373 diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
27374 index e47e73b..348e0bd 100644
27375 --- a/drivers/edac/amd76x_edac.c
27376 +++ b/drivers/edac/amd76x_edac.c
27377 @@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
27381 -static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
27382 +static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
27384 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27386 diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
27387 index 1af531a..3a8ff27 100644
27388 --- a/drivers/edac/e752x_edac.c
27389 +++ b/drivers/edac/e752x_edac.c
27390 @@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
27394 -static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
27395 +static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
27397 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27399 diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
27400 index 6ffb6d2..383d8d7 100644
27401 --- a/drivers/edac/e7xxx_edac.c
27402 +++ b/drivers/edac/e7xxx_edac.c
27403 @@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
27407 -static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
27408 +static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
27410 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27412 diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
27413 index 495198a..ac08c85 100644
27414 --- a/drivers/edac/edac_pci_sysfs.c
27415 +++ b/drivers/edac/edac_pci_sysfs.c
27416 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
27417 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
27418 static int edac_pci_poll_msec = 1000; /* one second workq period */
27420 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
27421 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
27422 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
27423 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
27425 static struct kobject *edac_pci_top_main_kobj;
27426 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
27427 @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27428 edac_printk(KERN_CRIT, EDAC_PCI,
27429 "Signaled System Error on %s\n",
27431 - atomic_inc(&pci_nonparity_count);
27432 + atomic_inc_unchecked(&pci_nonparity_count);
27435 if (status & (PCI_STATUS_PARITY)) {
27436 @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27437 "Master Data Parity Error on %s\n",
27440 - atomic_inc(&pci_parity_count);
27441 + atomic_inc_unchecked(&pci_parity_count);
27444 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27445 @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27446 "Detected Parity Error on %s\n",
27449 - atomic_inc(&pci_parity_count);
27450 + atomic_inc_unchecked(&pci_parity_count);
27454 @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27455 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
27456 "Signaled System Error on %s\n",
27458 - atomic_inc(&pci_nonparity_count);
27459 + atomic_inc_unchecked(&pci_nonparity_count);
27462 if (status & (PCI_STATUS_PARITY)) {
27463 @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27464 "Master Data Parity Error on "
27465 "%s\n", pci_name(dev));
27467 - atomic_inc(&pci_parity_count);
27468 + atomic_inc_unchecked(&pci_parity_count);
27471 if (status & (PCI_STATUS_DETECTED_PARITY)) {
27472 @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
27473 "Detected Parity Error on %s\n",
27476 - atomic_inc(&pci_parity_count);
27477 + atomic_inc_unchecked(&pci_parity_count);
27481 @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
27482 if (!check_pci_errors)
27485 - before_count = atomic_read(&pci_parity_count);
27486 + before_count = atomic_read_unchecked(&pci_parity_count);
27488 /* scan all PCI devices looking for a Parity Error on devices and
27490 @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
27491 /* Only if operator has selected panic on PCI Error */
27492 if (edac_pci_get_panic_on_pe()) {
27493 /* If the count is different 'after' from 'before' */
27494 - if (before_count != atomic_read(&pci_parity_count))
27495 + if (before_count != atomic_read_unchecked(&pci_parity_count))
27496 panic("EDAC: PCI Parity Error");
27499 diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
27500 index c0510b3..6e2a954 100644
27501 --- a/drivers/edac/i3000_edac.c
27502 +++ b/drivers/edac/i3000_edac.c
27503 @@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
27507 -static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
27508 +static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
27510 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27512 diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
27513 index aa08497..7e6822a 100644
27514 --- a/drivers/edac/i3200_edac.c
27515 +++ b/drivers/edac/i3200_edac.c
27516 @@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
27520 -static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
27521 +static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
27523 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27525 diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
27526 index 4dc3ac2..67d05a6 100644
27527 --- a/drivers/edac/i5000_edac.c
27528 +++ b/drivers/edac/i5000_edac.c
27529 @@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
27531 * The "E500P" device is the first device supported.
27533 -static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
27534 +static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
27535 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
27536 .driver_data = I5000P},
27538 diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
27539 index bcbdeec..9886d16 100644
27540 --- a/drivers/edac/i5100_edac.c
27541 +++ b/drivers/edac/i5100_edac.c
27542 @@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
27546 -static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
27547 +static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
27548 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
27549 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
27551 diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
27552 index 74d6ec34..baff517 100644
27553 --- a/drivers/edac/i5400_edac.c
27554 +++ b/drivers/edac/i5400_edac.c
27555 @@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
27557 * The "E500P" device is the first device supported.
27559 -static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
27560 +static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
27561 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
27562 {0,} /* 0 terminated list. */
27564 diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
27565 index a76fe83..15479e6 100644
27566 --- a/drivers/edac/i7300_edac.c
27567 +++ b/drivers/edac/i7300_edac.c
27568 @@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
27570 * Has only 8086:360c PCI ID
27572 -static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
27573 +static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
27574 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
27575 {0,} /* 0 terminated list. */
27577 diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
27578 index f6cf448..3f612e9 100644
27579 --- a/drivers/edac/i7core_edac.c
27580 +++ b/drivers/edac/i7core_edac.c
27581 @@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev_table[] = {
27583 * pci_device_id table for which devices we are looking for
27585 -static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
27586 +static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
27587 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
27588 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
27589 {0,} /* 0 terminated list. */
27590 diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
27591 index 4329d39..f3022ef 100644
27592 --- a/drivers/edac/i82443bxgx_edac.c
27593 +++ b/drivers/edac/i82443bxgx_edac.c
27594 @@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
27596 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
27598 -static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
27599 +static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
27600 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
27601 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
27602 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
27603 diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
27604 index 931a057..fd28340 100644
27605 --- a/drivers/edac/i82860_edac.c
27606 +++ b/drivers/edac/i82860_edac.c
27607 @@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
27611 -static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
27612 +static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
27614 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27616 diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
27617 index 33864c6..01edc61 100644
27618 --- a/drivers/edac/i82875p_edac.c
27619 +++ b/drivers/edac/i82875p_edac.c
27620 @@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
27624 -static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
27625 +static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
27627 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27629 diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
27630 index a5da732..983363b 100644
27631 --- a/drivers/edac/i82975x_edac.c
27632 +++ b/drivers/edac/i82975x_edac.c
27633 @@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
27637 -static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
27638 +static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
27640 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27642 diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
27643 index 795a320..3bbc3d3 100644
27644 --- a/drivers/edac/mce_amd.h
27645 +++ b/drivers/edac/mce_amd.h
27646 @@ -83,7 +83,7 @@ struct amd_decoder_ops {
27647 bool (*dc_mce)(u16, u8);
27648 bool (*ic_mce)(u16, u8);
27649 bool (*nb_mce)(u16, u8);
27653 void amd_report_gart_errors(bool);
27654 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
27655 diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
27656 index b153674..ad2ba9b 100644
27657 --- a/drivers/edac/r82600_edac.c
27658 +++ b/drivers/edac/r82600_edac.c
27659 @@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
27663 -static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
27664 +static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
27666 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
27668 diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
27669 index b6f47de..c5acf3a 100644
27670 --- a/drivers/edac/x38_edac.c
27671 +++ b/drivers/edac/x38_edac.c
27672 @@ -440,7 +440,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
27676 -static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
27677 +static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
27679 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
27681 diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
27682 index 85661b0..c784559a 100644
27683 --- a/drivers/firewire/core-card.c
27684 +++ b/drivers/firewire/core-card.c
27685 @@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
27687 void fw_core_remove_card(struct fw_card *card)
27689 - struct fw_card_driver dummy_driver = dummy_driver_template;
27690 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
27692 card->driver->update_phy_reg(card, 4,
27693 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
27694 diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
27695 index 4799393..37bd3ab 100644
27696 --- a/drivers/firewire/core-cdev.c
27697 +++ b/drivers/firewire/core-cdev.c
27698 @@ -1331,8 +1331,7 @@ static int init_iso_resource(struct client *client,
27701 if ((request->channels == 0 && request->bandwidth == 0) ||
27702 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
27703 - request->bandwidth < 0)
27704 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
27707 r = kmalloc(sizeof(*r), GFP_KERNEL);
27708 diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
27709 index 334b82a..ea5261d 100644
27710 --- a/drivers/firewire/core-transaction.c
27711 +++ b/drivers/firewire/core-transaction.c
27713 #include <linux/timer.h>
27714 #include <linux/types.h>
27715 #include <linux/workqueue.h>
27716 +#include <linux/sched.h>
27718 #include <asm/byteorder.h>
27720 @@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
27721 struct transaction_callback_data d;
27722 struct fw_transaction t;
27724 + pax_track_stack();
27726 init_timer_on_stack(&t.split_timeout_timer);
27727 init_completion(&d.done);
27728 d.payload = payload;
27729 diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
27730 index b45be57..5fad18b 100644
27731 --- a/drivers/firewire/core.h
27732 +++ b/drivers/firewire/core.h
27733 @@ -101,6 +101,7 @@ struct fw_card_driver {
27735 int (*stop_iso)(struct fw_iso_context *ctx);
27737 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
27739 void fw_card_initialize(struct fw_card *card,
27740 const struct fw_card_driver *driver, struct device *device);
27741 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
27742 index bcb1126..2cc2121 100644
27743 --- a/drivers/firmware/dmi_scan.c
27744 +++ b/drivers/firmware/dmi_scan.c
27745 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
27750 - * no iounmap() for that ioremap(); it would be a no-op, but
27751 - * it's so early in setup that sucker gets confused into doing
27752 - * what it shouldn't if we actually call it.
27754 p = dmi_ioremap(0xF0000, 0x10000);
27757 @@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
27761 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
27762 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
27766 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
27767 index 98723cb..10ca85b 100644
27768 --- a/drivers/gpio/gpio-vr41xx.c
27769 +++ b/drivers/gpio/gpio-vr41xx.c
27770 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
27771 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
27772 maskl, pendl, maskh, pendh);
27774 - atomic_inc(&irq_err_count);
27775 + atomic_inc_unchecked(&irq_err_count);
27779 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
27780 index 2410c40..2d03563 100644
27781 --- a/drivers/gpu/drm/drm_crtc.c
27782 +++ b/drivers/gpu/drm/drm_crtc.c
27783 @@ -1374,7 +1374,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27785 if ((out_resp->count_modes >= mode_count) && mode_count) {
27787 - mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
27788 + mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
27789 list_for_each_entry(mode, &connector->modes, head) {
27790 drm_crtc_convert_to_umode(&u_mode, mode);
27791 if (copy_to_user(mode_ptr + copied,
27792 @@ -1389,8 +1389,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27794 if ((out_resp->count_props >= props_count) && props_count) {
27796 - prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
27797 - prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
27798 + prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
27799 + prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
27800 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
27801 if (connector->property_ids[i] != 0) {
27802 if (put_user(connector->property_ids[i],
27803 @@ -1412,7 +1412,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
27805 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
27807 - encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
27808 + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
27809 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
27810 if (connector->encoder_ids[i] != 0) {
27811 if (put_user(connector->encoder_ids[i],
27812 @@ -1571,7 +1571,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
27815 for (i = 0; i < crtc_req->count_connectors; i++) {
27816 - set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
27817 + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
27818 if (get_user(out_id, &set_connectors_ptr[i])) {
27821 @@ -1852,7 +1852,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
27822 fb = obj_to_fb(obj);
27824 num_clips = r->num_clips;
27825 - clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
27826 + clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
27828 if (!num_clips != !clips_ptr) {
27830 @@ -2276,7 +2276,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27831 out_resp->flags = property->flags;
27833 if ((out_resp->count_values >= value_count) && value_count) {
27834 - values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
27835 + values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
27836 for (i = 0; i < value_count; i++) {
27837 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
27839 @@ -2289,7 +2289,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27840 if (property->flags & DRM_MODE_PROP_ENUM) {
27841 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
27843 - enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
27844 + enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
27845 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
27847 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
27848 @@ -2312,7 +2312,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
27849 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
27851 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
27852 - blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
27853 + blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
27855 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
27856 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
27857 @@ -2373,7 +2373,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27858 struct drm_mode_get_blob *out_resp = data;
27859 struct drm_property_blob *blob;
27862 + void __user *blob_ptr;
27864 if (!drm_core_check_feature(dev, DRIVER_MODESET))
27866 @@ -2387,7 +2387,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
27867 blob = obj_to_blob(obj);
27869 if (out_resp->length == blob->length) {
27870 - blob_ptr = (void *)(unsigned long)out_resp->data;
27871 + blob_ptr = (void __user *)(unsigned long)out_resp->data;
27872 if (copy_to_user(blob_ptr, blob->data, blob->length)){
27875 diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
27876 index f88a9b2..8f4078f 100644
27877 --- a/drivers/gpu/drm/drm_crtc_helper.c
27878 +++ b/drivers/gpu/drm/drm_crtc_helper.c
27879 @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
27880 struct drm_crtc *tmp;
27883 - WARN(!crtc, "checking null crtc?\n");
27888 @@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
27889 struct drm_encoder *encoder;
27892 + pax_track_stack();
27894 crtc->enabled = drm_helper_crtc_in_use(crtc);
27895 if (!crtc->enabled)
27897 diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
27898 index 93a112d..c8b065d 100644
27899 --- a/drivers/gpu/drm/drm_drv.c
27900 +++ b/drivers/gpu/drm/drm_drv.c
27901 @@ -307,7 +307,7 @@ module_exit(drm_core_exit);
27903 * Copy and IOCTL return string to user space
27905 -static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
27906 +static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
27910 @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
27912 dev = file_priv->minor->dev;
27913 atomic_inc(&dev->ioctl_count);
27914 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
27915 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
27916 ++file_priv->ioctl_count;
27918 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
27919 diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
27920 index 2ec7d48..be14bb1 100644
27921 --- a/drivers/gpu/drm/drm_fops.c
27922 +++ b/drivers/gpu/drm/drm_fops.c
27923 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device * dev)
27926 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
27927 - atomic_set(&dev->counts[i], 0);
27928 + atomic_set_unchecked(&dev->counts[i], 0);
27930 dev->sigdata.lock = NULL;
27932 @@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct file *filp)
27934 retcode = drm_open_helper(inode, filp, dev);
27936 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
27937 - if (!dev->open_count++)
27938 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
27939 + if (local_inc_return(&dev->open_count) == 1)
27940 retcode = drm_setup(dev);
27943 @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, struct file *filp)
27945 mutex_lock(&drm_global_mutex);
27947 - DRM_DEBUG("open_count = %d\n", dev->open_count);
27948 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
27950 if (dev->driver->preclose)
27951 dev->driver->preclose(dev, file_priv);
27952 @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
27953 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
27954 task_pid_nr(current),
27955 (long)old_encode_dev(file_priv->minor->device),
27956 - dev->open_count);
27957 + local_read(&dev->open_count));
27959 /* if the master has gone away we can't do anything with the lock */
27960 if (file_priv->minor->master)
27961 @@ -565,8 +565,8 @@ int drm_release(struct inode *inode, struct file *filp)
27962 * End inline drm_release
27965 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
27966 - if (!--dev->open_count) {
27967 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
27968 + if (local_dec_and_test(&dev->open_count)) {
27969 if (atomic_read(&dev->ioctl_count)) {
27970 DRM_ERROR("Device busy: %d\n",
27971 atomic_read(&dev->ioctl_count));
27972 diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
27973 index c87dc96..326055d 100644
27974 --- a/drivers/gpu/drm/drm_global.c
27975 +++ b/drivers/gpu/drm/drm_global.c
27977 struct drm_global_item {
27978 struct mutex mutex;
27981 + atomic_t refcount;
27984 static struct drm_global_item glob[DRM_GLOBAL_NUM];
27985 @@ -49,7 +49,7 @@ void drm_global_init(void)
27986 struct drm_global_item *item = &glob[i];
27987 mutex_init(&item->mutex);
27988 item->object = NULL;
27989 - item->refcount = 0;
27990 + atomic_set(&item->refcount, 0);
27994 @@ -59,7 +59,7 @@ void drm_global_release(void)
27995 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
27996 struct drm_global_item *item = &glob[i];
27997 BUG_ON(item->object != NULL);
27998 - BUG_ON(item->refcount != 0);
27999 + BUG_ON(atomic_read(&item->refcount) != 0);
28003 @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28006 mutex_lock(&item->mutex);
28007 - if (item->refcount == 0) {
28008 + if (atomic_read(&item->refcount) == 0) {
28009 item->object = kzalloc(ref->size, GFP_KERNEL);
28010 if (unlikely(item->object == NULL)) {
28012 @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
28016 - ++item->refcount;
28017 + atomic_inc(&item->refcount);
28018 ref->object = item->object;
28019 object = item->object;
28020 mutex_unlock(&item->mutex);
28021 @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
28022 struct drm_global_item *item = &glob[ref->global_type];
28024 mutex_lock(&item->mutex);
28025 - BUG_ON(item->refcount == 0);
28026 + BUG_ON(atomic_read(&item->refcount) == 0);
28027 BUG_ON(ref->object != item->object);
28028 - if (--item->refcount == 0) {
28029 + if (atomic_dec_and_test(&item->refcount)) {
28031 item->object = NULL;
28033 diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
28034 index ab1162d..42587b2 100644
28035 --- a/drivers/gpu/drm/drm_info.c
28036 +++ b/drivers/gpu/drm/drm_info.c
28037 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
28038 struct drm_local_map *map;
28039 struct drm_map_list *r_list;
28041 - /* Hardcoded from _DRM_FRAME_BUFFER,
28042 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28043 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28044 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28045 + static const char * const types[] = {
28046 + [_DRM_FRAME_BUFFER] = "FB",
28047 + [_DRM_REGISTERS] = "REG",
28048 + [_DRM_SHM] = "SHM",
28049 + [_DRM_AGP] = "AGP",
28050 + [_DRM_SCATTER_GATHER] = "SG",
28051 + [_DRM_CONSISTENT] = "PCI",
28052 + [_DRM_GEM] = "GEM" };
28056 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
28060 - if (map->type < 0 || map->type > 5)
28061 + if (map->type >= ARRAY_SIZE(types))
28064 type = types[map->type];
28065 @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, void *data)
28066 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28067 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28068 vma->vm_flags & VM_IO ? 'i' : '-',
28069 +#ifdef CONFIG_GRKERNSEC_HIDESYM
28075 #if defined(__i386__)
28076 pgprot = pgprot_val(vma->vm_page_prot);
28077 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
28078 index 4a058c7..b42cd92 100644
28079 --- a/drivers/gpu/drm/drm_ioc32.c
28080 +++ b/drivers/gpu/drm/drm_ioc32.c
28081 @@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
28082 request = compat_alloc_user_space(nbytes);
28083 if (!access_ok(VERIFY_WRITE, request, nbytes))
28085 - list = (struct drm_buf_desc *) (request + 1);
28086 + list = (struct drm_buf_desc __user *) (request + 1);
28088 if (__put_user(count, &request->count)
28089 || __put_user(list, &request->list))
28090 @@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
28091 request = compat_alloc_user_space(nbytes);
28092 if (!access_ok(VERIFY_WRITE, request, nbytes))
28094 - list = (struct drm_buf_pub *) (request + 1);
28095 + list = (struct drm_buf_pub __user *) (request + 1);
28097 if (__put_user(count, &request->count)
28098 || __put_user(list, &request->list))
28099 diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
28100 index 904d7e9..ab88581 100644
28101 --- a/drivers/gpu/drm/drm_ioctl.c
28102 +++ b/drivers/gpu/drm/drm_ioctl.c
28103 @@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev, void *data,
28104 stats->data[i].value =
28105 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28107 - stats->data[i].value = atomic_read(&dev->counts[i]);
28108 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28109 stats->data[i].type = dev->types[i];
28112 diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
28113 index 632ae24..244cf4a 100644
28114 --- a/drivers/gpu/drm/drm_lock.c
28115 +++ b/drivers/gpu/drm/drm_lock.c
28116 @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28117 if (drm_lock_take(&master->lock, lock->context)) {
28118 master->lock.file_priv = file_priv;
28119 master->lock.lock_time = jiffies;
28120 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28121 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28122 break; /* Got lock */
28125 @@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
28129 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28130 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28132 if (drm_lock_free(&master->lock, lock->context)) {
28133 /* FIXME: Should really bail out here. */
28134 diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
28135 index 8f371e8..9f85d52 100644
28136 --- a/drivers/gpu/drm/i810/i810_dma.c
28137 +++ b/drivers/gpu/drm/i810/i810_dma.c
28138 @@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
28139 dma->buflist[vertex->idx],
28140 vertex->discard, vertex->used);
28142 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28143 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28144 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28145 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28146 sarea_priv->last_enqueue = dev_priv->counter - 1;
28147 sarea_priv->last_dispatch = (int)hw_status[5];
28149 @@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
28150 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28153 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28154 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28155 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28156 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28157 sarea_priv->last_enqueue = dev_priv->counter - 1;
28158 sarea_priv->last_dispatch = (int)hw_status[5];
28160 diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
28161 index c9339f4..f5e1b9d 100644
28162 --- a/drivers/gpu/drm/i810/i810_drv.h
28163 +++ b/drivers/gpu/drm/i810/i810_drv.h
28164 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28167 wait_queue_head_t irq_queue;
28168 - atomic_t irq_received;
28169 - atomic_t irq_emitted;
28170 + atomic_unchecked_t irq_received;
28171 + atomic_unchecked_t irq_emitted;
28174 } drm_i810_private_t;
28175 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
28176 index 3c395a5..02889c2 100644
28177 --- a/drivers/gpu/drm/i915/i915_debugfs.c
28178 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
28179 @@ -497,7 +497,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
28182 seq_printf(m, "Interrupts received: %d\n",
28183 - atomic_read(&dev_priv->irq_received));
28184 + atomic_read_unchecked(&dev_priv->irq_received));
28185 for (i = 0; i < I915_NUM_RINGS; i++) {
28186 if (IS_GEN6(dev) || IS_GEN7(dev)) {
28187 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
28188 @@ -1185,7 +1185,7 @@ static int i915_opregion(struct seq_file *m, void *unused)
28191 if (opregion->header)
28192 - seq_write(m, opregion->header, OPREGION_SIZE);
28193 + seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
28195 mutex_unlock(&dev->struct_mutex);
28197 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
28198 index 8a3942c..1b73bf1 100644
28199 --- a/drivers/gpu/drm/i915/i915_dma.c
28200 +++ b/drivers/gpu/drm/i915/i915_dma.c
28201 @@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
28204 spin_lock(&dev->count_lock);
28205 - can_switch = (dev->open_count == 0);
28206 + can_switch = (local_read(&dev->open_count) == 0);
28207 spin_unlock(&dev->count_lock);
28210 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
28211 index 7916bd9..7c17a0f 100644
28212 --- a/drivers/gpu/drm/i915/i915_drv.h
28213 +++ b/drivers/gpu/drm/i915/i915_drv.h
28214 @@ -222,7 +222,7 @@ struct drm_i915_display_funcs {
28215 /* render clock increase/decrease */
28216 /* display clock increase/decrease */
28217 /* pll clock increase/decrease */
28221 struct intel_device_info {
28223 @@ -305,7 +305,7 @@ typedef struct drm_i915_private {
28227 - atomic_t irq_received;
28228 + atomic_unchecked_t irq_received;
28230 /* protects the irq masks */
28231 spinlock_t irq_lock;
28232 @@ -882,7 +882,7 @@ struct drm_i915_gem_object {
28233 * will be page flipped away on the next vblank. When it
28234 * reaches 0, dev_priv->pending_flip_queue will be woken up.
28236 - atomic_t pending_flip;
28237 + atomic_unchecked_t pending_flip;
28240 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
28241 @@ -1262,7 +1262,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
28242 extern void intel_teardown_gmbus(struct drm_device *dev);
28243 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
28244 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
28245 -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28246 +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
28248 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
28250 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28251 index 4934cf8..1da9c84 100644
28252 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28253 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
28254 @@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
28255 i915_gem_clflush_object(obj);
28257 if (obj->base.pending_write_domain)
28258 - cd->flips |= atomic_read(&obj->pending_flip);
28259 + cd->flips |= atomic_read_unchecked(&obj->pending_flip);
28261 /* The actual obj->write_domain will be updated with
28262 * pending_write_domain after we emit the accumulated flush for all
28263 @@ -864,9 +864,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
28266 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
28268 + unsigned int count)
28273 for (i = 0; i < count; i++) {
28274 char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
28275 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
28276 index 73248d0..f7bac29 100644
28277 --- a/drivers/gpu/drm/i915/i915_irq.c
28278 +++ b/drivers/gpu/drm/i915/i915_irq.c
28279 @@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
28280 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
28281 struct drm_i915_master_private *master_priv;
28283 - atomic_inc(&dev_priv->irq_received);
28284 + atomic_inc_unchecked(&dev_priv->irq_received);
28286 /* disable master interrupt before clearing iir */
28287 de_ier = I915_READ(DEIER);
28288 @@ -565,7 +565,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
28289 struct drm_i915_master_private *master_priv;
28290 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
28292 - atomic_inc(&dev_priv->irq_received);
28293 + atomic_inc_unchecked(&dev_priv->irq_received);
28296 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
28297 @@ -1229,7 +1229,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
28298 int ret = IRQ_NONE, pipe;
28299 bool blc_event = false;
28301 - atomic_inc(&dev_priv->irq_received);
28302 + atomic_inc_unchecked(&dev_priv->irq_received);
28304 iir = I915_READ(IIR);
28306 @@ -1741,7 +1741,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
28308 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28310 - atomic_set(&dev_priv->irq_received, 0);
28311 + atomic_set_unchecked(&dev_priv->irq_received, 0);
28313 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28314 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28315 @@ -1905,7 +1905,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
28316 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
28319 - atomic_set(&dev_priv->irq_received, 0);
28320 + atomic_set_unchecked(&dev_priv->irq_received, 0);
28322 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
28323 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
28324 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
28325 index 07e7cf3..c75f312 100644
28326 --- a/drivers/gpu/drm/i915/intel_display.c
28327 +++ b/drivers/gpu/drm/i915/intel_display.c
28328 @@ -2205,7 +2205,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
28330 wait_event(dev_priv->pending_flip_queue,
28331 atomic_read(&dev_priv->mm.wedged) ||
28332 - atomic_read(&obj->pending_flip) == 0);
28333 + atomic_read_unchecked(&obj->pending_flip) == 0);
28335 /* Big Hammer, we also need to ensure that any pending
28336 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
28337 @@ -2826,7 +2826,7 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
28338 obj = to_intel_framebuffer(crtc->fb)->obj;
28339 dev_priv = crtc->dev->dev_private;
28340 wait_event(dev_priv->pending_flip_queue,
28341 - atomic_read(&obj->pending_flip) == 0);
28342 + atomic_read_unchecked(&obj->pending_flip) == 0);
28345 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
28346 @@ -6676,7 +6676,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
28348 atomic_clear_mask(1 << intel_crtc->plane,
28349 &obj->pending_flip.counter);
28350 - if (atomic_read(&obj->pending_flip) == 0)
28351 + if (atomic_read_unchecked(&obj->pending_flip) == 0)
28352 wake_up(&dev_priv->pending_flip_queue);
28354 schedule_work(&work->work);
28355 @@ -6965,7 +6965,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28356 /* Block clients from rendering to the new back buffer until
28357 * the flip occurs and the object is no longer visible.
28359 - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28360 + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28362 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
28364 @@ -6979,7 +6979,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
28368 - atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28369 + atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
28371 drm_gem_object_unreference(&work->old_fb_obj->base);
28372 drm_gem_object_unreference(&obj->base);
28373 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
28374 index 54558a0..2d97005 100644
28375 --- a/drivers/gpu/drm/mga/mga_drv.h
28376 +++ b/drivers/gpu/drm/mga/mga_drv.h
28377 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
28381 - atomic_t vbl_received; /**< Number of vblanks received. */
28382 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
28383 wait_queue_head_t fence_queue;
28384 - atomic_t last_fence_retired;
28385 + atomic_unchecked_t last_fence_retired;
28386 u32 next_fence_to_post;
28388 unsigned int fb_cpp;
28389 diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
28390 index 2581202..f230a8d9 100644
28391 --- a/drivers/gpu/drm/mga/mga_irq.c
28392 +++ b/drivers/gpu/drm/mga/mga_irq.c
28393 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
28397 - return atomic_read(&dev_priv->vbl_received);
28398 + return atomic_read_unchecked(&dev_priv->vbl_received);
28402 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28403 /* VBLANK interrupt */
28404 if (status & MGA_VLINEPEN) {
28405 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
28406 - atomic_inc(&dev_priv->vbl_received);
28407 + atomic_inc_unchecked(&dev_priv->vbl_received);
28408 drm_handle_vblank(dev, 0);
28411 @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
28412 if ((prim_start & ~0x03) != (prim_end & ~0x03))
28413 MGA_WRITE(MGA_PRIMEND, prim_end);
28415 - atomic_inc(&dev_priv->last_fence_retired);
28416 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
28417 DRM_WAKEUP(&dev_priv->fence_queue);
28420 @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
28423 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
28424 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
28425 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
28426 - *sequence) <= (1 << 23)));
28428 *sequence = cur_fence;
28429 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
28430 index b311fab..dc11d6a 100644
28431 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
28432 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
28433 @@ -201,7 +201,7 @@ struct methods {
28434 const char desc[8];
28435 void (*loadbios)(struct drm_device *, uint8_t *);
28440 static struct methods shadow_methods[] = {
28441 { "PRAMIN", load_vbios_pramin, true },
28442 @@ -5489,7 +5489,7 @@ parse_bit_displayport_tbl_entry(struct drm_device *dev, struct nvbios *bios,
28445 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
28449 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
28451 diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
28452 index d7d51de..7c6a7f1 100644
28453 --- a/drivers/gpu/drm/nouveau/nouveau_drv.h
28454 +++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
28455 @@ -238,7 +238,7 @@ struct nouveau_channel {
28456 struct list_head pending;
28458 uint32_t sequence_ack;
28459 - atomic_t last_sequence_irq;
28460 + atomic_unchecked_t last_sequence_irq;
28461 struct nouveau_vma vma;
28464 @@ -319,7 +319,7 @@ struct nouveau_exec_engine {
28465 u32 handle, u16 class);
28466 void (*set_tile_region)(struct drm_device *dev, int i);
28467 void (*tlb_flush)(struct drm_device *, int engine);
28471 struct nouveau_instmem_engine {
28473 @@ -341,13 +341,13 @@ struct nouveau_instmem_engine {
28474 struct nouveau_mc_engine {
28475 int (*init)(struct drm_device *dev);
28476 void (*takedown)(struct drm_device *dev);
28480 struct nouveau_timer_engine {
28481 int (*init)(struct drm_device *dev);
28482 void (*takedown)(struct drm_device *dev);
28483 uint64_t (*read)(struct drm_device *dev);
28487 struct nouveau_fb_engine {
28489 @@ -513,7 +513,7 @@ struct nouveau_vram_engine {
28490 void (*put)(struct drm_device *, struct nouveau_mem **);
28492 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
28496 struct nouveau_engine {
28497 struct nouveau_instmem_engine instmem;
28498 @@ -660,7 +660,7 @@ struct drm_nouveau_private {
28499 struct drm_global_reference mem_global_ref;
28500 struct ttm_bo_global_ref bo_global_ref;
28501 struct ttm_bo_device bdev;
28502 - atomic_t validate_sequence;
28503 + atomic_unchecked_t validate_sequence;
28507 diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
28508 index ae22dfa..4f09960 100644
28509 --- a/drivers/gpu/drm/nouveau/nouveau_fence.c
28510 +++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
28511 @@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_channel *chan)
28512 if (USE_REFCNT(dev))
28513 sequence = nvchan_rd32(chan, 0x48);
28515 - sequence = atomic_read(&chan->fence.last_sequence_irq);
28516 + sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
28518 if (chan->fence.sequence_ack == sequence)
28520 @@ -539,7 +539,7 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
28524 - atomic_set(&chan->fence.last_sequence_irq, 0);
28525 + atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
28529 diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
28530 index 5f0bc57..eb9fac8 100644
28531 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c
28532 +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
28533 @@ -314,7 +314,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
28537 - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
28538 + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
28540 if (++trycnt > 100000) {
28541 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
28542 diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
28543 index 10656e4..59bf2a4 100644
28544 --- a/drivers/gpu/drm/nouveau/nouveau_state.c
28545 +++ b/drivers/gpu/drm/nouveau/nouveau_state.c
28546 @@ -496,7 +496,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev)
28549 spin_lock(&dev->count_lock);
28550 - can_switch = (dev->open_count == 0);
28551 + can_switch = (local_read(&dev->open_count) == 0);
28552 spin_unlock(&dev->count_lock);
28555 diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c
28556 index dbdea8e..cd6eeeb 100644
28557 --- a/drivers/gpu/drm/nouveau/nv04_graph.c
28558 +++ b/drivers/gpu/drm/nouveau/nv04_graph.c
28559 @@ -554,7 +554,7 @@ static int
28560 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
28561 u32 class, u32 mthd, u32 data)
28563 - atomic_set(&chan->fence.last_sequence_irq, data);
28564 + atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
28568 diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
28569 index 570e190..084a31a 100644
28570 --- a/drivers/gpu/drm/r128/r128_cce.c
28571 +++ b/drivers/gpu/drm/r128/r128_cce.c
28572 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
28574 /* GH: Simple idle check.
28576 - atomic_set(&dev_priv->idle_count, 0);
28577 + atomic_set_unchecked(&dev_priv->idle_count, 0);
28579 /* We don't support anything other than bus-mastering ring mode,
28580 * but the ring can be in either AGP or PCI space for the ring
28581 diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
28582 index 930c71b..499aded 100644
28583 --- a/drivers/gpu/drm/r128/r128_drv.h
28584 +++ b/drivers/gpu/drm/r128/r128_drv.h
28585 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
28587 unsigned long cce_buffers_offset;
28589 - atomic_t idle_count;
28590 + atomic_unchecked_t idle_count;
28595 u32 crtc_offset_cntl;
28597 - atomic_t vbl_received;
28598 + atomic_unchecked_t vbl_received;
28601 unsigned int front_offset;
28602 diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
28603 index 429d5a0..7e899ed 100644
28604 --- a/drivers/gpu/drm/r128/r128_irq.c
28605 +++ b/drivers/gpu/drm/r128/r128_irq.c
28606 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
28610 - return atomic_read(&dev_priv->vbl_received);
28611 + return atomic_read_unchecked(&dev_priv->vbl_received);
28614 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28615 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
28616 /* VBLANK interrupt */
28617 if (status & R128_CRTC_VBLANK_INT) {
28618 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
28619 - atomic_inc(&dev_priv->vbl_received);
28620 + atomic_inc_unchecked(&dev_priv->vbl_received);
28621 drm_handle_vblank(dev, 0);
28622 return IRQ_HANDLED;
28624 diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
28625 index a9e33ce..09edd4b 100644
28626 --- a/drivers/gpu/drm/r128/r128_state.c
28627 +++ b/drivers/gpu/drm/r128/r128_state.c
28628 @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
28630 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
28632 - if (atomic_read(&dev_priv->idle_count) == 0)
28633 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
28634 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
28636 - atomic_set(&dev_priv->idle_count, 0);
28637 + atomic_set_unchecked(&dev_priv->idle_count, 0);
28641 diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
28642 index 14cc88a..cc7b3a5 100644
28643 --- a/drivers/gpu/drm/radeon/atom.c
28644 +++ b/drivers/gpu/drm/radeon/atom.c
28645 @@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
28649 + pax_track_stack();
28654 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
28655 index 5a82b6b..9e69c73 100644
28656 --- a/drivers/gpu/drm/radeon/mkregtable.c
28657 +++ b/drivers/gpu/drm/radeon/mkregtable.c
28658 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
28660 regmatch_t match[4];
28668 struct offset *offset;
28669 char last_reg_s[10];
28671 + unsigned long last_reg;
28674 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
28675 diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
28676 index 184628c..30e1725 100644
28677 --- a/drivers/gpu/drm/radeon/radeon.h
28678 +++ b/drivers/gpu/drm/radeon/radeon.h
28679 @@ -192,7 +192,7 @@ extern int sumo_get_temp(struct radeon_device *rdev);
28681 struct radeon_fence_driver {
28682 uint32_t scratch_reg;
28684 + atomic_unchecked_t seq;
28686 unsigned long last_jiffies;
28687 unsigned long last_timeout;
28688 @@ -962,7 +962,7 @@ struct radeon_asic {
28689 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
28690 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
28691 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
28697 diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
28698 index 285acc4..f4d909f 100644
28699 --- a/drivers/gpu/drm/radeon/radeon_atombios.c
28700 +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
28701 @@ -569,6 +569,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
28702 struct radeon_gpio_rec gpio;
28703 struct radeon_hpd hpd;
28705 + pax_track_stack();
28707 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
28710 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
28711 index b51e157..8f14fb9 100644
28712 --- a/drivers/gpu/drm/radeon/radeon_device.c
28713 +++ b/drivers/gpu/drm/radeon/radeon_device.c
28714 @@ -684,7 +684,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
28717 spin_lock(&dev->count_lock);
28718 - can_switch = (dev->open_count == 0);
28719 + can_switch = (local_read(&dev->open_count) == 0);
28720 spin_unlock(&dev->count_lock);
28723 diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
28724 index 07ac481..41cb437 100644
28725 --- a/drivers/gpu/drm/radeon/radeon_display.c
28726 +++ b/drivers/gpu/drm/radeon/radeon_display.c
28727 @@ -926,6 +926,8 @@ void radeon_compute_pll_legacy(struct radeon_pll *pll,
28729 u32 pll_out_min, pll_out_max;
28731 + pax_track_stack();
28733 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
28734 freq = freq * 1000;
28736 diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
28737 index a1b59ca..86f2d44 100644
28738 --- a/drivers/gpu/drm/radeon/radeon_drv.h
28739 +++ b/drivers/gpu/drm/radeon/radeon_drv.h
28740 @@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
28743 wait_queue_head_t swi_queue;
28744 - atomic_t swi_emitted;
28745 + atomic_unchecked_t swi_emitted;
28747 uint32_t irq_enable_reg;
28748 uint32_t r500_disp_irq_reg;
28749 diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
28750 index 7fd4e3e..9748ab5 100644
28751 --- a/drivers/gpu/drm/radeon/radeon_fence.c
28752 +++ b/drivers/gpu/drm/radeon/radeon_fence.c
28753 @@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
28754 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
28757 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
28758 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
28759 if (!rdev->cp.ready)
28760 /* FIXME: cp is not running assume everythings is done right
28762 @@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
28765 radeon_fence_write(rdev, 0);
28766 - atomic_set(&rdev->fence_drv.seq, 0);
28767 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
28768 INIT_LIST_HEAD(&rdev->fence_drv.created);
28769 INIT_LIST_HEAD(&rdev->fence_drv.emited);
28770 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
28771 diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
28772 index 48b7cea..342236f 100644
28773 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c
28774 +++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
28775 @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
28776 request = compat_alloc_user_space(sizeof(*request));
28777 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
28778 || __put_user(req32.param, &request->param)
28779 - || __put_user((void __user *)(unsigned long)req32.value,
28780 + || __put_user((unsigned long)req32.value,
28784 diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
28785 index 465746b..cb2b055 100644
28786 --- a/drivers/gpu/drm/radeon/radeon_irq.c
28787 +++ b/drivers/gpu/drm/radeon/radeon_irq.c
28788 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
28792 - atomic_inc(&dev_priv->swi_emitted);
28793 - ret = atomic_read(&dev_priv->swi_emitted);
28794 + atomic_inc_unchecked(&dev_priv->swi_emitted);
28795 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
28798 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
28799 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
28800 drm_radeon_private_t *dev_priv =
28801 (drm_radeon_private_t *) dev->dev_private;
28803 - atomic_set(&dev_priv->swi_emitted, 0);
28804 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
28805 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
28807 dev->max_vblank_count = 0x001fffff;
28808 diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
28809 index 92e7ea7..147ffad 100644
28810 --- a/drivers/gpu/drm/radeon/radeon_state.c
28811 +++ b/drivers/gpu/drm/radeon/radeon_state.c
28812 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
28813 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
28814 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
28816 - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28817 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
28818 sarea_priv->nbox * sizeof(depth_boxes[0])))
28821 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
28823 drm_radeon_private_t *dev_priv = dev->dev_private;
28824 drm_radeon_getparam_t *param = data;
28828 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
28830 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
28831 index 0b5468b..9c4b308 100644
28832 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
28833 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
28834 @@ -672,8 +672,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
28836 if (unlikely(ttm_vm_ops == NULL)) {
28837 ttm_vm_ops = vma->vm_ops;
28838 - radeon_ttm_vm_ops = *ttm_vm_ops;
28839 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28840 + pax_open_kernel();
28841 + memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
28842 + *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
28843 + pax_close_kernel();
28845 vma->vm_ops = &radeon_ttm_vm_ops;
28847 diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
28848 index a9049ed..501f284 100644
28849 --- a/drivers/gpu/drm/radeon/rs690.c
28850 +++ b/drivers/gpu/drm/radeon/rs690.c
28851 @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
28852 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
28853 rdev->pm.sideport_bandwidth.full)
28854 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
28855 - read_delay_latency.full = dfixed_const(370 * 800 * 1000);
28856 + read_delay_latency.full = dfixed_const(800 * 1000);
28857 read_delay_latency.full = dfixed_div(read_delay_latency,
28858 rdev->pm.igp_sideport_mclk);
28859 + a.full = dfixed_const(370);
28860 + read_delay_latency.full = dfixed_mul(read_delay_latency, a);
28862 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
28863 rdev->pm.k8_bandwidth.full)
28864 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28865 index 727e93d..1565650 100644
28866 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
28867 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
28868 @@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages(void)
28869 static int ttm_pool_mm_shrink(struct shrinker *shrink,
28870 struct shrink_control *sc)
28872 - static atomic_t start_pool = ATOMIC_INIT(0);
28873 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
28875 - unsigned pool_offset = atomic_add_return(1, &start_pool);
28876 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
28877 struct ttm_page_pool *pool;
28878 int shrink_pages = sc->nr_to_scan;
28880 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
28881 index 9cf87d9..2000b7d 100644
28882 --- a/drivers/gpu/drm/via/via_drv.h
28883 +++ b/drivers/gpu/drm/via/via_drv.h
28884 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
28885 typedef uint32_t maskarray_t[5];
28887 typedef struct drm_via_irq {
28888 - atomic_t irq_received;
28889 + atomic_unchecked_t irq_received;
28890 uint32_t pending_mask;
28891 uint32_t enable_mask;
28892 wait_queue_head_t irq_queue;
28893 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
28894 struct timeval last_vblank;
28895 int last_vblank_valid;
28896 unsigned usec_per_vblank;
28897 - atomic_t vbl_received;
28898 + atomic_unchecked_t vbl_received;
28899 drm_via_state_t hc_state;
28900 char pci_buf[VIA_PCI_BUF_SIZE];
28901 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
28902 diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
28903 index d391f48..10c8ca3 100644
28904 --- a/drivers/gpu/drm/via/via_irq.c
28905 +++ b/drivers/gpu/drm/via/via_irq.c
28906 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
28910 - return atomic_read(&dev_priv->vbl_received);
28911 + return atomic_read_unchecked(&dev_priv->vbl_received);
28914 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28915 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28917 status = VIA_READ(VIA_REG_INTERRUPT);
28918 if (status & VIA_IRQ_VBLANK_PENDING) {
28919 - atomic_inc(&dev_priv->vbl_received);
28920 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
28921 + atomic_inc_unchecked(&dev_priv->vbl_received);
28922 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
28923 do_gettimeofday(&cur_vblank);
28924 if (dev_priv->last_vblank_valid) {
28925 dev_priv->usec_per_vblank =
28926 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28927 dev_priv->last_vblank = cur_vblank;
28928 dev_priv->last_vblank_valid = 1;
28930 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
28931 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
28932 DRM_DEBUG("US per vblank is: %u\n",
28933 dev_priv->usec_per_vblank);
28935 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
28937 for (i = 0; i < dev_priv->num_irqs; ++i) {
28938 if (status & cur_irq->pending_mask) {
28939 - atomic_inc(&cur_irq->irq_received);
28940 + atomic_inc_unchecked(&cur_irq->irq_received);
28941 DRM_WAKEUP(&cur_irq->irq_queue);
28943 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
28944 @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
28945 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28946 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
28948 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
28949 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
28951 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
28952 (((cur_irq_sequence =
28953 - atomic_read(&cur_irq->irq_received)) -
28954 + atomic_read_unchecked(&cur_irq->irq_received)) -
28955 *sequence) <= (1 << 23)));
28957 *sequence = cur_irq_sequence;
28958 @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
28961 for (i = 0; i < dev_priv->num_irqs; ++i) {
28962 - atomic_set(&cur_irq->irq_received, 0);
28963 + atomic_set_unchecked(&cur_irq->irq_received, 0);
28964 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
28965 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
28966 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
28967 @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
28968 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
28969 case VIA_IRQ_RELATIVE:
28970 irqwait->request.sequence +=
28971 - atomic_read(&cur_irq->irq_received);
28972 + atomic_read_unchecked(&cur_irq->irq_received);
28973 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
28974 case VIA_IRQ_ABSOLUTE:
28976 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28977 index 10fc01f..b4e9822 100644
28978 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28979 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
28980 @@ -240,7 +240,7 @@ struct vmw_private {
28981 * Fencing and IRQs.
28984 - atomic_t fence_seq;
28985 + atomic_unchecked_t fence_seq;
28986 wait_queue_head_t fence_queue;
28987 wait_queue_head_t fifo_queue;
28988 atomic_t fence_queue_waiters;
28989 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28990 index 41b95ed..69ea504 100644
28991 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28992 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
28993 @@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
28994 struct drm_vmw_fence_rep fence_rep;
28995 struct drm_vmw_fence_rep __user *user_fence_rep;
28998 + void __user *user_cmd;
29001 struct vmw_sw_context *sw_context = &dev_priv->ctx;
29002 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29003 index 61eacc1..ee38ce8 100644
29004 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29005 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29006 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
29007 while (!vmw_lag_lt(queue, us)) {
29008 spin_lock(&queue->lock);
29009 if (list_empty(&queue->head))
29010 - sequence = atomic_read(&dev_priv->fence_seq);
29011 + sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29013 fence = list_first_entry(&queue->head,
29014 struct vmw_fence, head);
29015 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29016 index 635c0ff..2641bbb 100644
29017 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29018 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29019 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
29020 (unsigned int) min,
29021 (unsigned int) fifo->capabilities);
29023 - atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29024 + atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29025 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29026 vmw_fence_queue_init(&fifo->fence_queue);
29027 return vmw_fifo_send_fence(dev_priv, &dummy);
29028 @@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
29030 iowrite32(bytes, fifo_mem +
29031 SVGA_FIFO_RESERVED);
29032 - return fifo_mem + (next_cmd >> 2);
29033 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
29035 need_bounce = true;
29037 @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29039 fm = vmw_fifo_reserve(dev_priv, bytes);
29040 if (unlikely(fm == NULL)) {
29041 - *sequence = atomic_read(&dev_priv->fence_seq);
29042 + *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29044 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29046 @@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
29050 - *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29051 + *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29052 } while (*sequence == 0);
29054 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29055 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29056 index e92298a..f68f2d6 100644
29057 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29058 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29059 @@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
29060 * emitted. Then the fence is stale and signaled.
29063 - ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29064 + ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29068 @@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
29071 down_read(&fifo_state->rwsem);
29072 - signal_seq = atomic_read(&dev_priv->fence_seq);
29073 + signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29077 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29078 index dfe32e6..dd18a00 100644
29079 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29080 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
29081 @@ -843,7 +843,6 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29082 struct vmw_framebuffer *vfb = NULL;
29083 struct vmw_surface *surface = NULL;
29084 struct vmw_dma_buffer *bo = NULL;
29085 - u64 required_size;
29089 @@ -852,8 +851,9 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
29090 * requested framebuffer.
29093 - required_size = mode_cmd->pitch * mode_cmd->height;
29094 - if (unlikely(required_size > (u64) dev_priv->vram_size)) {
29095 + if (!vmw_kms_validate_mode_vram(dev_priv,
29097 + mode_cmd->height)) {
29098 DRM_ERROR("VRAM size is too small for requested mode.\n");
29101 diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
29102 index c72f1c0..18376f1 100644
29103 --- a/drivers/gpu/vga/vgaarb.c
29104 +++ b/drivers/gpu/vga/vgaarb.c
29105 @@ -993,14 +993,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
29106 uc = &priv->cards[i];
29112 + ret_val = -EINVAL;
29116 - if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
29118 + if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
29119 + ret_val = -EINVAL;
29123 - if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
29125 + if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
29126 + ret_val = -EINVAL;
29130 vga_put(pdev, io_state);
29132 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
29133 index f26ae31..721fe1b 100644
29134 --- a/drivers/hid/hid-core.c
29135 +++ b/drivers/hid/hid-core.c
29136 @@ -1951,7 +1951,7 @@ static bool hid_ignore(struct hid_device *hdev)
29138 int hid_add_device(struct hid_device *hdev)
29140 - static atomic_t id = ATOMIC_INIT(0);
29141 + static atomic_unchecked_t id = ATOMIC_INIT(0);
29144 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29145 @@ -1966,7 +1966,7 @@ int hid_add_device(struct hid_device *hdev)
29146 /* XXX hack, any other cleaner solution after the driver core
29147 * is converted to allow more than 20 bytes as the device name? */
29148 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29149 - hdev->vendor, hdev->product, atomic_inc_return(&id));
29150 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29152 hid_debug_register(hdev, dev_name(&hdev->dev));
29153 ret = device_add(&hdev->dev);
29154 diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
29155 index 7c1188b..5a64357 100644
29156 --- a/drivers/hid/usbhid/hiddev.c
29157 +++ b/drivers/hid/usbhid/hiddev.c
29158 @@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
29161 case HIDIOCAPPLICATION:
29162 - if (arg < 0 || arg >= hid->maxapplication)
29163 + if (arg >= hid->maxapplication)
29166 for (i = 0; i < hid->maxcollection; i++)
29167 diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
29168 index 66f6729..2d6de0a 100644
29169 --- a/drivers/hwmon/acpi_power_meter.c
29170 +++ b/drivers/hwmon/acpi_power_meter.c
29171 @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
29178 mutex_lock(&resource->lock);
29179 resource->trip[attr->index - 7] = temp;
29180 diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
29181 index fe4104c..346febb 100644
29182 --- a/drivers/hwmon/sht15.c
29183 +++ b/drivers/hwmon/sht15.c
29184 @@ -166,7 +166,7 @@ struct sht15_data {
29186 bool supply_uV_valid;
29187 struct work_struct update_supply_work;
29188 - atomic_t interrupt_handled;
29189 + atomic_unchecked_t interrupt_handled;
29193 @@ -509,13 +509,13 @@ static int sht15_measurement(struct sht15_data *data,
29196 gpio_direction_input(data->pdata->gpio_data);
29197 - atomic_set(&data->interrupt_handled, 0);
29198 + atomic_set_unchecked(&data->interrupt_handled, 0);
29200 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29201 if (gpio_get_value(data->pdata->gpio_data) == 0) {
29202 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
29203 /* Only relevant if the interrupt hasn't occurred. */
29204 - if (!atomic_read(&data->interrupt_handled))
29205 + if (!atomic_read_unchecked(&data->interrupt_handled))
29206 schedule_work(&data->read_work);
29208 ret = wait_event_timeout(data->wait_queue,
29209 @@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
29211 /* First disable the interrupt */
29212 disable_irq_nosync(irq);
29213 - atomic_inc(&data->interrupt_handled);
29214 + atomic_inc_unchecked(&data->interrupt_handled);
29215 /* Then schedule a reading work struct */
29216 if (data->state != SHT15_READING_NOTHING)
29217 schedule_work(&data->read_work);
29218 @@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
29219 * If not, then start the interrupt again - care here as could
29220 * have gone low in meantime so verify it hasn't!
29222 - atomic_set(&data->interrupt_handled, 0);
29223 + atomic_set_unchecked(&data->interrupt_handled, 0);
29224 enable_irq(gpio_to_irq(data->pdata->gpio_data));
29225 /* If still not occurred or another handler has been scheduled */
29226 if (gpio_get_value(data->pdata->gpio_data)
29227 - || atomic_read(&data->interrupt_handled))
29228 + || atomic_read_unchecked(&data->interrupt_handled))
29232 diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
29233 index 378fcb5..5e91fa8 100644
29234 --- a/drivers/i2c/busses/i2c-amd756-s4882.c
29235 +++ b/drivers/i2c/busses/i2c-amd756-s4882.c
29237 extern struct i2c_adapter amd756_smbus;
29239 static struct i2c_adapter *s4882_adapter;
29240 -static struct i2c_algorithm *s4882_algo;
29241 +static i2c_algorithm_no_const *s4882_algo;
29243 /* Wrapper access functions for multiplexed SMBus */
29244 static DEFINE_MUTEX(amd756_lock);
29245 diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
29246 index 29015eb..af2d8e9 100644
29247 --- a/drivers/i2c/busses/i2c-nforce2-s4985.c
29248 +++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
29250 extern struct i2c_adapter *nforce2_smbus;
29252 static struct i2c_adapter *s4985_adapter;
29253 -static struct i2c_algorithm *s4985_algo;
29254 +static i2c_algorithm_no_const *s4985_algo;
29256 /* Wrapper access functions for multiplexed SMBus */
29257 static DEFINE_MUTEX(nforce2_lock);
29258 diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
29259 index d7a4833..7fae376 100644
29260 --- a/drivers/i2c/i2c-mux.c
29261 +++ b/drivers/i2c/i2c-mux.c
29263 /* multiplexer per channel data */
29264 struct i2c_mux_priv {
29265 struct i2c_adapter adap;
29266 - struct i2c_algorithm algo;
29267 + i2c_algorithm_no_const algo;
29269 struct i2c_adapter *parent;
29270 void *mux_dev; /* the mux chip/device */
29271 diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
29272 index 57d00ca..0145194 100644
29273 --- a/drivers/ide/aec62xx.c
29274 +++ b/drivers/ide/aec62xx.c
29275 @@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_port_ops = {
29276 .cable_detect = atp86x_cable_detect,
29279 -static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
29280 +static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
29283 .init_chipset = init_chipset_aec62xx,
29284 diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
29285 index 2c8016a..911a27c 100644
29286 --- a/drivers/ide/alim15x3.c
29287 +++ b/drivers/ide/alim15x3.c
29288 @@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_ops = {
29289 .dma_sff_read_status = ide_dma_sff_read_status,
29292 -static const struct ide_port_info ali15x3_chipset __devinitdata = {
29293 +static const struct ide_port_info ali15x3_chipset __devinitconst = {
29295 .init_chipset = init_chipset_ali15x3,
29296 .init_hwif = init_hwif_ali15x3,
29297 diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
29298 index 3747b25..56fc995 100644
29299 --- a/drivers/ide/amd74xx.c
29300 +++ b/drivers/ide/amd74xx.c
29301 @@ -223,7 +223,7 @@ static const struct ide_port_ops amd_port_ops = {
29302 .udma_mask = udma, \
29305 -static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
29306 +static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
29307 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
29308 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
29309 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
29310 diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
29311 index 15f0ead..cb43480 100644
29312 --- a/drivers/ide/atiixp.c
29313 +++ b/drivers/ide/atiixp.c
29314 @@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_port_ops = {
29315 .cable_detect = atiixp_cable_detect,
29318 -static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
29319 +static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
29320 { /* 0: IXP200/300/400/700 */
29322 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
29323 diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
29324 index 5f80312..d1fc438 100644
29325 --- a/drivers/ide/cmd64x.c
29326 +++ b/drivers/ide/cmd64x.c
29327 @@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
29328 .dma_sff_read_status = ide_dma_sff_read_status,
29331 -static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
29332 +static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
29335 .init_chipset = init_chipset_cmd64x,
29336 diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
29337 index 2c1e5f7..1444762 100644
29338 --- a/drivers/ide/cs5520.c
29339 +++ b/drivers/ide/cs5520.c
29340 @@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_port_ops = {
29341 .set_dma_mode = cs5520_set_dma_mode,
29344 -static const struct ide_port_info cyrix_chipset __devinitdata = {
29345 +static const struct ide_port_info cyrix_chipset __devinitconst = {
29347 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
29348 .port_ops = &cs5520_port_ops,
29349 diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
29350 index 4dc4eb9..49b40ad 100644
29351 --- a/drivers/ide/cs5530.c
29352 +++ b/drivers/ide/cs5530.c
29353 @@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_port_ops = {
29354 .udma_filter = cs5530_udma_filter,
29357 -static const struct ide_port_info cs5530_chipset __devinitdata = {
29358 +static const struct ide_port_info cs5530_chipset __devinitconst = {
29360 .init_chipset = init_chipset_cs5530,
29361 .init_hwif = init_hwif_cs5530,
29362 diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
29363 index 5059faf..18d4c85 100644
29364 --- a/drivers/ide/cs5535.c
29365 +++ b/drivers/ide/cs5535.c
29366 @@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
29367 .cable_detect = cs5535_cable_detect,
29370 -static const struct ide_port_info cs5535_chipset __devinitdata = {
29371 +static const struct ide_port_info cs5535_chipset __devinitconst = {
29373 .port_ops = &cs5535_port_ops,
29374 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
29375 diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
29376 index 67cbcfa..37ea151 100644
29377 --- a/drivers/ide/cy82c693.c
29378 +++ b/drivers/ide/cy82c693.c
29379 @@ -163,7 +163,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
29380 .set_dma_mode = cy82c693_set_dma_mode,
29383 -static const struct ide_port_info cy82c693_chipset __devinitdata = {
29384 +static const struct ide_port_info cy82c693_chipset __devinitconst = {
29386 .init_iops = init_iops_cy82c693,
29387 .port_ops = &cy82c693_port_ops,
29388 diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
29389 index 58c51cd..4aec3b8 100644
29390 --- a/drivers/ide/hpt366.c
29391 +++ b/drivers/ide/hpt366.c
29392 @@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings = {
29396 -static const struct hpt_info hpt36x __devinitdata = {
29397 +static const struct hpt_info hpt36x __devinitconst = {
29398 .chip_name = "HPT36x",
29399 .chip_type = HPT36x,
29400 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
29401 @@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __devinitdata = {
29402 .timings = &hpt36x_timings
29405 -static const struct hpt_info hpt370 __devinitdata = {
29406 +static const struct hpt_info hpt370 __devinitconst = {
29407 .chip_name = "HPT370",
29408 .chip_type = HPT370,
29409 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29410 @@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __devinitdata = {
29411 .timings = &hpt37x_timings
29414 -static const struct hpt_info hpt370a __devinitdata = {
29415 +static const struct hpt_info hpt370a __devinitconst = {
29416 .chip_name = "HPT370A",
29417 .chip_type = HPT370A,
29418 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
29419 @@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __devinitdata = {
29420 .timings = &hpt37x_timings
29423 -static const struct hpt_info hpt374 __devinitdata = {
29424 +static const struct hpt_info hpt374 __devinitconst = {
29425 .chip_name = "HPT374",
29426 .chip_type = HPT374,
29427 .udma_mask = ATA_UDMA5,
29428 @@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __devinitdata = {
29429 .timings = &hpt37x_timings
29432 -static const struct hpt_info hpt372 __devinitdata = {
29433 +static const struct hpt_info hpt372 __devinitconst = {
29434 .chip_name = "HPT372",
29435 .chip_type = HPT372,
29436 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29437 @@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __devinitdata = {
29438 .timings = &hpt37x_timings
29441 -static const struct hpt_info hpt372a __devinitdata = {
29442 +static const struct hpt_info hpt372a __devinitconst = {
29443 .chip_name = "HPT372A",
29444 .chip_type = HPT372A,
29445 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29446 @@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __devinitdata = {
29447 .timings = &hpt37x_timings
29450 -static const struct hpt_info hpt302 __devinitdata = {
29451 +static const struct hpt_info hpt302 __devinitconst = {
29452 .chip_name = "HPT302",
29453 .chip_type = HPT302,
29454 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29455 @@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __devinitdata = {
29456 .timings = &hpt37x_timings
29459 -static const struct hpt_info hpt371 __devinitdata = {
29460 +static const struct hpt_info hpt371 __devinitconst = {
29461 .chip_name = "HPT371",
29462 .chip_type = HPT371,
29463 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29464 @@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __devinitdata = {
29465 .timings = &hpt37x_timings
29468 -static const struct hpt_info hpt372n __devinitdata = {
29469 +static const struct hpt_info hpt372n __devinitconst = {
29470 .chip_name = "HPT372N",
29471 .chip_type = HPT372N,
29472 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29473 @@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __devinitdata = {
29474 .timings = &hpt37x_timings
29477 -static const struct hpt_info hpt302n __devinitdata = {
29478 +static const struct hpt_info hpt302n __devinitconst = {
29479 .chip_name = "HPT302N",
29480 .chip_type = HPT302N,
29481 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29482 @@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __devinitdata = {
29483 .timings = &hpt37x_timings
29486 -static const struct hpt_info hpt371n __devinitdata = {
29487 +static const struct hpt_info hpt371n __devinitconst = {
29488 .chip_name = "HPT371N",
29489 .chip_type = HPT371N,
29490 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
29491 @@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
29492 .dma_sff_read_status = ide_dma_sff_read_status,
29495 -static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
29496 +static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
29499 .init_chipset = init_chipset_hpt366,
29500 diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
29501 index 04b0956..f5b47dc 100644
29502 --- a/drivers/ide/ide-cd.c
29503 +++ b/drivers/ide/ide-cd.c
29504 @@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
29505 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
29506 if ((unsigned long)buf & alignment
29507 || blk_rq_bytes(rq) & q->dma_pad_mask
29508 - || object_is_on_stack(buf))
29509 + || object_starts_on_stack(buf))
29513 diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
29514 index 61fdf54..2834ea6 100644
29515 --- a/drivers/ide/ide-floppy.c
29516 +++ b/drivers/ide/ide-floppy.c
29517 @@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
29518 u8 pc_buf[256], header_len, desc_cnt;
29519 int i, rc = 1, blocks, length;
29521 + pax_track_stack();
29523 ide_debug_log(IDE_DBG_FUNC, "enter");
29525 drive->bios_cyl = 0;
29526 diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
29527 index a743e68..1cfd674 100644
29528 --- a/drivers/ide/ide-pci-generic.c
29529 +++ b/drivers/ide/ide-pci-generic.c
29530 @@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
29531 .udma_mask = ATA_UDMA6, \
29534 -static const struct ide_port_info generic_chipsets[] __devinitdata = {
29535 +static const struct ide_port_info generic_chipsets[] __devinitconst = {
29537 DECLARE_GENERIC_PCI_DEV(0),
29539 diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
29540 index 560e66d..d5dd180 100644
29541 --- a/drivers/ide/it8172.c
29542 +++ b/drivers/ide/it8172.c
29543 @@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
29544 .set_dma_mode = it8172_set_dma_mode,
29547 -static const struct ide_port_info it8172_port_info __devinitdata = {
29548 +static const struct ide_port_info it8172_port_info __devinitconst = {
29550 .port_ops = &it8172_port_ops,
29551 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
29552 diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
29553 index 46816ba..1847aeb 100644
29554 --- a/drivers/ide/it8213.c
29555 +++ b/drivers/ide/it8213.c
29556 @@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
29557 .cable_detect = it8213_cable_detect,
29560 -static const struct ide_port_info it8213_chipset __devinitdata = {
29561 +static const struct ide_port_info it8213_chipset __devinitconst = {
29563 .enablebits = { {0x41, 0x80, 0x80} },
29564 .port_ops = &it8213_port_ops,
29565 diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
29566 index 2e3169f..c5611db 100644
29567 --- a/drivers/ide/it821x.c
29568 +++ b/drivers/ide/it821x.c
29569 @@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_port_ops = {
29570 .cable_detect = it821x_cable_detect,
29573 -static const struct ide_port_info it821x_chipset __devinitdata = {
29574 +static const struct ide_port_info it821x_chipset __devinitconst = {
29576 .init_chipset = init_chipset_it821x,
29577 .init_hwif = init_hwif_it821x,
29578 diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
29579 index 74c2c4a..efddd7d 100644
29580 --- a/drivers/ide/jmicron.c
29581 +++ b/drivers/ide/jmicron.c
29582 @@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
29583 .cable_detect = jmicron_cable_detect,
29586 -static const struct ide_port_info jmicron_chipset __devinitdata = {
29587 +static const struct ide_port_info jmicron_chipset __devinitconst = {
29589 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
29590 .port_ops = &jmicron_port_ops,
29591 diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
29592 index 95327a2..73f78d8 100644
29593 --- a/drivers/ide/ns87415.c
29594 +++ b/drivers/ide/ns87415.c
29595 @@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
29596 .dma_sff_read_status = superio_dma_sff_read_status,
29599 -static const struct ide_port_info ns87415_chipset __devinitdata = {
29600 +static const struct ide_port_info ns87415_chipset __devinitconst = {
29602 .init_hwif = init_hwif_ns87415,
29603 .tp_ops = &ns87415_tp_ops,
29604 diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
29605 index 1a53a4c..39edc66 100644
29606 --- a/drivers/ide/opti621.c
29607 +++ b/drivers/ide/opti621.c
29608 @@ -131,7 +131,7 @@ static const struct ide_port_ops opti621_port_ops = {
29609 .set_pio_mode = opti621_set_pio_mode,
29612 -static const struct ide_port_info opti621_chipset __devinitdata = {
29613 +static const struct ide_port_info opti621_chipset __devinitconst = {
29615 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
29616 .port_ops = &opti621_port_ops,
29617 diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
29618 index 9546fe2..2e5ceb6 100644
29619 --- a/drivers/ide/pdc202xx_new.c
29620 +++ b/drivers/ide/pdc202xx_new.c
29621 @@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
29622 .udma_mask = udma, \
29625 -static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
29626 +static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
29627 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
29628 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
29630 diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
29631 index 3a35ec6..5634510 100644
29632 --- a/drivers/ide/pdc202xx_old.c
29633 +++ b/drivers/ide/pdc202xx_old.c
29634 @@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
29635 .max_sectors = sectors, \
29638 -static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
29639 +static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
29640 { /* 0: PDC20246 */
29642 .init_chipset = init_chipset_pdc202xx,
29643 diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
29644 index b59d04c..368c2a7 100644
29645 --- a/drivers/ide/piix.c
29646 +++ b/drivers/ide/piix.c
29647 @@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
29648 .udma_mask = udma, \
29651 -static const struct ide_port_info piix_pci_info[] __devinitdata = {
29652 +static const struct ide_port_info piix_pci_info[] __devinitconst = {
29655 * MPIIX actually has only a single IDE channel mapped to
29656 diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
29657 index a6414a8..c04173e 100644
29658 --- a/drivers/ide/rz1000.c
29659 +++ b/drivers/ide/rz1000.c
29660 @@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
29664 -static const struct ide_port_info rz1000_chipset __devinitdata = {
29665 +static const struct ide_port_info rz1000_chipset __devinitconst = {
29667 .host_flags = IDE_HFLAG_NO_DMA,
29669 diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
29670 index 356b9b5..d4758eb 100644
29671 --- a/drivers/ide/sc1200.c
29672 +++ b/drivers/ide/sc1200.c
29673 @@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
29674 .dma_sff_read_status = ide_dma_sff_read_status,
29677 -static const struct ide_port_info sc1200_chipset __devinitdata = {
29678 +static const struct ide_port_info sc1200_chipset __devinitconst = {
29680 .port_ops = &sc1200_port_ops,
29681 .dma_ops = &sc1200_dma_ops,
29682 diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
29683 index b7f5b0c..9701038 100644
29684 --- a/drivers/ide/scc_pata.c
29685 +++ b/drivers/ide/scc_pata.c
29686 @@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
29687 .dma_sff_read_status = scc_dma_sff_read_status,
29690 -static const struct ide_port_info scc_chipset __devinitdata = {
29691 +static const struct ide_port_info scc_chipset __devinitconst = {
29693 .init_iops = init_iops_scc,
29694 .init_dma = scc_init_dma,
29695 diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
29696 index 35fb8da..24d72ef 100644
29697 --- a/drivers/ide/serverworks.c
29698 +++ b/drivers/ide/serverworks.c
29699 @@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_port_ops = {
29700 .cable_detect = svwks_cable_detect,
29703 -static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
29704 +static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
29707 .init_chipset = init_chipset_svwks,
29708 diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
29709 index ab3db61..afed580 100644
29710 --- a/drivers/ide/setup-pci.c
29711 +++ b/drivers/ide/setup-pci.c
29712 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
29713 int ret, i, n_ports = dev2 ? 4 : 2;
29714 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
29716 + pax_track_stack();
29718 for (i = 0; i < n_ports / 2; i++) {
29719 ret = ide_setup_pci_controller(pdev[i], d, !i);
29721 diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
29722 index ddeda44..46f7e30 100644
29723 --- a/drivers/ide/siimage.c
29724 +++ b/drivers/ide/siimage.c
29725 @@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
29726 .udma_mask = ATA_UDMA6, \
29729 -static const struct ide_port_info siimage_chipsets[] __devinitdata = {
29730 +static const struct ide_port_info siimage_chipsets[] __devinitconst = {
29731 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
29732 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
29734 diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
29735 index 4a00225..09e61b4 100644
29736 --- a/drivers/ide/sis5513.c
29737 +++ b/drivers/ide/sis5513.c
29738 @@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
29739 .cable_detect = sis_cable_detect,
29742 -static const struct ide_port_info sis5513_chipset __devinitdata = {
29743 +static const struct ide_port_info sis5513_chipset __devinitconst = {
29745 .init_chipset = init_chipset_sis5513,
29746 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
29747 diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
29748 index f21dc2a..d051cd2 100644
29749 --- a/drivers/ide/sl82c105.c
29750 +++ b/drivers/ide/sl82c105.c
29751 @@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
29752 .dma_sff_read_status = ide_dma_sff_read_status,
29755 -static const struct ide_port_info sl82c105_chipset __devinitdata = {
29756 +static const struct ide_port_info sl82c105_chipset __devinitconst = {
29758 .init_chipset = init_chipset_sl82c105,
29759 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
29760 diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
29761 index 864ffe0..863a5e9 100644
29762 --- a/drivers/ide/slc90e66.c
29763 +++ b/drivers/ide/slc90e66.c
29764 @@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
29765 .cable_detect = slc90e66_cable_detect,
29768 -static const struct ide_port_info slc90e66_chipset __devinitdata = {
29769 +static const struct ide_port_info slc90e66_chipset __devinitconst = {
29771 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
29772 .port_ops = &slc90e66_port_ops,
29773 diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
29774 index e444d24..ba577de 100644
29775 --- a/drivers/ide/tc86c001.c
29776 +++ b/drivers/ide/tc86c001.c
29777 @@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
29778 .dma_sff_read_status = ide_dma_sff_read_status,
29781 -static const struct ide_port_info tc86c001_chipset __devinitdata = {
29782 +static const struct ide_port_info tc86c001_chipset __devinitconst = {
29784 .init_hwif = init_hwif_tc86c001,
29785 .port_ops = &tc86c001_port_ops,
29786 diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
29787 index e53a1b7..d11aff7 100644
29788 --- a/drivers/ide/triflex.c
29789 +++ b/drivers/ide/triflex.c
29790 @@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
29791 .set_dma_mode = triflex_set_mode,
29794 -static const struct ide_port_info triflex_device __devinitdata = {
29795 +static const struct ide_port_info triflex_device __devinitconst = {
29797 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
29798 .port_ops = &triflex_port_ops,
29799 diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
29800 index 4b42ca0..e494a98 100644
29801 --- a/drivers/ide/trm290.c
29802 +++ b/drivers/ide/trm290.c
29803 @@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
29804 .dma_check = trm290_dma_check,
29807 -static const struct ide_port_info trm290_chipset __devinitdata = {
29808 +static const struct ide_port_info trm290_chipset __devinitconst = {
29810 .init_hwif = init_hwif_trm290,
29811 .tp_ops = &trm290_tp_ops,
29812 diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
29813 index f46f49c..eb77678 100644
29814 --- a/drivers/ide/via82cxxx.c
29815 +++ b/drivers/ide/via82cxxx.c
29816 @@ -403,7 +403,7 @@ static const struct ide_port_ops via_port_ops = {
29817 .cable_detect = via82cxxx_cable_detect,
29820 -static const struct ide_port_info via82cxxx_chipset __devinitdata = {
29821 +static const struct ide_port_info via82cxxx_chipset __devinitconst = {
29823 .init_chipset = init_chipset_via82cxxx,
29824 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
29825 diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
29826 index fc0f2bd..ac2f8a5 100644
29827 --- a/drivers/infiniband/core/cm.c
29828 +++ b/drivers/infiniband/core/cm.c
29829 @@ -113,7 +113,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
29831 struct cm_counter_group {
29832 struct kobject obj;
29833 - atomic_long_t counter[CM_ATTR_COUNT];
29834 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
29837 struct cm_counter_attribute {
29838 @@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm_work *work,
29839 struct ib_mad_send_buf *msg = NULL;
29842 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29843 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29844 counter[CM_REQ_COUNTER]);
29846 /* Quick state check to discard duplicate REQs. */
29847 @@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
29851 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29852 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29853 counter[CM_REP_COUNTER]);
29854 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
29856 @@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work *work)
29857 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
29858 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
29859 spin_unlock_irq(&cm_id_priv->lock);
29860 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29861 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29862 counter[CM_RTU_COUNTER]);
29865 @@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_work *work)
29866 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
29867 dreq_msg->local_comm_id);
29869 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29870 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29871 counter[CM_DREQ_COUNTER]);
29872 cm_issue_drep(work->port, work->mad_recv_wc);
29874 @@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_work *work)
29875 case IB_CM_MRA_REP_RCVD:
29877 case IB_CM_TIMEWAIT:
29878 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29879 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29880 counter[CM_DREQ_COUNTER]);
29881 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29883 @@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_work *work)
29886 case IB_CM_DREQ_RCVD:
29887 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29888 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29889 counter[CM_DREQ_COUNTER]);
29892 @@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work *work)
29893 ib_modify_mad(cm_id_priv->av.port->mad_agent,
29894 cm_id_priv->msg, timeout)) {
29895 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
29896 - atomic_long_inc(&work->port->
29897 + atomic_long_inc_unchecked(&work->port->
29898 counter_group[CM_RECV_DUPLICATES].
29899 counter[CM_MRA_COUNTER]);
29901 @@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work *work)
29903 case IB_CM_MRA_REQ_RCVD:
29904 case IB_CM_MRA_REP_RCVD:
29905 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29906 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29907 counter[CM_MRA_COUNTER]);
29910 @@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work *work)
29911 case IB_CM_LAP_IDLE:
29913 case IB_CM_MRA_LAP_SENT:
29914 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29915 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29916 counter[CM_LAP_COUNTER]);
29917 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
29919 @@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work *work)
29922 case IB_CM_LAP_RCVD:
29923 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29924 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29925 counter[CM_LAP_COUNTER]);
29928 @@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
29929 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
29930 if (cur_cm_id_priv) {
29931 spin_unlock_irq(&cm.lock);
29932 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
29933 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
29934 counter[CM_SIDR_REQ_COUNTER]);
29935 goto out; /* Duplicate message. */
29937 @@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
29938 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
29941 - atomic_long_add(1 + msg->retries,
29942 + atomic_long_add_unchecked(1 + msg->retries,
29943 &port->counter_group[CM_XMIT].counter[attr_index]);
29945 - atomic_long_add(msg->retries,
29946 + atomic_long_add_unchecked(msg->retries,
29947 &port->counter_group[CM_XMIT_RETRIES].
29948 counter[attr_index]);
29950 @@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
29953 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
29954 - atomic_long_inc(&port->counter_group[CM_RECV].
29955 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
29956 counter[attr_id - CM_ATTR_ID_OFFSET]);
29958 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
29959 @@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
29960 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
29962 return sprintf(buf, "%ld\n",
29963 - atomic_long_read(&group->counter[cm_attr->index]));
29964 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
29967 static const struct sysfs_ops cm_counter_ops = {
29968 diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
29969 index ca4c5dc..572d1ae 100644
29970 --- a/drivers/infiniband/core/cma.c
29971 +++ b/drivers/infiniband/core/cma.c
29972 @@ -2492,6 +2492,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
29974 req.private_data_len = sizeof(struct cma_hdr) +
29975 conn_param->private_data_len;
29976 + if (req.private_data_len < conn_param->private_data_len)
29979 req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
29980 if (!req.private_data)
29982 @@ -2541,6 +2544,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
29983 memset(&req, 0, sizeof req);
29984 offset = cma_user_data_offset(id_priv->id.ps);
29985 req.private_data_len = offset + conn_param->private_data_len;
29986 + if (req.private_data_len < conn_param->private_data_len)
29989 private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
29992 diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
29993 index 4507043..14ad522 100644
29994 --- a/drivers/infiniband/core/fmr_pool.c
29995 +++ b/drivers/infiniband/core/fmr_pool.c
29996 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
29998 struct task_struct *thread;
30000 - atomic_t req_ser;
30001 - atomic_t flush_ser;
30002 + atomic_unchecked_t req_ser;
30003 + atomic_unchecked_t flush_ser;
30005 wait_queue_head_t force_wait;
30007 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30008 struct ib_fmr_pool *pool = pool_ptr;
30011 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30012 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30013 ib_fmr_batch_release(pool);
30015 - atomic_inc(&pool->flush_ser);
30016 + atomic_inc_unchecked(&pool->flush_ser);
30017 wake_up_interruptible(&pool->force_wait);
30019 if (pool->flush_function)
30020 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
30023 set_current_state(TASK_INTERRUPTIBLE);
30024 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30025 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30026 !kthread_should_stop())
30028 __set_current_state(TASK_RUNNING);
30029 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
30030 pool->dirty_watermark = params->dirty_watermark;
30031 pool->dirty_len = 0;
30032 spin_lock_init(&pool->pool_lock);
30033 - atomic_set(&pool->req_ser, 0);
30034 - atomic_set(&pool->flush_ser, 0);
30035 + atomic_set_unchecked(&pool->req_ser, 0);
30036 + atomic_set_unchecked(&pool->flush_ser, 0);
30037 init_waitqueue_head(&pool->force_wait);
30039 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30040 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
30042 spin_unlock_irq(&pool->pool_lock);
30044 - serial = atomic_inc_return(&pool->req_ser);
30045 + serial = atomic_inc_return_unchecked(&pool->req_ser);
30046 wake_up_process(pool->thread);
30048 if (wait_event_interruptible(pool->force_wait,
30049 - atomic_read(&pool->flush_ser) - serial >= 0))
30050 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30054 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
30056 list_add_tail(&fmr->list, &pool->dirty_list);
30057 if (++pool->dirty_len >= pool->dirty_watermark) {
30058 - atomic_inc(&pool->req_ser);
30059 + atomic_inc_unchecked(&pool->req_ser);
30060 wake_up_process(pool->thread);
30063 diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
30064 index 40c8353..946b0e4 100644
30065 --- a/drivers/infiniband/hw/cxgb4/mem.c
30066 +++ b/drivers/infiniband/hw/cxgb4/mem.c
30067 @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30069 struct fw_ri_tpte tpt;
30071 - static atomic_t key;
30072 + static atomic_unchecked_t key;
30074 if (c4iw_fatal_error(rdev))
30076 @@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
30077 &rdev->resource.tpt_fifo_lock);
30080 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30081 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30083 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30084 __func__, stag_state, type, pdid, stag_idx);
30085 diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
30086 index 31ae1b1..2f5b038 100644
30087 --- a/drivers/infiniband/hw/ipath/ipath_fs.c
30088 +++ b/drivers/infiniband/hw/ipath/ipath_fs.c
30089 @@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
30090 struct infinipath_counters counters;
30091 struct ipath_devdata *dd;
30093 + pax_track_stack();
30095 dd = file->f_path.dentry->d_inode->i_private;
30096 dd->ipath_f_read_counters(dd, &counters);
30098 diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
30099 index 79b3dbc..96e5fcc 100644
30100 --- a/drivers/infiniband/hw/ipath/ipath_rc.c
30101 +++ b/drivers/infiniband/hw/ipath/ipath_rc.c
30102 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30103 struct ib_atomic_eth *ateth;
30104 struct ipath_ack_entry *e;
30106 - atomic64_t *maddr;
30107 + atomic64_unchecked_t *maddr;
30111 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
30112 IB_ACCESS_REMOTE_ATOMIC)))
30113 goto nack_acc_unlck;
30114 /* Perform atomic OP and save result. */
30115 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30116 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30117 sdata = be64_to_cpu(ateth->swap_data);
30118 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30119 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30120 - (u64) atomic64_add_return(sdata, maddr) - sdata :
30121 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30122 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30123 be64_to_cpu(ateth->compare_data),
30125 diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
30126 index 1f95bba..9530f87 100644
30127 --- a/drivers/infiniband/hw/ipath/ipath_ruc.c
30128 +++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
30129 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
30130 unsigned long flags;
30133 - atomic64_t *maddr;
30134 + atomic64_unchecked_t *maddr;
30135 enum ib_wc_status send_status;
30138 @@ -382,11 +382,11 @@ again:
30139 IB_ACCESS_REMOTE_ATOMIC)))
30141 /* Perform atomic OP and save result. */
30142 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30143 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30144 sdata = wqe->wr.wr.atomic.compare_add;
30145 *(u64 *) sqp->s_sge.sge.vaddr =
30146 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30147 - (u64) atomic64_add_return(sdata, maddr) - sdata :
30148 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30149 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30150 sdata, wqe->wr.wr.atomic.swap);
30152 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
30153 index 2d668c6..3312bb7 100644
30154 --- a/drivers/infiniband/hw/nes/nes.c
30155 +++ b/drivers/infiniband/hw/nes/nes.c
30156 @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
30157 LIST_HEAD(nes_adapter_list);
30158 static LIST_HEAD(nes_dev_list);
30160 -atomic_t qps_destroyed;
30161 +atomic_unchecked_t qps_destroyed;
30163 static unsigned int ee_flsh_adapter;
30164 static unsigned int sysfs_nonidx_addr;
30165 @@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
30166 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30167 struct nes_adapter *nesadapter = nesdev->nesadapter;
30169 - atomic_inc(&qps_destroyed);
30170 + atomic_inc_unchecked(&qps_destroyed);
30172 /* Free the control structures */
30174 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
30175 index 6fe7987..68637b5 100644
30176 --- a/drivers/infiniband/hw/nes/nes.h
30177 +++ b/drivers/infiniband/hw/nes/nes.h
30178 @@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30179 extern unsigned int wqm_quanta;
30180 extern struct list_head nes_adapter_list;
30182 -extern atomic_t cm_connects;
30183 -extern atomic_t cm_accepts;
30184 -extern atomic_t cm_disconnects;
30185 -extern atomic_t cm_closes;
30186 -extern atomic_t cm_connecteds;
30187 -extern atomic_t cm_connect_reqs;
30188 -extern atomic_t cm_rejects;
30189 -extern atomic_t mod_qp_timouts;
30190 -extern atomic_t qps_created;
30191 -extern atomic_t qps_destroyed;
30192 -extern atomic_t sw_qps_destroyed;
30193 +extern atomic_unchecked_t cm_connects;
30194 +extern atomic_unchecked_t cm_accepts;
30195 +extern atomic_unchecked_t cm_disconnects;
30196 +extern atomic_unchecked_t cm_closes;
30197 +extern atomic_unchecked_t cm_connecteds;
30198 +extern atomic_unchecked_t cm_connect_reqs;
30199 +extern atomic_unchecked_t cm_rejects;
30200 +extern atomic_unchecked_t mod_qp_timouts;
30201 +extern atomic_unchecked_t qps_created;
30202 +extern atomic_unchecked_t qps_destroyed;
30203 +extern atomic_unchecked_t sw_qps_destroyed;
30204 extern u32 mh_detected;
30205 extern u32 mh_pauses_sent;
30206 extern u32 cm_packets_sent;
30207 @@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30208 extern u32 cm_packets_received;
30209 extern u32 cm_packets_dropped;
30210 extern u32 cm_packets_retrans;
30211 -extern atomic_t cm_listens_created;
30212 -extern atomic_t cm_listens_destroyed;
30213 +extern atomic_unchecked_t cm_listens_created;
30214 +extern atomic_unchecked_t cm_listens_destroyed;
30215 extern u32 cm_backlog_drops;
30216 -extern atomic_t cm_loopbacks;
30217 -extern atomic_t cm_nodes_created;
30218 -extern atomic_t cm_nodes_destroyed;
30219 -extern atomic_t cm_accel_dropped_pkts;
30220 -extern atomic_t cm_resets_recvd;
30221 +extern atomic_unchecked_t cm_loopbacks;
30222 +extern atomic_unchecked_t cm_nodes_created;
30223 +extern atomic_unchecked_t cm_nodes_destroyed;
30224 +extern atomic_unchecked_t cm_accel_dropped_pkts;
30225 +extern atomic_unchecked_t cm_resets_recvd;
30227 extern u32 int_mod_timer_init;
30228 extern u32 int_mod_cq_depth_256;
30229 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
30230 index a237547..28a9819 100644
30231 --- a/drivers/infiniband/hw/nes/nes_cm.c
30232 +++ b/drivers/infiniband/hw/nes/nes_cm.c
30233 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30234 u32 cm_packets_retrans;
30235 u32 cm_packets_created;
30236 u32 cm_packets_received;
30237 -atomic_t cm_listens_created;
30238 -atomic_t cm_listens_destroyed;
30239 +atomic_unchecked_t cm_listens_created;
30240 +atomic_unchecked_t cm_listens_destroyed;
30241 u32 cm_backlog_drops;
30242 -atomic_t cm_loopbacks;
30243 -atomic_t cm_nodes_created;
30244 -atomic_t cm_nodes_destroyed;
30245 -atomic_t cm_accel_dropped_pkts;
30246 -atomic_t cm_resets_recvd;
30247 +atomic_unchecked_t cm_loopbacks;
30248 +atomic_unchecked_t cm_nodes_created;
30249 +atomic_unchecked_t cm_nodes_destroyed;
30250 +atomic_unchecked_t cm_accel_dropped_pkts;
30251 +atomic_unchecked_t cm_resets_recvd;
30253 static inline int mini_cm_accelerated(struct nes_cm_core *,
30254 struct nes_cm_node *);
30255 @@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30257 static struct nes_cm_core *g_cm_core;
30259 -atomic_t cm_connects;
30260 -atomic_t cm_accepts;
30261 -atomic_t cm_disconnects;
30262 -atomic_t cm_closes;
30263 -atomic_t cm_connecteds;
30264 -atomic_t cm_connect_reqs;
30265 -atomic_t cm_rejects;
30266 +atomic_unchecked_t cm_connects;
30267 +atomic_unchecked_t cm_accepts;
30268 +atomic_unchecked_t cm_disconnects;
30269 +atomic_unchecked_t cm_closes;
30270 +atomic_unchecked_t cm_connecteds;
30271 +atomic_unchecked_t cm_connect_reqs;
30272 +atomic_unchecked_t cm_rejects;
30276 @@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
30280 - atomic_inc(&cm_listens_destroyed);
30281 + atomic_inc_unchecked(&cm_listens_destroyed);
30283 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30285 @@ -1242,7 +1242,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
30288 add_hte_node(cm_core, cm_node);
30289 - atomic_inc(&cm_nodes_created);
30290 + atomic_inc_unchecked(&cm_nodes_created);
30294 @@ -1300,7 +1300,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
30297 atomic_dec(&cm_core->node_cnt);
30298 - atomic_inc(&cm_nodes_destroyed);
30299 + atomic_inc_unchecked(&cm_nodes_destroyed);
30300 nesqp = cm_node->nesqp;
30302 nesqp->cm_node = NULL;
30303 @@ -1367,7 +1367,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
30305 static void drop_packet(struct sk_buff *skb)
30307 - atomic_inc(&cm_accel_dropped_pkts);
30308 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
30309 dev_kfree_skb_any(skb);
30312 @@ -1430,7 +1430,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
30315 int reset = 0; /* whether to send reset in case of err.. */
30316 - atomic_inc(&cm_resets_recvd);
30317 + atomic_inc_unchecked(&cm_resets_recvd);
30318 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30319 " refcnt=%d\n", cm_node, cm_node->state,
30320 atomic_read(&cm_node->ref_count));
30321 @@ -2059,7 +2059,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
30322 rem_ref_cm_node(cm_node->cm_core, cm_node);
30325 - atomic_inc(&cm_loopbacks);
30326 + atomic_inc_unchecked(&cm_loopbacks);
30327 loopbackremotenode->loopbackpartner = cm_node;
30328 loopbackremotenode->tcp_cntxt.rcv_wscale =
30329 NES_CM_DEFAULT_RCV_WND_SCALE;
30330 @@ -2334,7 +2334,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
30331 add_ref_cm_node(cm_node);
30332 } else if (cm_node->state == NES_CM_STATE_TSA) {
30333 rem_ref_cm_node(cm_core, cm_node);
30334 - atomic_inc(&cm_accel_dropped_pkts);
30335 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
30336 dev_kfree_skb_any(skb);
30339 @@ -2640,7 +2640,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30341 if ((cm_id) && (cm_id->event_handler)) {
30342 if (issue_disconn) {
30343 - atomic_inc(&cm_disconnects);
30344 + atomic_inc_unchecked(&cm_disconnects);
30345 cm_event.event = IW_CM_EVENT_DISCONNECT;
30346 cm_event.status = disconn_status;
30347 cm_event.local_addr = cm_id->local_addr;
30348 @@ -2662,7 +2662,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
30352 - atomic_inc(&cm_closes);
30353 + atomic_inc_unchecked(&cm_closes);
30354 nes_disconnect(nesqp, 1);
30356 cm_id->provider_data = nesqp;
30357 @@ -2793,7 +2793,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30359 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30360 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30361 - atomic_inc(&cm_accepts);
30362 + atomic_inc_unchecked(&cm_accepts);
30364 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30365 netdev_refcnt_read(nesvnic->netdev));
30366 @@ -3003,7 +3003,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
30368 struct nes_cm_core *cm_core;
30370 - atomic_inc(&cm_rejects);
30371 + atomic_inc_unchecked(&cm_rejects);
30372 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30373 loopback = cm_node->loopbackpartner;
30374 cm_core = cm_node->cm_core;
30375 @@ -3069,7 +3069,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
30376 ntohl(cm_id->local_addr.sin_addr.s_addr),
30377 ntohs(cm_id->local_addr.sin_port));
30379 - atomic_inc(&cm_connects);
30380 + atomic_inc_unchecked(&cm_connects);
30381 nesqp->active_conn = 1;
30383 /* cache the cm_id in the qp */
30384 @@ -3175,7 +3175,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
30385 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30388 - atomic_inc(&cm_listens_created);
30389 + atomic_inc_unchecked(&cm_listens_created);
30392 cm_id->add_ref(cm_id);
30393 @@ -3280,7 +3280,7 @@ static void cm_event_connected(struct nes_cm_event *event)
30394 if (nesqp->destroyed) {
30397 - atomic_inc(&cm_connecteds);
30398 + atomic_inc_unchecked(&cm_connecteds);
30399 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30400 " local port 0x%04X. jiffies = %lu.\n",
30402 @@ -3495,7 +3495,7 @@ static void cm_event_reset(struct nes_cm_event *event)
30404 cm_id->add_ref(cm_id);
30405 ret = cm_id->event_handler(cm_id, &cm_event);
30406 - atomic_inc(&cm_closes);
30407 + atomic_inc_unchecked(&cm_closes);
30408 cm_event.event = IW_CM_EVENT_CLOSE;
30409 cm_event.status = 0;
30410 cm_event.provider_data = cm_id->provider_data;
30411 @@ -3531,7 +3531,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
30413 cm_id = cm_node->cm_id;
30415 - atomic_inc(&cm_connect_reqs);
30416 + atomic_inc_unchecked(&cm_connect_reqs);
30417 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30418 cm_node, cm_id, jiffies);
30420 @@ -3569,7 +3569,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
30422 cm_id = cm_node->cm_id;
30424 - atomic_inc(&cm_connect_reqs);
30425 + atomic_inc_unchecked(&cm_connect_reqs);
30426 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30427 cm_node, cm_id, jiffies);
30429 diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
30430 index 9d7ffeb..a95dd7d 100644
30431 --- a/drivers/infiniband/hw/nes/nes_nic.c
30432 +++ b/drivers/infiniband/hw/nes/nes_nic.c
30433 @@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
30434 target_stat_values[++index] = mh_detected;
30435 target_stat_values[++index] = mh_pauses_sent;
30436 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30437 - target_stat_values[++index] = atomic_read(&cm_connects);
30438 - target_stat_values[++index] = atomic_read(&cm_accepts);
30439 - target_stat_values[++index] = atomic_read(&cm_disconnects);
30440 - target_stat_values[++index] = atomic_read(&cm_connecteds);
30441 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30442 - target_stat_values[++index] = atomic_read(&cm_rejects);
30443 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30444 - target_stat_values[++index] = atomic_read(&qps_created);
30445 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30446 - target_stat_values[++index] = atomic_read(&qps_destroyed);
30447 - target_stat_values[++index] = atomic_read(&cm_closes);
30448 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30449 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30450 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30451 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30452 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30453 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30454 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30455 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30456 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30457 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30458 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30459 target_stat_values[++index] = cm_packets_sent;
30460 target_stat_values[++index] = cm_packets_bounced;
30461 target_stat_values[++index] = cm_packets_created;
30462 target_stat_values[++index] = cm_packets_received;
30463 target_stat_values[++index] = cm_packets_dropped;
30464 target_stat_values[++index] = cm_packets_retrans;
30465 - target_stat_values[++index] = atomic_read(&cm_listens_created);
30466 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30467 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30468 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30469 target_stat_values[++index] = cm_backlog_drops;
30470 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
30471 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
30472 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30473 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30474 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30475 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30476 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30477 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30478 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30479 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30480 target_stat_values[++index] = nesadapter->free_4kpbl;
30481 target_stat_values[++index] = nesadapter->free_256pbl;
30482 target_stat_values[++index] = int_mod_timer_init;
30483 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
30484 index 9f2f7d4..6d2fee2 100644
30485 --- a/drivers/infiniband/hw/nes/nes_verbs.c
30486 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
30489 #include <rdma/ib_umem.h>
30491 -atomic_t mod_qp_timouts;
30492 -atomic_t qps_created;
30493 -atomic_t sw_qps_destroyed;
30494 +atomic_unchecked_t mod_qp_timouts;
30495 +atomic_unchecked_t qps_created;
30496 +atomic_unchecked_t sw_qps_destroyed;
30498 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30500 @@ -1131,7 +1131,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
30501 if (init_attr->create_flags)
30502 return ERR_PTR(-EINVAL);
30504 - atomic_inc(&qps_created);
30505 + atomic_inc_unchecked(&qps_created);
30506 switch (init_attr->qp_type) {
30508 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30509 @@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
30510 struct iw_cm_event cm_event;
30513 - atomic_inc(&sw_qps_destroyed);
30514 + atomic_inc_unchecked(&sw_qps_destroyed);
30515 nesqp->destroyed = 1;
30517 /* Blow away the connection if it exists. */
30518 diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
30519 index c9624ea..e025b66 100644
30520 --- a/drivers/infiniband/hw/qib/qib.h
30521 +++ b/drivers/infiniband/hw/qib/qib.h
30523 #include <linux/completion.h>
30524 #include <linux/kref.h>
30525 #include <linux/sched.h>
30526 +#include <linux/slab.h>
30528 #include "qib_common.h"
30529 #include "qib_verbs.h"
30530 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
30531 index c351aa4..e6967c2 100644
30532 --- a/drivers/input/gameport/gameport.c
30533 +++ b/drivers/input/gameport/gameport.c
30534 @@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
30536 static void gameport_init_port(struct gameport *gameport)
30538 - static atomic_t gameport_no = ATOMIC_INIT(0);
30539 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
30541 __module_get(THIS_MODULE);
30543 mutex_init(&gameport->drv_mutex);
30544 device_initialize(&gameport->dev);
30545 dev_set_name(&gameport->dev, "gameport%lu",
30546 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
30547 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
30548 gameport->dev.bus = &gameport_bus;
30549 gameport->dev.release = gameport_release_port;
30550 if (gameport->parent)
30551 diff --git a/drivers/input/input.c b/drivers/input/input.c
30552 index da38d97..2aa0b79 100644
30553 --- a/drivers/input/input.c
30554 +++ b/drivers/input/input.c
30555 @@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struct input_dev *dev)
30557 int input_register_device(struct input_dev *dev)
30559 - static atomic_t input_no = ATOMIC_INIT(0);
30560 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
30561 struct input_handler *handler;
30564 @@ -1851,7 +1851,7 @@ int input_register_device(struct input_dev *dev)
30565 dev->setkeycode = input_default_setkeycode;
30567 dev_set_name(&dev->dev, "input%ld",
30568 - (unsigned long) atomic_inc_return(&input_no) - 1);
30569 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
30571 error = device_add(&dev->dev);
30573 diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
30574 index b8d8611..15f8d2c 100644
30575 --- a/drivers/input/joystick/sidewinder.c
30576 +++ b/drivers/input/joystick/sidewinder.c
30578 #include <linux/kernel.h>
30579 #include <linux/module.h>
30580 #include <linux/slab.h>
30581 +#include <linux/sched.h>
30582 #include <linux/init.h>
30583 #include <linux/input.h>
30584 #include <linux/gameport.h>
30585 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
30586 unsigned char buf[SW_LENGTH];
30589 + pax_track_stack();
30591 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
30593 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
30594 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
30595 index d728875..844c89b 100644
30596 --- a/drivers/input/joystick/xpad.c
30597 +++ b/drivers/input/joystick/xpad.c
30598 @@ -710,7 +710,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
30600 static int xpad_led_probe(struct usb_xpad *xpad)
30602 - static atomic_t led_seq = ATOMIC_INIT(0);
30603 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
30605 struct xpad_led *led;
30606 struct led_classdev *led_cdev;
30607 @@ -723,7 +723,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
30611 - led_no = (long)atomic_inc_return(&led_seq) - 1;
30612 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
30614 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
30616 diff --git a/drivers/input/misc/cma3000_d0x.c b/drivers/input/misc/cma3000_d0x.c
30617 index 1633b63..09f8f20 100644
30618 --- a/drivers/input/misc/cma3000_d0x.c
30619 +++ b/drivers/input/misc/cma3000_d0x.c
30620 @@ -114,8 +114,8 @@ static void decode_mg(struct cma3000_accl_data *data, int *datax,
30621 static irqreturn_t cma3000_thread_irq(int irq, void *dev_id)
30623 struct cma3000_accl_data *data = dev_id;
30624 - int datax, datay, dataz;
30625 - u8 ctrl, mode, range, intr_status;
30626 + int datax, datay, dataz, intr_status;
30627 + u8 ctrl, mode, range;
30629 intr_status = CMA3000_READ(data, CMA3000_INTSTATUS, "interrupt status");
30630 if (intr_status < 0)
30631 diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
30632 index 0110b5a..d3ad144 100644
30633 --- a/drivers/input/mousedev.c
30634 +++ b/drivers/input/mousedev.c
30635 @@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
30637 spin_unlock_irq(&client->packet_lock);
30639 - if (copy_to_user(buffer, data, count))
30640 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
30644 diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
30645 index ba70058..571d25d 100644
30646 --- a/drivers/input/serio/serio.c
30647 +++ b/drivers/input/serio/serio.c
30648 @@ -497,7 +497,7 @@ static void serio_release_port(struct device *dev)
30650 static void serio_init_port(struct serio *serio)
30652 - static atomic_t serio_no = ATOMIC_INIT(0);
30653 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
30655 __module_get(THIS_MODULE);
30657 @@ -508,7 +508,7 @@ static void serio_init_port(struct serio *serio)
30658 mutex_init(&serio->drv_mutex);
30659 device_initialize(&serio->dev);
30660 dev_set_name(&serio->dev, "serio%ld",
30661 - (long)atomic_inc_return(&serio_no) - 1);
30662 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
30663 serio->dev.bus = &serio_bus;
30664 serio->dev.release = serio_release_port;
30665 serio->dev.groups = serio_device_attr_groups;
30666 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
30667 index e44933d..9ba484a 100644
30668 --- a/drivers/isdn/capi/capi.c
30669 +++ b/drivers/isdn/capi/capi.c
30670 @@ -83,8 +83,8 @@ struct capiminor {
30672 struct capi20_appl *ap;
30674 - atomic_t datahandle;
30676 + atomic_unchecked_t datahandle;
30677 + atomic_unchecked_t msgid;
30679 struct tty_port port;
30681 @@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
30682 capimsg_setu16(s, 2, mp->ap->applid);
30683 capimsg_setu8 (s, 4, CAPI_DATA_B3);
30684 capimsg_setu8 (s, 5, CAPI_RESP);
30685 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
30686 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
30687 capimsg_setu32(s, 8, mp->ncci);
30688 capimsg_setu16(s, 12, datahandle);
30690 @@ -518,14 +518,14 @@ static void handle_minor_send(struct capiminor *mp)
30691 mp->outbytes -= len;
30692 spin_unlock_bh(&mp->outlock);
30694 - datahandle = atomic_inc_return(&mp->datahandle);
30695 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
30696 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
30697 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30698 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
30699 capimsg_setu16(skb->data, 2, mp->ap->applid);
30700 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
30701 capimsg_setu8 (skb->data, 5, CAPI_REQ);
30702 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
30703 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
30704 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
30705 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
30706 capimsg_setu16(skb->data, 16, len); /* Data length */
30707 diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
30708 index db621db..825ea1a 100644
30709 --- a/drivers/isdn/gigaset/common.c
30710 +++ b/drivers/isdn/gigaset/common.c
30711 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
30712 cs->commands_pending = 0;
30713 cs->cur_at_seq = 0;
30715 - cs->open_count = 0;
30716 + local_set(&cs->open_count, 0);
30719 cs->tty_dev = NULL;
30720 diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
30721 index 212efaf..f187c6b 100644
30722 --- a/drivers/isdn/gigaset/gigaset.h
30723 +++ b/drivers/isdn/gigaset/gigaset.h
30725 #include <linux/tty_driver.h>
30726 #include <linux/list.h>
30727 #include <linux/atomic.h>
30728 +#include <asm/local.h>
30730 #define GIG_VERSION {0, 5, 0, 0}
30731 #define GIG_COMPAT {0, 4, 0, 0}
30732 @@ -433,7 +434,7 @@ struct cardstate {
30733 spinlock_t cmdlock;
30734 unsigned curlen, cmdbytes;
30736 - unsigned open_count;
30737 + local_t open_count;
30738 struct tty_struct *tty;
30739 struct tasklet_struct if_wake_tasklet;
30740 unsigned control_state;
30741 diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
30742 index e35058b..5898a8b 100644
30743 --- a/drivers/isdn/gigaset/interface.c
30744 +++ b/drivers/isdn/gigaset/interface.c
30745 @@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
30747 tty->driver_data = cs;
30749 - ++cs->open_count;
30751 - if (cs->open_count == 1) {
30752 + if (local_inc_return(&cs->open_count) == 1) {
30753 spin_lock_irqsave(&cs->lock, flags);
30755 spin_unlock_irqrestore(&cs->lock, flags);
30756 @@ -192,10 +190,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
30758 if (!cs->connected)
30759 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30760 - else if (!cs->open_count)
30761 + else if (!local_read(&cs->open_count))
30762 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30764 - if (!--cs->open_count) {
30765 + if (!local_dec_return(&cs->open_count)) {
30766 spin_lock_irqsave(&cs->lock, flags);
30768 spin_unlock_irqrestore(&cs->lock, flags);
30769 @@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *tty,
30770 if (!cs->connected) {
30771 gig_dbg(DEBUG_IF, "not connected");
30773 - } else if (!cs->open_count)
30774 + } else if (!local_read(&cs->open_count))
30775 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30778 @@ -360,7 +358,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
30782 - if (!cs->open_count) {
30783 + if (!local_read(&cs->open_count)) {
30784 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30787 @@ -413,7 +411,7 @@ static int if_write_room(struct tty_struct *tty)
30788 if (!cs->connected) {
30789 gig_dbg(DEBUG_IF, "not connected");
30791 - } else if (!cs->open_count)
30792 + } else if (!local_read(&cs->open_count))
30793 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30794 else if (cs->mstate != MS_LOCKED) {
30795 dev_warn(cs->dev, "can't write to unlocked device\n");
30796 @@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
30798 if (!cs->connected)
30799 gig_dbg(DEBUG_IF, "not connected");
30800 - else if (!cs->open_count)
30801 + else if (!local_read(&cs->open_count))
30802 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30803 else if (cs->mstate != MS_LOCKED)
30804 dev_warn(cs->dev, "can't write to unlocked device\n");
30805 @@ -471,7 +469,7 @@ static void if_throttle(struct tty_struct *tty)
30807 if (!cs->connected)
30808 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30809 - else if (!cs->open_count)
30810 + else if (!local_read(&cs->open_count))
30811 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30813 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30814 @@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_struct *tty)
30816 if (!cs->connected)
30817 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
30818 - else if (!cs->open_count)
30819 + else if (!local_read(&cs->open_count))
30820 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30822 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
30823 @@ -526,7 +524,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
30827 - if (!cs->open_count) {
30828 + if (!local_read(&cs->open_count)) {
30829 dev_warn(cs->dev, "%s: device not opened\n", __func__);
30832 diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
30833 index 2a57da59..e7a12ed 100644
30834 --- a/drivers/isdn/hardware/avm/b1.c
30835 +++ b/drivers/isdn/hardware/avm/b1.c
30836 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
30839 if (t4file->user) {
30840 - if (copy_from_user(buf, dp, left))
30841 + if (left > sizeof buf || copy_from_user(buf, dp, left))
30844 memcpy(buf, dp, left);
30845 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
30848 if (config->user) {
30849 - if (copy_from_user(buf, dp, left))
30850 + if (left > sizeof buf || copy_from_user(buf, dp, left))
30853 memcpy(buf, dp, left);
30854 diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
30855 index f130724..c373c68 100644
30856 --- a/drivers/isdn/hardware/eicon/capidtmf.c
30857 +++ b/drivers/isdn/hardware/eicon/capidtmf.c
30858 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
30859 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
30860 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
30862 + pax_track_stack();
30864 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
30866 diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
30867 index 4d425c6..a9be6c4 100644
30868 --- a/drivers/isdn/hardware/eicon/capifunc.c
30869 +++ b/drivers/isdn/hardware/eicon/capifunc.c
30870 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
30872 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30874 + pax_track_stack();
30876 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30878 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30879 diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
30880 index 3029234..ef0d9e2 100644
30881 --- a/drivers/isdn/hardware/eicon/diddfunc.c
30882 +++ b/drivers/isdn/hardware/eicon/diddfunc.c
30883 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30885 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30887 + pax_track_stack();
30889 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30891 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30892 diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
30893 index 0bbee78..a0d0a01 100644
30894 --- a/drivers/isdn/hardware/eicon/divasfunc.c
30895 +++ b/drivers/isdn/hardware/eicon/divasfunc.c
30896 @@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30898 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30900 + pax_track_stack();
30902 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30904 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30905 diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
30906 index 85784a7..a19ca98 100644
30907 --- a/drivers/isdn/hardware/eicon/divasync.h
30908 +++ b/drivers/isdn/hardware/eicon/divasync.h
30909 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
30910 } diva_didd_add_adapter_t;
30911 typedef struct _diva_didd_remove_adapter {
30912 IDI_CALL p_request;
30913 -} diva_didd_remove_adapter_t;
30914 +} __no_const diva_didd_remove_adapter_t;
30915 typedef struct _diva_didd_read_adapter_array {
30918 diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
30919 index db87d51..7d09acf 100644
30920 --- a/drivers/isdn/hardware/eicon/idifunc.c
30921 +++ b/drivers/isdn/hardware/eicon/idifunc.c
30922 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30924 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30926 + pax_track_stack();
30928 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30930 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30931 diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
30932 index a339598..b6a8bfc 100644
30933 --- a/drivers/isdn/hardware/eicon/message.c
30934 +++ b/drivers/isdn/hardware/eicon/message.c
30935 @@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
30939 + pax_track_stack();
30942 Id = ((word)plci->Id<<8)|a->Id;
30943 PUT_WORD(&SS_Ind[4],0x0000);
30944 @@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
30948 + pax_track_stack();
30951 for(i=0;i<8;i++) bp_parms[i].length = 0;
30952 for(i=0;i<2;i++) global_config[i].length = 0;
30953 @@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
30954 const byte llc3[] = {4,3,2,2,6,6,0};
30955 const byte header[] = {0,2,3,3,0,0,0};
30957 + pax_track_stack();
30959 for(i=0;i<8;i++) bp_parms[i].length = 0;
30960 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
30961 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
30962 @@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
30963 word appl_number_group_type[MAX_APPL];
30966 + pax_track_stack();
30968 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
30970 if(!a->group_optimization_enabled)
30971 diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
30972 index a564b75..f3cf8b5 100644
30973 --- a/drivers/isdn/hardware/eicon/mntfunc.c
30974 +++ b/drivers/isdn/hardware/eicon/mntfunc.c
30975 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
30977 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
30979 + pax_track_stack();
30981 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
30983 for (x = 0; x < MAX_DESCRIPTORS; x++) {
30984 diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
30985 index a3bd163..8956575 100644
30986 --- a/drivers/isdn/hardware/eicon/xdi_adapter.h
30987 +++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
30988 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
30989 typedef struct _diva_os_idi_adapter_interface {
30990 diva_init_card_proc_t cleanup_adapter_proc;
30991 diva_cmd_card_proc_t cmd_proc;
30992 -} diva_os_idi_adapter_interface_t;
30993 +} __no_const diva_os_idi_adapter_interface_t;
30995 typedef struct _diva_os_xdi_adapter {
30996 struct list_head link;
30997 diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
30998 index 6ed82ad..b05ac05 100644
30999 --- a/drivers/isdn/i4l/isdn_common.c
31000 +++ b/drivers/isdn/i4l/isdn_common.c
31001 @@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
31003 void __user *argp = (void __user *)arg;
31005 + pax_track_stack();
31007 #define name iocpar.name
31008 #define bname iocpar.bname
31009 #define iocts iocpar.iocts
31010 diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
31011 index 1f355bb..43f1fea 100644
31012 --- a/drivers/isdn/icn/icn.c
31013 +++ b/drivers/isdn/icn/icn.c
31014 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
31018 - if (copy_from_user(msg, buf, count))
31019 + if (count > sizeof msg || copy_from_user(msg, buf, count))
31022 memcpy(msg, buf, count);
31023 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
31024 index 2535933..09a8e86 100644
31025 --- a/drivers/lguest/core.c
31026 +++ b/drivers/lguest/core.c
31027 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
31028 * it's worked so far. The end address needs +1 because __get_vm_area
31029 * allocates an extra guard page, so we need space for that.
31032 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31033 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31034 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31035 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31037 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31038 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31039 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31042 if (!switcher_vma) {
31044 printk("lguest: could not map switcher pages high\n");
31045 @@ -119,7 +127,7 @@ static __init int map_switcher(void)
31046 * Now the Switcher is mapped at the right address, we can't fail!
31047 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
31049 - memcpy(switcher_vma->addr, start_switcher_text,
31050 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31051 end_switcher_text - start_switcher_text);
31053 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31054 diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
31055 index 65af42f..530c87a 100644
31056 --- a/drivers/lguest/x86/core.c
31057 +++ b/drivers/lguest/x86/core.c
31058 @@ -59,7 +59,7 @@ static struct {
31059 /* Offset from where switcher.S was compiled to where we've copied it */
31060 static unsigned long switcher_offset(void)
31062 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31063 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31066 /* This cpu's struct lguest_pages. */
31067 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
31068 * These copies are pretty cheap, so we do them unconditionally: */
31069 /* Save the current Host top-level page directory.
31072 +#ifdef CONFIG_PAX_PER_CPU_PGD
31073 + pages->state.host_cr3 = read_cr3();
31075 pages->state.host_cr3 = __pa(current->mm->pgd);
31079 * Set up the Guest's page tables to see this CPU's pages (and no
31080 * other CPU's pages).
31081 @@ -472,7 +478,7 @@ void __init lguest_arch_host_init(void)
31082 * compiled-in switcher code and the high-mapped copy we just made.
31084 for (i = 0; i < IDT_ENTRIES; i++)
31085 - default_idt_entries[i] += switcher_offset();
31086 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31089 * Set up the Switcher's per-cpu areas.
31090 @@ -555,7 +561,7 @@ void __init lguest_arch_host_init(void)
31091 * it will be undisturbed when we switch. To change %cs and jump we
31092 * need this structure to feed to Intel's "lcall" instruction.
31094 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31095 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31096 lguest_entry.segment = LGUEST_CS;
31099 diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
31100 index 40634b0..4f5855e 100644
31101 --- a/drivers/lguest/x86/switcher_32.S
31102 +++ b/drivers/lguest/x86/switcher_32.S
31104 #include <asm/page.h>
31105 #include <asm/segment.h>
31106 #include <asm/lguest.h>
31107 +#include <asm/processor-flags.h>
31109 // We mark the start of the code to copy
31110 // It's placed in .text tho it's never run here
31111 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31112 // Changes type when we load it: damn Intel!
31113 // For after we switch over our page tables
31114 // That entry will be read-only: we'd crash.
31116 +#ifdef CONFIG_PAX_KERNEXEC
31118 + xor $X86_CR0_WP, %edx
31122 movl $(GDT_ENTRY_TSS*8), %edx
31125 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31126 // Let's clear it again for our return.
31127 // The GDT descriptor of the Host
31128 // Points to the table after two "size" bytes
31129 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31130 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31131 // Clear "used" from type field (byte 5, bit 2)
31132 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31133 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31135 +#ifdef CONFIG_PAX_KERNEXEC
31137 + xor $X86_CR0_WP, %eax
31141 // Once our page table's switched, the Guest is live!
31142 // The Host fades as we run this final step.
31143 @@ -295,13 +309,12 @@ deliver_to_host:
31144 // I consulted gcc, and it gave
31145 // These instructions, which I gladly credit:
31146 leal (%edx,%ebx,8), %eax
31147 - movzwl (%eax),%edx
31148 - movl 4(%eax), %eax
31151 + movl 4(%eax), %edx
31153 // Now the address of the handler's in %edx
31154 // We call it now: its "iret" drops us home.
31156 + ljmp $__KERNEL_CS, $1f
31159 // Every interrupt can come to us here
31160 // But we must truly tell each apart.
31161 diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
31162 index 4daf9e5..b8d1d0f 100644
31163 --- a/drivers/macintosh/macio_asic.c
31164 +++ b/drivers/macintosh/macio_asic.c
31165 @@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
31166 * MacIO is matched against any Apple ID, it's probe() function
31167 * will then decide wether it applies or not
31169 -static const struct pci_device_id __devinitdata pci_ids [] = { {
31170 +static const struct pci_device_id __devinitconst pci_ids [] = { {
31171 .vendor = PCI_VENDOR_ID_APPLE,
31172 .device = PCI_ANY_ID,
31173 .subvendor = PCI_ANY_ID,
31174 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
31175 index 2e9a3ca..c2fb229 100644
31176 --- a/drivers/md/dm-ioctl.c
31177 +++ b/drivers/md/dm-ioctl.c
31178 @@ -1578,7 +1578,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
31179 cmd == DM_LIST_VERSIONS_CMD)
31182 - if ((cmd == DM_DEV_CREATE_CMD)) {
31183 + if (cmd == DM_DEV_CREATE_CMD) {
31184 if (!*param->name) {
31185 DMWARN("name not supplied when creating device");
31187 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
31188 index 9bfd057..01180bc 100644
31189 --- a/drivers/md/dm-raid1.c
31190 +++ b/drivers/md/dm-raid1.c
31191 @@ -40,7 +40,7 @@ enum dm_raid1_error {
31194 struct mirror_set *ms;
31195 - atomic_t error_count;
31196 + atomic_unchecked_t error_count;
31197 unsigned long error_type;
31198 struct dm_dev *dev;
31200 @@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
31203 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31204 - if (!atomic_read(&m->error_count))
31205 + if (!atomic_read_unchecked(&m->error_count))
31209 @@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
31210 * simple way to tell if a device has encountered
31213 - atomic_inc(&m->error_count);
31214 + atomic_inc_unchecked(&m->error_count);
31216 if (test_and_set_bit(error_type, &m->error_type))
31218 @@ -408,7 +408,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
31219 struct mirror *m = get_default_mirror(ms);
31222 - if (likely(!atomic_read(&m->error_count)))
31223 + if (likely(!atomic_read_unchecked(&m->error_count)))
31226 if (m-- == ms->mirror)
31227 @@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
31229 struct mirror *default_mirror = get_default_mirror(m->ms);
31231 - return !atomic_read(&default_mirror->error_count);
31232 + return !atomic_read_unchecked(&default_mirror->error_count);
31235 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31236 @@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
31238 if (likely(region_in_sync(ms, region, 1)))
31239 m = choose_mirror(ms, bio->bi_sector);
31240 - else if (m && atomic_read(&m->error_count))
31241 + else if (m && atomic_read_unchecked(&m->error_count))
31245 @@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
31248 ms->mirror[mirror].ms = ms;
31249 - atomic_set(&(ms->mirror[mirror].error_count), 0);
31250 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31251 ms->mirror[mirror].error_type = 0;
31252 ms->mirror[mirror].offset = offset;
31254 @@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_target *ti)
31256 static char device_status_char(struct mirror *m)
31258 - if (!atomic_read(&(m->error_count)))
31259 + if (!atomic_read_unchecked(&(m->error_count)))
31262 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31263 diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
31264 index 3d80cf0..b77cc47 100644
31265 --- a/drivers/md/dm-stripe.c
31266 +++ b/drivers/md/dm-stripe.c
31267 @@ -20,7 +20,7 @@ struct stripe {
31268 struct dm_dev *dev;
31269 sector_t physical_start;
31271 - atomic_t error_count;
31272 + atomic_unchecked_t error_count;
31276 @@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
31280 - atomic_set(&(sc->stripe[i].error_count), 0);
31281 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31285 @@ -314,7 +314,7 @@ static int stripe_status(struct dm_target *ti,
31286 DMEMIT("%d ", sc->stripes);
31287 for (i = 0; i < sc->stripes; i++) {
31288 DMEMIT("%s ", sc->stripe[i].dev->name);
31289 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31290 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31294 @@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
31296 for (i = 0; i < sc->stripes; i++)
31297 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31298 - atomic_inc(&(sc->stripe[i].error_count));
31299 - if (atomic_read(&(sc->stripe[i].error_count)) <
31300 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
31301 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31302 DM_IO_ERROR_THRESHOLD)
31303 schedule_work(&sc->trigger_event);
31305 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
31306 index bc04518..7a83b81 100644
31307 --- a/drivers/md/dm-table.c
31308 +++ b/drivers/md/dm-table.c
31309 @@ -389,7 +389,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
31313 - if ((start >= dev_size) || (start + len > dev_size)) {
31314 + if ((start >= dev_size) || (len > dev_size - start)) {
31315 DMWARN("%s: %s too small for target: "
31316 "start=%llu, len=%llu, dev_size=%llu",
31317 dm_device_name(ti->table->md), bdevname(bdev, b),
31318 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
31319 index 52b39f3..83a8b6b 100644
31320 --- a/drivers/md/dm.c
31321 +++ b/drivers/md/dm.c
31322 @@ -165,9 +165,9 @@ struct mapped_device {
31326 - atomic_t event_nr;
31327 + atomic_unchecked_t event_nr;
31328 wait_queue_head_t eventq;
31329 - atomic_t uevent_seq;
31330 + atomic_unchecked_t uevent_seq;
31331 struct list_head uevent_list;
31332 spinlock_t uevent_lock; /* Protect access to uevent_list */
31334 @@ -1843,8 +1843,8 @@ static struct mapped_device *alloc_dev(int minor)
31335 rwlock_init(&md->map_lock);
31336 atomic_set(&md->holders, 1);
31337 atomic_set(&md->open_count, 0);
31338 - atomic_set(&md->event_nr, 0);
31339 - atomic_set(&md->uevent_seq, 0);
31340 + atomic_set_unchecked(&md->event_nr, 0);
31341 + atomic_set_unchecked(&md->uevent_seq, 0);
31342 INIT_LIST_HEAD(&md->uevent_list);
31343 spin_lock_init(&md->uevent_lock);
31345 @@ -1978,7 +1978,7 @@ static void event_callback(void *context)
31347 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31349 - atomic_inc(&md->event_nr);
31350 + atomic_inc_unchecked(&md->event_nr);
31351 wake_up(&md->eventq);
31354 @@ -2614,18 +2614,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
31356 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31358 - return atomic_add_return(1, &md->uevent_seq);
31359 + return atomic_add_return_unchecked(1, &md->uevent_seq);
31362 uint32_t dm_get_event_nr(struct mapped_device *md)
31364 - return atomic_read(&md->event_nr);
31365 + return atomic_read_unchecked(&md->event_nr);
31368 int dm_wait_event(struct mapped_device *md, int event_nr)
31370 return wait_event_interruptible(md->eventq,
31371 - (event_nr != atomic_read(&md->event_nr)));
31372 + (event_nr != atomic_read_unchecked(&md->event_nr)));
31375 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31376 diff --git a/drivers/md/md.c b/drivers/md/md.c
31377 index 5c95ccb..217fa57 100644
31378 --- a/drivers/md/md.c
31379 +++ b/drivers/md/md.c
31380 @@ -280,10 +280,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
31381 * start build, activate spare
31383 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31384 -static atomic_t md_event_count;
31385 +static atomic_unchecked_t md_event_count;
31386 void md_new_event(mddev_t *mddev)
31388 - atomic_inc(&md_event_count);
31389 + atomic_inc_unchecked(&md_event_count);
31390 wake_up(&md_event_waiters);
31392 EXPORT_SYMBOL_GPL(md_new_event);
31393 @@ -293,7 +293,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31395 static void md_new_event_inintr(mddev_t *mddev)
31397 - atomic_inc(&md_event_count);
31398 + atomic_inc_unchecked(&md_event_count);
31399 wake_up(&md_event_waiters);
31402 @@ -1531,7 +1531,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
31404 rdev->preferred_minor = 0xffff;
31405 rdev->data_offset = le64_to_cpu(sb->data_offset);
31406 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31407 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31409 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31410 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31411 @@ -1748,7 +1748,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
31413 sb->resync_offset = cpu_to_le64(0);
31415 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31416 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31418 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31419 sb->size = cpu_to_le64(mddev->dev_sectors);
31420 @@ -2643,7 +2643,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
31422 errors_show(mdk_rdev_t *rdev, char *page)
31424 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31425 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31429 @@ -2652,7 +2652,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
31431 unsigned long n = simple_strtoul(buf, &e, 10);
31432 if (*buf && (*e == 0 || *e == '\n')) {
31433 - atomic_set(&rdev->corrected_errors, n);
31434 + atomic_set_unchecked(&rdev->corrected_errors, n);
31438 @@ -3042,8 +3042,8 @@ int md_rdev_init(mdk_rdev_t *rdev)
31439 rdev->sb_loaded = 0;
31440 rdev->bb_page = NULL;
31441 atomic_set(&rdev->nr_pending, 0);
31442 - atomic_set(&rdev->read_errors, 0);
31443 - atomic_set(&rdev->corrected_errors, 0);
31444 + atomic_set_unchecked(&rdev->read_errors, 0);
31445 + atomic_set_unchecked(&rdev->corrected_errors, 0);
31447 INIT_LIST_HEAD(&rdev->same_set);
31448 init_waitqueue_head(&rdev->blocked_wait);
31449 @@ -6667,7 +6667,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31451 spin_unlock(&pers_lock);
31452 seq_printf(seq, "\n");
31453 - seq->poll_event = atomic_read(&md_event_count);
31454 + seq->poll_event = atomic_read_unchecked(&md_event_count);
31457 if (v == (void*)2) {
31458 @@ -6756,7 +6756,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
31459 chunk_kb ? "KB" : "B");
31460 if (bitmap->file) {
31461 seq_printf(seq, ", file: ");
31462 - seq_path(seq, &bitmap->file->f_path, " \t\n");
31463 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31466 seq_printf(seq, "\n");
31467 @@ -6787,7 +6787,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
31470 seq = file->private_data;
31471 - seq->poll_event = atomic_read(&md_event_count);
31472 + seq->poll_event = atomic_read_unchecked(&md_event_count);
31476 @@ -6801,7 +6801,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
31477 /* always allow read */
31478 mask = POLLIN | POLLRDNORM;
31480 - if (seq->poll_event != atomic_read(&md_event_count))
31481 + if (seq->poll_event != atomic_read_unchecked(&md_event_count))
31482 mask |= POLLERR | POLLPRI;
31485 @@ -6845,7 +6845,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
31486 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31487 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31488 (int)part_stat_read(&disk->part0, sectors[1]) -
31489 - atomic_read(&disk->sync_io);
31490 + atomic_read_unchecked(&disk->sync_io);
31491 /* sync IO will cause sync_io to increase before the disk_stats
31492 * as sync_io is counted when a request starts, and
31493 * disk_stats is counted when it completes.
31494 diff --git a/drivers/md/md.h b/drivers/md/md.h
31495 index 0a309dc..7e01d7f 100644
31496 --- a/drivers/md/md.h
31497 +++ b/drivers/md/md.h
31498 @@ -124,13 +124,13 @@ struct mdk_rdev_s
31499 * only maintained for arrays that
31500 * support hot removal
31502 - atomic_t read_errors; /* number of consecutive read errors that
31503 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
31504 * we have tried to ignore.
31506 struct timespec last_read_error; /* monotonic time since our
31509 - atomic_t corrected_errors; /* number of corrected read errors,
31510 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
31511 * for reporting to userspace and storing
31514 @@ -415,7 +415,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
31516 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
31518 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31519 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
31522 struct mdk_personality
31523 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
31524 index d9587df..83a0dc3 100644
31525 --- a/drivers/md/raid1.c
31526 +++ b/drivers/md/raid1.c
31527 @@ -1541,7 +1541,7 @@ static int fix_sync_read_error(r1bio_t *r1_bio)
31528 if (r1_sync_page_io(rdev, sect, s,
31529 bio->bi_io_vec[idx].bv_page,
31531 - atomic_add(s, &rdev->corrected_errors);
31532 + atomic_add_unchecked(s, &rdev->corrected_errors);
31536 @@ -1754,7 +1754,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
31537 test_bit(In_sync, &rdev->flags)) {
31538 if (r1_sync_page_io(rdev, sect, s,
31539 conf->tmppage, READ)) {
31540 - atomic_add(s, &rdev->corrected_errors);
31541 + atomic_add_unchecked(s, &rdev->corrected_errors);
31543 "md/raid1:%s: read error corrected "
31544 "(%d sectors at %llu on %s)\n",
31545 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
31546 index 1d44228..98db57d 100644
31547 --- a/drivers/md/raid10.c
31548 +++ b/drivers/md/raid10.c
31549 @@ -1423,7 +1423,7 @@ static void end_sync_read(struct bio *bio, int error)
31550 /* The write handler will notice the lack of
31551 * R10BIO_Uptodate and record any errors etc
31553 - atomic_add(r10_bio->sectors,
31554 + atomic_add_unchecked(r10_bio->sectors,
31555 &conf->mirrors[d].rdev->corrected_errors);
31557 /* for reconstruct, we always reschedule after a read.
31558 @@ -1723,7 +1723,7 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31560 struct timespec cur_time_mon;
31561 unsigned long hours_since_last;
31562 - unsigned int read_errors = atomic_read(&rdev->read_errors);
31563 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
31565 ktime_get_ts(&cur_time_mon);
31567 @@ -1745,9 +1745,9 @@ static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
31568 * overflowing the shift of read_errors by hours_since_last.
31570 if (hours_since_last >= 8 * sizeof(read_errors))
31571 - atomic_set(&rdev->read_errors, 0);
31572 + atomic_set_unchecked(&rdev->read_errors, 0);
31574 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
31575 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
31578 static int r10_sync_page_io(mdk_rdev_t *rdev, sector_t sector,
31579 @@ -1797,8 +1797,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31582 check_decay_read_errors(mddev, rdev);
31583 - atomic_inc(&rdev->read_errors);
31584 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
31585 + atomic_inc_unchecked(&rdev->read_errors);
31586 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
31587 char b[BDEVNAME_SIZE];
31588 bdevname(rdev->bdev, b);
31590 @@ -1806,7 +1806,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31591 "md/raid10:%s: %s: Raid device exceeded "
31592 "read_error threshold [cur %d:max %d]\n",
31594 - atomic_read(&rdev->read_errors), max_read_errors);
31595 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
31597 "md/raid10:%s: %s: Failing raid device\n",
31599 @@ -1951,7 +1951,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
31600 (unsigned long long)(
31601 sect + rdev->data_offset),
31602 bdevname(rdev->bdev, b));
31603 - atomic_add(s, &rdev->corrected_errors);
31604 + atomic_add_unchecked(s, &rdev->corrected_errors);
31607 rdev_dec_pending(rdev, mddev);
31608 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
31609 index b6200c3..02e8702 100644
31610 --- a/drivers/md/raid5.c
31611 +++ b/drivers/md/raid5.c
31612 @@ -1616,19 +1616,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
31613 (unsigned long long)(sh->sector
31614 + rdev->data_offset),
31615 bdevname(rdev->bdev, b));
31616 - atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
31617 + atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
31618 clear_bit(R5_ReadError, &sh->dev[i].flags);
31619 clear_bit(R5_ReWrite, &sh->dev[i].flags);
31621 - if (atomic_read(&conf->disks[i].rdev->read_errors))
31622 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
31623 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
31624 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
31626 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
31628 rdev = conf->disks[i].rdev;
31630 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
31631 - atomic_inc(&rdev->read_errors);
31632 + atomic_inc_unchecked(&rdev->read_errors);
31633 if (conf->mddev->degraded >= conf->max_degraded)
31634 printk_ratelimited(
31636 @@ -1648,7 +1648,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
31637 (unsigned long long)(sh->sector
31638 + rdev->data_offset),
31640 - else if (atomic_read(&rdev->read_errors)
31641 + else if (atomic_read_unchecked(&rdev->read_errors)
31642 > conf->max_nr_stripes)
31643 printk(KERN_WARNING
31644 "md/raid:%s: Too many read errors, failing device %s.\n",
31645 @@ -1978,6 +1978,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
31647 struct stripe_head sh2;
31649 + pax_track_stack();
31651 chunk_offset = sector_div(new_sector, sectors_per_chunk);
31652 stripe = new_sector;
31653 diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
31654 index 1d1d8d2..6c6837a 100644
31655 --- a/drivers/media/common/saa7146_hlp.c
31656 +++ b/drivers/media/common/saa7146_hlp.c
31657 @@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
31659 int x[32], y[32], w[32], h[32];
31661 + pax_track_stack();
31663 /* clear out memory */
31664 memset(&line_list[0], 0x00, sizeof(u32)*32);
31665 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
31666 diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
31667 index 573d540..16f78f3 100644
31668 --- a/drivers/media/dvb/ddbridge/ddbridge-core.c
31669 +++ b/drivers/media/dvb/ddbridge/ddbridge-core.c
31670 @@ -1675,7 +1675,7 @@ static struct ddb_info ddb_v6 = {
31671 .subvendor = _subvend, .subdevice = _subdev, \
31672 .driver_data = (unsigned long)&_driverdata }
31674 -static const struct pci_device_id ddb_id_tbl[] __devinitdata = {
31675 +static const struct pci_device_id ddb_id_tbl[] __devinitconst = {
31676 DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
31677 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
31678 DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
31679 diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31680 index 7ea517b..252fe54 100644
31681 --- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31682 +++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
31683 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
31684 u8 buf[HOST_LINK_BUF_SIZE];
31687 + pax_track_stack();
31689 dprintk("%s\n", __func__);
31691 /* check if we have space for a link buf in the rx_buffer */
31692 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
31693 unsigned long timeout;
31696 + pax_track_stack();
31698 dprintk("%s\n", __func__);
31700 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
31701 diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
31702 index a7d876f..8c21b61 100644
31703 --- a/drivers/media/dvb/dvb-core/dvb_demux.h
31704 +++ b/drivers/media/dvb/dvb-core/dvb_demux.h
31705 @@ -73,7 +73,7 @@ struct dvb_demux_feed {
31708 dmx_section_cb sec;
31712 struct dvb_demux *demux;
31714 diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
31715 index f732877..d38c35a 100644
31716 --- a/drivers/media/dvb/dvb-core/dvbdev.c
31717 +++ b/drivers/media/dvb/dvb-core/dvbdev.c
31718 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
31719 const struct dvb_device *template, void *priv, int type)
31721 struct dvb_device *dvbdev;
31722 - struct file_operations *dvbdevfops;
31723 + file_operations_no_const *dvbdevfops;
31724 struct device *clsdev;
31727 diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
31728 index acb5fb2..2413f1d 100644
31729 --- a/drivers/media/dvb/dvb-usb/cxusb.c
31730 +++ b/drivers/media/dvb/dvb-usb/cxusb.c
31731 @@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
31732 struct dib0700_adapter_state {
31733 int (*set_param_save) (struct dvb_frontend *,
31734 struct dvb_frontend_parameters *);
31738 static int dib7070_set_param_override(struct dvb_frontend *fe,
31739 struct dvb_frontend_parameters *fep)
31740 diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
31741 index a224e94..503b76a 100644
31742 --- a/drivers/media/dvb/dvb-usb/dib0700_core.c
31743 +++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
31744 @@ -478,6 +478,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
31748 + pax_track_stack();
31750 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
31751 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
31752 hx.addr, hx.len, hx.chk);
31753 diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
31754 index 058b231..183d2b3 100644
31755 --- a/drivers/media/dvb/dvb-usb/dw2102.c
31756 +++ b/drivers/media/dvb/dvb-usb/dw2102.c
31757 @@ -95,7 +95,7 @@ struct su3000_state {
31759 struct s6x0_state {
31760 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
31765 static int dvb_usb_dw2102_debug;
31766 diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
31767 index 37b1469..28a6f6f 100644
31768 --- a/drivers/media/dvb/dvb-usb/lmedm04.c
31769 +++ b/drivers/media/dvb/dvb-usb/lmedm04.c
31770 @@ -742,6 +742,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
31771 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
31772 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
31774 + pax_track_stack();
31778 @@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_device *dev)
31779 int ret = 0, len_in;
31780 u8 data[512] = {0};
31782 + pax_track_stack();
31786 info("FRM Firmware Cold Reset");
31787 diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
31788 index ba91735..4261d84 100644
31789 --- a/drivers/media/dvb/frontends/dib3000.h
31790 +++ b/drivers/media/dvb/frontends/dib3000.h
31791 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
31792 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
31793 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
31794 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
31798 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
31799 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
31800 diff --git a/drivers/media/dvb/frontends/mb86a16.c b/drivers/media/dvb/frontends/mb86a16.c
31801 index c283112..7f367a7 100644
31802 --- a/drivers/media/dvb/frontends/mb86a16.c
31803 +++ b/drivers/media/dvb/frontends/mb86a16.c
31804 @@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16_state *state)
31808 + pax_track_stack();
31810 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
31813 diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
31814 index c709ce6..b3fe620 100644
31815 --- a/drivers/media/dvb/frontends/or51211.c
31816 +++ b/drivers/media/dvb/frontends/or51211.c
31817 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
31821 + pax_track_stack();
31823 dprintk("Firmware is %zd bytes\n",fw->size);
31825 /* Get eprom data */
31826 diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
31827 index 0564192..75b16f5 100644
31828 --- a/drivers/media/dvb/ngene/ngene-cards.c
31829 +++ b/drivers/media/dvb/ngene/ngene-cards.c
31830 @@ -477,7 +477,7 @@ static struct ngene_info ngene_info_m780 = {
31832 /****************************************************************************/
31834 -static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
31835 +static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
31836 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
31837 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
31838 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
31839 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
31840 index 16a089f..ab1667d 100644
31841 --- a/drivers/media/radio/radio-cadet.c
31842 +++ b/drivers/media/radio/radio-cadet.c
31843 @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
31844 unsigned char readbuf[RDS_BUFFER];
31847 + if (count > RDS_BUFFER)
31849 mutex_lock(&dev->lock);
31850 if (dev->rdsstat == 0) {
31852 diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
31853 index 9cde353..8c6a1c3 100644
31854 --- a/drivers/media/video/au0828/au0828.h
31855 +++ b/drivers/media/video/au0828/au0828.h
31856 @@ -191,7 +191,7 @@ struct au0828_dev {
31859 struct i2c_adapter i2c_adap;
31860 - struct i2c_algorithm i2c_algo;
31861 + i2c_algorithm_no_const i2c_algo;
31862 struct i2c_client i2c_client;
31865 diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
31866 index 9e2f870..22e3a08 100644
31867 --- a/drivers/media/video/cx18/cx18-driver.c
31868 +++ b/drivers/media/video/cx18/cx18-driver.c
31869 @@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
31870 struct i2c_client c;
31873 + pax_track_stack();
31875 memset(&c, 0, sizeof(c));
31876 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
31877 c.adapter = &cx->i2c_adap[0];
31878 diff --git a/drivers/media/video/cx23885/cx23885-input.c b/drivers/media/video/cx23885/cx23885-input.c
31879 index ce765e3..f9e1b04 100644
31880 --- a/drivers/media/video/cx23885/cx23885-input.c
31881 +++ b/drivers/media/video/cx23885/cx23885-input.c
31882 @@ -53,6 +53,8 @@ static void cx23885_input_process_measurements(struct cx23885_dev *dev,
31883 bool handle = false;
31884 struct ir_raw_event ir_core_event[64];
31886 + pax_track_stack();
31890 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
31891 diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
31892 index 68d1240..46b32eb 100644
31893 --- a/drivers/media/video/cx88/cx88-alsa.c
31894 +++ b/drivers/media/video/cx88/cx88-alsa.c
31895 @@ -766,7 +766,7 @@ static struct snd_kcontrol_new snd_cx88_alc_switch = {
31896 * Only boards with eeprom and byte 1 at eeprom=1 have it
31899 -static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
31900 +static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
31901 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31902 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
31904 diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31905 index 9515f3a..c9ecb85 100644
31906 --- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31907 +++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
31908 @@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
31910 struct tveeprom tvdata;
31912 + pax_track_stack();
31914 memset(&tvdata,0,sizeof(tvdata));
31916 eeprom = pvr2_eeprom_fetch(hdw);
31917 diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31918 index 305e6aa..0143317 100644
31919 --- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31920 +++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
31921 @@ -196,7 +196,7 @@ struct pvr2_hdw {
31924 struct i2c_adapter i2c_adap;
31925 - struct i2c_algorithm i2c_algo;
31926 + i2c_algorithm_no_const i2c_algo;
31927 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
31928 int i2c_cx25840_hack_state;
31930 diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
31931 index f9f29cc..5a2e330 100644
31932 --- a/drivers/media/video/saa7134/saa6752hs.c
31933 +++ b/drivers/media/video/saa7134/saa6752hs.c
31934 @@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
31935 unsigned char localPAT[256];
31936 unsigned char localPMT[256];
31938 + pax_track_stack();
31940 /* Set video format - must be done first as it resets other settings */
31941 set_reg8(client, 0x41, h->video_format);
31943 diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
31944 index 62fac7f..f29e0b9 100644
31945 --- a/drivers/media/video/saa7164/saa7164-cmd.c
31946 +++ b/drivers/media/video/saa7164/saa7164-cmd.c
31947 @@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
31949 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31951 + pax_track_stack();
31953 /* While any outstand message on the bus exists... */
31956 @@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
31958 dprintk(DBGLVL_CMD, "%s()\n", __func__);
31960 + pax_track_stack();
31964 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
31965 diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
31966 index 84cd1b6..f741e07 100644
31967 --- a/drivers/media/video/timblogiw.c
31968 +++ b/drivers/media/video/timblogiw.c
31969 @@ -744,7 +744,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
31971 /* Platform device functions */
31973 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31974 +static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
31975 .vidioc_querycap = timblogiw_querycap,
31976 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
31977 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
31978 @@ -766,7 +766,7 @@ static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
31979 .vidioc_enum_framesizes = timblogiw_enum_framesizes,
31982 -static __devinitconst struct v4l2_file_operations timblogiw_fops = {
31983 +static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
31984 .owner = THIS_MODULE,
31985 .open = timblogiw_open,
31986 .release = timblogiw_close,
31987 diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
31988 index f344411..6ae9974 100644
31989 --- a/drivers/media/video/usbvision/usbvision-core.c
31990 +++ b/drivers/media/video/usbvision/usbvision-core.c
31991 @@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_compress(struct usb_usbvision *usbvision
31992 unsigned char rv, gv, bv;
31993 static unsigned char *Y, *U, *V;
31995 + pax_track_stack();
31997 frame = usbvision->cur_frame;
31998 image_size = frame->frmwidth * frame->frmheight;
31999 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
32000 diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
32001 index f300dea..04834ba 100644
32002 --- a/drivers/media/video/videobuf-dma-sg.c
32003 +++ b/drivers/media/video/videobuf-dma-sg.c
32004 @@ -607,6 +607,8 @@ void *videobuf_sg_alloc(size_t size)
32006 struct videobuf_queue q;
32008 + pax_track_stack();
32010 /* Required to make generic handler to call __videobuf_alloc */
32011 q.int_ops = &sg_ops;
32013 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
32014 index 7956a10..f39232f 100644
32015 --- a/drivers/message/fusion/mptbase.c
32016 +++ b/drivers/message/fusion/mptbase.c
32017 @@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
32018 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
32019 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
32021 +#ifdef CONFIG_GRKERNSEC_HIDESYM
32022 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
32024 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
32025 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
32029 * Rounding UP to nearest 4-kB boundary here...
32031 diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
32032 index 7596aec..f7ae9aa 100644
32033 --- a/drivers/message/fusion/mptsas.c
32034 +++ b/drivers/message/fusion/mptsas.c
32035 @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
32039 +static inline void
32040 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32042 + if (phy_info->port_details) {
32043 + phy_info->port_details->rphy = rphy;
32044 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32045 + ioc->name, rphy));
32049 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32050 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32051 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32052 + ioc->name, rphy, rphy->dev.release));
32058 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
32059 @@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
32063 -static inline void
32064 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32066 - if (phy_info->port_details) {
32067 - phy_info->port_details->rphy = rphy;
32068 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32069 - ioc->name, rphy));
32073 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32074 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32075 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32076 - ioc->name, rphy, rphy->dev.release));
32080 static inline struct sas_port *
32081 mptsas_get_port(struct mptsas_phyinfo *phy_info)
32083 diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
32084 index ce61a57..3da8862 100644
32085 --- a/drivers/message/fusion/mptscsih.c
32086 +++ b/drivers/message/fusion/mptscsih.c
32087 @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
32089 h = shost_priv(SChost);
32092 - if (h->info_kbuf == NULL)
32093 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32094 - return h->info_kbuf;
32095 - h->info_kbuf[0] = '\0';
32099 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32100 - h->info_kbuf[size-1] = '\0';
32102 + if (h->info_kbuf == NULL)
32103 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32104 + return h->info_kbuf;
32105 + h->info_kbuf[0] = '\0';
32107 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32108 + h->info_kbuf[size-1] = '\0';
32110 return h->info_kbuf;
32112 diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
32113 index 098de2b..fbb922c 100644
32114 --- a/drivers/message/i2o/i2o_config.c
32115 +++ b/drivers/message/i2o/i2o_config.c
32116 @@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned long arg)
32117 struct i2o_message *msg;
32120 + pax_track_stack();
32122 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
32125 diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
32126 index 07dbeaf..5533142 100644
32127 --- a/drivers/message/i2o/i2o_proc.c
32128 +++ b/drivers/message/i2o/i2o_proc.c
32129 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
32130 "Array Controller Device"
32133 -static char *chtostr(u8 * chars, int n)
32137 - return strncat(tmp, (char *)chars, n);
32140 static int i2o_report_query_status(struct seq_file *seq, int block_status,
32143 @@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
32145 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
32146 seq_printf(seq, "%-#8x", ddm_table.module_id);
32147 - seq_printf(seq, "%-29s",
32148 - chtostr(ddm_table.module_name_version, 28));
32149 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
32150 seq_printf(seq, "%9d ", ddm_table.data_size);
32151 seq_printf(seq, "%8d", ddm_table.code_size);
32153 @@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
32155 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
32156 seq_printf(seq, "%-#8x", dst->module_id);
32157 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
32158 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
32159 + seq_printf(seq, "%-.28s", dst->module_name_version);
32160 + seq_printf(seq, "%-.8s", dst->date);
32161 seq_printf(seq, "%8d ", dst->module_size);
32162 seq_printf(seq, "%8d ", dst->mpb_size);
32163 seq_printf(seq, "0x%04x", dst->module_flags);
32164 @@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
32165 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
32166 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
32167 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
32168 - seq_printf(seq, "Vendor info : %s\n",
32169 - chtostr((u8 *) (work32 + 2), 16));
32170 - seq_printf(seq, "Product info : %s\n",
32171 - chtostr((u8 *) (work32 + 6), 16));
32172 - seq_printf(seq, "Description : %s\n",
32173 - chtostr((u8 *) (work32 + 10), 16));
32174 - seq_printf(seq, "Product rev. : %s\n",
32175 - chtostr((u8 *) (work32 + 14), 8));
32176 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
32177 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
32178 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
32179 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
32181 seq_printf(seq, "Serial number : ");
32182 print_serial_number(seq, (u8 *) (work32 + 16),
32183 @@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
32186 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
32187 - seq_printf(seq, "Module name : %s\n",
32188 - chtostr(result.module_name, 24));
32189 - seq_printf(seq, "Module revision : %s\n",
32190 - chtostr(result.module_rev, 8));
32191 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
32192 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
32194 seq_printf(seq, "Serial number : ");
32195 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
32196 @@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
32200 - seq_printf(seq, "Device name : %s\n",
32201 - chtostr(result.device_name, 64));
32202 - seq_printf(seq, "Service name : %s\n",
32203 - chtostr(result.service_name, 64));
32204 - seq_printf(seq, "Physical name : %s\n",
32205 - chtostr(result.physical_location, 64));
32206 - seq_printf(seq, "Instance number : %s\n",
32207 - chtostr(result.instance_number, 4));
32208 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
32209 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
32210 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
32211 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
32215 diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
32216 index a8c08f3..155fe3d 100644
32217 --- a/drivers/message/i2o/iop.c
32218 +++ b/drivers/message/i2o/iop.c
32219 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
32221 spin_lock_irqsave(&c->context_list_lock, flags);
32223 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
32224 - atomic_inc(&c->context_list_counter);
32225 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
32226 + atomic_inc_unchecked(&c->context_list_counter);
32228 - entry->context = atomic_read(&c->context_list_counter);
32229 + entry->context = atomic_read_unchecked(&c->context_list_counter);
32231 list_add(&entry->list, &c->context_list);
32233 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
32235 #if BITS_PER_LONG == 64
32236 spin_lock_init(&c->context_list_lock);
32237 - atomic_set(&c->context_list_counter, 0);
32238 + atomic_set_unchecked(&c->context_list_counter, 0);
32239 INIT_LIST_HEAD(&c->context_list);
32242 diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
32243 index a20e1c4..4f57255 100644
32244 --- a/drivers/mfd/ab3100-core.c
32245 +++ b/drivers/mfd/ab3100-core.c
32246 @@ -809,7 +809,7 @@ struct ab_family_id {
32250 -static const struct ab_family_id ids[] __devinitdata = {
32251 +static const struct ab_family_id ids[] __devinitconst = {
32255 diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
32256 index f12720d..3c251fd 100644
32257 --- a/drivers/mfd/abx500-core.c
32258 +++ b/drivers/mfd/abx500-core.c
32259 @@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
32261 struct abx500_device_entry {
32262 struct list_head list;
32263 - struct abx500_ops ops;
32264 + abx500_ops_no_const ops;
32265 struct device *dev;
32268 diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
32269 index 5c2a06a..8fa077c 100644
32270 --- a/drivers/mfd/janz-cmodio.c
32271 +++ b/drivers/mfd/janz-cmodio.c
32274 #include <linux/kernel.h>
32275 #include <linux/module.h>
32276 +#include <linux/slab.h>
32277 #include <linux/init.h>
32278 #include <linux/pci.h>
32279 #include <linux/interrupt.h>
32280 diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
32281 index 5fe5de1..af64f53 100644
32282 --- a/drivers/mfd/wm8350-i2c.c
32283 +++ b/drivers/mfd/wm8350-i2c.c
32284 @@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
32285 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
32288 + pax_track_stack();
32290 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
32293 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
32294 index 8b51cd6..f628f8d 100644
32295 --- a/drivers/misc/lis3lv02d/lis3lv02d.c
32296 +++ b/drivers/misc/lis3lv02d/lis3lv02d.c
32297 @@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
32298 * the lid is closed. This leads to interrupts as soon as a little move
32301 - atomic_inc(&lis3_dev.count);
32302 + atomic_inc_unchecked(&lis3_dev.count);
32304 wake_up_interruptible(&lis3_dev.misc_wait);
32305 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
32306 @@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
32307 if (lis3_dev.pm_dev)
32308 pm_runtime_get_sync(lis3_dev.pm_dev);
32310 - atomic_set(&lis3_dev.count, 0);
32311 + atomic_set_unchecked(&lis3_dev.count, 0);
32315 @@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
32316 add_wait_queue(&lis3_dev.misc_wait, &wait);
32318 set_current_state(TASK_INTERRUPTIBLE);
32319 - data = atomic_xchg(&lis3_dev.count, 0);
32320 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
32324 @@ -585,7 +585,7 @@ out:
32325 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
32327 poll_wait(file, &lis3_dev.misc_wait, wait);
32328 - if (atomic_read(&lis3_dev.count))
32329 + if (atomic_read_unchecked(&lis3_dev.count))
32330 return POLLIN | POLLRDNORM;
32333 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
32334 index a193958..4d7ecd2 100644
32335 --- a/drivers/misc/lis3lv02d/lis3lv02d.h
32336 +++ b/drivers/misc/lis3lv02d/lis3lv02d.h
32337 @@ -265,7 +265,7 @@ struct lis3lv02d {
32338 struct input_polled_dev *idev; /* input device */
32339 struct platform_device *pdev; /* platform device */
32340 struct regulator_bulk_data regulators[2];
32341 - atomic_t count; /* interrupt count after last read */
32342 + atomic_unchecked_t count; /* interrupt count after last read */
32343 union axis_conversion ac; /* hw -> logical axis */
32344 int mapped_btns[3];
32346 diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
32347 index 2f30bad..c4c13d0 100644
32348 --- a/drivers/misc/sgi-gru/gruhandles.c
32349 +++ b/drivers/misc/sgi-gru/gruhandles.c
32350 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
32351 unsigned long nsec;
32353 nsec = CLKS2NSEC(clks);
32354 - atomic_long_inc(&mcs_op_statistics[op].count);
32355 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
32356 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
32357 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
32358 if (mcs_op_statistics[op].max < nsec)
32359 mcs_op_statistics[op].max = nsec;
32361 diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
32362 index 7768b87..f8aac38 100644
32363 --- a/drivers/misc/sgi-gru/gruprocfs.c
32364 +++ b/drivers/misc/sgi-gru/gruprocfs.c
32367 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
32369 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
32370 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
32372 - unsigned long val = atomic_long_read(v);
32373 + unsigned long val = atomic_long_read_unchecked(v);
32375 seq_printf(s, "%16lu %s\n", val, id);
32377 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
32379 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
32380 for (op = 0; op < mcsop_last; op++) {
32381 - count = atomic_long_read(&mcs_op_statistics[op].count);
32382 - total = atomic_long_read(&mcs_op_statistics[op].total);
32383 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
32384 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
32385 max = mcs_op_statistics[op].max;
32386 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
32387 count ? total / count : 0, max);
32388 diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
32389 index 5c3ce24..4915ccb 100644
32390 --- a/drivers/misc/sgi-gru/grutables.h
32391 +++ b/drivers/misc/sgi-gru/grutables.h
32392 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
32395 struct gru_stats_s {
32396 - atomic_long_t vdata_alloc;
32397 - atomic_long_t vdata_free;
32398 - atomic_long_t gts_alloc;
32399 - atomic_long_t gts_free;
32400 - atomic_long_t gms_alloc;
32401 - atomic_long_t gms_free;
32402 - atomic_long_t gts_double_allocate;
32403 - atomic_long_t assign_context;
32404 - atomic_long_t assign_context_failed;
32405 - atomic_long_t free_context;
32406 - atomic_long_t load_user_context;
32407 - atomic_long_t load_kernel_context;
32408 - atomic_long_t lock_kernel_context;
32409 - atomic_long_t unlock_kernel_context;
32410 - atomic_long_t steal_user_context;
32411 - atomic_long_t steal_kernel_context;
32412 - atomic_long_t steal_context_failed;
32413 - atomic_long_t nopfn;
32414 - atomic_long_t asid_new;
32415 - atomic_long_t asid_next;
32416 - atomic_long_t asid_wrap;
32417 - atomic_long_t asid_reuse;
32418 - atomic_long_t intr;
32419 - atomic_long_t intr_cbr;
32420 - atomic_long_t intr_tfh;
32421 - atomic_long_t intr_spurious;
32422 - atomic_long_t intr_mm_lock_failed;
32423 - atomic_long_t call_os;
32424 - atomic_long_t call_os_wait_queue;
32425 - atomic_long_t user_flush_tlb;
32426 - atomic_long_t user_unload_context;
32427 - atomic_long_t user_exception;
32428 - atomic_long_t set_context_option;
32429 - atomic_long_t check_context_retarget_intr;
32430 - atomic_long_t check_context_unload;
32431 - atomic_long_t tlb_dropin;
32432 - atomic_long_t tlb_preload_page;
32433 - atomic_long_t tlb_dropin_fail_no_asid;
32434 - atomic_long_t tlb_dropin_fail_upm;
32435 - atomic_long_t tlb_dropin_fail_invalid;
32436 - atomic_long_t tlb_dropin_fail_range_active;
32437 - atomic_long_t tlb_dropin_fail_idle;
32438 - atomic_long_t tlb_dropin_fail_fmm;
32439 - atomic_long_t tlb_dropin_fail_no_exception;
32440 - atomic_long_t tfh_stale_on_fault;
32441 - atomic_long_t mmu_invalidate_range;
32442 - atomic_long_t mmu_invalidate_page;
32443 - atomic_long_t flush_tlb;
32444 - atomic_long_t flush_tlb_gru;
32445 - atomic_long_t flush_tlb_gru_tgh;
32446 - atomic_long_t flush_tlb_gru_zero_asid;
32447 + atomic_long_unchecked_t vdata_alloc;
32448 + atomic_long_unchecked_t vdata_free;
32449 + atomic_long_unchecked_t gts_alloc;
32450 + atomic_long_unchecked_t gts_free;
32451 + atomic_long_unchecked_t gms_alloc;
32452 + atomic_long_unchecked_t gms_free;
32453 + atomic_long_unchecked_t gts_double_allocate;
32454 + atomic_long_unchecked_t assign_context;
32455 + atomic_long_unchecked_t assign_context_failed;
32456 + atomic_long_unchecked_t free_context;
32457 + atomic_long_unchecked_t load_user_context;
32458 + atomic_long_unchecked_t load_kernel_context;
32459 + atomic_long_unchecked_t lock_kernel_context;
32460 + atomic_long_unchecked_t unlock_kernel_context;
32461 + atomic_long_unchecked_t steal_user_context;
32462 + atomic_long_unchecked_t steal_kernel_context;
32463 + atomic_long_unchecked_t steal_context_failed;
32464 + atomic_long_unchecked_t nopfn;
32465 + atomic_long_unchecked_t asid_new;
32466 + atomic_long_unchecked_t asid_next;
32467 + atomic_long_unchecked_t asid_wrap;
32468 + atomic_long_unchecked_t asid_reuse;
32469 + atomic_long_unchecked_t intr;
32470 + atomic_long_unchecked_t intr_cbr;
32471 + atomic_long_unchecked_t intr_tfh;
32472 + atomic_long_unchecked_t intr_spurious;
32473 + atomic_long_unchecked_t intr_mm_lock_failed;
32474 + atomic_long_unchecked_t call_os;
32475 + atomic_long_unchecked_t call_os_wait_queue;
32476 + atomic_long_unchecked_t user_flush_tlb;
32477 + atomic_long_unchecked_t user_unload_context;
32478 + atomic_long_unchecked_t user_exception;
32479 + atomic_long_unchecked_t set_context_option;
32480 + atomic_long_unchecked_t check_context_retarget_intr;
32481 + atomic_long_unchecked_t check_context_unload;
32482 + atomic_long_unchecked_t tlb_dropin;
32483 + atomic_long_unchecked_t tlb_preload_page;
32484 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
32485 + atomic_long_unchecked_t tlb_dropin_fail_upm;
32486 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
32487 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
32488 + atomic_long_unchecked_t tlb_dropin_fail_idle;
32489 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
32490 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
32491 + atomic_long_unchecked_t tfh_stale_on_fault;
32492 + atomic_long_unchecked_t mmu_invalidate_range;
32493 + atomic_long_unchecked_t mmu_invalidate_page;
32494 + atomic_long_unchecked_t flush_tlb;
32495 + atomic_long_unchecked_t flush_tlb_gru;
32496 + atomic_long_unchecked_t flush_tlb_gru_tgh;
32497 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
32499 - atomic_long_t copy_gpa;
32500 - atomic_long_t read_gpa;
32501 + atomic_long_unchecked_t copy_gpa;
32502 + atomic_long_unchecked_t read_gpa;
32504 - atomic_long_t mesq_receive;
32505 - atomic_long_t mesq_receive_none;
32506 - atomic_long_t mesq_send;
32507 - atomic_long_t mesq_send_failed;
32508 - atomic_long_t mesq_noop;
32509 - atomic_long_t mesq_send_unexpected_error;
32510 - atomic_long_t mesq_send_lb_overflow;
32511 - atomic_long_t mesq_send_qlimit_reached;
32512 - atomic_long_t mesq_send_amo_nacked;
32513 - atomic_long_t mesq_send_put_nacked;
32514 - atomic_long_t mesq_page_overflow;
32515 - atomic_long_t mesq_qf_locked;
32516 - atomic_long_t mesq_qf_noop_not_full;
32517 - atomic_long_t mesq_qf_switch_head_failed;
32518 - atomic_long_t mesq_qf_unexpected_error;
32519 - atomic_long_t mesq_noop_unexpected_error;
32520 - atomic_long_t mesq_noop_lb_overflow;
32521 - atomic_long_t mesq_noop_qlimit_reached;
32522 - atomic_long_t mesq_noop_amo_nacked;
32523 - atomic_long_t mesq_noop_put_nacked;
32524 - atomic_long_t mesq_noop_page_overflow;
32525 + atomic_long_unchecked_t mesq_receive;
32526 + atomic_long_unchecked_t mesq_receive_none;
32527 + atomic_long_unchecked_t mesq_send;
32528 + atomic_long_unchecked_t mesq_send_failed;
32529 + atomic_long_unchecked_t mesq_noop;
32530 + atomic_long_unchecked_t mesq_send_unexpected_error;
32531 + atomic_long_unchecked_t mesq_send_lb_overflow;
32532 + atomic_long_unchecked_t mesq_send_qlimit_reached;
32533 + atomic_long_unchecked_t mesq_send_amo_nacked;
32534 + atomic_long_unchecked_t mesq_send_put_nacked;
32535 + atomic_long_unchecked_t mesq_page_overflow;
32536 + atomic_long_unchecked_t mesq_qf_locked;
32537 + atomic_long_unchecked_t mesq_qf_noop_not_full;
32538 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
32539 + atomic_long_unchecked_t mesq_qf_unexpected_error;
32540 + atomic_long_unchecked_t mesq_noop_unexpected_error;
32541 + atomic_long_unchecked_t mesq_noop_lb_overflow;
32542 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
32543 + atomic_long_unchecked_t mesq_noop_amo_nacked;
32544 + atomic_long_unchecked_t mesq_noop_put_nacked;
32545 + atomic_long_unchecked_t mesq_noop_page_overflow;
32549 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
32550 tghop_invalidate, mcsop_last};
32552 struct mcs_op_statistic {
32553 - atomic_long_t count;
32554 - atomic_long_t total;
32555 + atomic_long_unchecked_t count;
32556 + atomic_long_unchecked_t total;
32560 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
32562 #define STAT(id) do { \
32563 if (gru_options & OPT_STATS) \
32564 - atomic_long_inc(&gru_stats.id); \
32565 + atomic_long_inc_unchecked(&gru_stats.id); \
32568 #ifdef CONFIG_SGI_GRU_DEBUG
32569 diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
32570 index 851b2f2..a4ec097 100644
32571 --- a/drivers/misc/sgi-xp/xp.h
32572 +++ b/drivers/misc/sgi-xp/xp.h
32573 @@ -289,7 +289,7 @@ struct xpc_interface {
32574 xpc_notify_func, void *);
32575 void (*received) (short, int, void *);
32576 enum xp_retval (*partid_to_nasids) (short, void *);
32580 extern struct xpc_interface xpc_interface;
32582 diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
32583 index b94d5f7..7f494c5 100644
32584 --- a/drivers/misc/sgi-xp/xpc.h
32585 +++ b/drivers/misc/sgi-xp/xpc.h
32586 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
32587 void (*received_payload) (struct xpc_channel *, void *);
32588 void (*notify_senders_of_disconnect) (struct xpc_channel *);
32590 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
32592 /* struct xpc_partition act_state values (for XPC HB) */
32594 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
32595 /* found in xpc_main.c */
32596 extern struct device *xpc_part;
32597 extern struct device *xpc_chan;
32598 -extern struct xpc_arch_operations xpc_arch_ops;
32599 +extern xpc_arch_operations_no_const xpc_arch_ops;
32600 extern int xpc_disengage_timelimit;
32601 extern int xpc_disengage_timedout;
32602 extern int xpc_activate_IRQ_rcvd;
32603 diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
32604 index 8d082b4..aa749ae 100644
32605 --- a/drivers/misc/sgi-xp/xpc_main.c
32606 +++ b/drivers/misc/sgi-xp/xpc_main.c
32607 @@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
32608 .notifier_call = xpc_system_die,
32611 -struct xpc_arch_operations xpc_arch_ops;
32612 +xpc_arch_operations_no_const xpc_arch_ops;
32615 * Timer function to enforce the timelimit on the partition disengage.
32616 diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
32617 index 26c5286..292d261 100644
32618 --- a/drivers/mmc/host/sdhci-pci.c
32619 +++ b/drivers/mmc/host/sdhci-pci.c
32620 @@ -542,7 +542,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
32621 .probe = via_probe,
32624 -static const struct pci_device_id pci_ids[] __devinitdata = {
32625 +static const struct pci_device_id pci_ids[] __devinitconst = {
32627 .vendor = PCI_VENDOR_ID_RICOH,
32628 .device = PCI_DEVICE_ID_RICOH_R5C822,
32629 diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
32630 index e1e122f..d99a6ea 100644
32631 --- a/drivers/mtd/chips/cfi_cmdset_0001.c
32632 +++ b/drivers/mtd/chips/cfi_cmdset_0001.c
32633 @@ -757,6 +757,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
32634 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
32635 unsigned long timeo = jiffies + HZ;
32637 + pax_track_stack();
32639 /* Prevent setting state FL_SYNCING for chip in suspended state. */
32640 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
32642 @@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
32643 unsigned long initial_adr;
32644 int initial_len = len;
32646 + pax_track_stack();
32648 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
32649 adr += chip->start;
32651 @@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
32655 + pax_track_stack();
32657 adr += chip->start;
32660 diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
32661 index 179814a..abe9d60 100644
32662 --- a/drivers/mtd/chips/cfi_cmdset_0020.c
32663 +++ b/drivers/mtd/chips/cfi_cmdset_0020.c
32664 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
32665 unsigned long cmd_addr;
32666 struct cfi_private *cfi = map->fldrv_priv;
32668 + pax_track_stack();
32670 adr += chip->start;
32672 /* Ensure cmd read/writes are aligned. */
32673 @@ -429,6 +431,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
32674 DECLARE_WAITQUEUE(wait, current);
32677 + pax_track_stack();
32679 /* M58LW064A requires bus alignment for buffer wriets -- saw */
32680 if (adr & (map_bankwidth(map)-1))
32682 @@ -743,6 +747,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
32683 DECLARE_WAITQUEUE(wait, current);
32686 + pax_track_stack();
32688 adr += chip->start;
32690 /* Let's determine this according to the interleave only once */
32691 @@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
32692 unsigned long timeo = jiffies + HZ;
32693 DECLARE_WAITQUEUE(wait, current);
32695 + pax_track_stack();
32697 adr += chip->start;
32699 /* Let's determine this according to the interleave only once */
32700 @@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
32701 unsigned long timeo = jiffies + HZ;
32702 DECLARE_WAITQUEUE(wait, current);
32704 + pax_track_stack();
32706 adr += chip->start;
32708 /* Let's determine this according to the interleave only once */
32709 diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
32710 index f7fbf60..9866457 100644
32711 --- a/drivers/mtd/devices/doc2000.c
32712 +++ b/drivers/mtd/devices/doc2000.c
32713 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
32715 /* The ECC will not be calculated correctly if less than 512 is written */
32717 - if (len != 0x200 && eccbuf)
32718 + if (len != 0x200)
32719 printk(KERN_WARNING
32720 "ECC needs a full sector write (adr: %lx size %lx)\n",
32721 (long) to, (long) len);
32722 diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
32723 index 241192f..d0c35a3 100644
32724 --- a/drivers/mtd/devices/doc2001.c
32725 +++ b/drivers/mtd/devices/doc2001.c
32726 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
32727 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
32729 /* Don't allow read past end of device */
32730 - if (from >= this->totlen)
32731 + if (from >= this->totlen || !len)
32734 /* Don't allow a single read to cross a 512-byte block boundary */
32735 diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
32736 index 037b399..225a71d 100644
32737 --- a/drivers/mtd/ftl.c
32738 +++ b/drivers/mtd/ftl.c
32739 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
32741 uint16_t srcunitswap = cpu_to_le16(srcunit);
32743 + pax_track_stack();
32745 eun = &part->EUNInfo[srcunit];
32746 xfer = &part->XferInfo[xferunit];
32747 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
32748 diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
32749 index d7592e6..31c505c 100644
32750 --- a/drivers/mtd/inftlcore.c
32751 +++ b/drivers/mtd/inftlcore.c
32752 @@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
32753 struct inftl_oob oob;
32756 + pax_track_stack();
32758 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
32759 "pending=%d)\n", inftl, thisVUC, pendingblock);
32761 diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
32762 index 104052e..6232be5 100644
32763 --- a/drivers/mtd/inftlmount.c
32764 +++ b/drivers/mtd/inftlmount.c
32765 @@ -53,6 +53,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
32766 struct INFTLPartition *ip;
32769 + pax_track_stack();
32771 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
32774 diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
32775 index dbfe17b..c7b0918 100644
32776 --- a/drivers/mtd/lpddr/qinfo_probe.c
32777 +++ b/drivers/mtd/lpddr/qinfo_probe.c
32778 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
32780 map_word pfow_val[4];
32782 + pax_track_stack();
32784 /* Check identification string */
32785 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
32786 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
32787 diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
32788 index 49e20a4..60fbfa5 100644
32789 --- a/drivers/mtd/mtdchar.c
32790 +++ b/drivers/mtd/mtdchar.c
32791 @@ -554,6 +554,8 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
32793 struct mtd_info_user info;
32795 + pax_track_stack();
32797 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
32799 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
32800 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
32801 index d527621..2491fab 100644
32802 --- a/drivers/mtd/nand/denali.c
32803 +++ b/drivers/mtd/nand/denali.c
32805 #include <linux/pci.h>
32806 #include <linux/mtd/mtd.h>
32807 #include <linux/module.h>
32808 +#include <linux/slab.h>
32810 #include "denali.h"
32812 diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
32813 index b155666..611b801 100644
32814 --- a/drivers/mtd/nftlcore.c
32815 +++ b/drivers/mtd/nftlcore.c
32816 @@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
32820 + pax_track_stack();
32822 memset(BlockMap, 0xff, sizeof(BlockMap));
32823 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
32825 diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
32826 index e3cd1ff..0ea79a3 100644
32827 --- a/drivers/mtd/nftlmount.c
32828 +++ b/drivers/mtd/nftlmount.c
32830 #include <asm/errno.h>
32831 #include <linux/delay.h>
32832 #include <linux/slab.h>
32833 +#include <linux/sched.h>
32834 #include <linux/mtd/mtd.h>
32835 #include <linux/mtd/nand.h>
32836 #include <linux/mtd/nftl.h>
32837 @@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
32838 struct mtd_info *mtd = nftl->mbd.mtd;
32841 + pax_track_stack();
32843 /* Assume logical EraseSize == physical erasesize for starting the scan.
32844 We'll sort it out later if we find a MediaHeader which says otherwise */
32845 /* Actually, we won't. The new DiskOnChip driver has already scanned
32846 diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
32847 index 6c3fb5a..c542a81 100644
32848 --- a/drivers/mtd/ubi/build.c
32849 +++ b/drivers/mtd/ubi/build.c
32850 @@ -1311,7 +1311,7 @@ module_exit(ubi_exit);
32851 static int __init bytes_str_to_int(const char *str)
32854 - unsigned long result;
32855 + unsigned long result, scale = 1;
32857 result = simple_strtoul(str, &endp, 0);
32858 if (str == endp || result >= INT_MAX) {
32859 @@ -1322,11 +1322,11 @@ static int __init bytes_str_to_int(const char *str)
32871 if (endp[1] == 'i' && endp[2] == 'B')
32874 @@ -1337,7 +1337,13 @@ static int __init bytes_str_to_int(const char *str)
32879 + if ((intoverflow_t)result*scale >= INT_MAX) {
32880 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
32885 + return result*scale;
32889 diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
32890 index d4f7dda..d627d46 100644
32891 --- a/drivers/net/atlx/atl2.c
32892 +++ b/drivers/net/atlx/atl2.c
32893 @@ -2857,7 +2857,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
32896 #define ATL2_PARAM(X, desc) \
32897 - static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32898 + static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
32899 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
32900 MODULE_PARM_DESC(X, desc);
32902 diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
32903 index 87aecdf..ec23470 100644
32904 --- a/drivers/net/bna/bfa_ioc_ct.c
32905 +++ b/drivers/net/bna/bfa_ioc_ct.c
32906 @@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct bfa_ioc *ioc);
32907 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
32908 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
32910 -static struct bfa_ioc_hwif nw_hwif_ct;
32911 +static struct bfa_ioc_hwif nw_hwif_ct = {
32912 + .ioc_pll_init = bfa_ioc_ct_pll_init,
32913 + .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
32914 + .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
32915 + .ioc_reg_init = bfa_ioc_ct_reg_init,
32916 + .ioc_map_port = bfa_ioc_ct_map_port,
32917 + .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
32918 + .ioc_notify_fail = bfa_ioc_ct_notify_fail,
32919 + .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
32920 + .ioc_sync_start = bfa_ioc_ct_sync_start,
32921 + .ioc_sync_join = bfa_ioc_ct_sync_join,
32922 + .ioc_sync_leave = bfa_ioc_ct_sync_leave,
32923 + .ioc_sync_ack = bfa_ioc_ct_sync_ack,
32924 + .ioc_sync_complete = bfa_ioc_ct_sync_complete
32928 * Called from bfa_ioc_attach() to map asic specific calls.
32929 @@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
32931 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
32933 - nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
32934 - nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
32935 - nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
32936 - nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
32937 - nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
32938 - nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
32939 - nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
32940 - nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
32941 - nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
32942 - nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
32943 - nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
32944 - nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
32945 - nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
32947 ioc->ioc_hwif = &nw_hwif_ct;
32950 diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
32951 index 8e35b25..c39f205 100644
32952 --- a/drivers/net/bna/bnad.c
32953 +++ b/drivers/net/bna/bnad.c
32954 @@ -1673,7 +1673,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32955 struct bna_intr_info *intr_info =
32956 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
32957 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
32958 - struct bna_tx_event_cbfn tx_cbfn;
32959 + static struct bna_tx_event_cbfn tx_cbfn = {
32960 + /* Initialize the tx event handlers */
32961 + .tcb_setup_cbfn = bnad_cb_tcb_setup,
32962 + .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
32963 + .tx_stall_cbfn = bnad_cb_tx_stall,
32964 + .tx_resume_cbfn = bnad_cb_tx_resume,
32965 + .tx_cleanup_cbfn = bnad_cb_tx_cleanup
32968 unsigned long flags;
32970 @@ -1682,13 +1689,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx_id)
32971 tx_config->txq_depth = bnad->txq_depth;
32972 tx_config->tx_type = BNA_TX_T_REGULAR;
32974 - /* Initialize the tx event handlers */
32975 - tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
32976 - tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
32977 - tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
32978 - tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
32979 - tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
32981 /* Get BNA's resource requirement for one tx object */
32982 spin_lock_irqsave(&bnad->bna_lock, flags);
32983 bna_tx_res_req(bnad->num_txq_per_tx,
32984 @@ -1819,21 +1819,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx_id)
32985 struct bna_intr_info *intr_info =
32986 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
32987 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
32988 - struct bna_rx_event_cbfn rx_cbfn;
32989 + static struct bna_rx_event_cbfn rx_cbfn = {
32990 + /* Initialize the Rx event handlers */
32991 + .rcb_setup_cbfn = bnad_cb_rcb_setup,
32992 + .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
32993 + .ccb_setup_cbfn = bnad_cb_ccb_setup,
32994 + .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
32995 + .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
32996 + .rx_post_cbfn = bnad_cb_rx_post
32999 unsigned long flags;
33001 /* Initialize the Rx object configuration */
33002 bnad_init_rx_config(bnad, rx_config);
33004 - /* Initialize the Rx event handlers */
33005 - rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
33006 - rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
33007 - rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
33008 - rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
33009 - rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
33010 - rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
33012 /* Get BNA's resource requirement for one Rx object */
33013 spin_lock_irqsave(&bnad->bna_lock, flags);
33014 bna_rx_res_req(rx_config, res_info);
33015 diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
33016 index 4b2b570..31033f4 100644
33017 --- a/drivers/net/bnx2.c
33018 +++ b/drivers/net/bnx2.c
33019 @@ -5877,6 +5877,8 @@ bnx2_test_nvram(struct bnx2 *bp)
33023 + pax_track_stack();
33025 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
33026 goto test_nvram_done;
33028 diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
33029 index cf3e479..5dc0ecc 100644
33030 --- a/drivers/net/bnx2x/bnx2x_ethtool.c
33031 +++ b/drivers/net/bnx2x/bnx2x_ethtool.c
33032 @@ -1943,6 +1943,8 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
33036 + pax_track_stack();
33041 diff --git a/drivers/net/bnx2x/bnx2x_sp.h b/drivers/net/bnx2x/bnx2x_sp.h
33042 index 9a517c2..a50cfcb 100644
33043 --- a/drivers/net/bnx2x/bnx2x_sp.h
33044 +++ b/drivers/net/bnx2x/bnx2x_sp.h
33045 @@ -449,7 +449,7 @@ struct bnx2x_rx_mode_obj {
33047 int (*wait_comp)(struct bnx2x *bp,
33048 struct bnx2x_rx_mode_ramrod_params *p);
33052 /********************** Set multicast group ***********************************/
33054 diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
33055 index c5f5479..2e8c260 100644
33056 --- a/drivers/net/cxgb3/l2t.h
33057 +++ b/drivers/net/cxgb3/l2t.h
33058 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
33060 struct l2t_skb_cb {
33061 arp_failure_handler_func arp_failure_handler;
33065 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
33067 diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
33068 index b4efa29..c5f2703 100644
33069 --- a/drivers/net/cxgb4/cxgb4_main.c
33070 +++ b/drivers/net/cxgb4/cxgb4_main.c
33071 @@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct adapter *adap)
33072 unsigned int nchan = adap->params.nports;
33073 struct msix_entry entries[MAX_INGQ + 1];
33075 + pax_track_stack();
33077 for (i = 0; i < ARRAY_SIZE(entries); ++i)
33078 entries[i].entry = i;
33080 diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
33081 index d1ec111..12735bc 100644
33082 --- a/drivers/net/cxgb4/t4_hw.c
33083 +++ b/drivers/net/cxgb4/t4_hw.c
33084 @@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
33085 u8 vpd[VPD_LEN], csum;
33086 unsigned int vpdr_len, kw_offset, id_len;
33088 + pax_track_stack();
33090 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
33093 diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
33094 index 536b3a5..e6f8dcc 100644
33095 --- a/drivers/net/e1000e/82571.c
33096 +++ b/drivers/net/e1000e/82571.c
33097 @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
33099 struct e1000_hw *hw = &adapter->hw;
33100 struct e1000_mac_info *mac = &hw->mac;
33101 - struct e1000_mac_operations *func = &mac->ops;
33102 + e1000_mac_operations_no_const *func = &mac->ops;
33105 bool force_clear_smbi = false;
33106 diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
33107 index e4f4225..24da2ea 100644
33108 --- a/drivers/net/e1000e/es2lan.c
33109 +++ b/drivers/net/e1000e/es2lan.c
33110 @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
33112 struct e1000_hw *hw = &adapter->hw;
33113 struct e1000_mac_info *mac = &hw->mac;
33114 - struct e1000_mac_operations *func = &mac->ops;
33115 + e1000_mac_operations_no_const *func = &mac->ops;
33117 /* Set media type */
33118 switch (adapter->pdev->device) {
33119 diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
33120 index 2967039..ca8c40c 100644
33121 --- a/drivers/net/e1000e/hw.h
33122 +++ b/drivers/net/e1000e/hw.h
33123 @@ -778,6 +778,7 @@ struct e1000_mac_operations {
33124 void (*write_vfta)(struct e1000_hw *, u32, u32);
33125 s32 (*read_mac_addr)(struct e1000_hw *);
33127 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33130 * When to use various PHY register access functions:
33131 @@ -818,6 +819,7 @@ struct e1000_phy_operations {
33132 void (*power_up)(struct e1000_hw *);
33133 void (*power_down)(struct e1000_hw *);
33135 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33137 /* Function pointers for the NVM. */
33138 struct e1000_nvm_operations {
33139 @@ -829,9 +831,10 @@ struct e1000_nvm_operations {
33140 s32 (*validate)(struct e1000_hw *);
33141 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
33143 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33145 struct e1000_mac_info {
33146 - struct e1000_mac_operations ops;
33147 + e1000_mac_operations_no_const ops;
33149 u8 perm_addr[ETH_ALEN];
33151 @@ -872,7 +875,7 @@ struct e1000_mac_info {
33154 struct e1000_phy_info {
33155 - struct e1000_phy_operations ops;
33156 + e1000_phy_operations_no_const ops;
33158 enum e1000_phy_type type;
33160 @@ -906,7 +909,7 @@ struct e1000_phy_info {
33163 struct e1000_nvm_info {
33164 - struct e1000_nvm_operations ops;
33165 + e1000_nvm_operations_no_const ops;
33167 enum e1000_nvm_type type;
33168 enum e1000_nvm_override override;
33169 diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
33170 index fa8677c..196356f 100644
33171 --- a/drivers/net/fealnx.c
33172 +++ b/drivers/net/fealnx.c
33173 @@ -150,7 +150,7 @@ struct chip_info {
33177 -static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
33178 +static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
33179 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33180 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
33181 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
33182 diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
33183 index 2a5a34d..be871cc 100644
33184 --- a/drivers/net/hamradio/6pack.c
33185 +++ b/drivers/net/hamradio/6pack.c
33186 @@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
33187 unsigned char buf[512];
33190 + pax_track_stack();
33195 diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
33196 index 4519a13..f97fcd0 100644
33197 --- a/drivers/net/igb/e1000_hw.h
33198 +++ b/drivers/net/igb/e1000_hw.h
33199 @@ -314,6 +314,7 @@ struct e1000_mac_operations {
33200 s32 (*read_mac_addr)(struct e1000_hw *);
33201 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
33203 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33205 struct e1000_phy_operations {
33206 s32 (*acquire)(struct e1000_hw *);
33207 @@ -330,6 +331,7 @@ struct e1000_phy_operations {
33208 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
33209 s32 (*write_reg)(struct e1000_hw *, u32, u16);
33211 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33213 struct e1000_nvm_operations {
33214 s32 (*acquire)(struct e1000_hw *);
33215 @@ -339,6 +341,7 @@ struct e1000_nvm_operations {
33216 s32 (*update)(struct e1000_hw *);
33217 s32 (*validate)(struct e1000_hw *);
33219 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33221 struct e1000_info {
33222 s32 (*get_invariants)(struct e1000_hw *);
33223 @@ -350,7 +353,7 @@ struct e1000_info {
33224 extern const struct e1000_info e1000_82575_info;
33226 struct e1000_mac_info {
33227 - struct e1000_mac_operations ops;
33228 + e1000_mac_operations_no_const ops;
33232 @@ -388,7 +391,7 @@ struct e1000_mac_info {
33235 struct e1000_phy_info {
33236 - struct e1000_phy_operations ops;
33237 + e1000_phy_operations_no_const ops;
33239 enum e1000_phy_type type;
33241 @@ -423,7 +426,7 @@ struct e1000_phy_info {
33244 struct e1000_nvm_info {
33245 - struct e1000_nvm_operations ops;
33246 + e1000_nvm_operations_no_const ops;
33247 enum e1000_nvm_type type;
33248 enum e1000_nvm_override override;
33250 @@ -468,6 +471,7 @@ struct e1000_mbx_operations {
33251 s32 (*check_for_ack)(struct e1000_hw *, u16);
33252 s32 (*check_for_rst)(struct e1000_hw *, u16);
33254 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33256 struct e1000_mbx_stats {
33258 @@ -479,7 +483,7 @@ struct e1000_mbx_stats {
33261 struct e1000_mbx_info {
33262 - struct e1000_mbx_operations ops;
33263 + e1000_mbx_operations_no_const ops;
33264 struct e1000_mbx_stats stats;
33267 diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
33268 index d7ed58f..64cde36 100644
33269 --- a/drivers/net/igbvf/vf.h
33270 +++ b/drivers/net/igbvf/vf.h
33271 @@ -189,9 +189,10 @@ struct e1000_mac_operations {
33272 s32 (*read_mac_addr)(struct e1000_hw *);
33273 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
33275 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33277 struct e1000_mac_info {
33278 - struct e1000_mac_operations ops;
33279 + e1000_mac_operations_no_const ops;
33283 @@ -213,6 +214,7 @@ struct e1000_mbx_operations {
33284 s32 (*check_for_ack)(struct e1000_hw *);
33285 s32 (*check_for_rst)(struct e1000_hw *);
33287 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33289 struct e1000_mbx_stats {
33291 @@ -224,7 +226,7 @@ struct e1000_mbx_stats {
33294 struct e1000_mbx_info {
33295 - struct e1000_mbx_operations ops;
33296 + e1000_mbx_operations_no_const ops;
33297 struct e1000_mbx_stats stats;
33300 diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
33301 index 6a130eb..1aeb9e4 100644
33302 --- a/drivers/net/ixgb/ixgb_main.c
33303 +++ b/drivers/net/ixgb/ixgb_main.c
33304 @@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev)
33308 + pax_track_stack();
33310 /* Check for Promiscuous and All Multicast modes */
33312 rctl = IXGB_READ_REG(hw, RCTL);
33313 diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
33314 index dd7fbeb..44b9bbf 100644
33315 --- a/drivers/net/ixgb/ixgb_param.c
33316 +++ b/drivers/net/ixgb/ixgb_param.c
33317 @@ -261,6 +261,9 @@ void __devinit
33318 ixgb_check_options(struct ixgb_adapter *adapter)
33320 int bd = adapter->bd_number;
33322 + pax_track_stack();
33324 if (bd >= IXGB_MAX_NIC) {
33325 pr_notice("Warning: no configuration for board #%i\n", bd);
33326 pr_notice("Using defaults for all values\n");
33327 diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
33328 index e0d970e..1cfdea5 100644
33329 --- a/drivers/net/ixgbe/ixgbe_type.h
33330 +++ b/drivers/net/ixgbe/ixgbe_type.h
33331 @@ -2642,6 +2642,7 @@ struct ixgbe_eeprom_operations {
33332 s32 (*update_checksum)(struct ixgbe_hw *);
33333 u16 (*calc_checksum)(struct ixgbe_hw *);
33335 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
33337 struct ixgbe_mac_operations {
33338 s32 (*init_hw)(struct ixgbe_hw *);
33339 @@ -2703,6 +2704,7 @@ struct ixgbe_mac_operations {
33340 /* Manageability interface */
33341 s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8);
33343 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33345 struct ixgbe_phy_operations {
33346 s32 (*identify)(struct ixgbe_hw *);
33347 @@ -2722,9 +2724,10 @@ struct ixgbe_phy_operations {
33348 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
33349 s32 (*check_overtemp)(struct ixgbe_hw *);
33351 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
33353 struct ixgbe_eeprom_info {
33354 - struct ixgbe_eeprom_operations ops;
33355 + ixgbe_eeprom_operations_no_const ops;
33356 enum ixgbe_eeprom_type type;
33357 u32 semaphore_delay;
33359 @@ -2734,7 +2737,7 @@ struct ixgbe_eeprom_info {
33361 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
33362 struct ixgbe_mac_info {
33363 - struct ixgbe_mac_operations ops;
33364 + ixgbe_mac_operations_no_const ops;
33365 enum ixgbe_mac_type type;
33366 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33367 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33368 @@ -2762,7 +2765,7 @@ struct ixgbe_mac_info {
33371 struct ixgbe_phy_info {
33372 - struct ixgbe_phy_operations ops;
33373 + ixgbe_phy_operations_no_const ops;
33374 struct mdio_if_info mdio;
33375 enum ixgbe_phy_type type;
33377 @@ -2790,6 +2793,7 @@ struct ixgbe_mbx_operations {
33378 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
33379 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
33381 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33383 struct ixgbe_mbx_stats {
33385 @@ -2801,7 +2805,7 @@ struct ixgbe_mbx_stats {
33388 struct ixgbe_mbx_info {
33389 - struct ixgbe_mbx_operations ops;
33390 + ixgbe_mbx_operations_no_const ops;
33391 struct ixgbe_mbx_stats stats;
33394 diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
33395 index 10306b4..28df758 100644
33396 --- a/drivers/net/ixgbevf/vf.h
33397 +++ b/drivers/net/ixgbevf/vf.h
33398 @@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
33399 s32 (*clear_vfta)(struct ixgbe_hw *);
33400 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
33402 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33404 enum ixgbe_mac_type {
33405 ixgbe_mac_unknown = 0,
33406 @@ -79,7 +80,7 @@ enum ixgbe_mac_type {
33409 struct ixgbe_mac_info {
33410 - struct ixgbe_mac_operations ops;
33411 + ixgbe_mac_operations_no_const ops;
33415 @@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
33416 s32 (*check_for_ack)(struct ixgbe_hw *);
33417 s32 (*check_for_rst)(struct ixgbe_hw *);
33419 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
33421 struct ixgbe_mbx_stats {
33423 @@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
33426 struct ixgbe_mbx_info {
33427 - struct ixgbe_mbx_operations ops;
33428 + ixgbe_mbx_operations_no_const ops;
33429 struct ixgbe_mbx_stats stats;
33432 diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
33433 index 27418d3..adf15bb 100644
33434 --- a/drivers/net/ksz884x.c
33435 +++ b/drivers/net/ksz884x.c
33436 @@ -6533,6 +6533,8 @@ static void netdev_get_ethtool_stats(struct net_device *dev,
33438 u64 counter[TOTAL_PORT_COUNTER_NUM];
33440 + pax_track_stack();
33442 mutex_lock(&hw_priv->lock);
33443 n = SWITCH_PORT_NUM;
33444 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
33445 diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
33446 index f0ee35d..3831c8a 100644
33447 --- a/drivers/net/mlx4/main.c
33448 +++ b/drivers/net/mlx4/main.c
33450 #include <linux/dma-mapping.h>
33451 #include <linux/slab.h>
33452 #include <linux/io-mapping.h>
33453 +#include <linux/sched.h>
33455 #include <linux/mlx4/device.h>
33456 #include <linux/mlx4/doorbell.h>
33457 @@ -762,6 +763,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
33461 + pax_track_stack();
33463 err = mlx4_QUERY_FW(dev);
33465 if (err == -EACCES)
33466 diff --git a/drivers/net/niu.c b/drivers/net/niu.c
33467 index ed47585..5e5be8f 100644
33468 --- a/drivers/net/niu.c
33469 +++ b/drivers/net/niu.c
33470 @@ -9061,6 +9061,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
33471 int i, num_irqs, err;
33474 + pax_track_stack();
33476 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
33477 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
33478 ldg_num_map[i] = first_ldg + i;
33479 diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
33480 index 80b6f36..5cd8938 100644
33481 --- a/drivers/net/pcnet32.c
33482 +++ b/drivers/net/pcnet32.c
33483 @@ -270,7 +270,7 @@ struct pcnet32_private {
33484 struct sk_buff **rx_skbuff;
33485 dma_addr_t *tx_dma_addr;
33486 dma_addr_t *rx_dma_addr;
33487 - struct pcnet32_access a;
33488 + struct pcnet32_access *a;
33489 spinlock_t lock; /* Guard lock */
33490 unsigned int cur_rx, cur_tx; /* The next free ring entry */
33491 unsigned int rx_ring_size; /* current rx ring size */
33492 @@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct net_device *dev)
33495 netif_wake_queue(dev);
33496 - val = lp->a.read_csr(ioaddr, CSR3);
33497 + val = lp->a->read_csr(ioaddr, CSR3);
33499 - lp->a.write_csr(ioaddr, CSR3, val);
33500 + lp->a->write_csr(ioaddr, CSR3, val);
33501 napi_enable(&lp->napi);
33504 @@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
33505 r = mii_link_ok(&lp->mii_if);
33506 } else if (lp->chip_version >= PCNET32_79C970A) {
33507 ulong ioaddr = dev->base_addr; /* card base I/O address */
33508 - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
33509 + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
33510 } else { /* can not detect link on really old chips */
33513 @@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
33514 pcnet32_netif_stop(dev);
33516 spin_lock_irqsave(&lp->lock, flags);
33517 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33518 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33520 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
33522 @@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
33523 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33525 struct pcnet32_private *lp = netdev_priv(dev);
33526 - struct pcnet32_access *a = &lp->a; /* access to registers */
33527 + struct pcnet32_access *a = lp->a; /* access to registers */
33528 ulong ioaddr = dev->base_addr; /* card base I/O address */
33529 struct sk_buff *skb; /* sk buff */
33530 int x, i; /* counters */
33531 @@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33532 pcnet32_netif_stop(dev);
33534 spin_lock_irqsave(&lp->lock, flags);
33535 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33536 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
33538 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
33540 /* Reset the PCNET32 */
33541 - lp->a.reset(ioaddr);
33542 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33543 + lp->a->reset(ioaddr);
33544 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33546 /* switch pcnet32 to 32bit mode */
33547 - lp->a.write_bcr(ioaddr, 20, 2);
33548 + lp->a->write_bcr(ioaddr, 20, 2);
33550 /* purge & init rings but don't actually restart */
33551 pcnet32_restart(dev, 0x0000);
33553 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33554 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33556 /* Initialize Transmit buffers. */
33557 size = data_len + 15;
33558 @@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33560 /* set int loopback in CSR15 */
33561 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
33562 - lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
33563 + lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
33565 teststatus = cpu_to_le16(0x8000);
33566 - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33567 + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
33569 /* Check status of descriptors */
33570 for (x = 0; x < numbuffs; x++) {
33571 @@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
33575 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33576 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
33578 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
33579 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
33580 @@ -1015,7 +1015,7 @@ clean_up:
33581 pcnet32_restart(dev, CSR0_NORMAL);
33583 pcnet32_purge_rx_ring(dev);
33584 - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33585 + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
33587 spin_unlock_irqrestore(&lp->lock, flags);
33589 @@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct net_device *dev,
33590 enum ethtool_phys_id_state state)
33592 struct pcnet32_private *lp = netdev_priv(dev);
33593 - struct pcnet32_access *a = &lp->a;
33594 + struct pcnet32_access *a = lp->a;
33595 ulong ioaddr = dev->base_addr;
33596 unsigned long flags;
33598 @@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
33601 struct pcnet32_private *lp = netdev_priv(dev);
33602 - struct pcnet32_access *a = &lp->a;
33603 + struct pcnet32_access *a = lp->a;
33604 ulong ioaddr = dev->base_addr;
33607 @@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33608 spin_lock_irqsave(&lp->lock, flags);
33609 if (pcnet32_tx(dev)) {
33610 /* reset the chip to clear the error condition, then restart */
33611 - lp->a.reset(ioaddr);
33612 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33613 + lp->a->reset(ioaddr);
33614 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33615 pcnet32_restart(dev, CSR0_START);
33616 netif_wake_queue(dev);
33618 @@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
33619 __napi_complete(napi);
33621 /* clear interrupt masks */
33622 - val = lp->a.read_csr(ioaddr, CSR3);
33623 + val = lp->a->read_csr(ioaddr, CSR3);
33625 - lp->a.write_csr(ioaddr, CSR3, val);
33626 + lp->a->write_csr(ioaddr, CSR3, val);
33628 /* Set interrupt enable. */
33629 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
33630 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
33632 spin_unlock_irqrestore(&lp->lock, flags);
33634 @@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33637 struct pcnet32_private *lp = netdev_priv(dev);
33638 - struct pcnet32_access *a = &lp->a;
33639 + struct pcnet32_access *a = lp->a;
33640 ulong ioaddr = dev->base_addr;
33641 unsigned long flags;
33643 @@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
33644 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
33645 if (lp->phymask & (1 << j)) {
33646 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
33647 - lp->a.write_bcr(ioaddr, 33,
33648 + lp->a->write_bcr(ioaddr, 33,
33650 - *buff++ = lp->a.read_bcr(ioaddr, 34);
33651 + *buff++ = lp->a->read_bcr(ioaddr, 34);
33655 @@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33656 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
33657 lp->options |= PCNET32_PORT_FD;
33662 /* prior to register_netdev, dev->name is not yet correct */
33663 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
33664 @@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33666 /* lp->phycount and lp->phymask are set to 0 by memset above */
33668 - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33669 + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
33670 /* scan for PHYs */
33671 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33672 unsigned short id1, id2;
33673 @@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
33674 pr_info("Found PHY %04x:%04x at address %d\n",
33677 - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33678 + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
33679 if (lp->phycount > 1)
33680 lp->options |= PCNET32_PORT_MII;
33682 @@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_device *dev)
33685 /* Reset the PCNET32 */
33686 - lp->a.reset(ioaddr);
33687 + lp->a->reset(ioaddr);
33689 /* switch pcnet32 to 32bit mode */
33690 - lp->a.write_bcr(ioaddr, 20, 2);
33691 + lp->a->write_bcr(ioaddr, 20, 2);
33693 netif_printk(lp, ifup, KERN_DEBUG, dev,
33694 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
33695 @@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_device *dev)
33696 (u32) (lp->init_dma_addr));
33698 /* set/reset autoselect bit */
33699 - val = lp->a.read_bcr(ioaddr, 2) & ~2;
33700 + val = lp->a->read_bcr(ioaddr, 2) & ~2;
33701 if (lp->options & PCNET32_PORT_ASEL)
33703 - lp->a.write_bcr(ioaddr, 2, val);
33704 + lp->a->write_bcr(ioaddr, 2, val);
33706 /* handle full duplex setting */
33707 if (lp->mii_if.full_duplex) {
33708 - val = lp->a.read_bcr(ioaddr, 9) & ~3;
33709 + val = lp->a->read_bcr(ioaddr, 9) & ~3;
33710 if (lp->options & PCNET32_PORT_FD) {
33712 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
33713 @@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_device *dev)
33714 if (lp->chip_version == 0x2627)
33717 - lp->a.write_bcr(ioaddr, 9, val);
33718 + lp->a->write_bcr(ioaddr, 9, val);
33721 /* set/reset GPSI bit in test register */
33722 - val = lp->a.read_csr(ioaddr, 124) & ~0x10;
33723 + val = lp->a->read_csr(ioaddr, 124) & ~0x10;
33724 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
33726 - lp->a.write_csr(ioaddr, 124, val);
33727 + lp->a->write_csr(ioaddr, 124, val);
33729 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
33730 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
33731 @@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_device *dev)
33732 * duplex, and/or enable auto negotiation, and clear DANAS
33734 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
33735 - lp->a.write_bcr(ioaddr, 32,
33736 - lp->a.read_bcr(ioaddr, 32) | 0x0080);
33737 + lp->a->write_bcr(ioaddr, 32,
33738 + lp->a->read_bcr(ioaddr, 32) | 0x0080);
33739 /* disable Auto Negotiation, set 10Mpbs, HD */
33740 - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
33741 + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
33742 if (lp->options & PCNET32_PORT_FD)
33744 if (lp->options & PCNET32_PORT_100)
33746 - lp->a.write_bcr(ioaddr, 32, val);
33747 + lp->a->write_bcr(ioaddr, 32, val);
33749 if (lp->options & PCNET32_PORT_ASEL) {
33750 - lp->a.write_bcr(ioaddr, 32,
33751 - lp->a.read_bcr(ioaddr,
33752 + lp->a->write_bcr(ioaddr, 32,
33753 + lp->a->read_bcr(ioaddr,
33755 /* enable auto negotiate, setup, disable fd */
33756 - val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
33757 + val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
33759 - lp->a.write_bcr(ioaddr, 32, val);
33760 + lp->a->write_bcr(ioaddr, 32, val);
33764 @@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_device *dev)
33765 * There is really no good other way to handle multiple PHYs
33766 * other than turning off all automatics
33768 - val = lp->a.read_bcr(ioaddr, 2);
33769 - lp->a.write_bcr(ioaddr, 2, val & ~2);
33770 - val = lp->a.read_bcr(ioaddr, 32);
33771 - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33772 + val = lp->a->read_bcr(ioaddr, 2);
33773 + lp->a->write_bcr(ioaddr, 2, val & ~2);
33774 + val = lp->a->read_bcr(ioaddr, 32);
33775 + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
33777 if (!(lp->options & PCNET32_PORT_ASEL)) {
33779 @@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_device *dev)
33780 ethtool_cmd_speed_set(&ecmd,
33781 (lp->options & PCNET32_PORT_100) ?
33782 SPEED_100 : SPEED_10);
33783 - bcr9 = lp->a.read_bcr(ioaddr, 9);
33784 + bcr9 = lp->a->read_bcr(ioaddr, 9);
33786 if (lp->options & PCNET32_PORT_FD) {
33787 ecmd.duplex = DUPLEX_FULL;
33788 @@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_device *dev)
33789 ecmd.duplex = DUPLEX_HALF;
33792 - lp->a.write_bcr(ioaddr, 9, bcr9);
33793 + lp->a->write_bcr(ioaddr, 9, bcr9);
33796 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
33797 @@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_device *dev)
33800 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
33801 - val = lp->a.read_csr(ioaddr, CSR3);
33802 + val = lp->a->read_csr(ioaddr, CSR3);
33804 - lp->a.write_csr(ioaddr, CSR3, val);
33805 + lp->a->write_csr(ioaddr, CSR3, val);
33809 @@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_device *dev)
33810 napi_enable(&lp->napi);
33812 /* Re-initialize the PCNET32, and start it when done. */
33813 - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33814 - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33815 + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
33816 + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
33818 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33819 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33820 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
33821 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33823 netif_start_queue(dev);
33825 @@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_device *dev)
33829 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33830 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33833 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
33834 * reports that doing so triggers a bug in the '974.
33836 - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
33837 + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
33839 netif_printk(lp, ifup, KERN_DEBUG, dev,
33840 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
33842 (u32) (lp->init_dma_addr),
33843 - lp->a.read_csr(ioaddr, CSR0));
33844 + lp->a->read_csr(ioaddr, CSR0));
33846 spin_unlock_irqrestore(&lp->lock, flags);
33848 @@ -2218,7 +2218,7 @@ err_free_ring:
33849 * Switch back to 16bit mode to avoid problems with dumb
33850 * DOS packet driver after a warm reboot
33852 - lp->a.write_bcr(ioaddr, 20, 4);
33853 + lp->a->write_bcr(ioaddr, 20, 4);
33856 spin_unlock_irqrestore(&lp->lock, flags);
33857 @@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33859 /* wait for stop */
33860 for (i = 0; i < 100; i++)
33861 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
33862 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
33866 @@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
33870 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
33871 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
33874 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
33875 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
33878 - lp->a.write_csr(ioaddr, CSR0, csr0_bits);
33879 + lp->a->write_csr(ioaddr, CSR0, csr0_bits);
33882 static void pcnet32_tx_timeout(struct net_device *dev)
33883 @@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
33884 /* Transmitter timeout, serious problems. */
33885 if (pcnet32_debug & NETIF_MSG_DRV)
33886 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
33887 - dev->name, lp->a.read_csr(ioaddr, CSR0));
33888 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33889 + dev->name, lp->a->read_csr(ioaddr, CSR0));
33890 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33891 dev->stats.tx_errors++;
33892 if (netif_msg_tx_err(lp)) {
33894 @@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33896 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
33897 "%s() called, csr0 %4.4x\n",
33898 - __func__, lp->a.read_csr(ioaddr, CSR0));
33899 + __func__, lp->a->read_csr(ioaddr, CSR0));
33901 /* Default status -- will not enable Successful-TxDone
33902 * interrupt when that option is available to us.
33903 @@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
33904 dev->stats.tx_bytes += skb->len;
33906 /* Trigger an immediate send poll. */
33907 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33908 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
33910 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
33912 @@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
33914 spin_lock(&lp->lock);
33916 - csr0 = lp->a.read_csr(ioaddr, CSR0);
33917 + csr0 = lp->a->read_csr(ioaddr, CSR0);
33918 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
33919 if (csr0 == 0xffff)
33920 break; /* PCMCIA remove happened */
33921 /* Acknowledge all of the current interrupt sources ASAP. */
33922 - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33923 + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
33925 netif_printk(lp, intr, KERN_DEBUG, dev,
33926 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
33927 - csr0, lp->a.read_csr(ioaddr, CSR0));
33928 + csr0, lp->a->read_csr(ioaddr, CSR0));
33930 /* Log misc errors. */
33932 @@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
33933 if (napi_schedule_prep(&lp->napi)) {
33935 /* set interrupt masks */
33936 - val = lp->a.read_csr(ioaddr, CSR3);
33937 + val = lp->a->read_csr(ioaddr, CSR3);
33939 - lp->a.write_csr(ioaddr, CSR3, val);
33940 + lp->a->write_csr(ioaddr, CSR3, val);
33942 __napi_schedule(&lp->napi);
33945 - csr0 = lp->a.read_csr(ioaddr, CSR0);
33946 + csr0 = lp->a->read_csr(ioaddr, CSR0);
33949 netif_printk(lp, intr, KERN_DEBUG, dev,
33950 "exiting interrupt, csr0=%#4.4x\n",
33951 - lp->a.read_csr(ioaddr, CSR0));
33952 + lp->a->read_csr(ioaddr, CSR0));
33954 spin_unlock(&lp->lock);
33956 @@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_device *dev)
33958 spin_lock_irqsave(&lp->lock, flags);
33960 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33961 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33963 netif_printk(lp, ifdown, KERN_DEBUG, dev,
33964 "Shutting down ethercard, status was %2.2x\n",
33965 - lp->a.read_csr(ioaddr, CSR0));
33966 + lp->a->read_csr(ioaddr, CSR0));
33968 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
33969 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
33970 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
33973 * Switch back to 16bit mode to avoid problems with dumb
33974 * DOS packet driver after a warm reboot
33976 - lp->a.write_bcr(ioaddr, 20, 4);
33977 + lp->a->write_bcr(ioaddr, 20, 4);
33979 spin_unlock_irqrestore(&lp->lock, flags);
33981 @@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
33982 unsigned long flags;
33984 spin_lock_irqsave(&lp->lock, flags);
33985 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
33986 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
33987 spin_unlock_irqrestore(&lp->lock, flags);
33989 return &dev->stats;
33990 @@ -2577,10 +2577,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
33991 if (dev->flags & IFF_ALLMULTI) {
33992 ib->filter[0] = cpu_to_le32(~0U);
33993 ib->filter[1] = cpu_to_le32(~0U);
33994 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33995 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
33996 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
33997 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
33998 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
33999 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34000 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34001 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34004 /* clear the multicast filter */
34005 @@ -2594,7 +2594,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
34006 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
34008 for (i = 0; i < 4; i++)
34009 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
34010 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
34011 le16_to_cpu(mcast_table[i]));
34014 @@ -2609,28 +2609,28 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
34016 spin_lock_irqsave(&lp->lock, flags);
34017 suspended = pcnet32_suspend(dev, &flags, 0);
34018 - csr15 = lp->a.read_csr(ioaddr, CSR15);
34019 + csr15 = lp->a->read_csr(ioaddr, CSR15);
34020 if (dev->flags & IFF_PROMISC) {
34021 /* Log any net taps. */
34022 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
34023 lp->init_block->mode =
34024 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
34026 - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
34027 + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
34029 lp->init_block->mode =
34030 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
34031 - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34032 + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34033 pcnet32_load_multicast(dev);
34038 /* clear SUSPEND (SPND) - CSR5 bit 0 */
34039 - csr5 = lp->a.read_csr(ioaddr, CSR5);
34040 - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34041 + csr5 = lp->a->read_csr(ioaddr, CSR5);
34042 + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34044 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34045 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34046 pcnet32_restart(dev, CSR0_NORMAL);
34047 netif_wake_queue(dev);
34049 @@ -2648,8 +2648,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
34053 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34054 - val_out = lp->a.read_bcr(ioaddr, 34);
34055 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34056 + val_out = lp->a->read_bcr(ioaddr, 34);
34060 @@ -2663,8 +2663,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
34064 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34065 - lp->a.write_bcr(ioaddr, 34, val);
34066 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34067 + lp->a->write_bcr(ioaddr, 34, val);
34070 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34071 @@ -2741,7 +2741,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34072 curr_link = mii_link_ok(&lp->mii_if);
34074 ulong ioaddr = dev->base_addr; /* card base I/O address */
34075 - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34076 + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34079 if (prev_link || verbose) {
34080 @@ -2764,13 +2764,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
34081 (ecmd.duplex == DUPLEX_FULL)
34082 ? "full" : "half");
34084 - bcr9 = lp->a.read_bcr(dev->base_addr, 9);
34085 + bcr9 = lp->a->read_bcr(dev->base_addr, 9);
34086 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
34087 if (lp->mii_if.full_duplex)
34091 - lp->a.write_bcr(dev->base_addr, 9, bcr9);
34092 + lp->a->write_bcr(dev->base_addr, 9, bcr9);
34095 netif_info(lp, link, dev, "link up\n");
34096 diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
34097 index edfa15d..002bfa9 100644
34098 --- a/drivers/net/ppp_generic.c
34099 +++ b/drivers/net/ppp_generic.c
34100 @@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34101 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
34102 struct ppp_stats stats;
34103 struct ppp_comp_stats cstats;
34107 case SIOCGPPPSTATS:
34108 @@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
34112 - vers = PPP_VERSION;
34113 - if (copy_to_user(addr, vers, strlen(vers) + 1))
34114 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
34118 diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
34119 index 6d657ca..d1be94b 100644
34120 --- a/drivers/net/r8169.c
34121 +++ b/drivers/net/r8169.c
34122 @@ -663,12 +663,12 @@ struct rtl8169_private {
34124 void (*write)(void __iomem *, int, int);
34125 int (*read)(void __iomem *, int);
34127 + } __no_const mdio_ops;
34129 struct pll_power_ops {
34130 void (*down)(struct rtl8169_private *);
34131 void (*up)(struct rtl8169_private *);
34133 + } __no_const pll_power_ops;
34135 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
34136 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
34137 diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
34138 index 3c0f131..17f8b02 100644
34139 --- a/drivers/net/sis190.c
34140 +++ b/drivers/net/sis190.c
34141 @@ -1624,7 +1624,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
34142 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
34143 struct net_device *dev)
34145 - static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
34146 + static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
34147 struct sis190_private *tp = netdev_priv(dev);
34148 struct pci_dev *isa_bridge;
34150 diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
34151 index 4793df8..44c9849 100644
34152 --- a/drivers/net/sundance.c
34153 +++ b/drivers/net/sundance.c
34154 @@ -218,7 +218,7 @@ enum {
34155 struct pci_id_info {
34158 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34159 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34160 {"D-Link DFE-550TX FAST Ethernet Adapter"},
34161 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
34162 {"D-Link DFE-580TX 4 port Server Adapter"},
34163 diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
34164 index 2ea456d..3ad9523 100644
34165 --- a/drivers/net/tg3.h
34166 +++ b/drivers/net/tg3.h
34167 @@ -134,6 +134,7 @@
34168 #define CHIPREV_ID_5750_A0 0x4000
34169 #define CHIPREV_ID_5750_A1 0x4001
34170 #define CHIPREV_ID_5750_A3 0x4003
34171 +#define CHIPREV_ID_5750_C1 0x4201
34172 #define CHIPREV_ID_5750_C2 0x4202
34173 #define CHIPREV_ID_5752_A0_HW 0x5000
34174 #define CHIPREV_ID_5752_A0 0x6000
34175 diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
34176 index 515f122..41dd273 100644
34177 --- a/drivers/net/tokenring/abyss.c
34178 +++ b/drivers/net/tokenring/abyss.c
34179 @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
34181 static int __init abyss_init (void)
34183 - abyss_netdev_ops = tms380tr_netdev_ops;
34184 + pax_open_kernel();
34185 + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34187 - abyss_netdev_ops.ndo_open = abyss_open;
34188 - abyss_netdev_ops.ndo_stop = abyss_close;
34189 + *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
34190 + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
34191 + pax_close_kernel();
34193 return pci_register_driver(&abyss_driver);
34195 diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
34196 index 6153cfd..cf69c1c 100644
34197 --- a/drivers/net/tokenring/madgemc.c
34198 +++ b/drivers/net/tokenring/madgemc.c
34199 @@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver = {
34201 static int __init madgemc_init (void)
34203 - madgemc_netdev_ops = tms380tr_netdev_ops;
34204 - madgemc_netdev_ops.ndo_open = madgemc_open;
34205 - madgemc_netdev_ops.ndo_stop = madgemc_close;
34206 + pax_open_kernel();
34207 + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34208 + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
34209 + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
34210 + pax_close_kernel();
34212 return mca_register_driver (&madgemc_driver);
34214 diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
34215 index 8d362e6..f91cc52 100644
34216 --- a/drivers/net/tokenring/proteon.c
34217 +++ b/drivers/net/tokenring/proteon.c
34218 @@ -353,9 +353,11 @@ static int __init proteon_init(void)
34219 struct platform_device *pdev;
34220 int i, num = 0, err = 0;
34222 - proteon_netdev_ops = tms380tr_netdev_ops;
34223 - proteon_netdev_ops.ndo_open = proteon_open;
34224 - proteon_netdev_ops.ndo_stop = tms380tr_close;
34225 + pax_open_kernel();
34226 + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34227 + *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
34228 + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
34229 + pax_close_kernel();
34231 err = platform_driver_register(&proteon_driver);
34233 diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
34234 index 46db5c5..37c1536 100644
34235 --- a/drivers/net/tokenring/skisa.c
34236 +++ b/drivers/net/tokenring/skisa.c
34237 @@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
34238 struct platform_device *pdev;
34239 int i, num = 0, err = 0;
34241 - sk_isa_netdev_ops = tms380tr_netdev_ops;
34242 - sk_isa_netdev_ops.ndo_open = sk_isa_open;
34243 - sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34244 + pax_open_kernel();
34245 + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34246 + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
34247 + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34248 + pax_close_kernel();
34250 err = platform_driver_register(&sk_isa_driver);
34252 diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
34253 index ce90efc..2676f89 100644
34254 --- a/drivers/net/tulip/de2104x.c
34255 +++ b/drivers/net/tulip/de2104x.c
34256 @@ -1795,6 +1795,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
34257 struct de_srom_info_leaf *il;
34260 + pax_track_stack();
34262 /* download entire eeprom */
34263 for (i = 0; i < DE_EEPROM_WORDS; i++)
34264 ((__le16 *)ee_data)[i] =
34265 diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
34266 index 959b410..c97fac2 100644
34267 --- a/drivers/net/tulip/de4x5.c
34268 +++ b/drivers/net/tulip/de4x5.c
34269 @@ -5397,7 +5397,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34270 for (i=0; i<ETH_ALEN; i++) {
34271 tmp.addr[i] = dev->dev_addr[i];
34273 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34274 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34277 case DE4X5_SET_HWADDR: /* Set the hardware address */
34278 @@ -5437,7 +5437,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34279 spin_lock_irqsave(&lp->lock, flags);
34280 memcpy(&statbuf, &lp->pktStats, ioc->len);
34281 spin_unlock_irqrestore(&lp->lock, flags);
34282 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
34283 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34287 diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
34288 index fa5eee9..e074432 100644
34289 --- a/drivers/net/tulip/eeprom.c
34290 +++ b/drivers/net/tulip/eeprom.c
34291 @@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
34295 -static const char *block_name[] __devinitdata = {
34296 +static const char *block_name[] __devinitconst = {
34299 "21142 Serial PHY",
34300 diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
34301 index 862eadf..3eee1e6 100644
34302 --- a/drivers/net/tulip/winbond-840.c
34303 +++ b/drivers/net/tulip/winbond-840.c
34304 @@ -236,7 +236,7 @@ struct pci_id_info {
34305 int drv_flags; /* Driver use, intended as capability flags. */
34308 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34309 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34310 { /* Sometime a Level-One switch card. */
34311 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
34312 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
34313 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
34314 index 304fe78..db112fa 100644
34315 --- a/drivers/net/usb/hso.c
34316 +++ b/drivers/net/usb/hso.c
34318 #include <asm/byteorder.h>
34319 #include <linux/serial_core.h>
34320 #include <linux/serial.h>
34322 +#include <asm/local.h>
34324 #define MOD_AUTHOR "Option Wireless"
34325 #define MOD_DESCRIPTION "USB High Speed Option driver"
34326 @@ -257,7 +257,7 @@ struct hso_serial {
34328 /* from usb_serial_port */
34329 struct tty_struct *tty;
34331 + local_t open_count;
34332 spinlock_t serial_lock;
34334 int (*write_data) (struct hso_serial *serial);
34335 @@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
34338 urb = serial->rx_urb[0];
34339 - if (serial->open_count > 0) {
34340 + if (local_read(&serial->open_count) > 0) {
34341 count = put_rxbuf_data(urb, serial);
34344 @@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
34345 DUMP1(urb->transfer_buffer, urb->actual_length);
34347 /* Anyone listening? */
34348 - if (serial->open_count == 0)
34349 + if (local_read(&serial->open_count) == 0)
34353 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34354 spin_unlock_irq(&serial->serial_lock);
34356 /* check for port already opened, if not set the termios */
34357 - serial->open_count++;
34358 - if (serial->open_count == 1) {
34359 + if (local_inc_return(&serial->open_count) == 1) {
34360 serial->rx_state = RX_IDLE;
34361 /* Force default termio settings */
34362 _hso_serial_set_termios(tty, NULL);
34363 @@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
34364 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
34366 hso_stop_serial_device(serial->parent);
34367 - serial->open_count--;
34368 + local_dec(&serial->open_count);
34369 kref_put(&serial->parent->ref, hso_serial_ref_free);
34372 @@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
34374 /* reset the rts and dtr */
34375 /* do the actual close */
34376 - serial->open_count--;
34377 + local_dec(&serial->open_count);
34379 - if (serial->open_count <= 0) {
34380 - serial->open_count = 0;
34381 + if (local_read(&serial->open_count) <= 0) {
34382 + local_set(&serial->open_count, 0);
34383 spin_lock_irq(&serial->serial_lock);
34384 if (serial->tty == tty) {
34385 serial->tty->driver_data = NULL;
34386 @@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
34388 /* the actual setup */
34389 spin_lock_irqsave(&serial->serial_lock, flags);
34390 - if (serial->open_count)
34391 + if (local_read(&serial->open_count))
34392 _hso_serial_set_termios(tty, old);
34394 tty->termios = old;
34395 @@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *urb)
34396 D1("Pending read interrupt on port %d\n", i);
34397 spin_lock(&serial->serial_lock);
34398 if (serial->rx_state == RX_IDLE &&
34399 - serial->open_count > 0) {
34400 + local_read(&serial->open_count) > 0) {
34401 /* Setup and send a ctrl req read on
34403 if (!serial->rx_urb_filled[0]) {
34404 @@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interface *iface)
34405 /* Start all serial ports */
34406 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
34407 if (serial_table[i] && (serial_table[i]->interface == iface)) {
34408 - if (dev2ser(serial_table[i])->open_count) {
34409 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
34411 hso_start_serial_device(serial_table[i], GFP_NOIO);
34412 hso_kick_transmit(dev2ser(serial_table[i]));
34413 diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34414 index 27400ed..c796e05 100644
34415 --- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
34416 +++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
34417 @@ -601,8 +601,7 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
34418 * Return with error code if any of the queue indices
34421 - if (p->ring_index[i] < 0 ||
34422 - p->ring_index[i] >= adapter->num_rx_queues)
34423 + if (p->ring_index[i] >= adapter->num_rx_queues)
34427 diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
34428 index dd36258..e47fd31 100644
34429 --- a/drivers/net/vxge/vxge-config.h
34430 +++ b/drivers/net/vxge/vxge-config.h
34431 @@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
34432 void (*link_down)(struct __vxge_hw_device *devh);
34433 void (*crit_err)(struct __vxge_hw_device *devh,
34434 enum vxge_hw_event type, u64 ext_data);
34439 * struct __vxge_hw_blockpool_entry - Block private data structure
34440 diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
34441 index 178348a2..18bb433 100644
34442 --- a/drivers/net/vxge/vxge-main.c
34443 +++ b/drivers/net/vxge/vxge-main.c
34444 @@ -100,6 +100,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
34445 struct sk_buff *completed[NR_SKB_COMPLETED];
34448 + pax_track_stack();
34452 skb_ptr = completed;
34453 @@ -1915,6 +1917,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
34454 u8 mtable[256] = {0}; /* CPU to vpath mapping */
34457 + pax_track_stack();
34461 * - itable with bucket numbers
34462 diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
34463 index 4a518a3..936b334 100644
34464 --- a/drivers/net/vxge/vxge-traffic.h
34465 +++ b/drivers/net/vxge/vxge-traffic.h
34466 @@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
34467 struct vxge_hw_mempool_dma *dma_object,
34473 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
34474 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
34475 diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
34476 index 56aeb01..547f71f 100644
34477 --- a/drivers/net/wan/hdlc_x25.c
34478 +++ b/drivers/net/wan/hdlc_x25.c
34479 @@ -134,16 +134,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
34481 static int x25_open(struct net_device *dev)
34483 - struct lapb_register_struct cb;
34484 + static struct lapb_register_struct cb = {
34485 + .connect_confirmation = x25_connected,
34486 + .connect_indication = x25_connected,
34487 + .disconnect_confirmation = x25_disconnected,
34488 + .disconnect_indication = x25_disconnected,
34489 + .data_indication = x25_data_indication,
34490 + .data_transmit = x25_data_transmit
34494 - cb.connect_confirmation = x25_connected;
34495 - cb.connect_indication = x25_connected;
34496 - cb.disconnect_confirmation = x25_disconnected;
34497 - cb.disconnect_indication = x25_disconnected;
34498 - cb.data_indication = x25_data_indication;
34499 - cb.data_transmit = x25_data_transmit;
34501 result = lapb_register(dev, &cb);
34502 if (result != LAPB_OK)
34504 diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
34505 index 1fda46c..f2858f2 100644
34506 --- a/drivers/net/wimax/i2400m/usb-fw.c
34507 +++ b/drivers/net/wimax/i2400m/usb-fw.c
34508 @@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
34510 DECLARE_COMPLETION_ONSTACK(notif_completion);
34512 + pax_track_stack();
34514 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
34515 i2400m, ack, ack_size);
34516 BUG_ON(_ack == i2400m->bm_ack_buf);
34517 diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
34518 index e1b3e3c..e413f18 100644
34519 --- a/drivers/net/wireless/airo.c
34520 +++ b/drivers/net/wireless/airo.c
34521 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
34522 BSSListElement * loop_net;
34523 BSSListElement * tmp_net;
34525 + pax_track_stack();
34527 /* Blow away current list of scan results */
34528 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
34529 list_move_tail (&loop_net->list, &ai->network_free_list);
34530 @@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
34534 + pax_track_stack();
34536 memset( &mySsid, 0, sizeof( mySsid ) );
34539 @@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct inode *inode,
34540 __le32 *vals = stats.vals;
34543 + pax_track_stack();
34545 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34547 data = file->private_data;
34548 @@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
34549 /* If doLoseSync is not 1, we won't do a Lose Sync */
34550 int doLoseSync = -1;
34552 + pax_track_stack();
34554 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34556 data = file->private_data;
34557 @@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_device *dev,
34559 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
34561 + pax_track_stack();
34563 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
34566 @@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
34567 CapabilityRid cap_rid;
34568 __le32 *vals = stats_rid.vals;
34570 + pax_track_stack();
34572 /* Get stats out of the card */
34573 clear_bit(JOB_WSTATS, &local->jobs);
34574 if (local->power.event) {
34575 diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
34576 index 17c4b56..00d836f 100644
34577 --- a/drivers/net/wireless/ath/ath.h
34578 +++ b/drivers/net/wireless/ath/ath.h
34579 @@ -121,6 +121,7 @@ struct ath_ops {
34580 void (*write_flush) (void *);
34581 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
34583 +typedef struct ath_ops __no_const ath_ops_no_const;
34586 struct ath_bus_ops;
34587 diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
34588 index ccca724..7afbadc 100644
34589 --- a/drivers/net/wireless/ath/ath5k/debug.c
34590 +++ b/drivers/net/wireless/ath/ath5k/debug.c
34591 @@ -203,6 +203,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
34595 + pax_track_stack();
34597 v = ath5k_hw_reg_read(ah, AR5K_BEACON);
34598 len += snprintf(buf + len, sizeof(buf) - len,
34599 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
34600 @@ -321,6 +323,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
34601 unsigned int len = 0;
34604 + pax_track_stack();
34606 len += snprintf(buf + len, sizeof(buf) - len,
34607 "DEBUG LEVEL: 0x%08x\n\n", ah->debug.level);
34609 @@ -492,6 +496,8 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
34610 unsigned int len = 0;
34611 u32 filt = ath5k_hw_get_rx_filter(ah);
34613 + pax_track_stack();
34615 len += snprintf(buf + len, sizeof(buf) - len, "bssid-mask: %pM\n",
34617 len += snprintf(buf + len, sizeof(buf) - len, "filter-flags: 0x%x ",
34618 @@ -548,6 +554,8 @@ static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
34619 unsigned int len = 0;
34622 + pax_track_stack();
34624 len += snprintf(buf + len, sizeof(buf) - len,
34625 "RX\n---------------------\n");
34626 len += snprintf(buf + len, sizeof(buf) - len, "CRC\t%u\t(%u%%)\n",
34627 @@ -665,6 +673,8 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
34629 unsigned int len = 0;
34631 + pax_track_stack();
34633 len += snprintf(buf + len, sizeof(buf) - len,
34634 "HW has PHY error counters:\t%s\n",
34635 ah->ah_capabilities.cap_has_phyerr_counters ?
34636 @@ -829,6 +839,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34637 struct ath5k_buf *bf, *bf0;
34640 + pax_track_stack();
34642 len += snprintf(buf + len, sizeof(buf) - len,
34643 "available txbuffers: %d\n", ah->txbuf_len);
34645 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34646 index 7c2aaad..ad14dee 100644
34647 --- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34648 +++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
34649 @@ -758,6 +758,8 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah)
34653 + pax_track_stack();
34655 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
34656 if (ah->txchainmask & (1 << i))
34658 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34659 index f80d1d6..08b773d 100644
34660 --- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34661 +++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
34662 @@ -406,6 +406,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
34663 int theta_low_bin = 0;
34666 + pax_track_stack();
34668 /* disregard any bin that contains <= 16 samples */
34669 thresh_accum_cnt = 16;
34671 diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
34672 index d1eb896..8b67cd4 100644
34673 --- a/drivers/net/wireless/ath/ath9k/debug.c
34674 +++ b/drivers/net/wireless/ath/ath9k/debug.c
34675 @@ -387,6 +387,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
34677 unsigned int len = 0;
34679 + pax_track_stack();
34681 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
34682 len += snprintf(buf + len, sizeof(buf) - len,
34683 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
34684 @@ -477,6 +479,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
34688 + pax_track_stack();
34690 len += snprintf(buf + len, sizeof(buf) - len,
34691 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
34692 wiphy_name(sc->hw->wiphy),
34693 diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34694 index d3ff33c..309398e 100644
34695 --- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34696 +++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
34697 @@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
34698 unsigned int len = 0;
34701 + pax_track_stack();
34703 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34705 ath9k_htc_ps_wakeup(priv);
34706 @@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
34707 unsigned int len = 0;
34710 + pax_track_stack();
34712 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34714 ath9k_htc_ps_wakeup(priv);
34715 @@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
34716 unsigned int len = 0;
34719 + pax_track_stack();
34721 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
34723 ath9k_htc_ps_wakeup(priv);
34724 @@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
34726 unsigned int len = 0;
34728 + pax_track_stack();
34730 len += snprintf(buf + len, sizeof(buf) - len,
34731 "%20s : %10u\n", "Buffers queued",
34732 priv->debug.tx_stats.buf_queued);
34733 @@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
34735 unsigned int len = 0;
34737 + pax_track_stack();
34739 spin_lock_bh(&priv->tx.tx_lock);
34741 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
34742 @@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
34744 unsigned int len = 0;
34746 + pax_track_stack();
34748 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
34749 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
34751 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
34752 index c798890..c19a8fb 100644
34753 --- a/drivers/net/wireless/ath/ath9k/hw.h
34754 +++ b/drivers/net/wireless/ath/ath9k/hw.h
34755 @@ -588,7 +588,7 @@ struct ath_hw_private_ops {
34758 void (*ani_cache_ini_regs)(struct ath_hw *ah);
34763 * struct ath_hw_ops - callbacks used by hardware code and driver code
34764 @@ -639,7 +639,7 @@ struct ath_hw_ops {
34765 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
34766 struct ath_hw_antcomb_conf *antconf);
34771 struct ath_nf_limits {
34773 @@ -652,7 +652,7 @@ struct ath_nf_limits {
34774 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
34777 - struct ath_ops reg_ops;
34778 + ath_ops_no_const reg_ops;
34780 struct ieee80211_hw *hw;
34781 struct ath_common common;
34782 diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
34783 index ef9ad79..f5f8d80 100644
34784 --- a/drivers/net/wireless/ipw2x00/ipw2100.c
34785 +++ b/drivers/net/wireless/ipw2x00/ipw2100.c
34786 @@ -2102,6 +2102,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
34788 DECLARE_SSID_BUF(ssid);
34790 + pax_track_stack();
34792 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
34795 @@ -5451,6 +5453,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
34796 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
34799 + pax_track_stack();
34801 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
34804 diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
34805 index 32a9966..de69787 100644
34806 --- a/drivers/net/wireless/ipw2x00/libipw_rx.c
34807 +++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
34808 @@ -1565,6 +1565,8 @@ static void libipw_process_probe_response(struct libipw_device
34809 unsigned long flags;
34810 DECLARE_SSID_BUF(ssid);
34812 + pax_track_stack();
34814 LIBIPW_DEBUG_SCAN("'%s' (%pM"
34815 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
34816 print_ssid(ssid, info_element->data, info_element->len),
34817 diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34818 index 66ee1562..b90412b 100644
34819 --- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
34820 +++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
34821 @@ -3687,7 +3687,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
34823 if (iwl3945_mod_params.disable_hw_scan) {
34824 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
34825 - iwl3945_hw_ops.hw_scan = NULL;
34826 + pax_open_kernel();
34827 + *(void **)&iwl3945_hw_ops.hw_scan = NULL;
34828 + pax_close_kernel();
34831 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
34832 diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34833 index 3789ff4..22ab151 100644
34834 --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34835 +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
34836 @@ -920,6 +920,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
34837 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
34838 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
34840 + pax_track_stack();
34842 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
34844 /* Treat uninitialized rate scaling data same as non-existing. */
34845 @@ -2931,6 +2933,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
34846 container_of(lq_sta, struct iwl_station_priv, lq_sta);
34847 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
34849 + pax_track_stack();
34851 /* Override starting rate (index 0) if needed for debug purposes */
34852 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
34854 diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
34855 index f9a407e..a6f2bb7 100644
34856 --- a/drivers/net/wireless/iwlwifi/iwl-debug.h
34857 +++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
34858 @@ -68,8 +68,8 @@ do { \
34862 -#define IWL_DEBUG(__priv, level, fmt, args...)
34863 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
34864 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
34865 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
34866 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
34867 const void *p, u32 len)
34869 diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34870 index ec1485b..900c3bd 100644
34871 --- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34872 +++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
34873 @@ -561,6 +561,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
34875 const size_t bufsz = sizeof(buf);
34877 + pax_track_stack();
34879 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
34880 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
34881 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
34882 @@ -693,6 +695,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
34883 char buf[256 * NUM_IWL_RXON_CTX];
34884 const size_t bufsz = sizeof(buf);
34886 + pax_track_stack();
34888 for_each_context(priv, ctx) {
34889 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
34891 diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34892 index 0a0cc96..fd49ad8 100644
34893 --- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
34894 +++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
34895 @@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
34899 + pax_track_stack();
34903 if (count < sizeof(buf))
34904 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
34905 index 031cd89..bdc8435 100644
34906 --- a/drivers/net/wireless/mac80211_hwsim.c
34907 +++ b/drivers/net/wireless/mac80211_hwsim.c
34908 @@ -1670,9 +1670,11 @@ static int __init init_mac80211_hwsim(void)
34911 if (fake_hw_scan) {
34912 - mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34913 - mac80211_hwsim_ops.sw_scan_start = NULL;
34914 - mac80211_hwsim_ops.sw_scan_complete = NULL;
34915 + pax_open_kernel();
34916 + *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
34917 + *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
34918 + *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
34919 + pax_close_kernel();
34922 spin_lock_init(&hwsim_radio_lock);
34923 diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
34924 index 2215c3c..64e6a47 100644
34925 --- a/drivers/net/wireless/mwifiex/main.h
34926 +++ b/drivers/net/wireless/mwifiex/main.h
34927 @@ -560,7 +560,7 @@ struct mwifiex_if_ops {
34929 void (*update_mp_end_port) (struct mwifiex_adapter *, u16);
34930 void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
34934 struct mwifiex_adapter {
34935 struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
34936 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
34937 index 29f9389..f6d2ce0 100644
34938 --- a/drivers/net/wireless/rndis_wlan.c
34939 +++ b/drivers/net/wireless/rndis_wlan.c
34940 @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
34942 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
34944 - if (rts_threshold < 0 || rts_threshold > 2347)
34945 + if (rts_threshold > 2347)
34946 rts_threshold = 2347;
34948 tmp = cpu_to_le32(rts_threshold);
34949 diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34950 index 3b11642..d6bb049 100644
34951 --- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34952 +++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
34953 @@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
34955 u8 num_total_rfpath = rtlphy->num_total_rfpath;
34957 + pax_track_stack();
34959 precommoncmdcnt = 0;
34960 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
34962 diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
34963 index a77f1bb..c608b2b 100644
34964 --- a/drivers/net/wireless/wl1251/wl1251.h
34965 +++ b/drivers/net/wireless/wl1251/wl1251.h
34966 @@ -266,7 +266,7 @@ struct wl1251_if_operations {
34967 void (*reset)(struct wl1251 *wl);
34968 void (*enable_irq)(struct wl1251 *wl);
34969 void (*disable_irq)(struct wl1251 *wl);
34974 struct ieee80211_hw *hw;
34975 diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
34976 index e0b3736..4b466e6 100644
34977 --- a/drivers/net/wireless/wl12xx/spi.c
34978 +++ b/drivers/net/wireless/wl12xx/spi.c
34979 @@ -281,6 +281,8 @@ static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
34983 + pax_track_stack();
34985 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
34987 spi_message_init(&m);
34988 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
34989 index f34b5b2..b5abb9f 100644
34990 --- a/drivers/oprofile/buffer_sync.c
34991 +++ b/drivers/oprofile/buffer_sync.c
34992 @@ -343,7 +343,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
34993 if (cookie == NO_COOKIE)
34995 if (cookie == INVALID_COOKIE) {
34996 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
34997 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35000 if (cookie != last_cookie) {
35001 @@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
35002 /* add userspace sample */
35005 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
35006 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
35010 cookie = lookup_dcookie(mm, s->eip, &offset);
35012 if (cookie == INVALID_COOKIE) {
35013 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35014 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35018 @@ -563,7 +563,7 @@ void sync_buffer(int cpu)
35019 /* ignore backtraces if failed to add a sample */
35020 if (state == sb_bt_start) {
35021 state = sb_bt_ignore;
35022 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
35023 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
35027 diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
35028 index dd87e86..bc0148c 100644
35029 --- a/drivers/oprofile/event_buffer.c
35030 +++ b/drivers/oprofile/event_buffer.c
35031 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
35034 if (buffer_pos == buffer_size) {
35035 - atomic_inc(&oprofile_stats.event_lost_overflow);
35036 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
35040 diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
35041 index f8c752e..28bf4fc 100644
35042 --- a/drivers/oprofile/oprof.c
35043 +++ b/drivers/oprofile/oprof.c
35044 @@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
35045 if (oprofile_ops.switch_events())
35048 - atomic_inc(&oprofile_stats.multiplex_counter);
35049 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
35050 start_switch_worker();
35053 diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
35054 index 917d28e..d62d981 100644
35055 --- a/drivers/oprofile/oprofile_stats.c
35056 +++ b/drivers/oprofile/oprofile_stats.c
35057 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
35058 cpu_buf->sample_invalid_eip = 0;
35061 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
35062 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35063 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
35064 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35065 - atomic_set(&oprofile_stats.multiplex_counter, 0);
35066 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35067 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35068 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35069 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35070 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35074 diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
35075 index 38b6fc0..b5cbfce 100644
35076 --- a/drivers/oprofile/oprofile_stats.h
35077 +++ b/drivers/oprofile/oprofile_stats.h
35078 @@ -13,11 +13,11 @@
35079 #include <linux/atomic.h>
35081 struct oprofile_stat_struct {
35082 - atomic_t sample_lost_no_mm;
35083 - atomic_t sample_lost_no_mapping;
35084 - atomic_t bt_lost_no_mapping;
35085 - atomic_t event_lost_overflow;
35086 - atomic_t multiplex_counter;
35087 + atomic_unchecked_t sample_lost_no_mm;
35088 + atomic_unchecked_t sample_lost_no_mapping;
35089 + atomic_unchecked_t bt_lost_no_mapping;
35090 + atomic_unchecked_t event_lost_overflow;
35091 + atomic_unchecked_t multiplex_counter;
35094 extern struct oprofile_stat_struct oprofile_stats;
35095 diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
35096 index e9ff6f7..28e259a 100644
35097 --- a/drivers/oprofile/oprofilefs.c
35098 +++ b/drivers/oprofile/oprofilefs.c
35099 @@ -186,7 +186,7 @@ static const struct file_operations atomic_ro_fops = {
35102 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35103 - char const *name, atomic_t *val)
35104 + char const *name, atomic_unchecked_t *val)
35106 return __oprofilefs_create_file(sb, root, name,
35107 &atomic_ro_fops, 0444, val);
35108 diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
35109 index 3f56bc0..707d642 100644
35110 --- a/drivers/parport/procfs.c
35111 +++ b/drivers/parport/procfs.c
35112 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
35116 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35117 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35120 #ifdef CONFIG_PARPORT_1284
35121 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
35125 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35126 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35128 #endif /* IEEE1284.3 support. */
35130 diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
35131 index 9fff878..ad0ad53 100644
35132 --- a/drivers/pci/hotplug/cpci_hotplug.h
35133 +++ b/drivers/pci/hotplug/cpci_hotplug.h
35134 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35135 int (*hardware_test) (struct slot* slot, u32 value);
35136 u8 (*get_power) (struct slot* slot);
35137 int (*set_power) (struct slot* slot, int value);
35141 struct cpci_hp_controller {
35143 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
35144 index 76ba8a1..20ca857 100644
35145 --- a/drivers/pci/hotplug/cpqphp_nvram.c
35146 +++ b/drivers/pci/hotplug/cpqphp_nvram.c
35147 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
35149 void compaq_nvram_init (void __iomem *rom_start)
35152 +#ifndef CONFIG_PAX_KERNEXEC
35154 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35158 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35160 /* initialize our int15 lock */
35161 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
35162 index cbfbab1..6a9fced 100644
35163 --- a/drivers/pci/pcie/aspm.c
35164 +++ b/drivers/pci/pcie/aspm.c
35166 #define MODULE_PARAM_PREFIX "pcie_aspm."
35168 /* Note: those are not register definitions */
35169 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35170 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35171 -#define ASPM_STATE_L1 (4) /* L1 state */
35172 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35173 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35174 +#define ASPM_STATE_L1 (4U) /* L1 state */
35175 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35176 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35178 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
35179 index 6ab6bd3..72bdc69 100644
35180 --- a/drivers/pci/probe.c
35181 +++ b/drivers/pci/probe.c
35182 @@ -136,7 +136,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
35186 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
35187 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
35189 if (!dev->mmio_always_on) {
35190 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
35191 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
35192 index 27911b5..5b6db88 100644
35193 --- a/drivers/pci/proc.c
35194 +++ b/drivers/pci/proc.c
35195 @@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
35196 static int __init pci_proc_init(void)
35198 struct pci_dev *dev = NULL;
35200 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
35201 +#ifdef CONFIG_GRKERNSEC_PROC_USER
35202 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35203 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35204 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35207 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35209 proc_create("devices", 0, proc_bus_pci_dir,
35210 &proc_bus_pci_dev_operations);
35211 proc_initialized = 1;
35212 diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
35213 index 90832a9..419089a 100644
35214 --- a/drivers/pci/xen-pcifront.c
35215 +++ b/drivers/pci/xen-pcifront.c
35216 @@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_bus *bus, unsigned int devfn,
35217 struct pcifront_sd *sd = bus->sysdata;
35218 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35220 + pax_track_stack();
35222 if (verbose_request)
35223 dev_info(&pdev->xdev->dev,
35224 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
35225 @@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci_bus *bus, unsigned int devfn,
35226 struct pcifront_sd *sd = bus->sysdata;
35227 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35229 + pax_track_stack();
35231 if (verbose_request)
35232 dev_info(&pdev->xdev->dev,
35233 "write dev=%04x:%02x:%02x.%01x - "
35234 @@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
35235 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35236 struct msi_desc *entry;
35238 + pax_track_stack();
35240 if (nvec > SH_INFO_MAX_VEC) {
35241 dev_err(&dev->dev, "too much vector for pci frontend: %x."
35242 " Increase SH_INFO_MAX_VEC.\n", nvec);
35243 @@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(struct pci_dev *dev)
35244 struct pcifront_sd *sd = dev->bus->sysdata;
35245 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35247 + pax_track_stack();
35249 err = do_pci_op(pdev, &op);
35251 /* What should do for error ? */
35252 @@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struct pci_dev *dev, int vector[])
35253 struct pcifront_sd *sd = dev->bus->sysdata;
35254 struct pcifront_device *pdev = pcifront_get_pdev(sd);
35256 + pax_track_stack();
35258 err = do_pci_op(pdev, &op);
35259 if (likely(!err)) {
35260 vector[0] = op.value;
35261 diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
35262 index 7bd829f..a3237ad 100644
35263 --- a/drivers/platform/x86/thinkpad_acpi.c
35264 +++ b/drivers/platform/x86/thinkpad_acpi.c
35265 @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
35269 -void static hotkey_mask_warn_incomplete_mask(void)
35270 +static void hotkey_mask_warn_incomplete_mask(void)
35272 /* log only what the user can fix... */
35273 const u32 wantedmask = hotkey_driver_mask &
35274 @@ -2325,11 +2325,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
35278 -static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35279 - struct tp_nvram_state *newn,
35280 - const u32 event_mask)
35283 #define TPACPI_COMPARE_KEY(__scancode, __member) \
35285 if ((event_mask & (1 << __scancode)) && \
35286 @@ -2343,36 +2338,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35287 tpacpi_hotkey_send_key(__scancode); \
35290 - void issue_volchange(const unsigned int oldvol,
35291 - const unsigned int newvol)
35293 - unsigned int i = oldvol;
35294 +static void issue_volchange(const unsigned int oldvol,
35295 + const unsigned int newvol,
35296 + const u32 event_mask)
35298 + unsigned int i = oldvol;
35300 - while (i > newvol) {
35301 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35304 - while (i < newvol) {
35305 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35308 + while (i > newvol) {
35309 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35312 + while (i < newvol) {
35313 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35318 - void issue_brightnesschange(const unsigned int oldbrt,
35319 - const unsigned int newbrt)
35321 - unsigned int i = oldbrt;
35322 +static void issue_brightnesschange(const unsigned int oldbrt,
35323 + const unsigned int newbrt,
35324 + const u32 event_mask)
35326 + unsigned int i = oldbrt;
35328 - while (i > newbrt) {
35329 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35332 - while (i < newbrt) {
35333 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35336 + while (i > newbrt) {
35337 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35340 + while (i < newbrt) {
35341 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35346 +static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35347 + struct tp_nvram_state *newn,
35348 + const u32 event_mask)
35350 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
35351 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
35352 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
35353 @@ -2406,7 +2407,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35354 oldn->volume_level != newn->volume_level) {
35355 /* recently muted, or repeated mute keypress, or
35356 * multiple presses ending in mute */
35357 - issue_volchange(oldn->volume_level, newn->volume_level);
35358 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35359 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
35362 @@ -2416,7 +2417,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35363 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35365 if (oldn->volume_level != newn->volume_level) {
35366 - issue_volchange(oldn->volume_level, newn->volume_level);
35367 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
35368 } else if (oldn->volume_toggle != newn->volume_toggle) {
35369 /* repeated vol up/down keypress at end of scale ? */
35370 if (newn->volume_level == 0)
35371 @@ -2429,7 +2430,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35372 /* handle brightness */
35373 if (oldn->brightness_level != newn->brightness_level) {
35374 issue_brightnesschange(oldn->brightness_level,
35375 - newn->brightness_level);
35376 + newn->brightness_level,
35378 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
35379 /* repeated key presses that didn't change state */
35380 if (newn->brightness_level == 0)
35381 @@ -2438,10 +2440,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35382 && !tp_features.bright_unkfw)
35383 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
35387 #undef TPACPI_COMPARE_KEY
35388 #undef TPACPI_MAY_SEND_KEY
35393 diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
35394 index b859d16..5cc6b1a 100644
35395 --- a/drivers/pnp/pnpbios/bioscalls.c
35396 +++ b/drivers/pnp/pnpbios/bioscalls.c
35397 @@ -59,7 +59,7 @@ do { \
35398 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
35401 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
35402 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
35403 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
35406 @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35409 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
35411 + pax_open_kernel();
35412 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
35413 + pax_close_kernel();
35415 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
35416 spin_lock_irqsave(&pnp_bios_lock, flags);
35417 @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
35419 spin_unlock_irqrestore(&pnp_bios_lock, flags);
35421 + pax_open_kernel();
35422 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
35423 + pax_close_kernel();
35427 /* If we get here and this is set then the PnP BIOS faulted on us. */
35428 @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
35432 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
35433 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
35437 @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35438 pnp_bios_callpoint.offset = header->fields.pm16offset;
35439 pnp_bios_callpoint.segment = PNP_CS16;
35441 + pax_open_kernel();
35443 for_each_possible_cpu(i) {
35444 struct desc_struct *gdt = get_cpu_gdt_table(i);
35446 @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
35447 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
35448 (unsigned long)__va(header->fields.pm16dseg));
35451 + pax_close_kernel();
35453 diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
35454 index b0ecacb..7c9da2e 100644
35455 --- a/drivers/pnp/resource.c
35456 +++ b/drivers/pnp/resource.c
35457 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
35460 /* check if the resource is valid */
35461 - if (*irq < 0 || *irq > 15)
35465 /* check if the resource is reserved */
35466 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
35469 /* check if the resource is valid */
35470 - if (*dma < 0 || *dma == 4 || *dma > 7)
35471 + if (*dma == 4 || *dma > 7)
35474 /* check if the resource is reserved */
35475 diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
35476 index bb16f5b..c751eef 100644
35477 --- a/drivers/power/bq27x00_battery.c
35478 +++ b/drivers/power/bq27x00_battery.c
35480 struct bq27x00_device_info;
35481 struct bq27x00_access_methods {
35482 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
35486 enum bq27x00_chip { BQ27000, BQ27500 };
35488 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
35489 index 33f5d9a..d957d3f 100644
35490 --- a/drivers/regulator/max8660.c
35491 +++ b/drivers/regulator/max8660.c
35492 @@ -383,8 +383,10 @@ static int __devinit max8660_probe(struct i2c_client *client,
35493 max8660->shadow_regs[MAX8660_OVER1] = 5;
35495 /* Otherwise devices can be toggled via software */
35496 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
35497 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
35498 + pax_open_kernel();
35499 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
35500 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
35501 + pax_close_kernel();
35505 diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
35506 index 3285d41..ab7c22a 100644
35507 --- a/drivers/regulator/mc13892-regulator.c
35508 +++ b/drivers/regulator/mc13892-regulator.c
35509 @@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev)
35511 mc13xxx_unlock(mc13892);
35513 - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35514 + pax_open_kernel();
35515 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
35516 = mc13892_vcam_set_mode;
35517 - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35518 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
35519 = mc13892_vcam_get_mode;
35520 + pax_close_kernel();
35521 for (i = 0; i < pdata->num_regulators; i++) {
35522 init_data = &pdata->regulators[i];
35523 priv->regulators[i] = regulator_register(
35524 diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
35525 index cace6d3..f623fda 100644
35526 --- a/drivers/rtc/rtc-dev.c
35527 +++ b/drivers/rtc/rtc-dev.c
35529 #include <linux/module.h>
35530 #include <linux/rtc.h>
35531 #include <linux/sched.h>
35532 +#include <linux/grsecurity.h>
35533 #include "rtc-core.h"
35535 static dev_t rtc_devt;
35536 @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *file,
35537 if (copy_from_user(&tm, uarg, sizeof(tm)))
35540 + gr_log_timechange();
35542 return rtc_set_time(rtc, &tm);
35545 diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
35546 index f66c33b..7ae5823 100644
35547 --- a/drivers/scsi/BusLogic.c
35548 +++ b/drivers/scsi/BusLogic.c
35549 @@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
35550 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
35551 *PrototypeHostAdapter)
35553 + pax_track_stack();
35556 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
35557 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
35558 diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
35559 index ffb5878..e6d785c 100644
35560 --- a/drivers/scsi/aacraid/aacraid.h
35561 +++ b/drivers/scsi/aacraid/aacraid.h
35562 @@ -492,7 +492,7 @@ struct adapter_ops
35563 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
35564 /* Administrative operations */
35565 int (*adapter_comm)(struct aac_dev * dev, int comm);
35570 * Define which interrupt handler needs to be installed
35571 diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
35572 index 8a0b330..b4286de 100644
35573 --- a/drivers/scsi/aacraid/commctrl.c
35574 +++ b/drivers/scsi/aacraid/commctrl.c
35575 @@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
35576 u32 actual_fibsize64, actual_fibsize = 0;
35579 + pax_track_stack();
35581 if (dev->in_reset) {
35582 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
35583 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
35584 index c7b6fed..4db0569 100644
35585 --- a/drivers/scsi/aacraid/linit.c
35586 +++ b/drivers/scsi/aacraid/linit.c
35587 @@ -93,7 +93,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
35588 #elif defined(__devinitconst)
35589 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35591 -static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
35592 +static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
35594 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
35595 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
35596 diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
35597 index d5ff142..49c0ebb 100644
35598 --- a/drivers/scsi/aic94xx/aic94xx_init.c
35599 +++ b/drivers/scsi/aic94xx/aic94xx_init.c
35600 @@ -1012,7 +1012,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
35601 .lldd_control_phy = asd_control_phy,
35604 -static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
35605 +static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
35606 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
35607 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
35608 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
35609 diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
35610 index a796de9..1ef20e1 100644
35611 --- a/drivers/scsi/bfa/bfa.h
35612 +++ b/drivers/scsi/bfa/bfa.h
35613 @@ -196,7 +196,7 @@ struct bfa_hwif_s {
35619 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
35621 struct bfa_faa_cbfn_s {
35622 diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
35623 index e07bd47..dbd260a 100644
35624 --- a/drivers/scsi/bfa/bfa_fcpim.c
35625 +++ b/drivers/scsi/bfa/bfa_fcpim.c
35626 @@ -4179,7 +4179,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35627 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
35629 struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
35630 - struct bfa_itn_s *itn;
35631 + bfa_itn_s_no_const *itn;
35633 itn = BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
35635 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
35636 index 1080bcb..a3b39e3 100644
35637 --- a/drivers/scsi/bfa/bfa_fcpim.h
35638 +++ b/drivers/scsi/bfa/bfa_fcpim.h
35639 @@ -37,6 +37,7 @@ struct bfa_iotag_s {
35641 bfa_isr_func_t isr;
35643 +typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
35645 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
35646 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
35647 @@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
35648 struct list_head iotag_tio_free_q; /* free IO resources */
35649 struct list_head iotag_unused_q; /* unused IO resources*/
35650 struct bfa_iotag_s *iotag_arr;
35651 - struct bfa_itn_s *itn_arr;
35652 + bfa_itn_s_no_const *itn_arr;
35654 int num_fwtio_reqs;
35656 diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
35657 index d4f951f..197c350 100644
35658 --- a/drivers/scsi/bfa/bfa_fcs_lport.c
35659 +++ b/drivers/scsi/bfa/bfa_fcs_lport.c
35660 @@ -1700,6 +1700,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
35664 + pax_track_stack();
35667 * get hba attributes
35669 @@ -1977,6 +1979,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
35673 + pax_track_stack();
35676 * get port attributes
35678 diff --git a/drivers/scsi/bfa/bfa_fcs_rport.c b/drivers/scsi/bfa/bfa_fcs_rport.c
35679 index 52628d5..f89d033 100644
35680 --- a/drivers/scsi/bfa/bfa_fcs_rport.c
35681 +++ b/drivers/scsi/bfa/bfa_fcs_rport.c
35682 @@ -1871,6 +1871,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fcs_rport_s *rport,
35683 struct fc_rpsc_speed_info_s speeds;
35684 struct bfa_port_attr_s pport_attr;
35686 + pax_track_stack();
35688 bfa_trc(port->fcs, rx_fchs->s_id);
35689 bfa_trc(port->fcs, rx_fchs->d_id);
35691 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
35692 index 546d46b..642fa5b 100644
35693 --- a/drivers/scsi/bfa/bfa_ioc.h
35694 +++ b/drivers/scsi/bfa/bfa_ioc.h
35695 @@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
35696 bfa_ioc_disable_cbfn_t disable_cbfn;
35697 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
35698 bfa_ioc_reset_cbfn_t reset_cbfn;
35703 * IOC event notification mechanism.
35704 @@ -346,7 +346,7 @@ struct bfa_ioc_hwif_s {
35705 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
35706 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
35707 bfa_boolean_t (*ioc_lpu_read_stat) (struct bfa_ioc_s *ioc);
35712 * Queue element to wait for room in request queue. FIFO order is
35713 diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
35714 index 66fb725..0fe05ab 100644
35715 --- a/drivers/scsi/bfa/bfad.c
35716 +++ b/drivers/scsi/bfa/bfad.c
35717 @@ -1019,6 +1019,8 @@ bfad_start_ops(struct bfad_s *bfad) {
35718 struct bfad_vport_s *vport, *vport_new;
35719 struct bfa_fcs_driver_info_s driver_info;
35721 + pax_track_stack();
35723 /* Limit min/max. xfer size to [64k-32MB] */
35724 if (max_xfer_size < BFAD_MIN_SECTORS >> 1)
35725 max_xfer_size = BFAD_MIN_SECTORS >> 1;
35726 diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
35727 index b4f6c9a..0eb1938 100644
35728 --- a/drivers/scsi/dpt_i2o.c
35729 +++ b/drivers/scsi/dpt_i2o.c
35730 @@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
35734 + pax_track_stack();
35736 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
35737 // get user msg size in u32s
35738 if(get_user(size, &user_msg[0])){
35739 @@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
35743 + pax_track_stack();
35745 memset(msg, 0 , sizeof(msg));
35746 len = scsi_bufflen(cmd);
35747 direction = 0x00000000;
35748 diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
35749 index 94de889..ca4f0cf 100644
35750 --- a/drivers/scsi/eata.c
35751 +++ b/drivers/scsi/eata.c
35752 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
35753 struct hostdata *ha;
35756 + pax_track_stack();
35758 sprintf(name, "%s%d", driver_name, j);
35760 if (!request_region(port_base, REGION_SIZE, driver_name)) {
35761 diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
35762 index c74c4b8..c41ca3f 100644
35763 --- a/drivers/scsi/fcoe/fcoe_ctlr.c
35764 +++ b/drivers/scsi/fcoe/fcoe_ctlr.c
35765 @@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
35769 + pax_track_stack();
35771 fiph = (struct fip_header *)skb->data;
35772 sub = fiph->fip_subcode;
35774 diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
35775 index 3242bca..45a83e7 100644
35776 --- a/drivers/scsi/gdth.c
35777 +++ b/drivers/scsi/gdth.c
35778 @@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
35779 unsigned long flags;
35782 + pax_track_stack();
35784 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
35786 ha = gdth_find_ha(ldrv.ionode);
35787 @@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
35791 + pax_track_stack();
35793 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
35794 res.number >= MAX_HDRIVES)
35796 @@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg, char *cmnd)
35800 + pax_track_stack();
35802 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
35804 ha = gdth_find_ha(gen.ionode);
35805 @@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
35807 gdth_cmd_str gdtcmd;
35808 char cmnd[MAX_COMMAND_SIZE];
35810 + pax_track_stack();
35812 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
35814 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
35815 diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
35816 index 6527543..81e4fe2 100644
35817 --- a/drivers/scsi/gdth_proc.c
35818 +++ b/drivers/scsi/gdth_proc.c
35819 @@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
35822 char cmnd[MAX_COMMAND_SIZE];
35824 + pax_track_stack();
35826 memset(cmnd, 0xff, 12);
35827 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
35829 @@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
35830 gdth_hget_str *phg;
35831 char cmnd[MAX_COMMAND_SIZE];
35833 + pax_track_stack();
35835 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
35836 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
35837 if (!gdtcmd || !estr)
35838 diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
35839 index 351dc0b..951dc32 100644
35840 --- a/drivers/scsi/hosts.c
35841 +++ b/drivers/scsi/hosts.c
35843 #include "scsi_logging.h"
35846 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
35847 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
35850 static void scsi_host_cls_release(struct device *dev)
35851 @@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
35852 * subtract one because we increment first then return, but we need to
35853 * know what the next host number was before increment
35855 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
35856 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
35857 shost->dma_channel = 0xff;
35859 /* These three are default values which can be overridden */
35860 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
35861 index 418ce83..7ee1225 100644
35862 --- a/drivers/scsi/hpsa.c
35863 +++ b/drivers/scsi/hpsa.c
35864 @@ -499,7 +499,7 @@ static inline u32 next_command(struct ctlr_info *h)
35867 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
35868 - return h->access.command_completed(h);
35869 + return h->access->command_completed(h);
35871 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
35872 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
35873 @@ -2956,7 +2956,7 @@ static void start_io(struct ctlr_info *h)
35874 while (!list_empty(&h->reqQ)) {
35875 c = list_entry(h->reqQ.next, struct CommandList, list);
35876 /* can't do anything if fifo is full */
35877 - if ((h->access.fifo_full(h))) {
35878 + if ((h->access->fifo_full(h))) {
35879 dev_warn(&h->pdev->dev, "fifo full\n");
35882 @@ -2966,7 +2966,7 @@ static void start_io(struct ctlr_info *h)
35885 /* Tell the controller execute command */
35886 - h->access.submit_command(h, c);
35887 + h->access->submit_command(h, c);
35889 /* Put job onto the completed Q */
35891 @@ -2975,17 +2975,17 @@ static void start_io(struct ctlr_info *h)
35893 static inline unsigned long get_next_completion(struct ctlr_info *h)
35895 - return h->access.command_completed(h);
35896 + return h->access->command_completed(h);
35899 static inline bool interrupt_pending(struct ctlr_info *h)
35901 - return h->access.intr_pending(h);
35902 + return h->access->intr_pending(h);
35905 static inline long interrupt_not_for_us(struct ctlr_info *h)
35907 - return (h->access.intr_pending(h) == 0) ||
35908 + return (h->access->intr_pending(h) == 0) ||
35909 (h->interrupts_enabled == 0);
35912 @@ -3882,7 +3882,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
35913 if (prod_index < 0)
35915 h->product_name = products[prod_index].product_name;
35916 - h->access = *(products[prod_index].access);
35917 + h->access = products[prod_index].access;
35919 if (hpsa_board_disabled(h->pdev)) {
35920 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
35921 @@ -4163,7 +4163,7 @@ reinit_after_soft_reset:
35924 /* make sure the board interrupts are off */
35925 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
35926 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
35928 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
35930 @@ -4197,7 +4197,7 @@ reinit_after_soft_reset:
35931 * fake ones to scoop up any residual completions.
35933 spin_lock_irqsave(&h->lock, flags);
35934 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
35935 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
35936 spin_unlock_irqrestore(&h->lock, flags);
35937 free_irq(h->intr[h->intr_mode], h);
35938 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
35939 @@ -4216,9 +4216,9 @@ reinit_after_soft_reset:
35940 dev_info(&h->pdev->dev, "Board READY.\n");
35941 dev_info(&h->pdev->dev,
35942 "Waiting for stale completions to drain.\n");
35943 - h->access.set_intr_mask(h, HPSA_INTR_ON);
35944 + h->access->set_intr_mask(h, HPSA_INTR_ON);
35946 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
35947 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
35949 rc = controller_reset_failed(h->cfgtable);
35951 @@ -4239,7 +4239,7 @@ reinit_after_soft_reset:
35954 /* Turn the interrupts on so we can service requests */
35955 - h->access.set_intr_mask(h, HPSA_INTR_ON);
35956 + h->access->set_intr_mask(h, HPSA_INTR_ON);
35958 hpsa_hba_inquiry(h);
35959 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
35960 @@ -4292,7 +4292,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
35961 * To write all data in the battery backed cache to disks
35963 hpsa_flush_cache(h);
35964 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
35965 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
35966 free_irq(h->intr[h->intr_mode], h);
35967 #ifdef CONFIG_PCI_MSI
35968 if (h->msix_vector)
35969 @@ -4455,7 +4455,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
35972 /* Change the access methods to the performant access methods */
35973 - h->access = SA5_performant_access;
35974 + h->access = &SA5_performant_access;
35975 h->transMethod = CFGTBL_Trans_Performant;
35978 diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
35979 index 7f53cea..a8c7188 100644
35980 --- a/drivers/scsi/hpsa.h
35981 +++ b/drivers/scsi/hpsa.h
35982 @@ -73,7 +73,7 @@ struct ctlr_info {
35983 unsigned int msix_vector;
35984 unsigned int msi_vector;
35985 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
35986 - struct access_method access;
35987 + struct access_method *access;
35989 /* queue and queue Info */
35990 struct list_head reqQ;
35991 diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
35992 index f2df059..a3a9930 100644
35993 --- a/drivers/scsi/ips.h
35994 +++ b/drivers/scsi/ips.h
35995 @@ -1027,7 +1027,7 @@ typedef struct {
35996 int (*intr)(struct ips_ha *);
35997 void (*enableint)(struct ips_ha *);
35998 uint32_t (*statupd)(struct ips_ha *);
36000 +} __no_const ips_hw_func_t;
36002 typedef struct ips_ha {
36003 uint8_t ha_id[IPS_MAX_CHANNELS+1];
36004 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
36005 index d261e98..1e00f35 100644
36006 --- a/drivers/scsi/libfc/fc_exch.c
36007 +++ b/drivers/scsi/libfc/fc_exch.c
36008 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
36009 * all together if not used XXX
36012 - atomic_t no_free_exch;
36013 - atomic_t no_free_exch_xid;
36014 - atomic_t xid_not_found;
36015 - atomic_t xid_busy;
36016 - atomic_t seq_not_found;
36017 - atomic_t non_bls_resp;
36018 + atomic_unchecked_t no_free_exch;
36019 + atomic_unchecked_t no_free_exch_xid;
36020 + atomic_unchecked_t xid_not_found;
36021 + atomic_unchecked_t xid_busy;
36022 + atomic_unchecked_t seq_not_found;
36023 + atomic_unchecked_t non_bls_resp;
36027 @@ -718,7 +718,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
36028 /* allocate memory for exchange */
36029 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
36031 - atomic_inc(&mp->stats.no_free_exch);
36032 + atomic_inc_unchecked(&mp->stats.no_free_exch);
36035 memset(ep, 0, sizeof(*ep));
36036 @@ -779,7 +779,7 @@ out:
36039 spin_unlock_bh(&pool->lock);
36040 - atomic_inc(&mp->stats.no_free_exch_xid);
36041 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
36042 mempool_free(ep, mp->ep_pool);
36045 @@ -922,7 +922,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36046 xid = ntohs(fh->fh_ox_id); /* we originated exch */
36047 ep = fc_exch_find(mp, xid);
36049 - atomic_inc(&mp->stats.xid_not_found);
36050 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36051 reject = FC_RJT_OX_ID;
36054 @@ -952,7 +952,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36055 ep = fc_exch_find(mp, xid);
36056 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
36058 - atomic_inc(&mp->stats.xid_busy);
36059 + atomic_inc_unchecked(&mp->stats.xid_busy);
36060 reject = FC_RJT_RX_ID;
36063 @@ -963,7 +963,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36065 xid = ep->xid; /* get our XID */
36067 - atomic_inc(&mp->stats.xid_not_found);
36068 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36069 reject = FC_RJT_RX_ID; /* XID not found */
36072 @@ -980,7 +980,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36075 if (sp->id != fh->fh_seq_id) {
36076 - atomic_inc(&mp->stats.seq_not_found);
36077 + atomic_inc_unchecked(&mp->stats.seq_not_found);
36078 if (f_ctl & FC_FC_END_SEQ) {
36080 * Update sequence_id based on incoming last
36081 @@ -1430,22 +1430,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36083 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36085 - atomic_inc(&mp->stats.xid_not_found);
36086 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36089 if (ep->esb_stat & ESB_ST_COMPLETE) {
36090 - atomic_inc(&mp->stats.xid_not_found);
36091 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36094 if (ep->rxid == FC_XID_UNKNOWN)
36095 ep->rxid = ntohs(fh->fh_rx_id);
36096 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36097 - atomic_inc(&mp->stats.xid_not_found);
36098 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36101 if (ep->did != ntoh24(fh->fh_s_id) &&
36102 ep->did != FC_FID_FLOGI) {
36103 - atomic_inc(&mp->stats.xid_not_found);
36104 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36108 @@ -1454,7 +1454,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36109 sp->ssb_stat |= SSB_ST_RESP;
36110 sp->id = fh->fh_seq_id;
36111 } else if (sp->id != fh->fh_seq_id) {
36112 - atomic_inc(&mp->stats.seq_not_found);
36113 + atomic_inc_unchecked(&mp->stats.seq_not_found);
36117 @@ -1518,9 +1518,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36118 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36121 - atomic_inc(&mp->stats.xid_not_found);
36122 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36124 - atomic_inc(&mp->stats.non_bls_resp);
36125 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
36129 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
36130 index db9238f..4378ed2 100644
36131 --- a/drivers/scsi/libsas/sas_ata.c
36132 +++ b/drivers/scsi/libsas/sas_ata.c
36133 @@ -368,7 +368,7 @@ static struct ata_port_operations sas_sata_ops = {
36134 .postreset = ata_std_postreset,
36135 .error_handler = ata_std_error_handler,
36136 .post_internal_cmd = sas_ata_post_internal,
36137 - .qc_defer = ata_std_qc_defer,
36138 + .qc_defer = ata_std_qc_defer,
36139 .qc_prep = ata_noop_qc_prep,
36140 .qc_issue = sas_ata_qc_issue,
36141 .qc_fill_rtf = sas_ata_qc_fill_rtf,
36142 diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
36143 index c088a36..01c73b0 100644
36144 --- a/drivers/scsi/lpfc/lpfc.h
36145 +++ b/drivers/scsi/lpfc/lpfc.h
36146 @@ -425,7 +425,7 @@ struct lpfc_vport {
36147 struct dentry *debug_nodelist;
36148 struct dentry *vport_debugfs_root;
36149 struct lpfc_debugfs_trc *disc_trc;
36150 - atomic_t disc_trc_cnt;
36151 + atomic_unchecked_t disc_trc_cnt;
36153 uint8_t stat_data_enabled;
36154 uint8_t stat_data_blocked;
36155 @@ -835,8 +835,8 @@ struct lpfc_hba {
36156 struct timer_list fabric_block_timer;
36157 unsigned long bit_flags;
36158 #define FABRIC_COMANDS_BLOCKED 0
36159 - atomic_t num_rsrc_err;
36160 - atomic_t num_cmd_success;
36161 + atomic_unchecked_t num_rsrc_err;
36162 + atomic_unchecked_t num_cmd_success;
36163 unsigned long last_rsrc_error_time;
36164 unsigned long last_ramp_down_time;
36165 unsigned long last_ramp_up_time;
36166 @@ -850,7 +850,7 @@ struct lpfc_hba {
36167 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
36168 struct dentry *debug_slow_ring_trc;
36169 struct lpfc_debugfs_trc *slow_ring_trc;
36170 - atomic_t slow_ring_trc_cnt;
36171 + atomic_unchecked_t slow_ring_trc_cnt;
36172 /* iDiag debugfs sub-directory */
36173 struct dentry *idiag_root;
36174 struct dentry *idiag_pci_cfg;
36175 diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
36176 index a0424dd..2499b6b 100644
36177 --- a/drivers/scsi/lpfc/lpfc_debugfs.c
36178 +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
36179 @@ -105,7 +105,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
36181 #include <linux/debugfs.h>
36183 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36184 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36185 static unsigned long lpfc_debugfs_start_time = 0L;
36188 @@ -146,7 +146,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
36189 lpfc_debugfs_enable = 0;
36192 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36193 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36194 (lpfc_debugfs_max_disc_trc - 1);
36195 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36196 dtp = vport->disc_trc + i;
36197 @@ -212,7 +212,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
36198 lpfc_debugfs_enable = 0;
36201 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36202 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36203 (lpfc_debugfs_max_slow_ring_trc - 1);
36204 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36205 dtp = phba->slow_ring_trc + i;
36206 @@ -635,14 +635,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
36207 !vport || !vport->disc_trc)
36210 - index = atomic_inc_return(&vport->disc_trc_cnt) &
36211 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36212 (lpfc_debugfs_max_disc_trc - 1);
36213 dtp = vport->disc_trc + index;
36215 dtp->data1 = data1;
36216 dtp->data2 = data2;
36217 dtp->data3 = data3;
36218 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36219 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36220 dtp->jif = jiffies;
36223 @@ -673,14 +673,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
36224 !phba || !phba->slow_ring_trc)
36227 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36228 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36229 (lpfc_debugfs_max_slow_ring_trc - 1);
36230 dtp = phba->slow_ring_trc + index;
36232 dtp->data1 = data1;
36233 dtp->data2 = data2;
36234 dtp->data3 = data3;
36235 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36236 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36237 dtp->jif = jiffies;
36240 @@ -3828,7 +3828,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36241 "slow_ring buffer\n");
36244 - atomic_set(&phba->slow_ring_trc_cnt, 0);
36245 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36246 memset(phba->slow_ring_trc, 0,
36247 (sizeof(struct lpfc_debugfs_trc) *
36248 lpfc_debugfs_max_slow_ring_trc));
36249 @@ -3874,7 +3874,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36253 - atomic_set(&vport->disc_trc_cnt, 0);
36254 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36256 snprintf(name, sizeof(name), "discovery_trace");
36257 vport->debug_disc_trc =
36258 diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
36259 index a3c8200..31e562e 100644
36260 --- a/drivers/scsi/lpfc/lpfc_init.c
36261 +++ b/drivers/scsi/lpfc/lpfc_init.c
36262 @@ -9969,8 +9969,10 @@ lpfc_init(void)
36263 printk(LPFC_COPYRIGHT "\n");
36265 if (lpfc_enable_npiv) {
36266 - lpfc_transport_functions.vport_create = lpfc_vport_create;
36267 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36268 + pax_open_kernel();
36269 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36270 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36271 + pax_close_kernel();
36273 lpfc_transport_template =
36274 fc_attach_transport(&lpfc_transport_functions);
36275 diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
36276 index eadd241..26c8e0f 100644
36277 --- a/drivers/scsi/lpfc/lpfc_scsi.c
36278 +++ b/drivers/scsi/lpfc/lpfc_scsi.c
36279 @@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
36280 uint32_t evt_posted;
36282 spin_lock_irqsave(&phba->hbalock, flags);
36283 - atomic_inc(&phba->num_rsrc_err);
36284 + atomic_inc_unchecked(&phba->num_rsrc_err);
36285 phba->last_rsrc_error_time = jiffies;
36287 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36288 @@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
36289 unsigned long flags;
36290 struct lpfc_hba *phba = vport->phba;
36291 uint32_t evt_posted;
36292 - atomic_inc(&phba->num_cmd_success);
36293 + atomic_inc_unchecked(&phba->num_cmd_success);
36295 if (vport->cfg_lun_queue_depth <= queue_depth)
36297 @@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36298 unsigned long num_rsrc_err, num_cmd_success;
36301 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36302 - num_cmd_success = atomic_read(&phba->num_cmd_success);
36303 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36304 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36306 vports = lpfc_create_vport_work_array(phba);
36307 if (vports != NULL)
36308 @@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36311 lpfc_destroy_vport_work_array(phba, vports);
36312 - atomic_set(&phba->num_rsrc_err, 0);
36313 - atomic_set(&phba->num_cmd_success, 0);
36314 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
36315 + atomic_set_unchecked(&phba->num_cmd_success, 0);
36319 @@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
36322 lpfc_destroy_vport_work_array(phba, vports);
36323 - atomic_set(&phba->num_rsrc_err, 0);
36324 - atomic_set(&phba->num_cmd_success, 0);
36325 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
36326 + atomic_set_unchecked(&phba->num_cmd_success, 0);
36330 diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
36331 index 2e6619e..fa64494 100644
36332 --- a/drivers/scsi/megaraid/megaraid_mbox.c
36333 +++ b/drivers/scsi/megaraid/megaraid_mbox.c
36334 @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
36338 + pax_track_stack();
36340 // Allocate memory for the base list of scb for management module.
36341 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
36343 diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
36344 index 86afb13f..c912398 100644
36345 --- a/drivers/scsi/osd/osd_initiator.c
36346 +++ b/drivers/scsi/osd/osd_initiator.c
36347 @@ -97,6 +97,8 @@ static int _osd_get_print_system_info(struct osd_dev *od,
36348 int nelem = ARRAY_SIZE(get_attrs), a = 0;
36351 + pax_track_stack();
36353 or = osd_start_request(od, GFP_KERNEL);
36356 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
36357 index d079f9a..d26072c 100644
36358 --- a/drivers/scsi/pmcraid.c
36359 +++ b/drivers/scsi/pmcraid.c
36360 @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
36361 res->scsi_dev = scsi_dev;
36362 scsi_dev->hostdata = res;
36363 res->change_detected = 0;
36364 - atomic_set(&res->read_failures, 0);
36365 - atomic_set(&res->write_failures, 0);
36366 + atomic_set_unchecked(&res->read_failures, 0);
36367 + atomic_set_unchecked(&res->write_failures, 0);
36370 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36371 @@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
36373 /* If this was a SCSI read/write command keep count of errors */
36374 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36375 - atomic_inc(&res->read_failures);
36376 + atomic_inc_unchecked(&res->read_failures);
36377 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36378 - atomic_inc(&res->write_failures);
36379 + atomic_inc_unchecked(&res->write_failures);
36381 if (!RES_IS_GSCSI(res->cfg_entry) &&
36382 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36383 @@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
36384 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36385 * hrrq_id assigned here in queuecommand
36387 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36388 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36389 pinstance->num_hrrq;
36390 cmd->cmd_done = pmcraid_io_done;
36392 @@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
36393 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36394 * hrrq_id assigned here in queuecommand
36396 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36397 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36398 pinstance->num_hrrq;
36400 if (request_size) {
36401 @@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
36403 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36404 /* add resources only after host is added into system */
36405 - if (!atomic_read(&pinstance->expose_resources))
36406 + if (!atomic_read_unchecked(&pinstance->expose_resources))
36409 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
36410 @@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instance(
36411 init_waitqueue_head(&pinstance->reset_wait_q);
36413 atomic_set(&pinstance->outstanding_cmds, 0);
36414 - atomic_set(&pinstance->last_message_id, 0);
36415 - atomic_set(&pinstance->expose_resources, 0);
36416 + atomic_set_unchecked(&pinstance->last_message_id, 0);
36417 + atomic_set_unchecked(&pinstance->expose_resources, 0);
36419 INIT_LIST_HEAD(&pinstance->free_res_q);
36420 INIT_LIST_HEAD(&pinstance->used_res_q);
36421 @@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
36422 /* Schedule worker thread to handle CCN and take care of adding and
36423 * removing devices to OS
36425 - atomic_set(&pinstance->expose_resources, 1);
36426 + atomic_set_unchecked(&pinstance->expose_resources, 1);
36427 schedule_work(&pinstance->worker_q);
36430 diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
36431 index f920baf..4417389 100644
36432 --- a/drivers/scsi/pmcraid.h
36433 +++ b/drivers/scsi/pmcraid.h
36434 @@ -749,7 +749,7 @@ struct pmcraid_instance {
36435 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
36437 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
36438 - atomic_t last_message_id;
36439 + atomic_unchecked_t last_message_id;
36441 /* configuration table */
36442 struct pmcraid_config_table *cfg_table;
36443 @@ -778,7 +778,7 @@ struct pmcraid_instance {
36444 atomic_t outstanding_cmds;
36446 /* should add/delete resources to mid-layer now ?*/
36447 - atomic_t expose_resources;
36448 + atomic_unchecked_t expose_resources;
36452 @@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
36453 struct pmcraid_config_table_entry_ext cfg_entry_ext;
36455 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36456 - atomic_t read_failures; /* count of failed READ commands */
36457 - atomic_t write_failures; /* count of failed WRITE commands */
36458 + atomic_unchecked_t read_failures; /* count of failed READ commands */
36459 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36461 /* To indicate add/delete/modify during CCN */
36462 u8 change_detected;
36463 diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
36464 index a03eaf4..a6b3fd9 100644
36465 --- a/drivers/scsi/qla2xxx/qla_def.h
36466 +++ b/drivers/scsi/qla2xxx/qla_def.h
36467 @@ -2244,7 +2244,7 @@ struct isp_operations {
36468 int (*get_flash_version) (struct scsi_qla_host *, void *);
36469 int (*start_scsi) (srb_t *);
36470 int (*abort_isp) (struct scsi_qla_host *);
36474 /* MSI-X Support *************************************************************/
36476 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
36477 index 473c5c8..4e2f24a 100644
36478 --- a/drivers/scsi/qla4xxx/ql4_def.h
36479 +++ b/drivers/scsi/qla4xxx/ql4_def.h
36480 @@ -256,7 +256,7 @@ struct ddb_entry {
36481 atomic_t retry_relogin_timer; /* Min Time between relogins
36483 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
36484 - atomic_t relogin_retry_count; /* Num of times relogin has been
36485 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
36489 diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
36490 index 42ed5db..0262f9e 100644
36491 --- a/drivers/scsi/qla4xxx/ql4_init.c
36492 +++ b/drivers/scsi/qla4xxx/ql4_init.c
36493 @@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
36494 ddb_entry->fw_ddb_index = fw_ddb_index;
36495 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
36496 atomic_set(&ddb_entry->relogin_timer, 0);
36497 - atomic_set(&ddb_entry->relogin_retry_count, 0);
36498 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36499 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36500 list_add_tail(&ddb_entry->list, &ha->ddb_list);
36501 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
36502 @@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
36503 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
36504 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
36505 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36506 - atomic_set(&ddb_entry->relogin_retry_count, 0);
36507 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36508 atomic_set(&ddb_entry->relogin_timer, 0);
36509 clear_bit(DF_RELOGIN, &ddb_entry->flags);
36510 iscsi_unblock_session(ddb_entry->sess);
36511 diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
36512 index f2364ec..44c42b1 100644
36513 --- a/drivers/scsi/qla4xxx/ql4_os.c
36514 +++ b/drivers/scsi/qla4xxx/ql4_os.c
36515 @@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
36516 ddb_entry->fw_ddb_device_state ==
36517 DDB_DS_SESSION_FAILED) {
36518 /* Reset retry relogin timer */
36519 - atomic_inc(&ddb_entry->relogin_retry_count);
36520 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
36521 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
36522 " timed out-retrying"
36525 ddb_entry->fw_ddb_index,
36526 - atomic_read(&ddb_entry->
36527 + atomic_read_unchecked(&ddb_entry->
36528 relogin_retry_count))
36531 diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
36532 index 2aeb2e9..46e3925 100644
36533 --- a/drivers/scsi/scsi.c
36534 +++ b/drivers/scsi/scsi.c
36535 @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
36536 unsigned long timeout;
36539 - atomic_inc(&cmd->device->iorequest_cnt);
36540 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36542 /* check if the device is still usable */
36543 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
36544 diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
36545 index 6888b2c..45befa1 100644
36546 --- a/drivers/scsi/scsi_debug.c
36547 +++ b/drivers/scsi/scsi_debug.c
36548 @@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
36549 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
36550 unsigned char *cmd = (unsigned char *)scp->cmnd;
36552 + pax_track_stack();
36554 if ((errsts = check_readiness(scp, 1, devip)))
36556 memset(arr, 0, sizeof(arr));
36557 @@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
36558 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
36559 unsigned char *cmd = (unsigned char *)scp->cmnd;
36561 + pax_track_stack();
36563 if ((errsts = check_readiness(scp, 1, devip)))
36565 memset(arr, 0, sizeof(arr));
36566 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
36567 index 6d219e4..eb3ded3 100644
36568 --- a/drivers/scsi/scsi_lib.c
36569 +++ b/drivers/scsi/scsi_lib.c
36570 @@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
36571 shost = sdev->host;
36572 scsi_init_cmd_errh(cmd);
36573 cmd->result = DID_NO_CONNECT << 16;
36574 - atomic_inc(&cmd->device->iorequest_cnt);
36575 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36578 * SCSI request completion path will do scsi_device_unbusy(),
36579 @@ -1441,9 +1441,9 @@ static void scsi_softirq_done(struct request *rq)
36581 INIT_LIST_HEAD(&cmd->eh_entry);
36583 - atomic_inc(&cmd->device->iodone_cnt);
36584 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
36586 - atomic_inc(&cmd->device->ioerr_cnt);
36587 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
36589 disposition = scsi_decide_disposition(cmd);
36590 if (disposition != SUCCESS &&
36591 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
36592 index e0bd3f7..816b8a6 100644
36593 --- a/drivers/scsi/scsi_sysfs.c
36594 +++ b/drivers/scsi/scsi_sysfs.c
36595 @@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
36598 struct scsi_device *sdev = to_scsi_device(dev); \
36599 - unsigned long long count = atomic_read(&sdev->field); \
36600 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
36601 return snprintf(buf, 20, "0x%llx\n", count); \
36603 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
36604 diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
36605 index 84a1fdf..693b0d6 100644
36606 --- a/drivers/scsi/scsi_tgt_lib.c
36607 +++ b/drivers/scsi/scsi_tgt_lib.c
36608 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
36611 dprintk("%lx %u\n", uaddr, len);
36612 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
36613 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
36616 * TODO: need to fixup sg_tablesize, max_segment_size,
36617 diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
36618 index 1b21491..1b7f60e 100644
36619 --- a/drivers/scsi/scsi_transport_fc.c
36620 +++ b/drivers/scsi/scsi_transport_fc.c
36621 @@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
36622 * Netlink Infrastructure
36625 -static atomic_t fc_event_seq;
36626 +static atomic_unchecked_t fc_event_seq;
36629 * fc_get_event_number - Obtain the next sequential FC event number
36630 @@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
36632 fc_get_event_number(void)
36634 - return atomic_add_return(1, &fc_event_seq);
36635 + return atomic_add_return_unchecked(1, &fc_event_seq);
36637 EXPORT_SYMBOL(fc_get_event_number);
36639 @@ -645,7 +645,7 @@ static __init int fc_transport_init(void)
36643 - atomic_set(&fc_event_seq, 0);
36644 + atomic_set_unchecked(&fc_event_seq, 0);
36646 error = transport_class_register(&fc_host_class);
36648 @@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
36651 *val = simple_strtoul(buf, &cp, 0);
36652 - if ((*cp && (*cp != '\n')) || (*val < 0))
36653 + if (*cp && (*cp != '\n'))
36656 * Check for overflow; dev_loss_tmo is u32
36657 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
36658 index 3fd16d7..ba0871f 100644
36659 --- a/drivers/scsi/scsi_transport_iscsi.c
36660 +++ b/drivers/scsi/scsi_transport_iscsi.c
36661 @@ -83,7 +83,7 @@ struct iscsi_internal {
36662 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
36665 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
36666 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
36667 static struct workqueue_struct *iscsi_eh_timer_workq;
36670 @@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
36673 ihost = shost->shost_data;
36674 - session->sid = atomic_add_return(1, &iscsi_session_nr);
36675 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
36677 if (id == ISCSI_MAX_TARGET) {
36678 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
36679 @@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(void)
36680 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
36681 ISCSI_TRANSPORT_VERSION);
36683 - atomic_set(&iscsi_session_nr, 0);
36684 + atomic_set_unchecked(&iscsi_session_nr, 0);
36686 err = class_register(&iscsi_transport_class);
36688 diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
36689 index 21a045e..ec89e03 100644
36690 --- a/drivers/scsi/scsi_transport_srp.c
36691 +++ b/drivers/scsi/scsi_transport_srp.c
36693 #include "scsi_transport_srp_internal.h"
36695 struct srp_host_attrs {
36696 - atomic_t next_port_id;
36697 + atomic_unchecked_t next_port_id;
36699 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
36701 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
36702 struct Scsi_Host *shost = dev_to_shost(dev);
36703 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
36705 - atomic_set(&srp_host->next_port_id, 0);
36706 + atomic_set_unchecked(&srp_host->next_port_id, 0);
36710 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
36711 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
36712 rport->roles = ids->roles;
36714 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
36715 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
36716 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
36718 transport_setup_device(&rport->dev);
36719 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
36720 index 909ed9e..1ae290a 100644
36721 --- a/drivers/scsi/sg.c
36722 +++ b/drivers/scsi/sg.c
36723 @@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
36724 sdp->disk->disk_name,
36725 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
36728 + (char __user *)arg);
36729 case BLKTRACESTART:
36730 return blk_trace_startstop(sdp->device->request_queue, 1);
36732 @@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
36733 const struct file_operations * fops;
36736 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
36737 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
36738 {"allow_dio", &adio_fops},
36739 {"debug", &debug_fops},
36740 {"def_reserved_size", &dressz_fops},
36741 @@ -2325,7 +2325,7 @@ sg_proc_init(void)
36744 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
36745 - struct sg_proc_leaf * leaf;
36746 + const struct sg_proc_leaf * leaf;
36748 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
36750 diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
36751 index b4543f5..e1b34b8 100644
36752 --- a/drivers/scsi/sym53c8xx_2/sym_glue.c
36753 +++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
36754 @@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
36755 int do_iounmap = 0;
36756 int do_disable_device = 1;
36758 + pax_track_stack();
36760 memset(&sym_dev, 0, sizeof(sym_dev));
36761 memset(&nvram, 0, sizeof(nvram));
36762 sym_dev.pdev = pdev;
36763 diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
36764 index a18996d..fe993cb 100644
36765 --- a/drivers/scsi/vmw_pvscsi.c
36766 +++ b/drivers/scsi/vmw_pvscsi.c
36767 @@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
36771 + pax_track_stack();
36773 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
36774 cmd.reqRingNumPages = adapter->req_pages;
36775 cmd.cmpRingNumPages = adapter->cmp_pages;
36776 diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
36777 index c5f37f0..898d202 100644
36778 --- a/drivers/spi/spi-dw-pci.c
36779 +++ b/drivers/spi/spi-dw-pci.c
36780 @@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pdev)
36781 #define spi_resume NULL
36784 -static const struct pci_device_id pci_ids[] __devinitdata = {
36785 +static const struct pci_device_id pci_ids[] __devinitconst = {
36786 /* Intel MID platform SPI controller 0 */
36787 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
36789 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
36790 index 4d1b9f5..8408fe3 100644
36791 --- a/drivers/spi/spi.c
36792 +++ b/drivers/spi/spi.c
36793 @@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *master)
36794 EXPORT_SYMBOL_GPL(spi_bus_unlock);
36796 /* portable code must never pass more than 32 bytes */
36797 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
36798 +#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
36802 diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36803 index 32ee39a..3004c3d 100644
36804 --- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36805 +++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
36806 @@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
36807 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
36810 -static struct net_device_ops ar6000_netdev_ops = {
36811 +static net_device_ops_no_const ar6000_netdev_ops = {
36813 .ndo_open = ar6000_open,
36814 .ndo_stop = ar6000_close,
36815 diff --git a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36816 index 39e0873..0925710 100644
36817 --- a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36818 +++ b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
36819 @@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
36820 typedef struct ar6k_pal_config_s
36822 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
36823 -}ar6k_pal_config_t;
36824 +} __no_const ar6k_pal_config_t;
36826 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
36827 #endif /* _AR6K_PAL_H_ */
36828 diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36829 index 05dada9..96171c6 100644
36830 --- a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36831 +++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
36832 @@ -451,14 +451,14 @@ static void brcmf_op_if(struct brcmf_if *ifp)
36833 free_netdev(ifp->net);
36835 /* Allocate etherdev, including space for private structure */
36836 - ifp->net = alloc_etherdev(sizeof(drvr_priv));
36837 + ifp->net = alloc_etherdev(sizeof(*drvr_priv));
36839 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36843 strcpy(ifp->net->name, ifp->name);
36844 - memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
36845 + memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(*drvr_priv));
36846 err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
36848 BRCMF_ERROR(("%s: brcmf_net_attach failed, "
36849 @@ -1279,7 +1279,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36850 BRCMF_TRACE(("%s: Enter\n", __func__));
36852 /* Allocate etherdev, including space for private structure */
36853 - net = alloc_etherdev(sizeof(drvr_priv));
36854 + net = alloc_etherdev(sizeof(*drvr_priv));
36856 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
36858 @@ -1295,7 +1295,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36860 * Save the brcmf_info into the priv
36862 - memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36863 + memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36865 /* Set network interface name if it was provided as module parameter */
36866 if (iface_name[0]) {
36867 @@ -1352,7 +1352,7 @@ struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
36869 * Save the brcmf_info into the priv
36871 - memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
36872 + memcpy(netdev_priv(net), &drvr_priv, sizeof(*drvr_priv));
36874 #if defined(CONFIG_PM_SLEEP)
36875 atomic_set(&brcmf_mmc_suspend, false);
36876 diff --git a/drivers/staging/brcm80211/brcmfmac/sdio_host.h b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36877 index d345472..cedb19e 100644
36878 --- a/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36879 +++ b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
36880 @@ -263,7 +263,7 @@ struct brcmf_sdioh_driver {
36881 u16 func, uint bustype, u32 regsva, void *param);
36882 /* detach from device */
36883 void (*detach) (void *ch);
36889 diff --git a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36890 index a01b01c..b3f721c 100644
36891 --- a/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36892 +++ b/drivers/staging/brcm80211/brcmsmac/phy/phy_int.h
36893 @@ -591,7 +591,7 @@ struct phy_func_ptr {
36894 initfn_t carrsuppr;
36895 rxsigpwrfn_t rxsigpwr;
36901 struct brcms_phy_pub pubpi_ro;
36902 diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
36903 index 8fb3051..a8b6c67 100644
36904 --- a/drivers/staging/et131x/et1310_tx.c
36905 +++ b/drivers/staging/et131x/et1310_tx.c
36906 @@ -635,11 +635,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
36907 struct net_device_stats *stats = &etdev->net_stats;
36909 if (tcb->flags & fMP_DEST_BROAD)
36910 - atomic_inc(&etdev->stats.brdcstxmt);
36911 + atomic_inc_unchecked(&etdev->stats.brdcstxmt);
36912 else if (tcb->flags & fMP_DEST_MULTI)
36913 - atomic_inc(&etdev->stats.multixmt);
36914 + atomic_inc_unchecked(&etdev->stats.multixmt);
36916 - atomic_inc(&etdev->stats.unixmt);
36917 + atomic_inc_unchecked(&etdev->stats.unixmt);
36920 stats->tx_bytes += tcb->skb->len;
36921 diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
36922 index 408c50b..fd65e9f 100644
36923 --- a/drivers/staging/et131x/et131x_adapter.h
36924 +++ b/drivers/staging/et131x/et131x_adapter.h
36925 @@ -106,11 +106,11 @@ struct ce_stats {
36928 u32 unircv; /* # multicast packets received */
36929 - atomic_t unixmt; /* # multicast packets for Tx */
36930 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
36931 u32 multircv; /* # multicast packets received */
36932 - atomic_t multixmt; /* # multicast packets for Tx */
36933 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
36934 u32 brdcstrcv; /* # broadcast packets received */
36935 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
36936 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
36937 u32 norcvbuf; /* # Rx packets discarded */
36938 u32 noxmtbuf; /* # Tx packets discarded */
36940 diff --git a/drivers/staging/hv/channel.c b/drivers/staging/hv/channel.c
36941 index 455f47a..86205ff 100644
36942 --- a/drivers/staging/hv/channel.c
36943 +++ b/drivers/staging/hv/channel.c
36944 @@ -447,8 +447,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
36948 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
36949 - atomic_inc(&vmbus_connection.next_gpadl_handle);
36950 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
36951 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
36953 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
36955 diff --git a/drivers/staging/hv/hv.c b/drivers/staging/hv/hv.c
36956 index 824f816..a800af7 100644
36957 --- a/drivers/staging/hv/hv.c
36958 +++ b/drivers/staging/hv/hv.c
36959 @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
36960 u64 output_address = (output) ? virt_to_phys(output) : 0;
36961 u32 output_address_hi = output_address >> 32;
36962 u32 output_address_lo = output_address & 0xFFFFFFFF;
36963 - volatile void *hypercall_page = hv_context.hypercall_page;
36964 + volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
36966 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
36967 "=a"(hv_status_lo) : "d" (control_hi),
36968 diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
36969 index d957fc2..43cedd9 100644
36970 --- a/drivers/staging/hv/hv_mouse.c
36971 +++ b/drivers/staging/hv/hv_mouse.c
36972 @@ -878,8 +878,10 @@ static void reportdesc_callback(struct hv_device *dev, void *packet, u32 len)
36974 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
36976 - hid_dev->ll_driver->open = mousevsc_hid_open;
36977 - hid_dev->ll_driver->close = mousevsc_hid_close;
36978 + pax_open_kernel();
36979 + *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
36980 + *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
36981 + pax_close_kernel();
36983 hid_dev->bus = BUS_VIRTUAL;
36984 hid_dev->vendor = input_device_ctx->device_info.vendor;
36985 diff --git a/drivers/staging/hv/hyperv_vmbus.h b/drivers/staging/hv/hyperv_vmbus.h
36986 index 349ad80..3f75719 100644
36987 --- a/drivers/staging/hv/hyperv_vmbus.h
36988 +++ b/drivers/staging/hv/hyperv_vmbus.h
36989 @@ -559,7 +559,7 @@ enum vmbus_connect_state {
36990 struct vmbus_connection {
36991 enum vmbus_connect_state conn_state;
36993 - atomic_t next_gpadl_handle;
36994 + atomic_unchecked_t next_gpadl_handle;
36997 * Represents channel interrupts. Each bit position represents a
36998 diff --git a/drivers/staging/hv/rndis_filter.c b/drivers/staging/hv/rndis_filter.c
36999 index dbb5201..d6047c6 100644
37000 --- a/drivers/staging/hv/rndis_filter.c
37001 +++ b/drivers/staging/hv/rndis_filter.c
37002 @@ -43,7 +43,7 @@ struct rndis_device {
37004 enum rndis_device_state state;
37006 - atomic_t new_req_id;
37007 + atomic_unchecked_t new_req_id;
37009 spinlock_t request_lock;
37010 struct list_head req_list;
37011 @@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
37014 set = &rndis_msg->msg.set_req;
37015 - set->req_id = atomic_inc_return(&dev->new_req_id);
37016 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37018 /* Add to the request list */
37019 spin_lock_irqsave(&dev->request_lock, flags);
37020 @@ -622,7 +622,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
37022 /* Setup the rndis set */
37023 halt = &request->request_msg.msg.halt_req;
37024 - halt->req_id = atomic_inc_return(&dev->new_req_id);
37025 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
37027 /* Ignore return since this msg is optional. */
37028 rndis_filter_send_request(dev, request);
37029 diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
37030 index 1c949f5..7a8b104 100644
37031 --- a/drivers/staging/hv/vmbus_drv.c
37032 +++ b/drivers/staging/hv/vmbus_drv.c
37033 @@ -660,11 +660,11 @@ int vmbus_child_device_register(struct hv_device *child_device_obj)
37037 - static atomic_t device_num = ATOMIC_INIT(0);
37038 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
37040 /* Set the device name. Otherwise, device_register() will fail. */
37041 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
37042 - atomic_inc_return(&device_num));
37043 + atomic_inc_return_unchecked(&device_num));
37045 /* The new device belongs to this bus */
37046 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
37047 diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
37048 index 3f26f71..fb5c787 100644
37049 --- a/drivers/staging/iio/ring_generic.h
37050 +++ b/drivers/staging/iio/ring_generic.h
37051 @@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
37053 int (*is_enabled)(struct iio_ring_buffer *ring);
37054 int (*enable)(struct iio_ring_buffer *ring);
37058 struct iio_ring_setup_ops {
37059 int (*preenable)(struct iio_dev *);
37060 diff --git a/drivers/staging/mei/interface.c b/drivers/staging/mei/interface.c
37061 index cfec92d..a65dacf 100644
37062 --- a/drivers/staging/mei/interface.c
37063 +++ b/drivers/staging/mei/interface.c
37064 @@ -332,7 +332,7 @@ int mei_send_flow_control(struct mei_device *dev, struct mei_cl *cl)
37065 mei_hdr->reserved = 0;
37067 mei_flow_control = (struct hbm_flow_control *) &dev->wr_msg_buf[1];
37068 - memset(mei_flow_control, 0, sizeof(mei_flow_control));
37069 + memset(mei_flow_control, 0, sizeof(*mei_flow_control));
37070 mei_flow_control->host_addr = cl->host_client_id;
37071 mei_flow_control->me_addr = cl->me_client_id;
37072 mei_flow_control->cmd.cmd = MEI_FLOW_CONTROL_CMD;
37073 @@ -396,7 +396,7 @@ int mei_disconnect(struct mei_device *dev, struct mei_cl *cl)
37075 mei_cli_disconnect =
37076 (struct hbm_client_disconnect_request *) &dev->wr_msg_buf[1];
37077 - memset(mei_cli_disconnect, 0, sizeof(mei_cli_disconnect));
37078 + memset(mei_cli_disconnect, 0, sizeof(*mei_cli_disconnect));
37079 mei_cli_disconnect->host_addr = cl->host_client_id;
37080 mei_cli_disconnect->me_addr = cl->me_client_id;
37081 mei_cli_disconnect->cmd.cmd = CLIENT_DISCONNECT_REQ_CMD;
37082 diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
37083 index 8b307b4..a97ac91 100644
37084 --- a/drivers/staging/octeon/ethernet-rx.c
37085 +++ b/drivers/staging/octeon/ethernet-rx.c
37086 @@ -420,11 +420,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37087 /* Increment RX stats for virtual ports */
37088 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37089 #ifdef CONFIG_64BIT
37090 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37091 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37092 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37093 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37095 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37096 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37097 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37098 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37101 netif_receive_skb(skb);
37102 @@ -436,9 +436,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37105 #ifdef CONFIG_64BIT
37106 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37107 + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37109 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37110 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
37112 dev_kfree_skb_irq(skb);
37114 diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
37115 index a8f780e..aef1098 100644
37116 --- a/drivers/staging/octeon/ethernet.c
37117 +++ b/drivers/staging/octeon/ethernet.c
37118 @@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
37119 * since the RX tasklet also increments it.
37121 #ifdef CONFIG_64BIT
37122 - atomic64_add(rx_status.dropped_packets,
37123 - (atomic64_t *)&priv->stats.rx_dropped);
37124 + atomic64_add_unchecked(rx_status.dropped_packets,
37125 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37127 - atomic_add(rx_status.dropped_packets,
37128 - (atomic_t *)&priv->stats.rx_dropped);
37129 + atomic_add_unchecked(rx_status.dropped_packets,
37130 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
37134 diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
37135 index f3c6060..56bf826 100644
37136 --- a/drivers/staging/pohmelfs/inode.c
37137 +++ b/drivers/staging/pohmelfs/inode.c
37138 @@ -1861,7 +1861,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37139 mutex_init(&psb->mcache_lock);
37140 psb->mcache_root = RB_ROOT;
37141 psb->mcache_timeout = msecs_to_jiffies(5000);
37142 - atomic_long_set(&psb->mcache_gen, 0);
37143 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
37145 psb->trans_max_pages = 100;
37147 @@ -1876,7 +1876,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
37148 INIT_LIST_HEAD(&psb->crypto_ready_list);
37149 INIT_LIST_HEAD(&psb->crypto_active_list);
37151 - atomic_set(&psb->trans_gen, 1);
37152 + atomic_set_unchecked(&psb->trans_gen, 1);
37153 atomic_long_set(&psb->total_inodes, 0);
37155 mutex_init(&psb->state_lock);
37156 diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
37157 index e22665c..a2a9390 100644
37158 --- a/drivers/staging/pohmelfs/mcache.c
37159 +++ b/drivers/staging/pohmelfs/mcache.c
37160 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
37164 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
37165 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
37167 mutex_lock(&psb->mcache_lock);
37168 err = pohmelfs_mcache_insert(psb, m);
37169 diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
37170 index 985b6b7..7699e05 100644
37171 --- a/drivers/staging/pohmelfs/netfs.h
37172 +++ b/drivers/staging/pohmelfs/netfs.h
37173 @@ -571,14 +571,14 @@ struct pohmelfs_config;
37174 struct pohmelfs_sb {
37175 struct rb_root mcache_root;
37176 struct mutex mcache_lock;
37177 - atomic_long_t mcache_gen;
37178 + atomic_long_unchecked_t mcache_gen;
37179 unsigned long mcache_timeout;
37183 unsigned int trans_retries;
37185 - atomic_t trans_gen;
37186 + atomic_unchecked_t trans_gen;
37188 unsigned int crypto_attached_size;
37189 unsigned int crypto_align_size;
37190 diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
37191 index 36a2535..0591bf4 100644
37192 --- a/drivers/staging/pohmelfs/trans.c
37193 +++ b/drivers/staging/pohmelfs/trans.c
37194 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
37196 struct netfs_cmd *cmd = t->iovec.iov_base;
37198 - t->gen = atomic_inc_return(&psb->trans_gen);
37199 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
37201 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
37202 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
37203 diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
37204 index b70cb2b..4db41a7 100644
37205 --- a/drivers/staging/rtl8712/rtl871x_io.h
37206 +++ b/drivers/staging/rtl8712/rtl871x_io.h
37207 @@ -83,7 +83,7 @@ struct _io_ops {
37209 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
37215 struct list_head list;
37216 diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
37217 index c7b5e8b..783d6cb 100644
37218 --- a/drivers/staging/sbe-2t3e3/netdev.c
37219 +++ b/drivers/staging/sbe-2t3e3/netdev.c
37220 @@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
37221 t3e3_if_config(sc, cmd_2t3e3, (char *)¶m, &resp, &rlen);
37224 - if (copy_to_user(data, &resp, rlen))
37225 + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
37229 diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
37230 index be21617..0954e45 100644
37231 --- a/drivers/staging/usbip/usbip_common.h
37232 +++ b/drivers/staging/usbip/usbip_common.h
37233 @@ -289,7 +289,7 @@ struct usbip_device {
37234 void (*shutdown)(struct usbip_device *);
37235 void (*reset)(struct usbip_device *);
37236 void (*unusable)(struct usbip_device *);
37238 + } __no_const eh_ops;
37242 diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
37243 index 71a586e..4d8a91a 100644
37244 --- a/drivers/staging/usbip/vhci.h
37245 +++ b/drivers/staging/usbip/vhci.h
37246 @@ -85,7 +85,7 @@ struct vhci_hcd {
37247 unsigned resuming:1;
37248 unsigned long re_timeout;
37251 + atomic_unchecked_t seqnum;
37255 diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
37256 index 2ee97e2..0420b86 100644
37257 --- a/drivers/staging/usbip/vhci_hcd.c
37258 +++ b/drivers/staging/usbip/vhci_hcd.c
37259 @@ -527,7 +527,7 @@ static void vhci_tx_urb(struct urb *urb)
37263 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37264 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37265 if (priv->seqnum == 0xffff)
37266 dev_info(&urb->dev->dev, "seqnum max\n");
37268 @@ -779,7 +779,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
37272 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37273 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37274 if (unlink->seqnum == 0xffff)
37275 pr_info("seqnum max\n");
37277 @@ -969,7 +969,7 @@ static int vhci_start(struct usb_hcd *hcd)
37278 vdev->rhport = rhport;
37281 - atomic_set(&vhci->seqnum, 0);
37282 + atomic_set_unchecked(&vhci->seqnum, 0);
37283 spin_lock_init(&vhci->lock);
37285 hcd->power_budget = 0; /* no limit */
37286 diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
37287 index 3872b8c..fe6d2f4 100644
37288 --- a/drivers/staging/usbip/vhci_rx.c
37289 +++ b/drivers/staging/usbip/vhci_rx.c
37290 @@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
37292 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
37293 pr_info("max seqnum %d\n",
37294 - atomic_read(&the_controller->seqnum));
37295 + atomic_read_unchecked(&the_controller->seqnum));
37296 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37299 diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
37300 index 7735027..30eed13 100644
37301 --- a/drivers/staging/vt6655/hostap.c
37302 +++ b/drivers/staging/vt6655/hostap.c
37303 @@ -79,14 +79,13 @@ static int msglevel =MSG_LEVEL_INFO;
37307 +static net_device_ops_no_const apdev_netdev_ops;
37309 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37311 PSDevice apdev_priv;
37312 struct net_device *dev = pDevice->dev;
37314 - const struct net_device_ops apdev_netdev_ops = {
37315 - .ndo_start_xmit = pDevice->tx_80211,
37318 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37320 @@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37321 *apdev_priv = *pDevice;
37322 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37324 + /* only half broken now */
37325 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37326 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37328 pDevice->apdev->type = ARPHRD_IEEE80211;
37329 diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
37330 index 51b5adf..098e320 100644
37331 --- a/drivers/staging/vt6656/hostap.c
37332 +++ b/drivers/staging/vt6656/hostap.c
37333 @@ -80,14 +80,13 @@ static int msglevel =MSG_LEVEL_INFO;
37337 +static net_device_ops_no_const apdev_netdev_ops;
37339 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37341 PSDevice apdev_priv;
37342 struct net_device *dev = pDevice->dev;
37344 - const struct net_device_ops apdev_netdev_ops = {
37345 - .ndo_start_xmit = pDevice->tx_80211,
37348 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37350 @@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37351 *apdev_priv = *pDevice;
37352 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37354 + /* only half broken now */
37355 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37356 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37358 pDevice->apdev->type = ARPHRD_IEEE80211;
37359 diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
37360 index 7843dfd..3db105f 100644
37361 --- a/drivers/staging/wlan-ng/hfa384x_usb.c
37362 +++ b/drivers/staging/wlan-ng/hfa384x_usb.c
37363 @@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
37365 struct usbctlx_completor {
37366 int (*complete) (struct usbctlx_completor *);
37371 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
37372 diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
37373 index 1ca66ea..76f1343 100644
37374 --- a/drivers/staging/zcache/tmem.c
37375 +++ b/drivers/staging/zcache/tmem.c
37377 * A tmem host implementation must use this function to register callbacks
37378 * for memory allocation.
37380 -static struct tmem_hostops tmem_hostops;
37381 +static tmem_hostops_no_const tmem_hostops;
37383 static void tmem_objnode_tree_init(void);
37385 @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_hostops *m)
37386 * A tmem host implementation must use this function to register
37387 * callbacks for a page-accessible memory (PAM) implementation
37389 -static struct tmem_pamops tmem_pamops;
37390 +static tmem_pamops_no_const tmem_pamops;
37392 void tmem_register_pamops(struct tmem_pamops *m)
37394 diff --git a/drivers/staging/zcache/tmem.h b/drivers/staging/zcache/tmem.h
37395 index ed147c4..94fc3c6 100644
37396 --- a/drivers/staging/zcache/tmem.h
37397 +++ b/drivers/staging/zcache/tmem.h
37398 @@ -180,6 +180,7 @@ struct tmem_pamops {
37399 void (*new_obj)(struct tmem_obj *);
37400 int (*replace_in_obj)(void *, struct tmem_obj *);
37402 +typedef struct tmem_pamops __no_const tmem_pamops_no_const;
37403 extern void tmem_register_pamops(struct tmem_pamops *m);
37405 /* memory allocation methods provided by the host implementation */
37406 @@ -189,6 +190,7 @@ struct tmem_hostops {
37407 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
37408 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
37410 +typedef struct tmem_hostops __no_const tmem_hostops_no_const;
37411 extern void tmem_register_hostops(struct tmem_hostops *m);
37413 /* core tmem accessor functions */
37414 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
37415 index c4ac6f6..4f90f53 100644
37416 --- a/drivers/target/iscsi/iscsi_target.c
37417 +++ b/drivers/target/iscsi/iscsi_target.c
37418 @@ -1370,7 +1370,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
37419 * outstanding_r2ts reaches zero, go ahead and send the delayed
37420 * TASK_ABORTED status.
37422 - if (atomic_read(&se_cmd->t_transport_aborted) != 0) {
37423 + if (atomic_read_unchecked(&se_cmd->t_transport_aborted) != 0) {
37424 if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
37425 if (--cmd->outstanding_r2ts < 1) {
37426 iscsit_stop_dataout_timer(cmd);
37427 diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
37428 index 8badcb4..94c9ac6 100644
37429 --- a/drivers/target/target_core_alua.c
37430 +++ b/drivers/target/target_core_alua.c
37431 @@ -723,6 +723,8 @@ static int core_alua_update_tpg_primary_metadata(
37432 char path[ALUA_METADATA_PATH_LEN];
37435 + pax_track_stack();
37437 memset(path, 0, ALUA_METADATA_PATH_LEN);
37439 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
37440 @@ -986,6 +988,8 @@ static int core_alua_update_tpg_secondary_metadata(
37441 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
37444 + pax_track_stack();
37446 memset(path, 0, ALUA_METADATA_PATH_LEN);
37447 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
37449 diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
37450 index 5f91397..dcc2d25 100644
37451 --- a/drivers/target/target_core_cdb.c
37452 +++ b/drivers/target/target_core_cdb.c
37453 @@ -933,6 +933,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
37455 unsigned char buf[SE_MODE_PAGE_BUF];
37457 + pax_track_stack();
37459 memset(buf, 0, SE_MODE_PAGE_BUF);
37461 switch (cdb[2] & 0x3f) {
37462 diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
37463 index b2575d8..b6b28fd 100644
37464 --- a/drivers/target/target_core_configfs.c
37465 +++ b/drivers/target/target_core_configfs.c
37466 @@ -1267,6 +1267,8 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
37468 int reg_count = 0, prf_isid;
37470 + pax_track_stack();
37472 if (!su_dev->se_dev_ptr)
37475 diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
37476 index 7fd3a16..bc2fb3e 100644
37477 --- a/drivers/target/target_core_pr.c
37478 +++ b/drivers/target/target_core_pr.c
37479 @@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_registration(
37480 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
37483 + pax_track_stack();
37485 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
37486 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
37488 @@ -1867,6 +1869,8 @@ static int __core_scsi3_update_aptpl_buf(
37492 + pax_track_stack();
37494 memset(buf, 0, pr_aptpl_buf_len);
37496 * Called to clear metadata once APTPL has been deactivated.
37497 @@ -1989,6 +1993,8 @@ static int __core_scsi3_write_aptpl_to_file(
37501 + pax_track_stack();
37503 memset(iov, 0, sizeof(struct iovec));
37504 memset(path, 0, 512);
37506 diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
37507 index 5c1b8c5..0cb7d0e 100644
37508 --- a/drivers/target/target_core_tmr.c
37509 +++ b/drivers/target/target_core_tmr.c
37510 @@ -255,7 +255,7 @@ static void core_tmr_drain_task_list(
37511 cmd->se_tfo->get_task_tag(cmd), cmd->pr_res_key,
37512 cmd->t_task_list_num,
37513 atomic_read(&cmd->t_task_cdbs_left),
37514 - atomic_read(&cmd->t_task_cdbs_sent),
37515 + atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37516 atomic_read(&cmd->t_transport_active),
37517 atomic_read(&cmd->t_transport_stop),
37518 atomic_read(&cmd->t_transport_sent));
37519 @@ -291,7 +291,7 @@ static void core_tmr_drain_task_list(
37520 pr_debug("LUN_RESET: got t_transport_active = 1 for"
37521 " task: %p, t_fe_count: %d dev: %p\n", task,
37523 - atomic_set(&cmd->t_transport_aborted, 1);
37524 + atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37525 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37527 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37528 @@ -299,7 +299,7 @@ static void core_tmr_drain_task_list(
37530 pr_debug("LUN_RESET: Got t_transport_active = 0 for task: %p,"
37531 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
37532 - atomic_set(&cmd->t_transport_aborted, 1);
37533 + atomic_set_unchecked(&cmd->t_transport_aborted, 1);
37534 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
37536 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
37537 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
37538 index e2added..ccb5251 100644
37539 --- a/drivers/target/target_core_transport.c
37540 +++ b/drivers/target/target_core_transport.c
37541 @@ -1445,7 +1445,7 @@ struct se_device *transport_add_device_to_core_hba(
37543 dev->queue_depth = dev_limits->queue_depth;
37544 atomic_set(&dev->depth_left, dev->queue_depth);
37545 - atomic_set(&dev->dev_ordered_id, 0);
37546 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
37548 se_dev_set_default_attribs(dev, dev_limits);
37550 @@ -1633,7 +1633,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
37551 * Used to determine when ORDERED commands should go from
37552 * Dormant to Active status.
37554 - cmd->se_ordered_id = atomic_inc_return(&cmd->se_dev->dev_ordered_id);
37555 + cmd->se_ordered_id = atomic_inc_return_unchecked(&cmd->se_dev->dev_ordered_id);
37556 smp_mb__after_atomic_inc();
37557 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
37558 cmd->se_ordered_id, cmd->sam_task_attr,
37559 @@ -1960,7 +1960,7 @@ static void transport_generic_request_failure(
37560 " t_transport_active: %d t_transport_stop: %d"
37561 " t_transport_sent: %d\n", cmd->t_task_list_num,
37562 atomic_read(&cmd->t_task_cdbs_left),
37563 - atomic_read(&cmd->t_task_cdbs_sent),
37564 + atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37565 atomic_read(&cmd->t_task_cdbs_ex_left),
37566 atomic_read(&cmd->t_transport_active),
37567 atomic_read(&cmd->t_transport_stop),
37568 @@ -2460,9 +2460,9 @@ check_depth:
37569 spin_lock_irqsave(&cmd->t_state_lock, flags);
37570 atomic_set(&task->task_active, 1);
37571 atomic_set(&task->task_sent, 1);
37572 - atomic_inc(&cmd->t_task_cdbs_sent);
37573 + atomic_inc_unchecked(&cmd->t_task_cdbs_sent);
37575 - if (atomic_read(&cmd->t_task_cdbs_sent) ==
37576 + if (atomic_read_unchecked(&cmd->t_task_cdbs_sent) ==
37577 cmd->t_task_list_num)
37578 atomic_set(&cmd->transport_sent, 1);
37580 @@ -4682,7 +4682,7 @@ static void transport_generic_wait_for_tasks(
37581 atomic_set(&cmd->transport_lun_stop, 0);
37583 if (!atomic_read(&cmd->t_transport_active) ||
37584 - atomic_read(&cmd->t_transport_aborted))
37585 + atomic_read_unchecked(&cmd->t_transport_aborted))
37588 atomic_set(&cmd->t_transport_stop, 1);
37589 @@ -4917,7 +4917,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
37593 - if (atomic_read(&cmd->t_transport_aborted) != 0) {
37594 + if (atomic_read_unchecked(&cmd->t_transport_aborted) != 0) {
37595 if (!send_status ||
37596 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
37598 @@ -4954,7 +4954,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
37600 if (cmd->data_direction == DMA_TO_DEVICE) {
37601 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
37602 - atomic_inc(&cmd->t_transport_aborted);
37603 + atomic_inc_unchecked(&cmd->t_transport_aborted);
37604 smp_mb__after_atomic_inc();
37605 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
37606 transport_new_cmd_failure(cmd);
37607 @@ -5068,7 +5068,7 @@ static void transport_processing_shutdown(struct se_device *dev)
37608 cmd->se_tfo->get_task_tag(cmd),
37609 cmd->t_task_list_num,
37610 atomic_read(&cmd->t_task_cdbs_left),
37611 - atomic_read(&cmd->t_task_cdbs_sent),
37612 + atomic_read_unchecked(&cmd->t_task_cdbs_sent),
37613 atomic_read(&cmd->t_transport_active),
37614 atomic_read(&cmd->t_transport_stop),
37615 atomic_read(&cmd->t_transport_sent));
37616 diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
37617 index d5f923b..9c78228 100644
37618 --- a/drivers/telephony/ixj.c
37619 +++ b/drivers/telephony/ixj.c
37620 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
37624 + pax_track_stack();
37626 if (!SCI_Prepare(j))
37629 diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
37630 index 4c8b665..1d931eb 100644
37631 --- a/drivers/tty/hvc/hvcs.c
37632 +++ b/drivers/tty/hvc/hvcs.c
37634 #include <asm/hvcserver.h>
37635 #include <asm/uaccess.h>
37636 #include <asm/vio.h>
37637 +#include <asm/local.h>
37640 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
37641 @@ -270,7 +271,7 @@ struct hvcs_struct {
37642 unsigned int index;
37644 struct tty_struct *tty;
37646 + local_t open_count;
37649 * Used to tell the driver kernel_thread what operations need to take
37650 @@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
37652 spin_lock_irqsave(&hvcsd->lock, flags);
37654 - if (hvcsd->open_count > 0) {
37655 + if (local_read(&hvcsd->open_count) > 0) {
37656 spin_unlock_irqrestore(&hvcsd->lock, flags);
37657 printk(KERN_INFO "HVCS: vterm state unchanged. "
37658 "The hvcs device node is still in use.\n");
37659 @@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
37660 if ((retval = hvcs_partner_connect(hvcsd)))
37661 goto error_release;
37663 - hvcsd->open_count = 1;
37664 + local_set(&hvcsd->open_count, 1);
37666 tty->driver_data = hvcsd;
37668 @@ -1179,7 +1180,7 @@ fast_open:
37670 spin_lock_irqsave(&hvcsd->lock, flags);
37671 kref_get(&hvcsd->kref);
37672 - hvcsd->open_count++;
37673 + local_inc(&hvcsd->open_count);
37674 hvcsd->todo_mask |= HVCS_SCHED_READ;
37675 spin_unlock_irqrestore(&hvcsd->lock, flags);
37677 @@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37678 hvcsd = tty->driver_data;
37680 spin_lock_irqsave(&hvcsd->lock, flags);
37681 - if (--hvcsd->open_count == 0) {
37682 + if (local_dec_and_test(&hvcsd->open_count)) {
37684 vio_disable_interrupts(hvcsd->vdev);
37686 @@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37687 free_irq(irq, hvcsd);
37688 kref_put(&hvcsd->kref, destroy_hvcs_struct);
37690 - } else if (hvcsd->open_count < 0) {
37691 + } else if (local_read(&hvcsd->open_count) < 0) {
37692 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
37693 " is missmanaged.\n",
37694 - hvcsd->vdev->unit_address, hvcsd->open_count);
37695 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
37698 spin_unlock_irqrestore(&hvcsd->lock, flags);
37699 @@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37701 spin_lock_irqsave(&hvcsd->lock, flags);
37702 /* Preserve this so that we know how many kref refs to put */
37703 - temp_open_count = hvcsd->open_count;
37704 + temp_open_count = local_read(&hvcsd->open_count);
37707 * Don't kref put inside the spinlock because the destruction
37708 @@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37709 hvcsd->tty->driver_data = NULL;
37712 - hvcsd->open_count = 0;
37713 + local_set(&hvcsd->open_count, 0);
37715 /* This will drop any buffered data on the floor which is OK in a hangup
37717 @@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct *tty,
37718 * the middle of a write operation? This is a crummy place to do this
37719 * but we want to keep it all in the spinlock.
37721 - if (hvcsd->open_count <= 0) {
37722 + if (local_read(&hvcsd->open_count) <= 0) {
37723 spin_unlock_irqrestore(&hvcsd->lock, flags);
37726 @@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_struct *tty)
37728 struct hvcs_struct *hvcsd = tty->driver_data;
37730 - if (!hvcsd || hvcsd->open_count <= 0)
37731 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
37734 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
37735 diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
37736 index ef92869..f4ebd88 100644
37737 --- a/drivers/tty/ipwireless/tty.c
37738 +++ b/drivers/tty/ipwireless/tty.c
37740 #include <linux/tty_driver.h>
37741 #include <linux/tty_flip.h>
37742 #include <linux/uaccess.h>
37743 +#include <asm/local.h>
37746 #include "network.h"
37747 @@ -51,7 +52,7 @@ struct ipw_tty {
37749 struct ipw_network *network;
37750 struct tty_struct *linux_tty;
37752 + local_t open_count;
37753 unsigned int control_lines;
37754 struct mutex ipw_tty_mutex;
37755 int tx_bytes_queued;
37756 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37757 mutex_unlock(&tty->ipw_tty_mutex);
37760 - if (tty->open_count == 0)
37761 + if (local_read(&tty->open_count) == 0)
37762 tty->tx_bytes_queued = 0;
37764 - tty->open_count++;
37765 + local_inc(&tty->open_count);
37767 tty->linux_tty = linux_tty;
37768 linux_tty->driver_data = tty;
37769 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37771 static void do_ipw_close(struct ipw_tty *tty)
37773 - tty->open_count--;
37775 - if (tty->open_count == 0) {
37776 + if (local_dec_return(&tty->open_count) == 0) {
37777 struct tty_struct *linux_tty = tty->linux_tty;
37779 if (linux_tty != NULL) {
37780 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
37783 mutex_lock(&tty->ipw_tty_mutex);
37784 - if (tty->open_count == 0) {
37785 + if (local_read(&tty->open_count) == 0) {
37786 mutex_unlock(&tty->ipw_tty_mutex);
37789 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
37793 - if (!tty->open_count) {
37794 + if (!local_read(&tty->open_count)) {
37795 mutex_unlock(&tty->ipw_tty_mutex);
37798 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
37801 mutex_lock(&tty->ipw_tty_mutex);
37802 - if (!tty->open_count) {
37803 + if (!local_read(&tty->open_count)) {
37804 mutex_unlock(&tty->ipw_tty_mutex);
37807 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
37811 - if (!tty->open_count)
37812 + if (!local_read(&tty->open_count))
37815 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
37816 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
37820 - if (!tty->open_count)
37821 + if (!local_read(&tty->open_count))
37824 return tty->tx_bytes_queued;
37825 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
37829 - if (!tty->open_count)
37830 + if (!local_read(&tty->open_count))
37833 return get_control_lines(tty);
37834 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
37838 - if (!tty->open_count)
37839 + if (!local_read(&tty->open_count))
37842 return set_control_lines(tty, set, clear);
37843 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
37847 - if (!tty->open_count)
37848 + if (!local_read(&tty->open_count))
37851 /* FIXME: Exactly how is the tty object locked here .. */
37852 @@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
37853 against a parallel ioctl etc */
37854 mutex_lock(&ttyj->ipw_tty_mutex);
37856 - while (ttyj->open_count)
37857 + while (local_read(&ttyj->open_count))
37858 do_ipw_close(ttyj);
37859 ipwireless_disassociate_network_ttys(network,
37860 ttyj->channel_idx);
37861 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
37862 index 8a50e4e..7d9ca3d 100644
37863 --- a/drivers/tty/n_gsm.c
37864 +++ b/drivers/tty/n_gsm.c
37865 @@ -1625,7 +1625,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
37866 kref_init(&dlci->ref);
37867 mutex_init(&dlci->mutex);
37868 dlci->fifo = &dlci->_fifo;
37869 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
37870 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
37874 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
37875 index 39d6ab6..eb97f41 100644
37876 --- a/drivers/tty/n_tty.c
37877 +++ b/drivers/tty/n_tty.c
37878 @@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
37880 *ops = tty_ldisc_N_TTY;
37882 - ops->refcount = ops->flags = 0;
37883 + atomic_set(&ops->refcount, 0);
37886 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
37887 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
37888 index e18604b..a7d5a11 100644
37889 --- a/drivers/tty/pty.c
37890 +++ b/drivers/tty/pty.c
37891 @@ -773,8 +773,10 @@ static void __init unix98_pty_init(void)
37892 register_sysctl_table(pty_root_table);
37894 /* Now create the /dev/ptmx special device */
37895 + pax_open_kernel();
37896 tty_default_fops(&ptmx_fops);
37897 - ptmx_fops.open = ptmx_open;
37898 + *(void **)&ptmx_fops.open = ptmx_open;
37899 + pax_close_kernel();
37901 cdev_init(&ptmx_cdev, &ptmx_fops);
37902 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
37903 diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
37904 index 6a1241c..d04ab0d 100644
37905 --- a/drivers/tty/rocket.c
37906 +++ b/drivers/tty/rocket.c
37907 @@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
37908 struct rocket_ports tmp;
37911 + pax_track_stack();
37915 memset(&tmp, 0, sizeof (tmp));
37916 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
37917 index 87e7e6c..89744e0 100644
37918 --- a/drivers/tty/serial/kgdboc.c
37919 +++ b/drivers/tty/serial/kgdboc.c
37921 #define MAX_CONFIG_LEN 40
37923 static struct kgdb_io kgdboc_io_ops;
37924 +static struct kgdb_io kgdboc_io_ops_console;
37926 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
37927 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
37928 static int configured = -1;
37930 static char config[MAX_CONFIG_LEN];
37931 @@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
37932 kgdboc_unregister_kbd();
37933 if (configured == 1)
37934 kgdb_unregister_io_module(&kgdboc_io_ops);
37935 + else if (configured == 2)
37936 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
37939 static int configure_kgdboc(void)
37940 @@ -156,13 +159,13 @@ static int configure_kgdboc(void)
37942 char *cptr = config;
37943 struct console *cons;
37944 + int is_console = 0;
37946 err = kgdboc_option_setup(config);
37947 if (err || !strlen(config) || isspace(config[0]))
37951 - kgdboc_io_ops.is_console = 0;
37952 kgdb_tty_driver = NULL;
37954 kgdboc_use_kms = 0;
37955 @@ -183,7 +186,7 @@ static int configure_kgdboc(void)
37957 if (cons->device && cons->device(cons, &idx) == p &&
37959 - kgdboc_io_ops.is_console = 1;
37964 @@ -193,12 +196,16 @@ static int configure_kgdboc(void)
37965 kgdb_tty_line = tty_line;
37968 - err = kgdb_register_io_module(&kgdboc_io_ops);
37969 + if (is_console) {
37970 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
37973 + err = kgdb_register_io_module(&kgdboc_io_ops);
37984 @@ -212,7 +219,7 @@ noconfig:
37985 static int __init init_kgdboc(void)
37987 /* Already configured? */
37988 - if (configured == 1)
37989 + if (configured >= 1)
37992 return configure_kgdboc();
37993 @@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
37994 if (config[len - 1] == '\n')
37995 config[len - 1] = '\0';
37997 - if (configured == 1)
37998 + if (configured >= 1)
38001 /* Go and configure with the new params. */
38002 @@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
38003 .post_exception = kgdboc_post_exp_handler,
38006 +static struct kgdb_io kgdboc_io_ops_console = {
38007 + .name = "kgdboc",
38008 + .read_char = kgdboc_get_char,
38009 + .write_char = kgdboc_put_char,
38010 + .pre_exception = kgdboc_pre_exp_handler,
38011 + .post_exception = kgdboc_post_exp_handler,
38015 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
38016 /* This is only available if kgdboc is a built in for early debugging */
38017 static int __init kgdboc_early_init(char *opt)
38018 diff --git a/drivers/tty/serial/mfd.c b/drivers/tty/serial/mfd.c
38019 index cab52f4..29fc6aa 100644
38020 --- a/drivers/tty/serial/mfd.c
38021 +++ b/drivers/tty/serial/mfd.c
38022 @@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci_dev *pdev)
38025 /* First 3 are UART ports, and the 4th is the DMA */
38026 -static const struct pci_device_id pci_ids[] __devinitdata = {
38027 +static const struct pci_device_id pci_ids[] __devinitconst = {
38028 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
38029 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
38030 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
38031 diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
38032 index 23bc743..d425c07 100644
38033 --- a/drivers/tty/serial/mrst_max3110.c
38034 +++ b/drivers/tty/serial/mrst_max3110.c
38035 @@ -393,6 +393,8 @@ static void max3110_con_receive(struct uart_max3110 *max)
38036 int loop = 1, num, total = 0;
38037 u8 recv_buf[512], *pbuf;
38039 + pax_track_stack();
38043 num = max3110_read_multi(max, pbuf);
38044 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
38045 index 1a890e2..1d8139c 100644
38046 --- a/drivers/tty/tty_io.c
38047 +++ b/drivers/tty/tty_io.c
38048 @@ -3238,7 +3238,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
38050 void tty_default_fops(struct file_operations *fops)
38052 - *fops = tty_fops;
38053 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
38057 diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
38058 index a76c808..ecbc743 100644
38059 --- a/drivers/tty/tty_ldisc.c
38060 +++ b/drivers/tty/tty_ldisc.c
38061 @@ -75,7 +75,7 @@ static void put_ldisc(struct tty_ldisc *ld)
38062 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
38063 struct tty_ldisc_ops *ldo = ld->ops;
38066 + atomic_dec(&ldo->refcount);
38067 module_put(ldo->owner);
38068 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38070 @@ -110,7 +110,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
38071 spin_lock_irqsave(&tty_ldisc_lock, flags);
38072 tty_ldiscs[disc] = new_ldisc;
38073 new_ldisc->num = disc;
38074 - new_ldisc->refcount = 0;
38075 + atomic_set(&new_ldisc->refcount, 0);
38076 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38079 @@ -138,7 +138,7 @@ int tty_unregister_ldisc(int disc)
38082 spin_lock_irqsave(&tty_ldisc_lock, flags);
38083 - if (tty_ldiscs[disc]->refcount)
38084 + if (atomic_read(&tty_ldiscs[disc]->refcount))
38087 tty_ldiscs[disc] = NULL;
38088 @@ -159,7 +159,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
38090 ret = ERR_PTR(-EAGAIN);
38091 if (try_module_get(ldops->owner)) {
38092 - ldops->refcount++;
38093 + atomic_inc(&ldops->refcount);
38097 @@ -172,7 +172,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
38098 unsigned long flags;
38100 spin_lock_irqsave(&tty_ldisc_lock, flags);
38101 - ldops->refcount--;
38102 + atomic_dec(&ldops->refcount);
38103 module_put(ldops->owner);
38104 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38106 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
38107 index 3761ccf..2c613b3 100644
38108 --- a/drivers/tty/vt/keyboard.c
38109 +++ b/drivers/tty/vt/keyboard.c
38110 @@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
38111 kbd->kbdmode == VC_OFF) &&
38112 value != KVAL(K_SAK))
38113 return; /* SAK is allowed even in raw mode */
38115 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
38117 + void *func = fn_handler[value];
38118 + if (func == fn_show_state || func == fn_show_ptregs ||
38119 + func == fn_show_mem)
38124 fn_handler[value](vc);
38127 diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
38128 index b3915b7..e716839 100644
38129 --- a/drivers/tty/vt/vt.c
38130 +++ b/drivers/tty/vt/vt.c
38131 @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
38133 static void notify_write(struct vc_data *vc, unsigned int unicode)
38135 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
38136 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
38137 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
38140 diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
38141 index 5e096f4..0da1363 100644
38142 --- a/drivers/tty/vt/vt_ioctl.c
38143 +++ b/drivers/tty/vt/vt_ioctl.c
38144 @@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38145 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
38148 - if (!capable(CAP_SYS_TTY_CONFIG))
38153 key_map = key_maps[s];
38154 @@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
38155 val = (i ? K_HOLE : K_NOSUCHMAP);
38156 return put_user(val, &user_kbe->kb_value);
38158 + if (!capable(CAP_SYS_TTY_CONFIG))
38163 if (!i && v == K_NOSUCHMAP) {
38164 @@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38168 - if (!capable(CAP_SYS_TTY_CONFIG))
38171 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
38174 @@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38176 return ((p && *p) ? -EOVERFLOW : 0);
38178 + if (!capable(CAP_SYS_TTY_CONFIG))
38184 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
38185 index d2efe82..9440ab6 100644
38186 --- a/drivers/uio/uio.c
38187 +++ b/drivers/uio/uio.c
38189 #include <linux/kobject.h>
38190 #include <linux/cdev.h>
38191 #include <linux/uio_driver.h>
38192 +#include <asm/local.h>
38194 #define UIO_MAX_DEVICES (1U << MINORBITS)
38196 @@ -32,10 +33,10 @@ struct uio_device {
38197 struct module *owner;
38198 struct device *dev;
38201 + atomic_unchecked_t event;
38202 struct fasync_struct *async_queue;
38203 wait_queue_head_t wait;
38205 + local_t vma_count;
38206 struct uio_info *info;
38207 struct kobject *map_dir;
38208 struct kobject *portio_dir;
38209 @@ -242,7 +243,7 @@ static ssize_t show_event(struct device *dev,
38210 struct device_attribute *attr, char *buf)
38212 struct uio_device *idev = dev_get_drvdata(dev);
38213 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
38214 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
38217 static struct device_attribute uio_class_attributes[] = {
38218 @@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *info)
38220 struct uio_device *idev = info->uio_dev;
38222 - atomic_inc(&idev->event);
38223 + atomic_inc_unchecked(&idev->event);
38224 wake_up_interruptible(&idev->wait);
38225 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38227 @@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, struct file *filep)
38230 listener->dev = idev;
38231 - listener->event_count = atomic_read(&idev->event);
38232 + listener->event_count = atomic_read_unchecked(&idev->event);
38233 filep->private_data = listener;
38235 if (idev->info->open) {
38236 @@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
38239 poll_wait(filep, &idev->wait, wait);
38240 - if (listener->event_count != atomic_read(&idev->event))
38241 + if (listener->event_count != atomic_read_unchecked(&idev->event))
38242 return POLLIN | POLLRDNORM;
38245 @@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
38247 set_current_state(TASK_INTERRUPTIBLE);
38249 - event_count = atomic_read(&idev->event);
38250 + event_count = atomic_read_unchecked(&idev->event);
38251 if (event_count != listener->event_count) {
38252 if (copy_to_user(buf, &event_count, count))
38254 @@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
38255 static void uio_vma_open(struct vm_area_struct *vma)
38257 struct uio_device *idev = vma->vm_private_data;
38258 - idev->vma_count++;
38259 + local_inc(&idev->vma_count);
38262 static void uio_vma_close(struct vm_area_struct *vma)
38264 struct uio_device *idev = vma->vm_private_data;
38265 - idev->vma_count--;
38266 + local_dec(&idev->vma_count);
38269 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38270 @@ -823,7 +824,7 @@ int __uio_register_device(struct module *owner,
38271 idev->owner = owner;
38273 init_waitqueue_head(&idev->wait);
38274 - atomic_set(&idev->event, 0);
38275 + atomic_set_unchecked(&idev->event, 0);
38277 ret = uio_get_minor(idev);
38279 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
38280 index a845f8b..4f54072 100644
38281 --- a/drivers/usb/atm/cxacru.c
38282 +++ b/drivers/usb/atm/cxacru.c
38283 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
38284 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
38287 - if (index < 0 || index > 0x7f)
38288 + if (index > 0x7f)
38292 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
38293 index d3448ca..d2864ca 100644
38294 --- a/drivers/usb/atm/usbatm.c
38295 +++ b/drivers/usb/atm/usbatm.c
38296 @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38297 if (printk_ratelimit())
38298 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38299 __func__, vpi, vci);
38300 - atomic_inc(&vcc->stats->rx_err);
38301 + atomic_inc_unchecked(&vcc->stats->rx_err);
38305 @@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38306 if (length > ATM_MAX_AAL5_PDU) {
38307 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38308 __func__, length, vcc);
38309 - atomic_inc(&vcc->stats->rx_err);
38310 + atomic_inc_unchecked(&vcc->stats->rx_err);
38314 @@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38315 if (sarb->len < pdu_length) {
38316 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38317 __func__, pdu_length, sarb->len, vcc);
38318 - atomic_inc(&vcc->stats->rx_err);
38319 + atomic_inc_unchecked(&vcc->stats->rx_err);
38323 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38324 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38326 - atomic_inc(&vcc->stats->rx_err);
38327 + atomic_inc_unchecked(&vcc->stats->rx_err);
38331 @@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38332 if (printk_ratelimit())
38333 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38335 - atomic_inc(&vcc->stats->rx_drop);
38336 + atomic_inc_unchecked(&vcc->stats->rx_drop);
38340 @@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38342 vcc->push(vcc, skb);
38344 - atomic_inc(&vcc->stats->rx);
38345 + atomic_inc_unchecked(&vcc->stats->rx);
38349 @@ -615,7 +615,7 @@ static void usbatm_tx_process(unsigned long data)
38350 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38352 usbatm_pop(vcc, skb);
38353 - atomic_inc(&vcc->stats->tx);
38354 + atomic_inc_unchecked(&vcc->stats->tx);
38356 skb = skb_dequeue(&instance->sndqueue);
38358 @@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
38360 return sprintf(page,
38361 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38362 - atomic_read(&atm_dev->stats.aal5.tx),
38363 - atomic_read(&atm_dev->stats.aal5.tx_err),
38364 - atomic_read(&atm_dev->stats.aal5.rx),
38365 - atomic_read(&atm_dev->stats.aal5.rx_err),
38366 - atomic_read(&atm_dev->stats.aal5.rx_drop));
38367 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38368 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38369 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38370 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38371 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38374 if (instance->disconnected)
38375 diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
38376 index 0149c09..f108812 100644
38377 --- a/drivers/usb/core/devices.c
38378 +++ b/drivers/usb/core/devices.c
38379 @@ -126,7 +126,7 @@ static const char format_endpt[] =
38380 * time it gets called.
38382 static struct device_connect_event {
38384 + atomic_unchecked_t count;
38385 wait_queue_head_t wait;
38387 .count = ATOMIC_INIT(1),
38388 @@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
38390 void usbfs_conn_disc_event(void)
38392 - atomic_add(2, &device_event.count);
38393 + atomic_add_unchecked(2, &device_event.count);
38394 wake_up(&device_event.wait);
38397 @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(struct file *file,
38399 poll_wait(file, &device_event.wait, wait);
38401 - event_count = atomic_read(&device_event.count);
38402 + event_count = atomic_read_unchecked(&device_event.count);
38403 if (file->f_version != event_count) {
38404 file->f_version = event_count;
38405 return POLLIN | POLLRDNORM;
38406 diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
38407 index 0b5ec23..0da3d76 100644
38408 --- a/drivers/usb/core/message.c
38409 +++ b/drivers/usb/core/message.c
38410 @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device *udev, int index)
38411 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
38413 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
38415 - smallbuf = kmalloc(++len, GFP_NOIO);
38417 + smallbuf = kmalloc(len, GFP_NOIO);
38420 memcpy(smallbuf, buf, len);
38421 diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
38422 index 1fc8f12..20647c1 100644
38423 --- a/drivers/usb/early/ehci-dbgp.c
38424 +++ b/drivers/usb/early/ehci-dbgp.c
38425 @@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
38428 static struct kgdb_io kgdbdbgp_io_ops;
38429 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
38430 +static struct kgdb_io kgdbdbgp_io_ops_console;
38431 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
38433 #define dbgp_kgdb_mode (0)
38435 @@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
38436 .write_char = kgdbdbgp_write_char,
38439 +static struct kgdb_io kgdbdbgp_io_ops_console = {
38440 + .name = "kgdbdbgp",
38441 + .read_char = kgdbdbgp_read_char,
38442 + .write_char = kgdbdbgp_write_char,
38446 static int kgdbdbgp_wait_time;
38448 static int __init kgdbdbgp_parse_config(char *str)
38449 @@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(char *str)
38451 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
38453 - kgdb_register_io_module(&kgdbdbgp_io_ops);
38454 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
38455 + if (early_dbgp_console.index != -1)
38456 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
38458 + kgdb_register_io_module(&kgdbdbgp_io_ops);
38462 diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
38463 index d718033..6075579 100644
38464 --- a/drivers/usb/host/xhci-mem.c
38465 +++ b/drivers/usb/host/xhci-mem.c
38466 @@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
38467 unsigned int num_tests;
38470 + pax_track_stack();
38472 num_tests = ARRAY_SIZE(simple_test_vector);
38473 for (i = 0; i < num_tests; i++) {
38474 ret = xhci_test_trb_in_td(xhci,
38475 diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
38476 index d6bea3e..60b250e 100644
38477 --- a/drivers/usb/wusbcore/wa-hc.h
38478 +++ b/drivers/usb/wusbcore/wa-hc.h
38479 @@ -192,7 +192,7 @@ struct wahc {
38480 struct list_head xfer_delayed_list;
38481 spinlock_t xfer_list_lock;
38482 struct work_struct xfer_work;
38483 - atomic_t xfer_id_count;
38484 + atomic_unchecked_t xfer_id_count;
38488 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
38489 INIT_LIST_HEAD(&wa->xfer_delayed_list);
38490 spin_lock_init(&wa->xfer_list_lock);
38491 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
38492 - atomic_set(&wa->xfer_id_count, 1);
38493 + atomic_set_unchecked(&wa->xfer_id_count, 1);
38497 diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
38498 index 4193345..49ae93d 100644
38499 --- a/drivers/usb/wusbcore/wa-xfer.c
38500 +++ b/drivers/usb/wusbcore/wa-xfer.c
38501 @@ -295,7 +295,7 @@ out:
38503 static void wa_xfer_id_init(struct wa_xfer *xfer)
38505 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
38506 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
38510 diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
38511 index c14c42b..f955cc2 100644
38512 --- a/drivers/vhost/vhost.c
38513 +++ b/drivers/vhost/vhost.c
38514 @@ -629,7 +629,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
38518 -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
38519 +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
38521 struct file *eventfp, *filep = NULL,
38522 *pollstart = NULL, *pollstop = NULL;
38523 diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
38524 index b0b2ac3..89a4399 100644
38525 --- a/drivers/video/aty/aty128fb.c
38526 +++ b/drivers/video/aty/aty128fb.c
38527 @@ -148,7 +148,7 @@ enum {
38530 /* Must match above enum */
38531 -static const char *r128_family[] __devinitdata = {
38532 +static const char *r128_family[] __devinitconst = {
38536 diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
38537 index 5c3960d..15cf8fc 100644
38538 --- a/drivers/video/fbcmap.c
38539 +++ b/drivers/video/fbcmap.c
38540 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
38544 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
38545 - !info->fbops->fb_setcmap)) {
38546 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
38550 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
38551 index ad93629..ca6a218 100644
38552 --- a/drivers/video/fbmem.c
38553 +++ b/drivers/video/fbmem.c
38554 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38555 image->dx += image->width + 8;
38557 } else if (rotate == FB_ROTATE_UD) {
38558 - for (x = 0; x < num && image->dx >= 0; x++) {
38559 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
38560 info->fbops->fb_imageblit(info, image);
38561 image->dx -= image->width + 8;
38563 @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
38564 image->dy += image->height + 8;
38566 } else if (rotate == FB_ROTATE_CCW) {
38567 - for (x = 0; x < num && image->dy >= 0; x++) {
38568 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
38569 info->fbops->fb_imageblit(info, image);
38570 image->dy -= image->height + 8;
38572 @@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
38573 int flags = info->flags;
38576 + pax_track_stack();
38578 if (var->activate & FB_ACTIVATE_INV_MODE) {
38579 struct fb_videomode mode1, mode2;
38581 @@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38582 void __user *argp = (void __user *)arg;
38585 + pax_track_stack();
38588 case FBIOGET_VSCREENINFO:
38589 if (!lock_fb_info(info))
38590 @@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
38592 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
38594 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
38595 + if (con2fb.framebuffer >= FB_MAX)
38597 if (!registered_fb[con2fb.framebuffer])
38598 request_module("fb%d", con2fb.framebuffer);
38599 diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
38600 index 5a5d092..265c5ed 100644
38601 --- a/drivers/video/geode/gx1fb_core.c
38602 +++ b/drivers/video/geode/gx1fb_core.c
38603 @@ -29,7 +29,7 @@ static int crt_option = 1;
38604 static char panel_option[32] = "";
38606 /* Modes relevant to the GX1 (taken from modedb.c) */
38607 -static const struct fb_videomode __devinitdata gx1_modedb[] = {
38608 +static const struct fb_videomode __devinitconst gx1_modedb[] = {
38609 /* 640x480-60 VESA */
38610 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
38611 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
38612 diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
38613 index 896e53d..4d87d0b 100644
38614 --- a/drivers/video/gxt4500.c
38615 +++ b/drivers/video/gxt4500.c
38616 @@ -156,7 +156,7 @@ struct gxt4500_par {
38617 static char *mode_option;
38619 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
38620 -static const struct fb_videomode defaultmode __devinitdata = {
38621 +static const struct fb_videomode defaultmode __devinitconst = {
38625 @@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
38629 -static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
38630 +static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
38631 .id = "IBM GXT4500P",
38632 .type = FB_TYPE_PACKED_PIXELS,
38633 .visual = FB_VISUAL_PSEUDOCOLOR,
38634 diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
38635 index 7672d2e..b56437f 100644
38636 --- a/drivers/video/i810/i810_accel.c
38637 +++ b/drivers/video/i810/i810_accel.c
38638 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
38641 printk("ringbuffer lockup!!!\n");
38642 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
38643 i810_report_error(mmio);
38644 par->dev_flags |= LOCKUP;
38645 info->pixmap.scan_align = 1;
38646 diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
38647 index 318f6fb..9a389c1 100644
38648 --- a/drivers/video/i810/i810_main.c
38649 +++ b/drivers/video/i810/i810_main.c
38650 @@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
38651 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
38654 -static const char *i810_pci_list[] __devinitdata = {
38655 +static const char *i810_pci_list[] __devinitconst = {
38656 "Intel(R) 810 Framebuffer Device" ,
38657 "Intel(R) 810-DC100 Framebuffer Device" ,
38658 "Intel(R) 810E Framebuffer Device" ,
38659 diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
38660 index de36693..3c63fc2 100644
38661 --- a/drivers/video/jz4740_fb.c
38662 +++ b/drivers/video/jz4740_fb.c
38663 @@ -136,7 +136,7 @@ struct jzfb {
38664 uint32_t pseudo_palette[16];
38667 -static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
38668 +static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
38670 .type = FB_TYPE_PACKED_PIXELS,
38671 .visual = FB_VISUAL_TRUECOLOR,
38672 diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
38673 index 3c14e43..eafa544 100644
38674 --- a/drivers/video/logo/logo_linux_clut224.ppm
38675 +++ b/drivers/video/logo/logo_linux_clut224.ppm
38676 @@ -1,1604 +1,1123 @@
38678 -# Standard 224-color Linux logo
38681 - 0 0 0 0 0 0 0 0 0 0 0 0
38682 - 0 0 0 0 0 0 0 0 0 0 0 0
38683 - 0 0 0 0 0 0 0 0 0 0 0 0
38684 - 0 0 0 0 0 0 0 0 0 0 0 0
38685 - 0 0 0 0 0 0 0 0 0 0 0 0
38686 - 0 0 0 0 0 0 0 0 0 0 0 0
38687 - 0 0 0 0 0 0 0 0 0 0 0 0
38688 - 0 0 0 0 0 0 0 0 0 0 0 0
38689 - 0 0 0 0 0 0 0 0 0 0 0 0
38690 - 6 6 6 6 6 6 10 10 10 10 10 10
38691 - 10 10 10 6 6 6 6 6 6 6 6 6
38692 - 0 0 0 0 0 0 0 0 0 0 0 0
38693 - 0 0 0 0 0 0 0 0 0 0 0 0
38694 - 0 0 0 0 0 0 0 0 0 0 0 0
38695 - 0 0 0 0 0 0 0 0 0 0 0 0
38696 - 0 0 0 0 0 0 0 0 0 0 0 0
38697 - 0 0 0 0 0 0 0 0 0 0 0 0
38698 - 0 0 0 0 0 0 0 0 0 0 0 0
38699 - 0 0 0 0 0 0 0 0 0 0 0 0
38700 - 0 0 0 0 0 0 0 0 0 0 0 0
38701 - 0 0 0 0 0 0 0 0 0 0 0 0
38702 - 0 0 0 0 0 0 0 0 0 0 0 0
38703 - 0 0 0 0 0 0 0 0 0 0 0 0
38704 - 0 0 0 0 0 0 0 0 0 0 0 0
38705 - 0 0 0 0 0 0 0 0 0 0 0 0
38706 - 0 0 0 0 0 0 0 0 0 0 0 0
38707 - 0 0 0 0 0 0 0 0 0 0 0 0
38708 - 0 0 0 0 0 0 0 0 0 0 0 0
38709 - 0 0 0 6 6 6 10 10 10 14 14 14
38710 - 22 22 22 26 26 26 30 30 30 34 34 34
38711 - 30 30 30 30 30 30 26 26 26 18 18 18
38712 - 14 14 14 10 10 10 6 6 6 0 0 0
38713 - 0 0 0 0 0 0 0 0 0 0 0 0
38714 - 0 0 0 0 0 0 0 0 0 0 0 0
38715 - 0 0 0 0 0 0 0 0 0 0 0 0
38716 - 0 0 0 0 0 0 0 0 0 0 0 0
38717 - 0 0 0 0 0 0 0 0 0 0 0 0
38718 - 0 0 0 0 0 0 0 0 0 0 0 0
38719 - 0 0 0 0 0 0 0 0 0 0 0 0
38720 - 0 0 0 0 0 0 0 0 0 0 0 0
38721 - 0 0 0 0 0 0 0 0 0 0 0 0
38722 - 0 0 0 0 0 1 0 0 1 0 0 0
38723 - 0 0 0 0 0 0 0 0 0 0 0 0
38724 - 0 0 0 0 0 0 0 0 0 0 0 0
38725 - 0 0 0 0 0 0 0 0 0 0 0 0
38726 - 0 0 0 0 0 0 0 0 0 0 0 0
38727 - 0 0 0 0 0 0 0 0 0 0 0 0
38728 - 0 0 0 0 0 0 0 0 0 0 0 0
38729 - 6 6 6 14 14 14 26 26 26 42 42 42
38730 - 54 54 54 66 66 66 78 78 78 78 78 78
38731 - 78 78 78 74 74 74 66 66 66 54 54 54
38732 - 42 42 42 26 26 26 18 18 18 10 10 10
38733 - 6 6 6 0 0 0 0 0 0 0 0 0
38734 - 0 0 0 0 0 0 0 0 0 0 0 0
38735 - 0 0 0 0 0 0 0 0 0 0 0 0
38736 - 0 0 0 0 0 0 0 0 0 0 0 0
38737 - 0 0 0 0 0 0 0 0 0 0 0 0
38738 - 0 0 0 0 0 0 0 0 0 0 0 0
38739 - 0 0 0 0 0 0 0 0 0 0 0 0
38740 - 0 0 0 0 0 0 0 0 0 0 0 0
38741 - 0 0 0 0 0 0 0 0 0 0 0 0
38742 - 0 0 1 0 0 0 0 0 0 0 0 0
38743 - 0 0 0 0 0 0 0 0 0 0 0 0
38744 - 0 0 0 0 0 0 0 0 0 0 0 0
38745 - 0 0 0 0 0 0 0 0 0 0 0 0
38746 - 0 0 0 0 0 0 0 0 0 0 0 0
38747 - 0 0 0 0 0 0 0 0 0 0 0 0
38748 - 0 0 0 0 0 0 0 0 0 10 10 10
38749 - 22 22 22 42 42 42 66 66 66 86 86 86
38750 - 66 66 66 38 38 38 38 38 38 22 22 22
38751 - 26 26 26 34 34 34 54 54 54 66 66 66
38752 - 86 86 86 70 70 70 46 46 46 26 26 26
38753 - 14 14 14 6 6 6 0 0 0 0 0 0
38754 - 0 0 0 0 0 0 0 0 0 0 0 0
38755 - 0 0 0 0 0 0 0 0 0 0 0 0
38756 - 0 0 0 0 0 0 0 0 0 0 0 0
38757 - 0 0 0 0 0 0 0 0 0 0 0 0
38758 - 0 0 0 0 0 0 0 0 0 0 0 0
38759 - 0 0 0 0 0 0 0 0 0 0 0 0
38760 - 0 0 0 0 0 0 0 0 0 0 0 0
38761 - 0 0 0 0 0 0 0 0 0 0 0 0
38762 - 0 0 1 0 0 1 0 0 1 0 0 0
38763 - 0 0 0 0 0 0 0 0 0 0 0 0
38764 - 0 0 0 0 0 0 0 0 0 0 0 0
38765 - 0 0 0 0 0 0 0 0 0 0 0 0
38766 - 0 0 0 0 0 0 0 0 0 0 0 0
38767 - 0 0 0 0 0 0 0 0 0 0 0 0
38768 - 0 0 0 0 0 0 10 10 10 26 26 26
38769 - 50 50 50 82 82 82 58 58 58 6 6 6
38770 - 2 2 6 2 2 6 2 2 6 2 2 6
38771 - 2 2 6 2 2 6 2 2 6 2 2 6
38772 - 6 6 6 54 54 54 86 86 86 66 66 66
38773 - 38 38 38 18 18 18 6 6 6 0 0 0
38774 - 0 0 0 0 0 0 0 0 0 0 0 0
38775 - 0 0 0 0 0 0 0 0 0 0 0 0
38776 - 0 0 0 0 0 0 0 0 0 0 0 0
38777 - 0 0 0 0 0 0 0 0 0 0 0 0
38778 - 0 0 0 0 0 0 0 0 0 0 0 0
38779 - 0 0 0 0 0 0 0 0 0 0 0 0
38780 - 0 0 0 0 0 0 0 0 0 0 0 0
38781 - 0 0 0 0 0 0 0 0 0 0 0 0
38782 - 0 0 0 0 0 0 0 0 0 0 0 0
38783 - 0 0 0 0 0 0 0 0 0 0 0 0
38784 - 0 0 0 0 0 0 0 0 0 0 0 0
38785 - 0 0 0 0 0 0 0 0 0 0 0 0
38786 - 0 0 0 0 0 0 0 0 0 0 0 0
38787 - 0 0 0 0 0 0 0 0 0 0 0 0
38788 - 0 0 0 6 6 6 22 22 22 50 50 50
38789 - 78 78 78 34 34 34 2 2 6 2 2 6
38790 - 2 2 6 2 2 6 2 2 6 2 2 6
38791 - 2 2 6 2 2 6 2 2 6 2 2 6
38792 - 2 2 6 2 2 6 6 6 6 70 70 70
38793 - 78 78 78 46 46 46 22 22 22 6 6 6
38794 - 0 0 0 0 0 0 0 0 0 0 0 0
38795 - 0 0 0 0 0 0 0 0 0 0 0 0
38796 - 0 0 0 0 0 0 0 0 0 0 0 0
38797 - 0 0 0 0 0 0 0 0 0 0 0 0
38798 - 0 0 0 0 0 0 0 0 0 0 0 0
38799 - 0 0 0 0 0 0 0 0 0 0 0 0
38800 - 0 0 0 0 0 0 0 0 0 0 0 0
38801 - 0 0 0 0 0 0 0 0 0 0 0 0
38802 - 0 0 1 0 0 1 0 0 1 0 0 0
38803 - 0 0 0 0 0 0 0 0 0 0 0 0
38804 - 0 0 0 0 0 0 0 0 0 0 0 0
38805 - 0 0 0 0 0 0 0 0 0 0 0 0
38806 - 0 0 0 0 0 0 0 0 0 0 0 0
38807 - 0 0 0 0 0 0 0 0 0 0 0 0
38808 - 6 6 6 18 18 18 42 42 42 82 82 82
38809 - 26 26 26 2 2 6 2 2 6 2 2 6
38810 - 2 2 6 2 2 6 2 2 6 2 2 6
38811 - 2 2 6 2 2 6 2 2 6 14 14 14
38812 - 46 46 46 34 34 34 6 6 6 2 2 6
38813 - 42 42 42 78 78 78 42 42 42 18 18 18
38814 - 6 6 6 0 0 0 0 0 0 0 0 0
38815 - 0 0 0 0 0 0 0 0 0 0 0 0
38816 - 0 0 0 0 0 0 0 0 0 0 0 0
38817 - 0 0 0 0 0 0 0 0 0 0 0 0
38818 - 0 0 0 0 0 0 0 0 0 0 0 0
38819 - 0 0 0 0 0 0 0 0 0 0 0 0
38820 - 0 0 0 0 0 0 0 0 0 0 0 0
38821 - 0 0 0 0 0 0 0 0 0 0 0 0
38822 - 0 0 1 0 0 0 0 0 1 0 0 0
38823 - 0 0 0 0 0 0 0 0 0 0 0 0
38824 - 0 0 0 0 0 0 0 0 0 0 0 0
38825 - 0 0 0 0 0 0 0 0 0 0 0 0
38826 - 0 0 0 0 0 0 0 0 0 0 0 0
38827 - 0 0 0 0 0 0 0 0 0 0 0 0
38828 - 10 10 10 30 30 30 66 66 66 58 58 58
38829 - 2 2 6 2 2 6 2 2 6 2 2 6
38830 - 2 2 6 2 2 6 2 2 6 2 2 6
38831 - 2 2 6 2 2 6 2 2 6 26 26 26
38832 - 86 86 86 101 101 101 46 46 46 10 10 10
38833 - 2 2 6 58 58 58 70 70 70 34 34 34
38834 - 10 10 10 0 0 0 0 0 0 0 0 0
38835 - 0 0 0 0 0 0 0 0 0 0 0 0
38836 - 0 0 0 0 0 0 0 0 0 0 0 0
38837 - 0 0 0 0 0 0 0 0 0 0 0 0
38838 - 0 0 0 0 0 0 0 0 0 0 0 0
38839 - 0 0 0 0 0 0 0 0 0 0 0 0
38840 - 0 0 0 0 0 0 0 0 0 0 0 0
38841 - 0 0 0 0 0 0 0 0 0 0 0 0
38842 - 0 0 1 0 0 1 0 0 1 0 0 0
38843 - 0 0 0 0 0 0 0 0 0 0 0 0
38844 - 0 0 0 0 0 0 0 0 0 0 0 0
38845 - 0 0 0 0 0 0 0 0 0 0 0 0
38846 - 0 0 0 0 0 0 0 0 0 0 0 0
38847 - 0 0 0 0 0 0 0 0 0 0 0 0
38848 - 14 14 14 42 42 42 86 86 86 10 10 10
38849 - 2 2 6 2 2 6 2 2 6 2 2 6
38850 - 2 2 6 2 2 6 2 2 6 2 2 6
38851 - 2 2 6 2 2 6 2 2 6 30 30 30
38852 - 94 94 94 94 94 94 58 58 58 26 26 26
38853 - 2 2 6 6 6 6 78 78 78 54 54 54
38854 - 22 22 22 6 6 6 0 0 0 0 0 0
38855 - 0 0 0 0 0 0 0 0 0 0 0 0
38856 - 0 0 0 0 0 0 0 0 0 0 0 0
38857 - 0 0 0 0 0 0 0 0 0 0 0 0
38858 - 0 0 0 0 0 0 0 0 0 0 0 0
38859 - 0 0 0 0 0 0 0 0 0 0 0 0
38860 - 0 0 0 0 0 0 0 0 0 0 0 0
38861 - 0 0 0 0 0 0 0 0 0 0 0 0
38862 - 0 0 0 0 0 0 0 0 0 0 0 0
38863 - 0 0 0 0 0 0 0 0 0 0 0 0
38864 - 0 0 0 0 0 0 0 0 0 0 0 0
38865 - 0 0 0 0 0 0 0 0 0 0 0 0
38866 - 0 0 0 0 0 0 0 0 0 0 0 0
38867 - 0 0 0 0 0 0 0 0 0 6 6 6
38868 - 22 22 22 62 62 62 62 62 62 2 2 6
38869 - 2 2 6 2 2 6 2 2 6 2 2 6
38870 - 2 2 6 2 2 6 2 2 6 2 2 6
38871 - 2 2 6 2 2 6 2 2 6 26 26 26
38872 - 54 54 54 38 38 38 18 18 18 10 10 10
38873 - 2 2 6 2 2 6 34 34 34 82 82 82
38874 - 38 38 38 14 14 14 0 0 0 0 0 0
38875 - 0 0 0 0 0 0 0 0 0 0 0 0
38876 - 0 0 0 0 0 0 0 0 0 0 0 0
38877 - 0 0 0 0 0 0 0 0 0 0 0 0
38878 - 0 0 0 0 0 0 0 0 0 0 0 0
38879 - 0 0 0 0 0 0 0 0 0 0 0 0
38880 - 0 0 0 0 0 0 0 0 0 0 0 0
38881 - 0 0 0 0 0 0 0 0 0 0 0 0
38882 - 0 0 0 0 0 1 0 0 1 0 0 0
38883 - 0 0 0 0 0 0 0 0 0 0 0 0
38884 - 0 0 0 0 0 0 0 0 0 0 0 0
38885 - 0 0 0 0 0 0 0 0 0 0 0 0
38886 - 0 0 0 0 0 0 0 0 0 0 0 0
38887 - 0 0 0 0 0 0 0 0 0 6 6 6
38888 - 30 30 30 78 78 78 30 30 30 2 2 6
38889 - 2 2 6 2 2 6 2 2 6 2 2 6
38890 - 2 2 6 2 2 6 2 2 6 2 2 6
38891 - 2 2 6 2 2 6 2 2 6 10 10 10
38892 - 10 10 10 2 2 6 2 2 6 2 2 6
38893 - 2 2 6 2 2 6 2 2 6 78 78 78
38894 - 50 50 50 18 18 18 6 6 6 0 0 0
38895 - 0 0 0 0 0 0 0 0 0 0 0 0
38896 - 0 0 0 0 0 0 0 0 0 0 0 0
38897 - 0 0 0 0 0 0 0 0 0 0 0 0
38898 - 0 0 0 0 0 0 0 0 0 0 0 0
38899 - 0 0 0 0 0 0 0 0 0 0 0 0
38900 - 0 0 0 0 0 0 0 0 0 0 0 0
38901 - 0 0 0 0 0 0 0 0 0 0 0 0
38902 - 0 0 1 0 0 0 0 0 0 0 0 0
38903 - 0 0 0 0 0 0 0 0 0 0 0 0
38904 - 0 0 0 0 0 0 0 0 0 0 0 0
38905 - 0 0 0 0 0 0 0 0 0 0 0 0
38906 - 0 0 0 0 0 0 0 0 0 0 0 0
38907 - 0 0 0 0 0 0 0 0 0 10 10 10
38908 - 38 38 38 86 86 86 14 14 14 2 2 6
38909 - 2 2 6 2 2 6 2 2 6 2 2 6
38910 - 2 2 6 2 2 6 2 2 6 2 2 6
38911 - 2 2 6 2 2 6 2 2 6 2 2 6
38912 - 2 2 6 2 2 6 2 2 6 2 2 6
38913 - 2 2 6 2 2 6 2 2 6 54 54 54
38914 - 66 66 66 26 26 26 6 6 6 0 0 0
38915 - 0 0 0 0 0 0 0 0 0 0 0 0
38916 - 0 0 0 0 0 0 0 0 0 0 0 0
38917 - 0 0 0 0 0 0 0 0 0 0 0 0
38918 - 0 0 0 0 0 0 0 0 0 0 0 0
38919 - 0 0 0 0 0 0 0 0 0 0 0 0
38920 - 0 0 0 0 0 0 0 0 0 0 0 0
38921 - 0 0 0 0 0 0 0 0 0 0 0 0
38922 - 0 0 0 0 0 1 0 0 1 0 0 0
38923 - 0 0 0 0 0 0 0 0 0 0 0 0
38924 - 0 0 0 0 0 0 0 0 0 0 0 0
38925 - 0 0 0 0 0 0 0 0 0 0 0 0
38926 - 0 0 0 0 0 0 0 0 0 0 0 0
38927 - 0 0 0 0 0 0 0 0 0 14 14 14
38928 - 42 42 42 82 82 82 2 2 6 2 2 6
38929 - 2 2 6 6 6 6 10 10 10 2 2 6
38930 - 2 2 6 2 2 6 2 2 6 2 2 6
38931 - 2 2 6 2 2 6 2 2 6 6 6 6
38932 - 14 14 14 10 10 10 2 2 6 2 2 6
38933 - 2 2 6 2 2 6 2 2 6 18 18 18
38934 - 82 82 82 34 34 34 10 10 10 0 0 0
38935 - 0 0 0 0 0 0 0 0 0 0 0 0
38936 - 0 0 0 0 0 0 0 0 0 0 0 0
38937 - 0 0 0 0 0 0 0 0 0 0 0 0
38938 - 0 0 0 0 0 0 0 0 0 0 0 0
38939 - 0 0 0 0 0 0 0 0 0 0 0 0
38940 - 0 0 0 0 0 0 0 0 0 0 0 0
38941 - 0 0 0 0 0 0 0 0 0 0 0 0
38942 - 0 0 1 0 0 0 0 0 0 0 0 0
38943 - 0 0 0 0 0 0 0 0 0 0 0 0
38944 - 0 0 0 0 0 0 0 0 0 0 0 0
38945 - 0 0 0 0 0 0 0 0 0 0 0 0
38946 - 0 0 0 0 0 0 0 0 0 0 0 0
38947 - 0 0 0 0 0 0 0 0 0 14 14 14
38948 - 46 46 46 86 86 86 2 2 6 2 2 6
38949 - 6 6 6 6 6 6 22 22 22 34 34 34
38950 - 6 6 6 2 2 6 2 2 6 2 2 6
38951 - 2 2 6 2 2 6 18 18 18 34 34 34
38952 - 10 10 10 50 50 50 22 22 22 2 2 6
38953 - 2 2 6 2 2 6 2 2 6 10 10 10
38954 - 86 86 86 42 42 42 14 14 14 0 0 0
38955 - 0 0 0 0 0 0 0 0 0 0 0 0
38956 - 0 0 0 0 0 0 0 0 0 0 0 0
38957 - 0 0 0 0 0 0 0 0 0 0 0 0
38958 - 0 0 0 0 0 0 0 0 0 0 0 0
38959 - 0 0 0 0 0 0 0 0 0 0 0 0
38960 - 0 0 0 0 0 0 0 0 0 0 0 0
38961 - 0 0 0 0 0 0 0 0 0 0 0 0
38962 - 0 0 1 0 0 1 0 0 1 0 0 0
38963 - 0 0 0 0 0 0 0 0 0 0 0 0
38964 - 0 0 0 0 0 0 0 0 0 0 0 0
38965 - 0 0 0 0 0 0 0 0 0 0 0 0
38966 - 0 0 0 0 0 0 0 0 0 0 0 0
38967 - 0 0 0 0 0 0 0 0 0 14 14 14
38968 - 46 46 46 86 86 86 2 2 6 2 2 6
38969 - 38 38 38 116 116 116 94 94 94 22 22 22
38970 - 22 22 22 2 2 6 2 2 6 2 2 6
38971 - 14 14 14 86 86 86 138 138 138 162 162 162
38972 -154 154 154 38 38 38 26 26 26 6 6 6
38973 - 2 2 6 2 2 6 2 2 6 2 2 6
38974 - 86 86 86 46 46 46 14 14 14 0 0 0
38975 - 0 0 0 0 0 0 0 0 0 0 0 0
38976 - 0 0 0 0 0 0 0 0 0 0 0 0
38977 - 0 0 0 0 0 0 0 0 0 0 0 0
38978 - 0 0 0 0 0 0 0 0 0 0 0 0
38979 - 0 0 0 0 0 0 0 0 0 0 0 0
38980 - 0 0 0 0 0 0 0 0 0 0 0 0
38981 - 0 0 0 0 0 0 0 0 0 0 0 0
38982 - 0 0 0 0 0 0 0 0 0 0 0 0
38983 - 0 0 0 0 0 0 0 0 0 0 0 0
38984 - 0 0 0 0 0 0 0 0 0 0 0 0
38985 - 0 0 0 0 0 0 0 0 0 0 0 0
38986 - 0 0 0 0 0 0 0 0 0 0 0 0
38987 - 0 0 0 0 0 0 0 0 0 14 14 14
38988 - 46 46 46 86 86 86 2 2 6 14 14 14
38989 -134 134 134 198 198 198 195 195 195 116 116 116
38990 - 10 10 10 2 2 6 2 2 6 6 6 6
38991 -101 98 89 187 187 187 210 210 210 218 218 218
38992 -214 214 214 134 134 134 14 14 14 6 6 6
38993 - 2 2 6 2 2 6 2 2 6 2 2 6
38994 - 86 86 86 50 50 50 18 18 18 6 6 6
38995 - 0 0 0 0 0 0 0 0 0 0 0 0
38996 - 0 0 0 0 0 0 0 0 0 0 0 0
38997 - 0 0 0 0 0 0 0 0 0 0 0 0
38998 - 0 0 0 0 0 0 0 0 0 0 0 0
38999 - 0 0 0 0 0 0 0 0 0 0 0 0
39000 - 0 0 0 0 0 0 0 0 0 0 0 0
39001 - 0 0 0 0 0 0 0 0 1 0 0 0
39002 - 0 0 1 0 0 1 0 0 1 0 0 0
39003 - 0 0 0 0 0 0 0 0 0 0 0 0
39004 - 0 0 0 0 0 0 0 0 0 0 0 0
39005 - 0 0 0 0 0 0 0 0 0 0 0 0
39006 - 0 0 0 0 0 0 0 0 0 0 0 0
39007 - 0 0 0 0 0 0 0 0 0 14 14 14
39008 - 46 46 46 86 86 86 2 2 6 54 54 54
39009 -218 218 218 195 195 195 226 226 226 246 246 246
39010 - 58 58 58 2 2 6 2 2 6 30 30 30
39011 -210 210 210 253 253 253 174 174 174 123 123 123
39012 -221 221 221 234 234 234 74 74 74 2 2 6
39013 - 2 2 6 2 2 6 2 2 6 2 2 6
39014 - 70 70 70 58 58 58 22 22 22 6 6 6
39015 - 0 0 0 0 0 0 0 0 0 0 0 0
39016 - 0 0 0 0 0 0 0 0 0 0 0 0
39017 - 0 0 0 0 0 0 0 0 0 0 0 0
39018 - 0 0 0 0 0 0 0 0 0 0 0 0
39019 - 0 0 0 0 0 0 0 0 0 0 0 0
39020 - 0 0 0 0 0 0 0 0 0 0 0 0
39021 - 0 0 0 0 0 0 0 0 0 0 0 0
39022 - 0 0 0 0 0 0 0 0 0 0 0 0
39023 - 0 0 0 0 0 0 0 0 0 0 0 0
39024 - 0 0 0 0 0 0 0 0 0 0 0 0
39025 - 0 0 0 0 0 0 0 0 0 0 0 0
39026 - 0 0 0 0 0 0 0 0 0 0 0 0
39027 - 0 0 0 0 0 0 0 0 0 14 14 14
39028 - 46 46 46 82 82 82 2 2 6 106 106 106
39029 -170 170 170 26 26 26 86 86 86 226 226 226
39030 -123 123 123 10 10 10 14 14 14 46 46 46
39031 -231 231 231 190 190 190 6 6 6 70 70 70
39032 - 90 90 90 238 238 238 158 158 158 2 2 6
39033 - 2 2 6 2 2 6 2 2 6 2 2 6
39034 - 70 70 70 58 58 58 22 22 22 6 6 6
39035 - 0 0 0 0 0 0 0 0 0 0 0 0
39036 - 0 0 0 0 0 0 0 0 0 0 0 0
39037 - 0 0 0 0 0 0 0 0 0 0 0 0
39038 - 0 0 0 0 0 0 0 0 0 0 0 0
39039 - 0 0 0 0 0 0 0 0 0 0 0 0
39040 - 0 0 0 0 0 0 0 0 0 0 0 0
39041 - 0 0 0 0 0 0 0 0 1 0 0 0
39042 - 0 0 1 0 0 1 0 0 1 0 0 0
39043 - 0 0 0 0 0 0 0 0 0 0 0 0
39044 - 0 0 0 0 0 0 0 0 0 0 0 0
39045 - 0 0 0 0 0 0 0 0 0 0 0 0
39046 - 0 0 0 0 0 0 0 0 0 0 0 0
39047 - 0 0 0 0 0 0 0 0 0 14 14 14
39048 - 42 42 42 86 86 86 6 6 6 116 116 116
39049 -106 106 106 6 6 6 70 70 70 149 149 149
39050 -128 128 128 18 18 18 38 38 38 54 54 54
39051 -221 221 221 106 106 106 2 2 6 14 14 14
39052 - 46 46 46 190 190 190 198 198 198 2 2 6
39053 - 2 2 6 2 2 6 2 2 6 2 2 6
39054 - 74 74 74 62 62 62 22 22 22 6 6 6
39055 - 0 0 0 0 0 0 0 0 0 0 0 0
39056 - 0 0 0 0 0 0 0 0 0 0 0 0
39057 - 0 0 0 0 0 0 0 0 0 0 0 0
39058 - 0 0 0 0 0 0 0 0 0 0 0 0
39059 - 0 0 0 0 0 0 0 0 0 0 0 0
39060 - 0 0 0 0 0 0 0 0 0 0 0 0
39061 - 0 0 0 0 0 0 0 0 1 0 0 0
39062 - 0 0 1 0 0 0 0 0 1 0 0 0
39063 - 0 0 0 0 0 0 0 0 0 0 0 0
39064 - 0 0 0 0 0 0 0 0 0 0 0 0
39065 - 0 0 0 0 0 0 0 0 0 0 0 0
39066 - 0 0 0 0 0 0 0 0 0 0 0 0
39067 - 0 0 0 0 0 0 0 0 0 14 14 14
39068 - 42 42 42 94 94 94 14 14 14 101 101 101
39069 -128 128 128 2 2 6 18 18 18 116 116 116
39070 -118 98 46 121 92 8 121 92 8 98 78 10
39071 -162 162 162 106 106 106 2 2 6 2 2 6
39072 - 2 2 6 195 195 195 195 195 195 6 6 6
39073 - 2 2 6 2 2 6 2 2 6 2 2 6
39074 - 74 74 74 62 62 62 22 22 22 6 6 6
39075 - 0 0 0 0 0 0 0 0 0 0 0 0
39076 - 0 0 0 0 0 0 0 0 0 0 0 0
39077 - 0 0 0 0 0 0 0 0 0 0 0 0
39078 - 0 0 0 0 0 0 0 0 0 0 0 0
39079 - 0 0 0 0 0 0 0 0 0 0 0 0
39080 - 0 0 0 0 0 0 0 0 0 0 0 0
39081 - 0 0 0 0 0 0 0 0 1 0 0 1
39082 - 0 0 1 0 0 0 0 0 1 0 0 0
39083 - 0 0 0 0 0 0 0 0 0 0 0 0
39084 - 0 0 0 0 0 0 0 0 0 0 0 0
39085 - 0 0 0 0 0 0 0 0 0 0 0 0
39086 - 0 0 0 0 0 0 0 0 0 0 0 0
39087 - 0 0 0 0 0 0 0 0 0 10 10 10
39088 - 38 38 38 90 90 90 14 14 14 58 58 58
39089 -210 210 210 26 26 26 54 38 6 154 114 10
39090 -226 170 11 236 186 11 225 175 15 184 144 12
39091 -215 174 15 175 146 61 37 26 9 2 2 6
39092 - 70 70 70 246 246 246 138 138 138 2 2 6
39093 - 2 2 6 2 2 6 2 2 6 2 2 6
39094 - 70 70 70 66 66 66 26 26 26 6 6 6
39095 - 0 0 0 0 0 0 0 0 0 0 0 0
39096 - 0 0 0 0 0 0 0 0 0 0 0 0
39097 - 0 0 0 0 0 0 0 0 0 0 0 0
39098 - 0 0 0 0 0 0 0 0 0 0 0 0
39099 - 0 0 0 0 0 0 0 0 0 0 0 0
39100 - 0 0 0 0 0 0 0 0 0 0 0 0
39101 - 0 0 0 0 0 0 0 0 0 0 0 0
39102 - 0 0 0 0 0 0 0 0 0 0 0 0
39103 - 0 0 0 0 0 0 0 0 0 0 0 0
39104 - 0 0 0 0 0 0 0 0 0 0 0 0
39105 - 0 0 0 0 0 0 0 0 0 0 0 0
39106 - 0 0 0 0 0 0 0 0 0 0 0 0
39107 - 0 0 0 0 0 0 0 0 0 10 10 10
39108 - 38 38 38 86 86 86 14 14 14 10 10 10
39109 -195 195 195 188 164 115 192 133 9 225 175 15
39110 -239 182 13 234 190 10 232 195 16 232 200 30
39111 -245 207 45 241 208 19 232 195 16 184 144 12
39112 -218 194 134 211 206 186 42 42 42 2 2 6
39113 - 2 2 6 2 2 6 2 2 6 2 2 6
39114 - 50 50 50 74 74 74 30 30 30 6 6 6
39115 - 0 0 0 0 0 0 0 0 0 0 0 0
39116 - 0 0 0 0 0 0 0 0 0 0 0 0
39117 - 0 0 0 0 0 0 0 0 0 0 0 0
39118 - 0 0 0 0 0 0 0 0 0 0 0 0
39119 - 0 0 0 0 0 0 0 0 0 0 0 0
39120 - 0 0 0 0 0 0 0 0 0 0 0 0
39121 - 0 0 0 0 0 0 0 0 0 0 0 0
39122 - 0 0 0 0 0 0 0 0 0 0 0 0
39123 - 0 0 0 0 0 0 0 0 0 0 0 0
39124 - 0 0 0 0 0 0 0 0 0 0 0 0
39125 - 0 0 0 0 0 0 0 0 0 0 0 0
39126 - 0 0 0 0 0 0 0 0 0 0 0 0
39127 - 0 0 0 0 0 0 0 0 0 10 10 10
39128 - 34 34 34 86 86 86 14 14 14 2 2 6
39129 -121 87 25 192 133 9 219 162 10 239 182 13
39130 -236 186 11 232 195 16 241 208 19 244 214 54
39131 -246 218 60 246 218 38 246 215 20 241 208 19
39132 -241 208 19 226 184 13 121 87 25 2 2 6
39133 - 2 2 6 2 2 6 2 2 6 2 2 6
39134 - 50 50 50 82 82 82 34 34 34 10 10 10
39135 - 0 0 0 0 0 0 0 0 0 0 0 0
39136 - 0 0 0 0 0 0 0 0 0 0 0 0
39137 - 0 0 0 0 0 0 0 0 0 0 0 0
39138 - 0 0 0 0 0 0 0 0 0 0 0 0
39139 - 0 0 0 0 0 0 0 0 0 0 0 0
39140 - 0 0 0 0 0 0 0 0 0 0 0 0
39141 - 0 0 0 0 0 0 0 0 0 0 0 0
39142 - 0 0 0 0 0 0 0 0 0 0 0 0
39143 - 0 0 0 0 0 0 0 0 0 0 0 0
39144 - 0 0 0 0 0 0 0 0 0 0 0 0
39145 - 0 0 0 0 0 0 0 0 0 0 0 0
39146 - 0 0 0 0 0 0 0 0 0 0 0 0
39147 - 0 0 0 0 0 0 0 0 0 10 10 10
39148 - 34 34 34 82 82 82 30 30 30 61 42 6
39149 -180 123 7 206 145 10 230 174 11 239 182 13
39150 -234 190 10 238 202 15 241 208 19 246 218 74
39151 -246 218 38 246 215 20 246 215 20 246 215 20
39152 -226 184 13 215 174 15 184 144 12 6 6 6
39153 - 2 2 6 2 2 6 2 2 6 2 2 6
39154 - 26 26 26 94 94 94 42 42 42 14 14 14
39155 - 0 0 0 0 0 0 0 0 0 0 0 0
39156 - 0 0 0 0 0 0 0 0 0 0 0 0
39157 - 0 0 0 0 0 0 0 0 0 0 0 0
39158 - 0 0 0 0 0 0 0 0 0 0 0 0
39159 - 0 0 0 0 0 0 0 0 0 0 0 0
39160 - 0 0 0 0 0 0 0 0 0 0 0 0
39161 - 0 0 0 0 0 0 0 0 0 0 0 0
39162 - 0 0 0 0 0 0 0 0 0 0 0 0
39163 - 0 0 0 0 0 0 0 0 0 0 0 0
39164 - 0 0 0 0 0 0 0 0 0 0 0 0
39165 - 0 0 0 0 0 0 0 0 0 0 0 0
39166 - 0 0 0 0 0 0 0 0 0 0 0 0
39167 - 0 0 0 0 0 0 0 0 0 10 10 10
39168 - 30 30 30 78 78 78 50 50 50 104 69 6
39169 -192 133 9 216 158 10 236 178 12 236 186 11
39170 -232 195 16 241 208 19 244 214 54 245 215 43
39171 -246 215 20 246 215 20 241 208 19 198 155 10
39172 -200 144 11 216 158 10 156 118 10 2 2 6
39173 - 2 2 6 2 2 6 2 2 6 2 2 6
39174 - 6 6 6 90 90 90 54 54 54 18 18 18
39175 - 6 6 6 0 0 0 0 0 0 0 0 0
39176 - 0 0 0 0 0 0 0 0 0 0 0 0
39177 - 0 0 0 0 0 0 0 0 0 0 0 0
39178 - 0 0 0 0 0 0 0 0 0 0 0 0
39179 - 0 0 0 0 0 0 0 0 0 0 0 0
39180 - 0 0 0 0 0 0 0 0 0 0 0 0
39181 - 0 0 0 0 0 0 0 0 0 0 0 0
39182 - 0 0 0 0 0 0 0 0 0 0 0 0
39183 - 0 0 0 0 0 0 0 0 0 0 0 0
39184 - 0 0 0 0 0 0 0 0 0 0 0 0
39185 - 0 0 0 0 0 0 0 0 0 0 0 0
39186 - 0 0 0 0 0 0 0 0 0 0 0 0
39187 - 0 0 0 0 0 0 0 0 0 10 10 10
39188 - 30 30 30 78 78 78 46 46 46 22 22 22
39189 -137 92 6 210 162 10 239 182 13 238 190 10
39190 -238 202 15 241 208 19 246 215 20 246 215 20
39191 -241 208 19 203 166 17 185 133 11 210 150 10
39192 -216 158 10 210 150 10 102 78 10 2 2 6
39193 - 6 6 6 54 54 54 14 14 14 2 2 6
39194 - 2 2 6 62 62 62 74 74 74 30 30 30
39195 - 10 10 10 0 0 0 0 0 0 0 0 0
39196 - 0 0 0 0 0 0 0 0 0 0 0 0
39197 - 0 0 0 0 0 0 0 0 0 0 0 0
39198 - 0 0 0 0 0 0 0 0 0 0 0 0
39199 - 0 0 0 0 0 0 0 0 0 0 0 0
39200 - 0 0 0 0 0 0 0 0 0 0 0 0
39201 - 0 0 0 0 0 0 0 0 0 0 0 0
39202 - 0 0 0 0 0 0 0 0 0 0 0 0
39203 - 0 0 0 0 0 0 0 0 0 0 0 0
39204 - 0 0 0 0 0 0 0 0 0 0 0 0
39205 - 0 0 0 0 0 0 0 0 0 0 0 0
39206 - 0 0 0 0 0 0 0 0 0 0 0 0
39207 - 0 0 0 0 0 0 0 0 0 10 10 10
39208 - 34 34 34 78 78 78 50 50 50 6 6 6
39209 - 94 70 30 139 102 15 190 146 13 226 184 13
39210 -232 200 30 232 195 16 215 174 15 190 146 13
39211 -168 122 10 192 133 9 210 150 10 213 154 11
39212 -202 150 34 182 157 106 101 98 89 2 2 6
39213 - 2 2 6 78 78 78 116 116 116 58 58 58
39214 - 2 2 6 22 22 22 90 90 90 46 46 46
39215 - 18 18 18 6 6 6 0 0 0 0 0 0
39216 - 0 0 0 0 0 0 0 0 0 0 0 0
39217 - 0 0 0 0 0 0 0 0 0 0 0 0
39218 - 0 0 0 0 0 0 0 0 0 0 0 0
39219 - 0 0 0 0 0 0 0 0 0 0 0 0
39220 - 0 0 0 0 0 0 0 0 0 0 0 0
39221 - 0 0 0 0 0 0 0 0 0 0 0 0
39222 - 0 0 0 0 0 0 0 0 0 0 0 0
39223 - 0 0 0 0 0 0 0 0 0 0 0 0
39224 - 0 0 0 0 0 0 0 0 0 0 0 0
39225 - 0 0 0 0 0 0 0 0 0 0 0 0
39226 - 0 0 0 0 0 0 0 0 0 0 0 0
39227 - 0 0 0 0 0 0 0 0 0 10 10 10
39228 - 38 38 38 86 86 86 50 50 50 6 6 6
39229 -128 128 128 174 154 114 156 107 11 168 122 10
39230 -198 155 10 184 144 12 197 138 11 200 144 11
39231 -206 145 10 206 145 10 197 138 11 188 164 115
39232 -195 195 195 198 198 198 174 174 174 14 14 14
39233 - 2 2 6 22 22 22 116 116 116 116 116 116
39234 - 22 22 22 2 2 6 74 74 74 70 70 70
39235 - 30 30 30 10 10 10 0 0 0 0 0 0
39236 - 0 0 0 0 0 0 0 0 0 0 0 0
39237 - 0 0 0 0 0 0 0 0 0 0 0 0
39238 - 0 0 0 0 0 0 0 0 0 0 0 0
39239 - 0 0 0 0 0 0 0 0 0 0 0 0
39240 - 0 0 0 0 0 0 0 0 0 0 0 0
39241 - 0 0 0 0 0 0 0 0 0 0 0 0
39242 - 0 0 0 0 0 0 0 0 0 0 0 0
39243 - 0 0 0 0 0 0 0 0 0 0 0 0
39244 - 0 0 0 0 0 0 0 0 0 0 0 0
39245 - 0 0 0 0 0 0 0 0 0 0 0 0
39246 - 0 0 0 0 0 0 0 0 0 0 0 0
39247 - 0 0 0 0 0 0 6 6 6 18 18 18
39248 - 50 50 50 101 101 101 26 26 26 10 10 10
39249 -138 138 138 190 190 190 174 154 114 156 107 11
39250 -197 138 11 200 144 11 197 138 11 192 133 9
39251 -180 123 7 190 142 34 190 178 144 187 187 187
39252 -202 202 202 221 221 221 214 214 214 66 66 66
39253 - 2 2 6 2 2 6 50 50 50 62 62 62
39254 - 6 6 6 2 2 6 10 10 10 90 90 90
39255 - 50 50 50 18 18 18 6 6 6 0 0 0
39256 - 0 0 0 0 0 0 0 0 0 0 0 0
39257 - 0 0 0 0 0 0 0 0 0 0 0 0
39258 - 0 0 0 0 0 0 0 0 0 0 0 0
39259 - 0 0 0 0 0 0 0 0 0 0 0 0
39260 - 0 0 0 0 0 0 0 0 0 0 0 0
39261 - 0 0 0 0 0 0 0 0 0 0 0 0
39262 - 0 0 0 0 0 0 0 0 0 0 0 0
39263 - 0 0 0 0 0 0 0 0 0 0 0 0
39264 - 0 0 0 0 0 0 0 0 0 0 0 0
39265 - 0 0 0 0 0 0 0 0 0 0 0 0
39266 - 0 0 0 0 0 0 0 0 0 0 0 0
39267 - 0 0 0 0 0 0 10 10 10 34 34 34
39268 - 74 74 74 74 74 74 2 2 6 6 6 6
39269 -144 144 144 198 198 198 190 190 190 178 166 146
39270 -154 121 60 156 107 11 156 107 11 168 124 44
39271 -174 154 114 187 187 187 190 190 190 210 210 210
39272 -246 246 246 253 253 253 253 253 253 182 182 182
39273 - 6 6 6 2 2 6 2 2 6 2 2 6
39274 - 2 2 6 2 2 6 2 2 6 62 62 62
39275 - 74 74 74 34 34 34 14 14 14 0 0 0
39276 - 0 0 0 0 0 0 0 0 0 0 0 0
39277 - 0 0 0 0 0 0 0 0 0 0 0 0
39278 - 0 0 0 0 0 0 0 0 0 0 0 0
39279 - 0 0 0 0 0 0 0 0 0 0 0 0
39280 - 0 0 0 0 0 0 0 0 0 0 0 0
39281 - 0 0 0 0 0 0 0 0 0 0 0 0
39282 - 0 0 0 0 0 0 0 0 0 0 0 0
39283 - 0 0 0 0 0 0 0 0 0 0 0 0
39284 - 0 0 0 0 0 0 0 0 0 0 0 0
39285 - 0 0 0 0 0 0 0 0 0 0 0 0
39286 - 0 0 0 0 0 0 0 0 0 0 0 0
39287 - 0 0 0 10 10 10 22 22 22 54 54 54
39288 - 94 94 94 18 18 18 2 2 6 46 46 46
39289 -234 234 234 221 221 221 190 190 190 190 190 190
39290 -190 190 190 187 187 187 187 187 187 190 190 190
39291 -190 190 190 195 195 195 214 214 214 242 242 242
39292 -253 253 253 253 253 253 253 253 253 253 253 253
39293 - 82 82 82 2 2 6 2 2 6 2 2 6
39294 - 2 2 6 2 2 6 2 2 6 14 14 14
39295 - 86 86 86 54 54 54 22 22 22 6 6 6
39296 - 0 0 0 0 0 0 0 0 0 0 0 0
39297 - 0 0 0 0 0 0 0 0 0 0 0 0
39298 - 0 0 0 0 0 0 0 0 0 0 0 0
39299 - 0 0 0 0 0 0 0 0 0 0 0 0
39300 - 0 0 0 0 0 0 0 0 0 0 0 0
39301 - 0 0 0 0 0 0 0 0 0 0 0 0
39302 - 0 0 0 0 0 0 0 0 0 0 0 0
39303 - 0 0 0 0 0 0 0 0 0 0 0 0
39304 - 0 0 0 0 0 0 0 0 0 0 0 0
39305 - 0 0 0 0 0 0 0 0 0 0 0 0
39306 - 0 0 0 0 0 0 0 0 0 0 0 0
39307 - 6 6 6 18 18 18 46 46 46 90 90 90
39308 - 46 46 46 18 18 18 6 6 6 182 182 182
39309 -253 253 253 246 246 246 206 206 206 190 190 190
39310 -190 190 190 190 190 190 190 190 190 190 190 190
39311 -206 206 206 231 231 231 250 250 250 253 253 253
39312 -253 253 253 253 253 253 253 253 253 253 253 253
39313 -202 202 202 14 14 14 2 2 6 2 2 6
39314 - 2 2 6 2 2 6 2 2 6 2 2 6
39315 - 42 42 42 86 86 86 42 42 42 18 18 18
39316 - 6 6 6 0 0 0 0 0 0 0 0 0
39317 - 0 0 0 0 0 0 0 0 0 0 0 0
39318 - 0 0 0 0 0 0 0 0 0 0 0 0
39319 - 0 0 0 0 0 0 0 0 0 0 0 0
39320 - 0 0 0 0 0 0 0 0 0 0 0 0
39321 - 0 0 0 0 0 0 0 0 0 0 0 0
39322 - 0 0 0 0 0 0 0 0 0 0 0 0
39323 - 0 0 0 0 0 0 0 0 0 0 0 0
39324 - 0 0 0 0 0 0 0 0 0 0 0 0
39325 - 0 0 0 0 0 0 0 0 0 0 0 0
39326 - 0 0 0 0 0 0 0 0 0 6 6 6
39327 - 14 14 14 38 38 38 74 74 74 66 66 66
39328 - 2 2 6 6 6 6 90 90 90 250 250 250
39329 -253 253 253 253 253 253 238 238 238 198 198 198
39330 -190 190 190 190 190 190 195 195 195 221 221 221
39331 -246 246 246 253 253 253 253 253 253 253 253 253
39332 -253 253 253 253 253 253 253 253 253 253 253 253
39333 -253 253 253 82 82 82 2 2 6 2 2 6
39334 - 2 2 6 2 2 6 2 2 6 2 2 6
39335 - 2 2 6 78 78 78 70 70 70 34 34 34
39336 - 14 14 14 6 6 6 0 0 0 0 0 0
39337 - 0 0 0 0 0 0 0 0 0 0 0 0
39338 - 0 0 0 0 0 0 0 0 0 0 0 0
39339 - 0 0 0 0 0 0 0 0 0 0 0 0
39340 - 0 0 0 0 0 0 0 0 0 0 0 0
39341 - 0 0 0 0 0 0 0 0 0 0 0 0
39342 - 0 0 0 0 0 0 0 0 0 0 0 0
39343 - 0 0 0 0 0 0 0 0 0 0 0 0
39344 - 0 0 0 0 0 0 0 0 0 0 0 0
39345 - 0 0 0 0 0 0 0 0 0 0 0 0
39346 - 0 0 0 0 0 0 0 0 0 14 14 14
39347 - 34 34 34 66 66 66 78 78 78 6 6 6
39348 - 2 2 6 18 18 18 218 218 218 253 253 253
39349 -253 253 253 253 253 253 253 253 253 246 246 246
39350 -226 226 226 231 231 231 246 246 246 253 253 253
39351 -253 253 253 253 253 253 253 253 253 253 253 253
39352 -253 253 253 253 253 253 253 253 253 253 253 253
39353 -253 253 253 178 178 178 2 2 6 2 2 6
39354 - 2 2 6 2 2 6 2 2 6 2 2 6
39355 - 2 2 6 18 18 18 90 90 90 62 62 62
39356 - 30 30 30 10 10 10 0 0 0 0 0 0
39357 - 0 0 0 0 0 0 0 0 0 0 0 0
39358 - 0 0 0 0 0 0 0 0 0 0 0 0
39359 - 0 0 0 0 0 0 0 0 0 0 0 0
39360 - 0 0 0 0 0 0 0 0 0 0 0 0
39361 - 0 0 0 0 0 0 0 0 0 0 0 0
39362 - 0 0 0 0 0 0 0 0 0 0 0 0
39363 - 0 0 0 0 0 0 0 0 0 0 0 0
39364 - 0 0 0 0 0 0 0 0 0 0 0 0
39365 - 0 0 0 0 0 0 0 0 0 0 0 0
39366 - 0 0 0 0 0 0 10 10 10 26 26 26
39367 - 58 58 58 90 90 90 18 18 18 2 2 6
39368 - 2 2 6 110 110 110 253 253 253 253 253 253
39369 -253 253 253 253 253 253 253 253 253 253 253 253
39370 -250 250 250 253 253 253 253 253 253 253 253 253
39371 -253 253 253 253 253 253 253 253 253 253 253 253
39372 -253 253 253 253 253 253 253 253 253 253 253 253
39373 -253 253 253 231 231 231 18 18 18 2 2 6
39374 - 2 2 6 2 2 6 2 2 6 2 2 6
39375 - 2 2 6 2 2 6 18 18 18 94 94 94
39376 - 54 54 54 26 26 26 10 10 10 0 0 0
39377 - 0 0 0 0 0 0 0 0 0 0 0 0
39378 - 0 0 0 0 0 0 0 0 0 0 0 0
39379 - 0 0 0 0 0 0 0 0 0 0 0 0
39380 - 0 0 0 0 0 0 0 0 0 0 0 0
39381 - 0 0 0 0 0 0 0 0 0 0 0 0
39382 - 0 0 0 0 0 0 0 0 0 0 0 0
39383 - 0 0 0 0 0 0 0 0 0 0 0 0
39384 - 0 0 0 0 0 0 0 0 0 0 0 0
39385 - 0 0 0 0 0 0 0 0 0 0 0 0
39386 - 0 0 0 6 6 6 22 22 22 50 50 50
39387 - 90 90 90 26 26 26 2 2 6 2 2 6
39388 - 14 14 14 195 195 195 250 250 250 253 253 253
39389 -253 253 253 253 253 253 253 253 253 253 253 253
39390 -253 253 253 253 253 253 253 253 253 253 253 253
39391 -253 253 253 253 253 253 253 253 253 253 253 253
39392 -253 253 253 253 253 253 253 253 253 253 253 253
39393 -250 250 250 242 242 242 54 54 54 2 2 6
39394 - 2 2 6 2 2 6 2 2 6 2 2 6
39395 - 2 2 6 2 2 6 2 2 6 38 38 38
39396 - 86 86 86 50 50 50 22 22 22 6 6 6
39397 - 0 0 0 0 0 0 0 0 0 0 0 0
39398 - 0 0 0 0 0 0 0 0 0 0 0 0
39399 - 0 0 0 0 0 0 0 0 0 0 0 0
39400 - 0 0 0 0 0 0 0 0 0 0 0 0
39401 - 0 0 0 0 0 0 0 0 0 0 0 0
39402 - 0 0 0 0 0 0 0 0 0 0 0 0
39403 - 0 0 0 0 0 0 0 0 0 0 0 0
39404 - 0 0 0 0 0 0 0 0 0 0 0 0
39405 - 0 0 0 0 0 0 0 0 0 0 0 0
39406 - 6 6 6 14 14 14 38 38 38 82 82 82
39407 - 34 34 34 2 2 6 2 2 6 2 2 6
39408 - 42 42 42 195 195 195 246 246 246 253 253 253
39409 -253 253 253 253 253 253 253 253 253 250 250 250
39410 -242 242 242 242 242 242 250 250 250 253 253 253
39411 -253 253 253 253 253 253 253 253 253 253 253 253
39412 -253 253 253 250 250 250 246 246 246 238 238 238
39413 -226 226 226 231 231 231 101 101 101 6 6 6
39414 - 2 2 6 2 2 6 2 2 6 2 2 6
39415 - 2 2 6 2 2 6 2 2 6 2 2 6
39416 - 38 38 38 82 82 82 42 42 42 14 14 14
39417 - 6 6 6 0 0 0 0 0 0 0 0 0
39418 - 0 0 0 0 0 0 0 0 0 0 0 0
39419 - 0 0 0 0 0 0 0 0 0 0 0 0
39420 - 0 0 0 0 0 0 0 0 0 0 0 0
39421 - 0 0 0 0 0 0 0 0 0 0 0 0
39422 - 0 0 0 0 0 0 0 0 0 0 0 0
39423 - 0 0 0 0 0 0 0 0 0 0 0 0
39424 - 0 0 0 0 0 0 0 0 0 0 0 0
39425 - 0 0 0 0 0 0 0 0 0 0 0 0
39426 - 10 10 10 26 26 26 62 62 62 66 66 66
39427 - 2 2 6 2 2 6 2 2 6 6 6 6
39428 - 70 70 70 170 170 170 206 206 206 234 234 234
39429 -246 246 246 250 250 250 250 250 250 238 238 238
39430 -226 226 226 231 231 231 238 238 238 250 250 250
39431 -250 250 250 250 250 250 246 246 246 231 231 231
39432 -214 214 214 206 206 206 202 202 202 202 202 202
39433 -198 198 198 202 202 202 182 182 182 18 18 18
39434 - 2 2 6 2 2 6 2 2 6 2 2 6
39435 - 2 2 6 2 2 6 2 2 6 2 2 6
39436 - 2 2 6 62 62 62 66 66 66 30 30 30
39437 - 10 10 10 0 0 0 0 0 0 0 0 0
39438 - 0 0 0 0 0 0 0 0 0 0 0 0
39439 - 0 0 0 0 0 0 0 0 0 0 0 0
39440 - 0 0 0 0 0 0 0 0 0 0 0 0
39441 - 0 0 0 0 0 0 0 0 0 0 0 0
39442 - 0 0 0 0 0 0 0 0 0 0 0 0
39443 - 0 0 0 0 0 0 0 0 0 0 0 0
39444 - 0 0 0 0 0 0 0 0 0 0 0 0
39445 - 0 0 0 0 0 0 0 0 0 0 0 0
39446 - 14 14 14 42 42 42 82 82 82 18 18 18
39447 - 2 2 6 2 2 6 2 2 6 10 10 10
39448 - 94 94 94 182 182 182 218 218 218 242 242 242
39449 -250 250 250 253 253 253 253 253 253 250 250 250
39450 -234 234 234 253 253 253 253 253 253 253 253 253
39451 -253 253 253 253 253 253 253 253 253 246 246 246
39452 -238 238 238 226 226 226 210 210 210 202 202 202
39453 -195 195 195 195 195 195 210 210 210 158 158 158
39454 - 6 6 6 14 14 14 50 50 50 14 14 14
39455 - 2 2 6 2 2 6 2 2 6 2 2 6
39456 - 2 2 6 6 6 6 86 86 86 46 46 46
39457 - 18 18 18 6 6 6 0 0 0 0 0 0
39458 - 0 0 0 0 0 0 0 0 0 0 0 0
39459 - 0 0 0 0 0 0 0 0 0 0 0 0
39460 - 0 0 0 0 0 0 0 0 0 0 0 0
39461 - 0 0 0 0 0 0 0 0 0 0 0 0
39462 - 0 0 0 0 0 0 0 0 0 0 0 0
39463 - 0 0 0 0 0 0 0 0 0 0 0 0
39464 - 0 0 0 0 0 0 0 0 0 0 0 0
39465 - 0 0 0 0 0 0 0 0 0 6 6 6
39466 - 22 22 22 54 54 54 70 70 70 2 2 6
39467 - 2 2 6 10 10 10 2 2 6 22 22 22
39468 -166 166 166 231 231 231 250 250 250 253 253 253
39469 -253 253 253 253 253 253 253 253 253 250 250 250
39470 -242 242 242 253 253 253 253 253 253 253 253 253
39471 -253 253 253 253 253 253 253 253 253 253 253 253
39472 -253 253 253 253 253 253 253 253 253 246 246 246
39473 -231 231 231 206 206 206 198 198 198 226 226 226
39474 - 94 94 94 2 2 6 6 6 6 38 38 38
39475 - 30 30 30 2 2 6 2 2 6 2 2 6
39476 - 2 2 6 2 2 6 62 62 62 66 66 66
39477 - 26 26 26 10 10 10 0 0 0 0 0 0
39478 - 0 0 0 0 0 0 0 0 0 0 0 0
39479 - 0 0 0 0 0 0 0 0 0 0 0 0
39480 - 0 0 0 0 0 0 0 0 0 0 0 0
39481 - 0 0 0 0 0 0 0 0 0 0 0 0
39482 - 0 0 0 0 0 0 0 0 0 0 0 0
39483 - 0 0 0 0 0 0 0 0 0 0 0 0
39484 - 0 0 0 0 0 0 0 0 0 0 0 0
39485 - 0 0 0 0 0 0 0 0 0 10 10 10
39486 - 30 30 30 74 74 74 50 50 50 2 2 6
39487 - 26 26 26 26 26 26 2 2 6 106 106 106
39488 -238 238 238 253 253 253 253 253 253 253 253 253
39489 -253 253 253 253 253 253 253 253 253 253 253 253
39490 -253 253 253 253 253 253 253 253 253 253 253 253
39491 -253 253 253 253 253 253 253 253 253 253 253 253
39492 -253 253 253 253 253 253 253 253 253 253 253 253
39493 -253 253 253 246 246 246 218 218 218 202 202 202
39494 -210 210 210 14 14 14 2 2 6 2 2 6
39495 - 30 30 30 22 22 22 2 2 6 2 2 6
39496 - 2 2 6 2 2 6 18 18 18 86 86 86
39497 - 42 42 42 14 14 14 0 0 0 0 0 0
39498 - 0 0 0 0 0 0 0 0 0 0 0 0
39499 - 0 0 0 0 0 0 0 0 0 0 0 0
39500 - 0 0 0 0 0 0 0 0 0 0 0 0
39501 - 0 0 0 0 0 0 0 0 0 0 0 0
39502 - 0 0 0 0 0 0 0 0 0 0 0 0
39503 - 0 0 0 0 0 0 0 0 0 0 0 0
39504 - 0 0 0 0 0 0 0 0 0 0 0 0
39505 - 0 0 0 0 0 0 0 0 0 14 14 14
39506 - 42 42 42 90 90 90 22 22 22 2 2 6
39507 - 42 42 42 2 2 6 18 18 18 218 218 218
39508 -253 253 253 253 253 253 253 253 253 253 253 253
39509 -253 253 253 253 253 253 253 253 253 253 253 253
39510 -253 253 253 253 253 253 253 253 253 253 253 253
39511 -253 253 253 253 253 253 253 253 253 253 253 253
39512 -253 253 253 253 253 253 253 253 253 253 253 253
39513 -253 253 253 253 253 253 250 250 250 221 221 221
39514 -218 218 218 101 101 101 2 2 6 14 14 14
39515 - 18 18 18 38 38 38 10 10 10 2 2 6
39516 - 2 2 6 2 2 6 2 2 6 78 78 78
39517 - 58 58 58 22 22 22 6 6 6 0 0 0
39518 - 0 0 0 0 0 0 0 0 0 0 0 0
39519 - 0 0 0 0 0 0 0 0 0 0 0 0
39520 - 0 0 0 0 0 0 0 0 0 0 0 0
39521 - 0 0 0 0 0 0 0 0 0 0 0 0
39522 - 0 0 0 0 0 0 0 0 0 0 0 0
39523 - 0 0 0 0 0 0 0 0 0 0 0 0
39524 - 0 0 0 0 0 0 0 0 0 0 0 0
39525 - 0 0 0 0 0 0 6 6 6 18 18 18
39526 - 54 54 54 82 82 82 2 2 6 26 26 26
39527 - 22 22 22 2 2 6 123 123 123 253 253 253
39528 -253 253 253 253 253 253 253 253 253 253 253 253
39529 -253 253 253 253 253 253 253 253 253 253 253 253
39530 -253 253 253 253 253 253 253 253 253 253 253 253
39531 -253 253 253 253 253 253 253 253 253 253 253 253
39532 -253 253 253 253 253 253 253 253 253 253 253 253
39533 -253 253 253 253 253 253 253 253 253 250 250 250
39534 -238 238 238 198 198 198 6 6 6 38 38 38
39535 - 58 58 58 26 26 26 38 38 38 2 2 6
39536 - 2 2 6 2 2 6 2 2 6 46 46 46
39537 - 78 78 78 30 30 30 10 10 10 0 0 0
39538 - 0 0 0 0 0 0 0 0 0 0 0 0
39539 - 0 0 0 0 0 0 0 0 0 0 0 0
39540 - 0 0 0 0 0 0 0 0 0 0 0 0
39541 - 0 0 0 0 0 0 0 0 0 0 0 0
39542 - 0 0 0 0 0 0 0 0 0 0 0 0
39543 - 0 0 0 0 0 0 0 0 0 0 0 0
39544 - 0 0 0 0 0 0 0 0 0 0 0 0
39545 - 0 0 0 0 0 0 10 10 10 30 30 30
39546 - 74 74 74 58 58 58 2 2 6 42 42 42
39547 - 2 2 6 22 22 22 231 231 231 253 253 253
39548 -253 253 253 253 253 253 253 253 253 253 253 253
39549 -253 253 253 253 253 253 253 253 253 250 250 250
39550 -253 253 253 253 253 253 253 253 253 253 253 253
39551 -253 253 253 253 253 253 253 253 253 253 253 253
39552 -253 253 253 253 253 253 253 253 253 253 253 253
39553 -253 253 253 253 253 253 253 253 253 253 253 253
39554 -253 253 253 246 246 246 46 46 46 38 38 38
39555 - 42 42 42 14 14 14 38 38 38 14 14 14
39556 - 2 2 6 2 2 6 2 2 6 6 6 6
39557 - 86 86 86 46 46 46 14 14 14 0 0 0
39558 - 0 0 0 0 0 0 0 0 0 0 0 0
39559 - 0 0 0 0 0 0 0 0 0 0 0 0
39560 - 0 0 0 0 0 0 0 0 0 0 0 0
39561 - 0 0 0 0 0 0 0 0 0 0 0 0
39562 - 0 0 0 0 0 0 0 0 0 0 0 0
39563 - 0 0 0 0 0 0 0 0 0 0 0 0
39564 - 0 0 0 0 0 0 0 0 0 0 0 0
39565 - 0 0 0 6 6 6 14 14 14 42 42 42
39566 - 90 90 90 18 18 18 18 18 18 26 26 26
39567 - 2 2 6 116 116 116 253 253 253 253 253 253
39568 -253 253 253 253 253 253 253 253 253 253 253 253
39569 -253 253 253 253 253 253 250 250 250 238 238 238
39570 -253 253 253 253 253 253 253 253 253 253 253 253
39571 -253 253 253 253 253 253 253 253 253 253 253 253
39572 -253 253 253 253 253 253 253 253 253 253 253 253
39573 -253 253 253 253 253 253 253 253 253 253 253 253
39574 -253 253 253 253 253 253 94 94 94 6 6 6
39575 - 2 2 6 2 2 6 10 10 10 34 34 34
39576 - 2 2 6 2 2 6 2 2 6 2 2 6
39577 - 74 74 74 58 58 58 22 22 22 6 6 6
39578 - 0 0 0 0 0 0 0 0 0 0 0 0
39579 - 0 0 0 0 0 0 0 0 0 0 0 0
39580 - 0 0 0 0 0 0 0 0 0 0 0 0
39581 - 0 0 0 0 0 0 0 0 0 0 0 0
39582 - 0 0 0 0 0 0 0 0 0 0 0 0
39583 - 0 0 0 0 0 0 0 0 0 0 0 0
39584 - 0 0 0 0 0 0 0 0 0 0 0 0
39585 - 0 0 0 10 10 10 26 26 26 66 66 66
39586 - 82 82 82 2 2 6 38 38 38 6 6 6
39587 - 14 14 14 210 210 210 253 253 253 253 253 253
39588 -253 253 253 253 253 253 253 253 253 253 253 253
39589 -253 253 253 253 253 253 246 246 246 242 242 242
39590 -253 253 253 253 253 253 253 253 253 253 253 253
39591 -253 253 253 253 253 253 253 253 253 253 253 253
39592 -253 253 253 253 253 253 253 253 253 253 253 253
39593 -253 253 253 253 253 253 253 253 253 253 253 253
39594 -253 253 253 253 253 253 144 144 144 2 2 6
39595 - 2 2 6 2 2 6 2 2 6 46 46 46
39596 - 2 2 6 2 2 6 2 2 6 2 2 6
39597 - 42 42 42 74 74 74 30 30 30 10 10 10
39598 - 0 0 0 0 0 0 0 0 0 0 0 0
39599 - 0 0 0 0 0 0 0 0 0 0 0 0
39600 - 0 0 0 0 0 0 0 0 0 0 0 0
39601 - 0 0 0 0 0 0 0 0 0 0 0 0
39602 - 0 0 0 0 0 0 0 0 0 0 0 0
39603 - 0 0 0 0 0 0 0 0 0 0 0 0
39604 - 0 0 0 0 0 0 0 0 0 0 0 0
39605 - 6 6 6 14 14 14 42 42 42 90 90 90
39606 - 26 26 26 6 6 6 42 42 42 2 2 6
39607 - 74 74 74 250 250 250 253 253 253 253 253 253
39608 -253 253 253 253 253 253 253 253 253 253 253 253
39609 -253 253 253 253 253 253 242 242 242 242 242 242
39610 -253 253 253 253 253 253 253 253 253 253 253 253
39611 -253 253 253 253 253 253 253 253 253 253 253 253
39612 -253 253 253 253 253 253 253 253 253 253 253 253
39613 -253 253 253 253 253 253 253 253 253 253 253 253
39614 -253 253 253 253 253 253 182 182 182 2 2 6
39615 - 2 2 6 2 2 6 2 2 6 46 46 46
39616 - 2 2 6 2 2 6 2 2 6 2 2 6
39617 - 10 10 10 86 86 86 38 38 38 10 10 10
39618 - 0 0 0 0 0 0 0 0 0 0 0 0
39619 - 0 0 0 0 0 0 0 0 0 0 0 0
39620 - 0 0 0 0 0 0 0 0 0 0 0 0
39621 - 0 0 0 0 0 0 0 0 0 0 0 0
39622 - 0 0 0 0 0 0 0 0 0 0 0 0
39623 - 0 0 0 0 0 0 0 0 0 0 0 0
39624 - 0 0 0 0 0 0 0 0 0 0 0 0
39625 - 10 10 10 26 26 26 66 66 66 82 82 82
39626 - 2 2 6 22 22 22 18 18 18 2 2 6
39627 -149 149 149 253 253 253 253 253 253 253 253 253
39628 -253 253 253 253 253 253 253 253 253 253 253 253
39629 -253 253 253 253 253 253 234 234 234 242 242 242
39630 -253 253 253 253 253 253 253 253 253 253 253 253
39631 -253 253 253 253 253 253 253 253 253 253 253 253
39632 -253 253 253 253 253 253 253 253 253 253 253 253
39633 -253 253 253 253 253 253 253 253 253 253 253 253
39634 -253 253 253 253 253 253 206 206 206 2 2 6
39635 - 2 2 6 2 2 6 2 2 6 38 38 38
39636 - 2 2 6 2 2 6 2 2 6 2 2 6
39637 - 6 6 6 86 86 86 46 46 46 14 14 14
39638 - 0 0 0 0 0 0 0 0 0 0 0 0
39639 - 0 0 0 0 0 0 0 0 0 0 0 0
39640 - 0 0 0 0 0 0 0 0 0 0 0 0
39641 - 0 0 0 0 0 0 0 0 0 0 0 0
39642 - 0 0 0 0 0 0 0 0 0 0 0 0
39643 - 0 0 0 0 0 0 0 0 0 0 0 0
39644 - 0 0 0 0 0 0 0 0 0 6 6 6
39645 - 18 18 18 46 46 46 86 86 86 18 18 18
39646 - 2 2 6 34 34 34 10 10 10 6 6 6
39647 -210 210 210 253 253 253 253 253 253 253 253 253
39648 -253 253 253 253 253 253 253 253 253 253 253 253
39649 -253 253 253 253 253 253 234 234 234 242 242 242
39650 -253 253 253 253 253 253 253 253 253 253 253 253
39651 -253 253 253 253 253 253 253 253 253 253 253 253
39652 -253 253 253 253 253 253 253 253 253 253 253 253
39653 -253 253 253 253 253 253 253 253 253 253 253 253
39654 -253 253 253 253 253 253 221 221 221 6 6 6
39655 - 2 2 6 2 2 6 6 6 6 30 30 30
39656 - 2 2 6 2 2 6 2 2 6 2 2 6
39657 - 2 2 6 82 82 82 54 54 54 18 18 18
39658 - 6 6 6 0 0 0 0 0 0 0 0 0
39659 - 0 0 0 0 0 0 0 0 0 0 0 0
39660 - 0 0 0 0 0 0 0 0 0 0 0 0
39661 - 0 0 0 0 0 0 0 0 0 0 0 0
39662 - 0 0 0 0 0 0 0 0 0 0 0 0
39663 - 0 0 0 0 0 0 0 0 0 0 0 0
39664 - 0 0 0 0 0 0 0 0 0 10 10 10
39665 - 26 26 26 66 66 66 62 62 62 2 2 6
39666 - 2 2 6 38 38 38 10 10 10 26 26 26
39667 -238 238 238 253 253 253 253 253 253 253 253 253
39668 -253 253 253 253 253 253 253 253 253 253 253 253
39669 -253 253 253 253 253 253 231 231 231 238 238 238
39670 -253 253 253 253 253 253 253 253 253 253 253 253
39671 -253 253 253 253 253 253 253 253 253 253 253 253
39672 -253 253 253 253 253 253 253 253 253 253 253 253
39673 -253 253 253 253 253 253 253 253 253 253 253 253
39674 -253 253 253 253 253 253 231 231 231 6 6 6
39675 - 2 2 6 2 2 6 10 10 10 30 30 30
39676 - 2 2 6 2 2 6 2 2 6 2 2 6
39677 - 2 2 6 66 66 66 58 58 58 22 22 22
39678 - 6 6 6 0 0 0 0 0 0 0 0 0
39679 - 0 0 0 0 0 0 0 0 0 0 0 0
39680 - 0 0 0 0 0 0 0 0 0 0 0 0
39681 - 0 0 0 0 0 0 0 0 0 0 0 0
39682 - 0 0 0 0 0 0 0 0 0 0 0 0
39683 - 0 0 0 0 0 0 0 0 0 0 0 0
39684 - 0 0 0 0 0 0 0 0 0 10 10 10
39685 - 38 38 38 78 78 78 6 6 6 2 2 6
39686 - 2 2 6 46 46 46 14 14 14 42 42 42
39687 -246 246 246 253 253 253 253 253 253 253 253 253
39688 -253 253 253 253 253 253 253 253 253 253 253 253
39689 -253 253 253 253 253 253 231 231 231 242 242 242
39690 -253 253 253 253 253 253 253 253 253 253 253 253
39691 -253 253 253 253 253 253 253 253 253 253 253 253
39692 -253 253 253 253 253 253 253 253 253 253 253 253
39693 -253 253 253 253 253 253 253 253 253 253 253 253
39694 -253 253 253 253 253 253 234 234 234 10 10 10
39695 - 2 2 6 2 2 6 22 22 22 14 14 14
39696 - 2 2 6 2 2 6 2 2 6 2 2 6
39697 - 2 2 6 66 66 66 62 62 62 22 22 22
39698 - 6 6 6 0 0 0 0 0 0 0 0 0
39699 - 0 0 0 0 0 0 0 0 0 0 0 0
39700 - 0 0 0 0 0 0 0 0 0 0 0 0
39701 - 0 0 0 0 0 0 0 0 0 0 0 0
39702 - 0 0 0 0 0 0 0 0 0 0 0 0
39703 - 0 0 0 0 0 0 0 0 0 0 0 0
39704 - 0 0 0 0 0 0 6 6 6 18 18 18
39705 - 50 50 50 74 74 74 2 2 6 2 2 6
39706 - 14 14 14 70 70 70 34 34 34 62 62 62
39707 -250 250 250 253 253 253 253 253 253 253 253 253
39708 -253 253 253 253 253 253 253 253 253 253 253 253
39709 -253 253 253 253 253 253 231 231 231 246 246 246
39710 -253 253 253 253 253 253 253 253 253 253 253 253
39711 -253 253 253 253 253 253 253 253 253 253 253 253
39712 -253 253 253 253 253 253 253 253 253 253 253 253
39713 -253 253 253 253 253 253 253 253 253 253 253 253
39714 -253 253 253 253 253 253 234 234 234 14 14 14
39715 - 2 2 6 2 2 6 30 30 30 2 2 6
39716 - 2 2 6 2 2 6 2 2 6 2 2 6
39717 - 2 2 6 66 66 66 62 62 62 22 22 22
39718 - 6 6 6 0 0 0 0 0 0 0 0 0
39719 - 0 0 0 0 0 0 0 0 0 0 0 0
39720 - 0 0 0 0 0 0 0 0 0 0 0 0
39721 - 0 0 0 0 0 0 0 0 0 0 0 0
39722 - 0 0 0 0 0 0 0 0 0 0 0 0
39723 - 0 0 0 0 0 0 0 0 0 0 0 0
39724 - 0 0 0 0 0 0 6 6 6 18 18 18
39725 - 54 54 54 62 62 62 2 2 6 2 2 6
39726 - 2 2 6 30 30 30 46 46 46 70 70 70
39727 -250 250 250 253 253 253 253 253 253 253 253 253
39728 -253 253 253 253 253 253 253 253 253 253 253 253
39729 -253 253 253 253 253 253 231 231 231 246 246 246
39730 -253 253 253 253 253 253 253 253 253 253 253 253
39731 -253 253 253 253 253 253 253 253 253 253 253 253
39732 -253 253 253 253 253 253 253 253 253 253 253 253
39733 -253 253 253 253 253 253 253 253 253 253 253 253
39734 -253 253 253 253 253 253 226 226 226 10 10 10
39735 - 2 2 6 6 6 6 30 30 30 2 2 6
39736 - 2 2 6 2 2 6 2 2 6 2 2 6
39737 - 2 2 6 66 66 66 58 58 58 22 22 22
39738 - 6 6 6 0 0 0 0 0 0 0 0 0
39739 - 0 0 0 0 0 0 0 0 0 0 0 0
39740 - 0 0 0 0 0 0 0 0 0 0 0 0
39741 - 0 0 0 0 0 0 0 0 0 0 0 0
39742 - 0 0 0 0 0 0 0 0 0 0 0 0
39743 - 0 0 0 0 0 0 0 0 0 0 0 0
39744 - 0 0 0 0 0 0 6 6 6 22 22 22
39745 - 58 58 58 62 62 62 2 2 6 2 2 6
39746 - 2 2 6 2 2 6 30 30 30 78 78 78
39747 -250 250 250 253 253 253 253 253 253 253 253 253
39748 -253 253 253 253 253 253 253 253 253 253 253 253
39749 -253 253 253 253 253 253 231 231 231 246 246 246
39750 -253 253 253 253 253 253 253 253 253 253 253 253
39751 -253 253 253 253 253 253 253 253 253 253 253 253
39752 -253 253 253 253 253 253 253 253 253 253 253 253
39753 -253 253 253 253 253 253 253 253 253 253 253 253
39754 -253 253 253 253 253 253 206 206 206 2 2 6
39755 - 22 22 22 34 34 34 18 14 6 22 22 22
39756 - 26 26 26 18 18 18 6 6 6 2 2 6
39757 - 2 2 6 82 82 82 54 54 54 18 18 18
39758 - 6 6 6 0 0 0 0 0 0 0 0 0
39759 - 0 0 0 0 0 0 0 0 0 0 0 0
39760 - 0 0 0 0 0 0 0 0 0 0 0 0
39761 - 0 0 0 0 0 0 0 0 0 0 0 0
39762 - 0 0 0 0 0 0 0 0 0 0 0 0
39763 - 0 0 0 0 0 0 0 0 0 0 0 0
39764 - 0 0 0 0 0 0 6 6 6 26 26 26
39765 - 62 62 62 106 106 106 74 54 14 185 133 11
39766 -210 162 10 121 92 8 6 6 6 62 62 62
39767 -238 238 238 253 253 253 253 253 253 253 253 253
39768 -253 253 253 253 253 253 253 253 253 253 253 253
39769 -253 253 253 253 253 253 231 231 231 246 246 246
39770 -253 253 253 253 253 253 253 253 253 253 253 253
39771 -253 253 253 253 253 253 253 253 253 253 253 253
39772 -253 253 253 253 253 253 253 253 253 253 253 253
39773 -253 253 253 253 253 253 253 253 253 253 253 253
39774 -253 253 253 253 253 253 158 158 158 18 18 18
39775 - 14 14 14 2 2 6 2 2 6 2 2 6
39776 - 6 6 6 18 18 18 66 66 66 38 38 38
39777 - 6 6 6 94 94 94 50 50 50 18 18 18
39778 - 6 6 6 0 0 0 0 0 0 0 0 0
39779 - 0 0 0 0 0 0 0 0 0 0 0 0
39780 - 0 0 0 0 0 0 0 0 0 0 0 0
39781 - 0 0 0 0 0 0 0 0 0 0 0 0
39782 - 0 0 0 0 0 0 0 0 0 0 0 0
39783 - 0 0 0 0 0 0 0 0 0 6 6 6
39784 - 10 10 10 10 10 10 18 18 18 38 38 38
39785 - 78 78 78 142 134 106 216 158 10 242 186 14
39786 -246 190 14 246 190 14 156 118 10 10 10 10
39787 - 90 90 90 238 238 238 253 253 253 253 253 253
39788 -253 253 253 253 253 253 253 253 253 253 253 253
39789 -253 253 253 253 253 253 231 231 231 250 250 250
39790 -253 253 253 253 253 253 253 253 253 253 253 253
39791 -253 253 253 253 253 253 253 253 253 253 253 253
39792 -253 253 253 253 253 253 253 253 253 253 253 253
39793 -253 253 253 253 253 253 253 253 253 246 230 190
39794 -238 204 91 238 204 91 181 142 44 37 26 9
39795 - 2 2 6 2 2 6 2 2 6 2 2 6
39796 - 2 2 6 2 2 6 38 38 38 46 46 46
39797 - 26 26 26 106 106 106 54 54 54 18 18 18
39798 - 6 6 6 0 0 0 0 0 0 0 0 0
39799 - 0 0 0 0 0 0 0 0 0 0 0 0
39800 - 0 0 0 0 0 0 0 0 0 0 0 0
39801 - 0 0 0 0 0 0 0 0 0 0 0 0
39802 - 0 0 0 0 0 0 0 0 0 0 0 0
39803 - 0 0 0 6 6 6 14 14 14 22 22 22
39804 - 30 30 30 38 38 38 50 50 50 70 70 70
39805 -106 106 106 190 142 34 226 170 11 242 186 14
39806 -246 190 14 246 190 14 246 190 14 154 114 10
39807 - 6 6 6 74 74 74 226 226 226 253 253 253
39808 -253 253 253 253 253 253 253 253 253 253 253 253
39809 -253 253 253 253 253 253 231 231 231 250 250 250
39810 -253 253 253 253 253 253 253 253 253 253 253 253
39811 -253 253 253 253 253 253 253 253 253 253 253 253
39812 -253 253 253 253 253 253 253 253 253 253 253 253
39813 -253 253 253 253 253 253 253 253 253 228 184 62
39814 -241 196 14 241 208 19 232 195 16 38 30 10
39815 - 2 2 6 2 2 6 2 2 6 2 2 6
39816 - 2 2 6 6 6 6 30 30 30 26 26 26
39817 -203 166 17 154 142 90 66 66 66 26 26 26
39818 - 6 6 6 0 0 0 0 0 0 0 0 0
39819 - 0 0 0 0 0 0 0 0 0 0 0 0
39820 - 0 0 0 0 0 0 0 0 0 0 0 0
39821 - 0 0 0 0 0 0 0 0 0 0 0 0
39822 - 0 0 0 0 0 0 0 0 0 0 0 0
39823 - 6 6 6 18 18 18 38 38 38 58 58 58
39824 - 78 78 78 86 86 86 101 101 101 123 123 123
39825 -175 146 61 210 150 10 234 174 13 246 186 14
39826 -246 190 14 246 190 14 246 190 14 238 190 10
39827 -102 78 10 2 2 6 46 46 46 198 198 198
39828 -253 253 253 253 253 253 253 253 253 253 253 253
39829 -253 253 253 253 253 253 234 234 234 242 242 242
39830 -253 253 253 253 253 253 253 253 253 253 253 253
39831 -253 253 253 253 253 253 253 253 253 253 253 253
39832 -253 253 253 253 253 253 253 253 253 253 253 253
39833 -253 253 253 253 253 253 253 253 253 224 178 62
39834 -242 186 14 241 196 14 210 166 10 22 18 6
39835 - 2 2 6 2 2 6 2 2 6 2 2 6
39836 - 2 2 6 2 2 6 6 6 6 121 92 8
39837 -238 202 15 232 195 16 82 82 82 34 34 34
39838 - 10 10 10 0 0 0 0 0 0 0 0 0
39839 - 0 0 0 0 0 0 0 0 0 0 0 0
39840 - 0 0 0 0 0 0 0 0 0 0 0 0
39841 - 0 0 0 0 0 0 0 0 0 0 0 0
39842 - 0 0 0 0 0 0 0 0 0 0 0 0
39843 - 14 14 14 38 38 38 70 70 70 154 122 46
39844 -190 142 34 200 144 11 197 138 11 197 138 11
39845 -213 154 11 226 170 11 242 186 14 246 190 14
39846 -246 190 14 246 190 14 246 190 14 246 190 14
39847 -225 175 15 46 32 6 2 2 6 22 22 22
39848 -158 158 158 250 250 250 253 253 253 253 253 253
39849 -253 253 253 253 253 253 253 253 253 253 253 253
39850 -253 253 253 253 253 253 253 253 253 253 253 253
39851 -253 253 253 253 253 253 253 253 253 253 253 253
39852 -253 253 253 253 253 253 253 253 253 253 253 253
39853 -253 253 253 250 250 250 242 242 242 224 178 62
39854 -239 182 13 236 186 11 213 154 11 46 32 6
39855 - 2 2 6 2 2 6 2 2 6 2 2 6
39856 - 2 2 6 2 2 6 61 42 6 225 175 15
39857 -238 190 10 236 186 11 112 100 78 42 42 42
39858 - 14 14 14 0 0 0 0 0 0 0 0 0
39859 - 0 0 0 0 0 0 0 0 0 0 0 0
39860 - 0 0 0 0 0 0 0 0 0 0 0 0
39861 - 0 0 0 0 0 0 0 0 0 0 0 0
39862 - 0 0 0 0 0 0 0 0 0 6 6 6
39863 - 22 22 22 54 54 54 154 122 46 213 154 11
39864 -226 170 11 230 174 11 226 170 11 226 170 11
39865 -236 178 12 242 186 14 246 190 14 246 190 14
39866 -246 190 14 246 190 14 246 190 14 246 190 14
39867 -241 196 14 184 144 12 10 10 10 2 2 6
39868 - 6 6 6 116 116 116 242 242 242 253 253 253
39869 -253 253 253 253 253 253 253 253 253 253 253 253
39870 -253 253 253 253 253 253 253 253 253 253 253 253
39871 -253 253 253 253 253 253 253 253 253 253 253 253
39872 -253 253 253 253 253 253 253 253 253 253 253 253
39873 -253 253 253 231 231 231 198 198 198 214 170 54
39874 -236 178 12 236 178 12 210 150 10 137 92 6
39875 - 18 14 6 2 2 6 2 2 6 2 2 6
39876 - 6 6 6 70 47 6 200 144 11 236 178 12
39877 -239 182 13 239 182 13 124 112 88 58 58 58
39878 - 22 22 22 6 6 6 0 0 0 0 0 0
39879 - 0 0 0 0 0 0 0 0 0 0 0 0
39880 - 0 0 0 0 0 0 0 0 0 0 0 0
39881 - 0 0 0 0 0 0 0 0 0 0 0 0
39882 - 0 0 0 0 0 0 0 0 0 10 10 10
39883 - 30 30 30 70 70 70 180 133 36 226 170 11
39884 -239 182 13 242 186 14 242 186 14 246 186 14
39885 -246 190 14 246 190 14 246 190 14 246 190 14
39886 -246 190 14 246 190 14 246 190 14 246 190 14
39887 -246 190 14 232 195 16 98 70 6 2 2 6
39888 - 2 2 6 2 2 6 66 66 66 221 221 221
39889 -253 253 253 253 253 253 253 253 253 253 253 253
39890 -253 253 253 253 253 253 253 253 253 253 253 253
39891 -253 253 253 253 253 253 253 253 253 253 253 253
39892 -253 253 253 253 253 253 253 253 253 253 253 253
39893 -253 253 253 206 206 206 198 198 198 214 166 58
39894 -230 174 11 230 174 11 216 158 10 192 133 9
39895 -163 110 8 116 81 8 102 78 10 116 81 8
39896 -167 114 7 197 138 11 226 170 11 239 182 13
39897 -242 186 14 242 186 14 162 146 94 78 78 78
39898 - 34 34 34 14 14 14 6 6 6 0 0 0
39899 - 0 0 0 0 0 0 0 0 0 0 0 0
39900 - 0 0 0 0 0 0 0 0 0 0 0 0
39901 - 0 0 0 0 0 0 0 0 0 0 0 0
39902 - 0 0 0 0 0 0 0 0 0 6 6 6
39903 - 30 30 30 78 78 78 190 142 34 226 170 11
39904 -239 182 13 246 190 14 246 190 14 246 190 14
39905 -246 190 14 246 190 14 246 190 14 246 190 14
39906 -246 190 14 246 190 14 246 190 14 246 190 14
39907 -246 190 14 241 196 14 203 166 17 22 18 6
39908 - 2 2 6 2 2 6 2 2 6 38 38 38
39909 -218 218 218 253 253 253 253 253 253 253 253 253
39910 -253 253 253 253 253 253 253 253 253 253 253 253
39911 -253 253 253 253 253 253 253 253 253 253 253 253
39912 -253 253 253 253 253 253 253 253 253 253 253 253
39913 -250 250 250 206 206 206 198 198 198 202 162 69
39914 -226 170 11 236 178 12 224 166 10 210 150 10
39915 -200 144 11 197 138 11 192 133 9 197 138 11
39916 -210 150 10 226 170 11 242 186 14 246 190 14
39917 -246 190 14 246 186 14 225 175 15 124 112 88
39918 - 62 62 62 30 30 30 14 14 14 6 6 6
39919 - 0 0 0 0 0 0 0 0 0 0 0 0
39920 - 0 0 0 0 0 0 0 0 0 0 0 0
39921 - 0 0 0 0 0 0 0 0 0 0 0 0
39922 - 0 0 0 0 0 0 0 0 0 10 10 10
39923 - 30 30 30 78 78 78 174 135 50 224 166 10
39924 -239 182 13 246 190 14 246 190 14 246 190 14
39925 -246 190 14 246 190 14 246 190 14 246 190 14
39926 -246 190 14 246 190 14 246 190 14 246 190 14
39927 -246 190 14 246 190 14 241 196 14 139 102 15
39928 - 2 2 6 2 2 6 2 2 6 2 2 6
39929 - 78 78 78 250 250 250 253 253 253 253 253 253
39930 -253 253 253 253 253 253 253 253 253 253 253 253
39931 -253 253 253 253 253 253 253 253 253 253 253 253
39932 -253 253 253 253 253 253 253 253 253 253 253 253
39933 -250 250 250 214 214 214 198 198 198 190 150 46
39934 -219 162 10 236 178 12 234 174 13 224 166 10
39935 -216 158 10 213 154 11 213 154 11 216 158 10
39936 -226 170 11 239 182 13 246 190 14 246 190 14
39937 -246 190 14 246 190 14 242 186 14 206 162 42
39938 -101 101 101 58 58 58 30 30 30 14 14 14
39939 - 6 6 6 0 0 0 0 0 0 0 0 0
39940 - 0 0 0 0 0 0 0 0 0 0 0 0
39941 - 0 0 0 0 0 0 0 0 0 0 0 0
39942 - 0 0 0 0 0 0 0 0 0 10 10 10
39943 - 30 30 30 74 74 74 174 135 50 216 158 10
39944 -236 178 12 246 190 14 246 190 14 246 190 14
39945 -246 190 14 246 190 14 246 190 14 246 190 14
39946 -246 190 14 246 190 14 246 190 14 246 190 14
39947 -246 190 14 246 190 14 241 196 14 226 184 13
39948 - 61 42 6 2 2 6 2 2 6 2 2 6
39949 - 22 22 22 238 238 238 253 253 253 253 253 253
39950 -253 253 253 253 253 253 253 253 253 253 253 253
39951 -253 253 253 253 253 253 253 253 253 253 253 253
39952 -253 253 253 253 253 253 253 253 253 253 253 253
39953 -253 253 253 226 226 226 187 187 187 180 133 36
39954 -216 158 10 236 178 12 239 182 13 236 178 12
39955 -230 174 11 226 170 11 226 170 11 230 174 11
39956 -236 178 12 242 186 14 246 190 14 246 190 14
39957 -246 190 14 246 190 14 246 186 14 239 182 13
39958 -206 162 42 106 106 106 66 66 66 34 34 34
39959 - 14 14 14 6 6 6 0 0 0 0 0 0
39960 - 0 0 0 0 0 0 0 0 0 0 0 0
39961 - 0 0 0 0 0 0 0 0 0 0 0 0
39962 - 0 0 0 0 0 0 0 0 0 6 6 6
39963 - 26 26 26 70 70 70 163 133 67 213 154 11
39964 -236 178 12 246 190 14 246 190 14 246 190 14
39965 -246 190 14 246 190 14 246 190 14 246 190 14
39966 -246 190 14 246 190 14 246 190 14 246 190 14
39967 -246 190 14 246 190 14 246 190 14 241 196 14
39968 -190 146 13 18 14 6 2 2 6 2 2 6
39969 - 46 46 46 246 246 246 253 253 253 253 253 253
39970 -253 253 253 253 253 253 253 253 253 253 253 253
39971 -253 253 253 253 253 253 253 253 253 253 253 253
39972 -253 253 253 253 253 253 253 253 253 253 253 253
39973 -253 253 253 221 221 221 86 86 86 156 107 11
39974 -216 158 10 236 178 12 242 186 14 246 186 14
39975 -242 186 14 239 182 13 239 182 13 242 186 14
39976 -242 186 14 246 186 14 246 190 14 246 190 14
39977 -246 190 14 246 190 14 246 190 14 246 190 14
39978 -242 186 14 225 175 15 142 122 72 66 66 66
39979 - 30 30 30 10 10 10 0 0 0 0 0 0
39980 - 0 0 0 0 0 0 0 0 0 0 0 0
39981 - 0 0 0 0 0 0 0 0 0 0 0 0
39982 - 0 0 0 0 0 0 0 0 0 6 6 6
39983 - 26 26 26 70 70 70 163 133 67 210 150 10
39984 -236 178 12 246 190 14 246 190 14 246 190 14
39985 -246 190 14 246 190 14 246 190 14 246 190 14
39986 -246 190 14 246 190 14 246 190 14 246 190 14
39987 -246 190 14 246 190 14 246 190 14 246 190 14
39988 -232 195 16 121 92 8 34 34 34 106 106 106
39989 -221 221 221 253 253 253 253 253 253 253 253 253
39990 -253 253 253 253 253 253 253 253 253 253 253 253
39991 -253 253 253 253 253 253 253 253 253 253 253 253
39992 -253 253 253 253 253 253 253 253 253 253 253 253
39993 -242 242 242 82 82 82 18 14 6 163 110 8
39994 -216 158 10 236 178 12 242 186 14 246 190 14
39995 -246 190 14 246 190 14 246 190 14 246 190 14
39996 -246 190 14 246 190 14 246 190 14 246 190 14
39997 -246 190 14 246 190 14 246 190 14 246 190 14
39998 -246 190 14 246 190 14 242 186 14 163 133 67
39999 - 46 46 46 18 18 18 6 6 6 0 0 0
40000 - 0 0 0 0 0 0 0 0 0 0 0 0
40001 - 0 0 0 0 0 0 0 0 0 0 0 0
40002 - 0 0 0 0 0 0 0 0 0 10 10 10
40003 - 30 30 30 78 78 78 163 133 67 210 150 10
40004 -236 178 12 246 186 14 246 190 14 246 190 14
40005 -246 190 14 246 190 14 246 190 14 246 190 14
40006 -246 190 14 246 190 14 246 190 14 246 190 14
40007 -246 190 14 246 190 14 246 190 14 246 190 14
40008 -241 196 14 215 174 15 190 178 144 253 253 253
40009 -253 253 253 253 253 253 253 253 253 253 253 253
40010 -253 253 253 253 253 253 253 253 253 253 253 253
40011 -253 253 253 253 253 253 253 253 253 253 253 253
40012 -253 253 253 253 253 253 253 253 253 218 218 218
40013 - 58 58 58 2 2 6 22 18 6 167 114 7
40014 -216 158 10 236 178 12 246 186 14 246 190 14
40015 -246 190 14 246 190 14 246 190 14 246 190 14
40016 -246 190 14 246 190 14 246 190 14 246 190 14
40017 -246 190 14 246 190 14 246 190 14 246 190 14
40018 -246 190 14 246 186 14 242 186 14 190 150 46
40019 - 54 54 54 22 22 22 6 6 6 0 0 0
40020 - 0 0 0 0 0 0 0 0 0 0 0 0
40021 - 0 0 0 0 0 0 0 0 0 0 0 0
40022 - 0 0 0 0 0 0 0 0 0 14 14 14
40023 - 38 38 38 86 86 86 180 133 36 213 154 11
40024 -236 178 12 246 186 14 246 190 14 246 190 14
40025 -246 190 14 246 190 14 246 190 14 246 190 14
40026 -246 190 14 246 190 14 246 190 14 246 190 14
40027 -246 190 14 246 190 14 246 190 14 246 190 14
40028 -246 190 14 232 195 16 190 146 13 214 214 214
40029 -253 253 253 253 253 253 253 253 253 253 253 253
40030 -253 253 253 253 253 253 253 253 253 253 253 253
40031 -253 253 253 253 253 253 253 253 253 253 253 253
40032 -253 253 253 250 250 250 170 170 170 26 26 26
40033 - 2 2 6 2 2 6 37 26 9 163 110 8
40034 -219 162 10 239 182 13 246 186 14 246 190 14
40035 -246 190 14 246 190 14 246 190 14 246 190 14
40036 -246 190 14 246 190 14 246 190 14 246 190 14
40037 -246 190 14 246 190 14 246 190 14 246 190 14
40038 -246 186 14 236 178 12 224 166 10 142 122 72
40039 - 46 46 46 18 18 18 6 6 6 0 0 0
40040 - 0 0 0 0 0 0 0 0 0 0 0 0
40041 - 0 0 0 0 0 0 0 0 0 0 0 0
40042 - 0 0 0 0 0 0 6 6 6 18 18 18
40043 - 50 50 50 109 106 95 192 133 9 224 166 10
40044 -242 186 14 246 190 14 246 190 14 246 190 14
40045 -246 190 14 246 190 14 246 190 14 246 190 14
40046 -246 190 14 246 190 14 246 190 14 246 190 14
40047 -246 190 14 246 190 14 246 190 14 246 190 14
40048 -242 186 14 226 184 13 210 162 10 142 110 46
40049 -226 226 226 253 253 253 253 253 253 253 253 253
40050 -253 253 253 253 253 253 253 253 253 253 253 253
40051 -253 253 253 253 253 253 253 253 253 253 253 253
40052 -198 198 198 66 66 66 2 2 6 2 2 6
40053 - 2 2 6 2 2 6 50 34 6 156 107 11
40054 -219 162 10 239 182 13 246 186 14 246 190 14
40055 -246 190 14 246 190 14 246 190 14 246 190 14
40056 -246 190 14 246 190 14 246 190 14 246 190 14
40057 -246 190 14 246 190 14 246 190 14 242 186 14
40058 -234 174 13 213 154 11 154 122 46 66 66 66
40059 - 30 30 30 10 10 10 0 0 0 0 0 0
40060 - 0 0 0 0 0 0 0 0 0 0 0 0
40061 - 0 0 0 0 0 0 0 0 0 0 0 0
40062 - 0 0 0 0 0 0 6 6 6 22 22 22
40063 - 58 58 58 154 121 60 206 145 10 234 174 13
40064 -242 186 14 246 186 14 246 190 14 246 190 14
40065 -246 190 14 246 190 14 246 190 14 246 190 14
40066 -246 190 14 246 190 14 246 190 14 246 190 14
40067 -246 190 14 246 190 14 246 190 14 246 190 14
40068 -246 186 14 236 178 12 210 162 10 163 110 8
40069 - 61 42 6 138 138 138 218 218 218 250 250 250
40070 -253 253 253 253 253 253 253 253 253 250 250 250
40071 -242 242 242 210 210 210 144 144 144 66 66 66
40072 - 6 6 6 2 2 6 2 2 6 2 2 6
40073 - 2 2 6 2 2 6 61 42 6 163 110 8
40074 -216 158 10 236 178 12 246 190 14 246 190 14
40075 -246 190 14 246 190 14 246 190 14 246 190 14
40076 -246 190 14 246 190 14 246 190 14 246 190 14
40077 -246 190 14 239 182 13 230 174 11 216 158 10
40078 -190 142 34 124 112 88 70 70 70 38 38 38
40079 - 18 18 18 6 6 6 0 0 0 0 0 0
40080 - 0 0 0 0 0 0 0 0 0 0 0 0
40081 - 0 0 0 0 0 0 0 0 0 0 0 0
40082 - 0 0 0 0 0 0 6 6 6 22 22 22
40083 - 62 62 62 168 124 44 206 145 10 224 166 10
40084 -236 178 12 239 182 13 242 186 14 242 186 14
40085 -246 186 14 246 190 14 246 190 14 246 190 14
40086 -246 190 14 246 190 14 246 190 14 246 190 14
40087 -246 190 14 246 190 14 246 190 14 246 190 14
40088 -246 190 14 236 178 12 216 158 10 175 118 6
40089 - 80 54 7 2 2 6 6 6 6 30 30 30
40090 - 54 54 54 62 62 62 50 50 50 38 38 38
40091 - 14 14 14 2 2 6 2 2 6 2 2 6
40092 - 2 2 6 2 2 6 2 2 6 2 2 6
40093 - 2 2 6 6 6 6 80 54 7 167 114 7
40094 -213 154 11 236 178 12 246 190 14 246 190 14
40095 -246 190 14 246 190 14 246 190 14 246 190 14
40096 -246 190 14 242 186 14 239 182 13 239 182 13
40097 -230 174 11 210 150 10 174 135 50 124 112 88
40098 - 82 82 82 54 54 54 34 34 34 18 18 18
40099 - 6 6 6 0 0 0 0 0 0 0 0 0
40100 - 0 0 0 0 0 0 0 0 0 0 0 0
40101 - 0 0 0 0 0 0 0 0 0 0 0 0
40102 - 0 0 0 0 0 0 6 6 6 18 18 18
40103 - 50 50 50 158 118 36 192 133 9 200 144 11
40104 -216 158 10 219 162 10 224 166 10 226 170 11
40105 -230 174 11 236 178 12 239 182 13 239 182 13
40106 -242 186 14 246 186 14 246 190 14 246 190 14
40107 -246 190 14 246 190 14 246 190 14 246 190 14
40108 -246 186 14 230 174 11 210 150 10 163 110 8
40109 -104 69 6 10 10 10 2 2 6 2 2 6
40110 - 2 2 6 2 2 6 2 2 6 2 2 6
40111 - 2 2 6 2 2 6 2 2 6 2 2 6
40112 - 2 2 6 2 2 6 2 2 6 2 2 6
40113 - 2 2 6 6 6 6 91 60 6 167 114 7
40114 -206 145 10 230 174 11 242 186 14 246 190 14
40115 -246 190 14 246 190 14 246 186 14 242 186 14
40116 -239 182 13 230 174 11 224 166 10 213 154 11
40117 -180 133 36 124 112 88 86 86 86 58 58 58
40118 - 38 38 38 22 22 22 10 10 10 6 6 6
40119 - 0 0 0 0 0 0 0 0 0 0 0 0
40120 - 0 0 0 0 0 0 0 0 0 0 0 0
40121 - 0 0 0 0 0 0 0 0 0 0 0 0
40122 - 0 0 0 0 0 0 0 0 0 14 14 14
40123 - 34 34 34 70 70 70 138 110 50 158 118 36
40124 -167 114 7 180 123 7 192 133 9 197 138 11
40125 -200 144 11 206 145 10 213 154 11 219 162 10
40126 -224 166 10 230 174 11 239 182 13 242 186 14
40127 -246 186 14 246 186 14 246 186 14 246 186 14
40128 -239 182 13 216 158 10 185 133 11 152 99 6
40129 -104 69 6 18 14 6 2 2 6 2 2 6
40130 - 2 2 6 2 2 6 2 2 6 2 2 6
40131 - 2 2 6 2 2 6 2 2 6 2 2 6
40132 - 2 2 6 2 2 6 2 2 6 2 2 6
40133 - 2 2 6 6 6 6 80 54 7 152 99 6
40134 -192 133 9 219 162 10 236 178 12 239 182 13
40135 -246 186 14 242 186 14 239 182 13 236 178 12
40136 -224 166 10 206 145 10 192 133 9 154 121 60
40137 - 94 94 94 62 62 62 42 42 42 22 22 22
40138 - 14 14 14 6 6 6 0 0 0 0 0 0
40139 - 0 0 0 0 0 0 0 0 0 0 0 0
40140 - 0 0 0 0 0 0 0 0 0 0 0 0
40141 - 0 0 0 0 0 0 0 0 0 0 0 0
40142 - 0 0 0 0 0 0 0 0 0 6 6 6
40143 - 18 18 18 34 34 34 58 58 58 78 78 78
40144 -101 98 89 124 112 88 142 110 46 156 107 11
40145 -163 110 8 167 114 7 175 118 6 180 123 7
40146 -185 133 11 197 138 11 210 150 10 219 162 10
40147 -226 170 11 236 178 12 236 178 12 234 174 13
40148 -219 162 10 197 138 11 163 110 8 130 83 6
40149 - 91 60 6 10 10 10 2 2 6 2 2 6
40150 - 18 18 18 38 38 38 38 38 38 38 38 38
40151 - 38 38 38 38 38 38 38 38 38 38 38 38
40152 - 38 38 38 38 38 38 26 26 26 2 2 6
40153 - 2 2 6 6 6 6 70 47 6 137 92 6
40154 -175 118 6 200 144 11 219 162 10 230 174 11
40155 -234 174 13 230 174 11 219 162 10 210 150 10
40156 -192 133 9 163 110 8 124 112 88 82 82 82
40157 - 50 50 50 30 30 30 14 14 14 6 6 6
40158 - 0 0 0 0 0 0 0 0 0 0 0 0
40159 - 0 0 0 0 0 0 0 0 0 0 0 0
40160 - 0 0 0 0 0 0 0 0 0 0 0 0
40161 - 0 0 0 0 0 0 0 0 0 0 0 0
40162 - 0 0 0 0 0 0 0 0 0 0 0 0
40163 - 6 6 6 14 14 14 22 22 22 34 34 34
40164 - 42 42 42 58 58 58 74 74 74 86 86 86
40165 -101 98 89 122 102 70 130 98 46 121 87 25
40166 -137 92 6 152 99 6 163 110 8 180 123 7
40167 -185 133 11 197 138 11 206 145 10 200 144 11
40168 -180 123 7 156 107 11 130 83 6 104 69 6
40169 - 50 34 6 54 54 54 110 110 110 101 98 89
40170 - 86 86 86 82 82 82 78 78 78 78 78 78
40171 - 78 78 78 78 78 78 78 78 78 78 78 78
40172 - 78 78 78 82 82 82 86 86 86 94 94 94
40173 -106 106 106 101 101 101 86 66 34 124 80 6
40174 -156 107 11 180 123 7 192 133 9 200 144 11
40175 -206 145 10 200 144 11 192 133 9 175 118 6
40176 -139 102 15 109 106 95 70 70 70 42 42 42
40177 - 22 22 22 10 10 10 0 0 0 0 0 0
40178 - 0 0 0 0 0 0 0 0 0 0 0 0
40179 - 0 0 0 0 0 0 0 0 0 0 0 0
40180 - 0 0 0 0 0 0 0 0 0 0 0 0
40181 - 0 0 0 0 0 0 0 0 0 0 0 0
40182 - 0 0 0 0 0 0 0 0 0 0 0 0
40183 - 0 0 0 0 0 0 6 6 6 10 10 10
40184 - 14 14 14 22 22 22 30 30 30 38 38 38
40185 - 50 50 50 62 62 62 74 74 74 90 90 90
40186 -101 98 89 112 100 78 121 87 25 124 80 6
40187 -137 92 6 152 99 6 152 99 6 152 99 6
40188 -138 86 6 124 80 6 98 70 6 86 66 30
40189 -101 98 89 82 82 82 58 58 58 46 46 46
40190 - 38 38 38 34 34 34 34 34 34 34 34 34
40191 - 34 34 34 34 34 34 34 34 34 34 34 34
40192 - 34 34 34 34 34 34 38 38 38 42 42 42
40193 - 54 54 54 82 82 82 94 86 76 91 60 6
40194 -134 86 6 156 107 11 167 114 7 175 118 6
40195 -175 118 6 167 114 7 152 99 6 121 87 25
40196 -101 98 89 62 62 62 34 34 34 18 18 18
40197 - 6 6 6 0 0 0 0 0 0 0 0 0
40198 - 0 0 0 0 0 0 0 0 0 0 0 0
40199 - 0 0 0 0 0 0 0 0 0 0 0 0
40200 - 0 0 0 0 0 0 0 0 0 0 0 0
40201 - 0 0 0 0 0 0 0 0 0 0 0 0
40202 - 0 0 0 0 0 0 0 0 0 0 0 0
40203 - 0 0 0 0 0 0 0 0 0 0 0 0
40204 - 0 0 0 6 6 6 6 6 6 10 10 10
40205 - 18 18 18 22 22 22 30 30 30 42 42 42
40206 - 50 50 50 66 66 66 86 86 86 101 98 89
40207 -106 86 58 98 70 6 104 69 6 104 69 6
40208 -104 69 6 91 60 6 82 62 34 90 90 90
40209 - 62 62 62 38 38 38 22 22 22 14 14 14
40210 - 10 10 10 10 10 10 10 10 10 10 10 10
40211 - 10 10 10 10 10 10 6 6 6 10 10 10
40212 - 10 10 10 10 10 10 10 10 10 14 14 14
40213 - 22 22 22 42 42 42 70 70 70 89 81 66
40214 - 80 54 7 104 69 6 124 80 6 137 92 6
40215 -134 86 6 116 81 8 100 82 52 86 86 86
40216 - 58 58 58 30 30 30 14 14 14 6 6 6
40217 - 0 0 0 0 0 0 0 0 0 0 0 0
40218 - 0 0 0 0 0 0 0 0 0 0 0 0
40219 - 0 0 0 0 0 0 0 0 0 0 0 0
40220 - 0 0 0 0 0 0 0 0 0 0 0 0
40221 - 0 0 0 0 0 0 0 0 0 0 0 0
40222 - 0 0 0 0 0 0 0 0 0 0 0 0
40223 - 0 0 0 0 0 0 0 0 0 0 0 0
40224 - 0 0 0 0 0 0 0 0 0 0 0 0
40225 - 0 0 0 6 6 6 10 10 10 14 14 14
40226 - 18 18 18 26 26 26 38 38 38 54 54 54
40227 - 70 70 70 86 86 86 94 86 76 89 81 66
40228 - 89 81 66 86 86 86 74 74 74 50 50 50
40229 - 30 30 30 14 14 14 6 6 6 0 0 0
40230 - 0 0 0 0 0 0 0 0 0 0 0 0
40231 - 0 0 0 0 0 0 0 0 0 0 0 0
40232 - 0 0 0 0 0 0 0 0 0 0 0 0
40233 - 6 6 6 18 18 18 34 34 34 58 58 58
40234 - 82 82 82 89 81 66 89 81 66 89 81 66
40235 - 94 86 66 94 86 76 74 74 74 50 50 50
40236 - 26 26 26 14 14 14 6 6 6 0 0 0
40237 - 0 0 0 0 0 0 0 0 0 0 0 0
40238 - 0 0 0 0 0 0 0 0 0 0 0 0
40239 - 0 0 0 0 0 0 0 0 0 0 0 0
40240 - 0 0 0 0 0 0 0 0 0 0 0 0
40241 - 0 0 0 0 0 0 0 0 0 0 0 0
40242 - 0 0 0 0 0 0 0 0 0 0 0 0
40243 - 0 0 0 0 0 0 0 0 0 0 0 0
40244 - 0 0 0 0 0 0 0 0 0 0 0 0
40245 - 0 0 0 0 0 0 0 0 0 0 0 0
40246 - 6 6 6 6 6 6 14 14 14 18 18 18
40247 - 30 30 30 38 38 38 46 46 46 54 54 54
40248 - 50 50 50 42 42 42 30 30 30 18 18 18
40249 - 10 10 10 0 0 0 0 0 0 0 0 0
40250 - 0 0 0 0 0 0 0 0 0 0 0 0
40251 - 0 0 0 0 0 0 0 0 0 0 0 0
40252 - 0 0 0 0 0 0 0 0 0 0 0 0
40253 - 0 0 0 6 6 6 14 14 14 26 26 26
40254 - 38 38 38 50 50 50 58 58 58 58 58 58
40255 - 54 54 54 42 42 42 30 30 30 18 18 18
40256 - 10 10 10 0 0 0 0 0 0 0 0 0
40257 - 0 0 0 0 0 0 0 0 0 0 0 0
40258 - 0 0 0 0 0 0 0 0 0 0 0 0
40259 - 0 0 0 0 0 0 0 0 0 0 0 0
40260 - 0 0 0 0 0 0 0 0 0 0 0 0
40261 - 0 0 0 0 0 0 0 0 0 0 0 0
40262 - 0 0 0 0 0 0 0 0 0 0 0 0
40263 - 0 0 0 0 0 0 0 0 0 0 0 0
40264 - 0 0 0 0 0 0 0 0 0 0 0 0
40265 - 0 0 0 0 0 0 0 0 0 0 0 0
40266 - 0 0 0 0 0 0 0 0 0 6 6 6
40267 - 6 6 6 10 10 10 14 14 14 18 18 18
40268 - 18 18 18 14 14 14 10 10 10 6 6 6
40269 - 0 0 0 0 0 0 0 0 0 0 0 0
40270 - 0 0 0 0 0 0 0 0 0 0 0 0
40271 - 0 0 0 0 0 0 0 0 0 0 0 0
40272 - 0 0 0 0 0 0 0 0 0 0 0 0
40273 - 0 0 0 0 0 0 0 0 0 6 6 6
40274 - 14 14 14 18 18 18 22 22 22 22 22 22
40275 - 18 18 18 14 14 14 10 10 10 6 6 6
40276 - 0 0 0 0 0 0 0 0 0 0 0 0
40277 - 0 0 0 0 0 0 0 0 0 0 0 0
40278 - 0 0 0 0 0 0 0 0 0 0 0 0
40279 - 0 0 0 0 0 0 0 0 0 0 0 0
40280 - 0 0 0 0 0 0 0 0 0 0 0 0
40281 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40282 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40283 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40284 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40285 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40286 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40287 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40288 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40289 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40290 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40291 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40292 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40293 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40295 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40296 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40297 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40298 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40299 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40300 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40301 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40302 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40303 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40304 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40305 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40306 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40307 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40309 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40310 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40311 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40312 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40313 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40314 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40315 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40316 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40317 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40318 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40319 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40320 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40321 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40323 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40324 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40325 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40326 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40327 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40328 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40329 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40330 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40331 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40332 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40333 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40334 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40335 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40337 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40338 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40339 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40340 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40341 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40342 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40343 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40344 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40345 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40346 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40347 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40348 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40349 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40351 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40352 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40353 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40354 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40355 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40356 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40357 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40358 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40359 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40360 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40361 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40362 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40363 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40365 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40366 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40367 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40368 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40369 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40370 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40371 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40372 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40373 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40374 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40375 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40376 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40377 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40379 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40380 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40381 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40382 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40383 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40384 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40385 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40386 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40387 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40388 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40389 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40390 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40391 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40393 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40394 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40395 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40396 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40397 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40398 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40399 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40400 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40401 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40402 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40403 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40404 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40405 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40407 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40408 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40409 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40410 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40411 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40412 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40413 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40414 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40415 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40416 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40417 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40418 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40419 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40421 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40422 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40423 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40424 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40425 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40426 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40427 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40428 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40429 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40430 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40431 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40432 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40433 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40435 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40436 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40437 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40438 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
40439 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
40440 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
40441 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
40442 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
40443 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
40444 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
40445 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
40446 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
40447 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
40449 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40450 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40451 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
40452 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
40453 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
40454 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
40455 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
40456 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
40457 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
40458 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
40459 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
40460 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
40461 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
40463 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40464 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40465 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
40466 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
40467 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
40468 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
40469 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
40470 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
40471 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
40472 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
40473 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
40474 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
40475 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
40477 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40478 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40479 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
40480 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
40481 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
40482 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
40483 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
40484 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
40485 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
40486 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
40487 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
40488 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
40489 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40491 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40492 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40493 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
40494 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
40495 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
40496 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
40497 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
40498 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
40499 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
40500 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
40501 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
40502 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
40503 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
40505 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40506 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
40507 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
40508 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
40509 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
40510 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
40511 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
40512 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
40513 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
40514 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
40515 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
40516 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
40517 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
40519 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40520 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
40521 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
40522 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
40523 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40524 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
40525 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
40526 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
40527 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
40528 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
40529 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
40530 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
40531 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
40533 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40534 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
40535 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
40536 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
40537 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
40538 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
40539 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
40540 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
40541 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
40542 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
40543 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
40544 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
40545 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
40547 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
40548 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
40549 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
40550 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
40551 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
40552 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
40553 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
40554 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
40555 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
40556 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
40557 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
40558 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
40559 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
40561 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40562 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
40563 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
40564 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
40565 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
40566 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
40567 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
40568 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
40569 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
40570 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
40571 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
40572 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
40573 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
40575 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
40576 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
40577 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
40578 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
40579 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
40580 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
40581 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
40582 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
40583 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
40584 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
40585 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
40586 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
40587 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
40589 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
40590 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
40591 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
40592 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
40593 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
40594 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
40595 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
40596 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
40597 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
40598 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
40599 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
40600 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
40601 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
40603 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
40604 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
40605 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
40606 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
40607 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
40608 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
40609 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
40610 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
40611 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
40612 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
40613 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
40614 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
40615 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
40617 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
40618 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
40619 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
40620 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
40621 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
40622 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
40623 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
40624 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
40625 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
40626 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
40627 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
40628 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
40629 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
40631 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
40632 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
40633 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
40634 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40635 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
40636 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
40637 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
40638 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
40639 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
40640 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
40641 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
40642 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
40643 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
40645 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
40646 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
40647 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
40648 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
40649 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
40650 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
40651 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
40652 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
40653 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
40654 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
40655 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
40656 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
40657 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
40659 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
40660 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
40661 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
40662 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
40663 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
40664 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40665 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
40666 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
40667 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
40668 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
40669 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
40670 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
40671 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
40673 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
40674 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
40675 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
40676 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
40677 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
40678 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40679 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
40680 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
40681 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
40682 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
40683 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
40684 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
40685 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
40687 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
40688 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
40689 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
40690 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
40691 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40692 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
40693 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
40694 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
40695 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
40696 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
40697 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
40698 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40699 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40701 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
40702 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
40703 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
40704 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
40705 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
40706 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40707 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40708 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
40709 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
40710 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
40711 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
40712 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
40713 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40715 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
40716 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
40717 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
40718 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
40719 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40720 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
40721 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
40722 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
40723 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
40724 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
40725 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
40726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40727 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40729 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
40730 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
40731 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
40732 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
40733 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40734 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40735 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40736 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
40737 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
40738 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
40739 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
40740 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40741 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40743 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
40744 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
40745 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
40746 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
40747 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40748 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
40749 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40750 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
40751 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
40752 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
40753 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40754 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40755 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40757 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
40758 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
40759 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
40760 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
40761 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40762 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
40763 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
40764 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
40765 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
40766 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
40767 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
40768 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40769 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40771 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
40772 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
40773 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
40774 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
40775 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40776 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
40777 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
40778 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
40779 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
40780 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
40781 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
40782 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40783 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40785 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
40786 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
40787 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
40788 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40789 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
40790 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
40791 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
40792 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
40793 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
40794 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
40795 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40796 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40797 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40799 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
40800 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
40801 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
40802 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40803 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40804 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
40805 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
40806 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
40807 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
40808 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
40809 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40810 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40811 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40813 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
40814 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
40815 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40816 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40817 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40818 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
40819 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
40820 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
40821 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
40822 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
40823 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40824 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40825 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40827 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
40828 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
40829 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40830 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40831 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40832 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
40833 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
40834 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
40835 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40836 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40837 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40838 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40839 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40841 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40842 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
40843 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40844 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
40845 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
40846 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
40847 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
40848 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
40849 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40850 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40851 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40852 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40853 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40855 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40856 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
40857 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40858 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
40859 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40860 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
40861 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
40862 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
40863 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40864 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40865 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40866 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40867 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40869 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
40870 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
40871 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40872 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
40873 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
40874 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
40875 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
40876 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
40877 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40878 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40879 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40880 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40881 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40883 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
40884 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
40885 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40886 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
40887 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
40888 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
40889 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
40890 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
40891 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40892 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40893 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40894 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40895 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40897 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40898 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
40899 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40900 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
40901 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
40902 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
40903 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
40904 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
40905 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40906 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40907 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40908 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40909 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40911 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
40912 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
40913 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40914 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
40915 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
40916 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
40917 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
40918 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
40919 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
40920 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40921 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40922 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40923 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40925 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40926 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
40927 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
40928 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
40929 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
40930 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
40931 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
40932 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
40933 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40934 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40935 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40936 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40937 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40939 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40940 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
40941 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40942 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
40943 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
40944 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
40945 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
40946 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
40947 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40948 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40949 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40950 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40951 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40953 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40954 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
40955 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
40956 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
40957 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
40958 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
40959 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40960 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
40961 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40962 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40963 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40964 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40965 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40967 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40968 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
40969 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
40970 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40971 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
40972 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
40973 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40974 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
40975 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40976 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40977 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40978 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40979 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40981 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40982 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
40983 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
40984 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
40985 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
40986 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
40987 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
40988 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
40989 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
40990 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40991 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40992 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40993 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40995 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40996 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
40997 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
40998 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
40999 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
41000 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
41001 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
41002 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
41003 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
41004 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41005 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41006 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41007 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41009 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
41010 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
41011 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
41012 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
41013 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41014 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
41015 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
41016 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
41017 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
41018 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41019 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41020 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41021 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41023 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41024 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
41025 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
41026 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
41027 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
41028 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
41029 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
41030 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
41031 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
41032 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41033 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41034 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41035 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41037 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
41038 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
41039 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
41040 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
41041 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
41042 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
41043 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
41044 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
41045 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
41046 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
41047 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41048 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41049 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41051 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
41052 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41053 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
41054 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
41055 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
41056 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
41057 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
41058 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
41059 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
41060 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
41061 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41062 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41063 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41065 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41066 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41067 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41068 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41069 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41070 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41071 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41072 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41073 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41074 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41075 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41076 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41077 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41079 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41080 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41081 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41082 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41083 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41084 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41085 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41086 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41087 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41088 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41089 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41090 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41091 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41093 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41094 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41095 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41096 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41097 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41098 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41099 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41100 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41101 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41102 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41103 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41104 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41105 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41107 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41108 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41109 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41110 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41111 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41112 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41113 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41114 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41115 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41116 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41117 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41121 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41122 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41123 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41124 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41125 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41126 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41127 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41128 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41129 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41130 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41131 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41135 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41136 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41137 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41138 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41139 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41140 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41141 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41142 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41143 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41144 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41145 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41149 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41150 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41151 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41152 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41153 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41154 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41155 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41156 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41157 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41158 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41159 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41163 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41164 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41165 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41166 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41167 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41168 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41169 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41170 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41171 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41172 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41173 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41177 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41178 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41179 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41180 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41181 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41182 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41183 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41184 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41185 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41186 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41187 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41191 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41192 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41193 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41194 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41195 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41196 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41197 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41198 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41199 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41200 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41201 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41205 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41206 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41207 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41208 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41209 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41210 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41211 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41212 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41213 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41214 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41215 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41219 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41220 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
41221 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41222 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
41223 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
41224 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
41225 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
41226 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
41227 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41228 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41229 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41233 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41234 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
41235 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
41236 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
41237 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
41238 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
41239 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41240 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41241 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41242 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41243 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41244 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41245 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41247 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41248 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41249 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41250 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41251 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41252 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41253 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41254 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41255 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41256 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41257 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41258 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41259 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41261 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41262 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41263 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41264 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41265 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41266 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41267 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41268 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41269 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41270 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41271 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41272 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41273 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41275 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41276 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41277 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41278 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41279 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41280 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41281 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41282 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41283 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41284 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41285 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41286 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41287 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41289 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41290 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41291 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41292 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41293 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41294 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41295 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41296 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41297 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41298 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41299 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41300 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41301 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41303 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41304 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41305 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41306 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41307 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41308 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41309 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41310 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41311 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41312 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41313 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41314 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41315 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41317 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41318 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41319 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41320 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41321 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41322 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41323 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41324 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41325 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41326 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41327 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41328 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41329 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41331 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41332 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41333 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41334 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41335 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41336 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41337 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41338 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41339 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41340 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41341 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41342 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41343 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41345 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41346 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41347 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41348 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41349 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41350 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41351 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41352 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41353 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41354 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41355 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41356 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41357 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41359 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41360 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41361 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41362 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41363 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41364 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41365 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41366 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41367 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41368 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41369 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41370 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41371 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41373 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41374 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41375 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41376 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41377 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41378 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41379 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41380 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41381 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41382 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41383 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41384 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41385 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41387 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41388 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41389 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41390 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41391 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41392 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41393 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41394 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41395 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41396 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41397 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41398 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41399 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41401 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
41402 index 087fc99..f85ed76 100644
41403 --- a/drivers/video/udlfb.c
41404 +++ b/drivers/video/udlfb.c
41405 @@ -585,11 +585,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
41406 dlfb_urb_completion(urb);
41409 - atomic_add(bytes_sent, &dev->bytes_sent);
41410 - atomic_add(bytes_identical, &dev->bytes_identical);
41411 - atomic_add(width*height*2, &dev->bytes_rendered);
41412 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41413 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41414 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
41415 end_cycles = get_cycles();
41416 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
41417 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41418 >> 10)), /* Kcycles */
41419 &dev->cpu_kcycles_used);
41421 @@ -710,11 +710,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
41422 dlfb_urb_completion(urb);
41425 - atomic_add(bytes_sent, &dev->bytes_sent);
41426 - atomic_add(bytes_identical, &dev->bytes_identical);
41427 - atomic_add(bytes_rendered, &dev->bytes_rendered);
41428 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41429 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41430 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
41431 end_cycles = get_cycles();
41432 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
41433 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41434 >> 10)), /* Kcycles */
41435 &dev->cpu_kcycles_used);
41437 @@ -1306,7 +1306,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
41438 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41439 struct dlfb_data *dev = fb_info->par;
41440 return snprintf(buf, PAGE_SIZE, "%u\n",
41441 - atomic_read(&dev->bytes_rendered));
41442 + atomic_read_unchecked(&dev->bytes_rendered));
41445 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41446 @@ -1314,7 +1314,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
41447 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41448 struct dlfb_data *dev = fb_info->par;
41449 return snprintf(buf, PAGE_SIZE, "%u\n",
41450 - atomic_read(&dev->bytes_identical));
41451 + atomic_read_unchecked(&dev->bytes_identical));
41454 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41455 @@ -1322,7 +1322,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
41456 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41457 struct dlfb_data *dev = fb_info->par;
41458 return snprintf(buf, PAGE_SIZE, "%u\n",
41459 - atomic_read(&dev->bytes_sent));
41460 + atomic_read_unchecked(&dev->bytes_sent));
41463 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41464 @@ -1330,7 +1330,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
41465 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41466 struct dlfb_data *dev = fb_info->par;
41467 return snprintf(buf, PAGE_SIZE, "%u\n",
41468 - atomic_read(&dev->cpu_kcycles_used));
41469 + atomic_read_unchecked(&dev->cpu_kcycles_used));
41472 static ssize_t edid_show(
41473 @@ -1387,10 +1387,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
41474 struct fb_info *fb_info = dev_get_drvdata(fbdev);
41475 struct dlfb_data *dev = fb_info->par;
41477 - atomic_set(&dev->bytes_rendered, 0);
41478 - atomic_set(&dev->bytes_identical, 0);
41479 - atomic_set(&dev->bytes_sent, 0);
41480 - atomic_set(&dev->cpu_kcycles_used, 0);
41481 + atomic_set_unchecked(&dev->bytes_rendered, 0);
41482 + atomic_set_unchecked(&dev->bytes_identical, 0);
41483 + atomic_set_unchecked(&dev->bytes_sent, 0);
41484 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
41488 diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
41489 index 7f8472c..9842e87 100644
41490 --- a/drivers/video/uvesafb.c
41491 +++ b/drivers/video/uvesafb.c
41493 #include <linux/io.h>
41494 #include <linux/mutex.h>
41495 #include <linux/slab.h>
41496 +#include <linux/moduleloader.h>
41497 #include <video/edid.h>
41498 #include <video/uvesafb.h>
41500 @@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
41504 - return call_usermodehelper(v86d_path, argv, envp, 1);
41505 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
41509 @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
41510 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
41511 par->pmi_setpal = par->ypan = 0;
41514 +#ifdef CONFIG_PAX_KERNEXEC
41515 +#ifdef CONFIG_MODULES
41516 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
41518 + if (!par->pmi_code) {
41519 + par->pmi_setpal = par->ypan = 0;
41524 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
41525 + task->t.regs.edi);
41527 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41528 + pax_open_kernel();
41529 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
41530 + pax_close_kernel();
41532 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
41533 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
41535 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
41536 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
41539 printk(KERN_INFO "uvesafb: protected mode interface info at "
41541 (u16)task->t.regs.es, (u16)task->t.regs.edi);
41542 @@ -1821,6 +1844,11 @@ out:
41543 if (par->vbe_modes)
41544 kfree(par->vbe_modes);
41546 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41547 + if (par->pmi_code)
41548 + module_free_exec(NULL, par->pmi_code);
41551 framebuffer_release(info);
41554 @@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platform_device *dev)
41555 kfree(par->vbe_state_orig);
41556 if (par->vbe_state_saved)
41557 kfree(par->vbe_state_saved);
41559 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41560 + if (par->pmi_code)
41561 + module_free_exec(NULL, par->pmi_code);
41566 framebuffer_release(info);
41567 diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
41568 index 501b340..86bd4cf 100644
41569 --- a/drivers/video/vesafb.c
41570 +++ b/drivers/video/vesafb.c
41574 #include <linux/module.h>
41575 +#include <linux/moduleloader.h>
41576 #include <linux/kernel.h>
41577 #include <linux/errno.h>
41578 #include <linux/string.h>
41579 @@ -52,8 +53,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
41580 static int vram_total __initdata; /* Set total amount of memory */
41581 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
41582 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
41583 -static void (*pmi_start)(void) __read_mostly;
41584 -static void (*pmi_pal) (void) __read_mostly;
41585 +static void (*pmi_start)(void) __read_only;
41586 +static void (*pmi_pal) (void) __read_only;
41587 static int depth __read_mostly;
41588 static int vga_compat __read_mostly;
41589 /* --------------------------------------------------------------------- */
41590 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
41591 unsigned int size_vmode;
41592 unsigned int size_remap;
41593 unsigned int size_total;
41594 + void *pmi_code = NULL;
41596 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
41598 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
41599 size_remap = size_total;
41600 vesafb_fix.smem_len = size_remap;
41603 - screen_info.vesapm_seg = 0;
41606 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
41607 printk(KERN_WARNING
41608 "vesafb: cannot reserve video memory at 0x%lx\n",
41609 @@ -307,9 +305,21 @@ static int __init vesafb_probe(struct platform_device *dev)
41610 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
41611 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
41615 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41616 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
41618 +#elif !defined(CONFIG_PAX_KERNEXEC)
41623 + screen_info.vesapm_seg = 0;
41625 if (screen_info.vesapm_seg) {
41626 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
41627 - screen_info.vesapm_seg,screen_info.vesapm_off);
41628 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
41629 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
41632 if (screen_info.vesapm_seg < 0xc000)
41633 @@ -317,9 +327,25 @@ static int __init vesafb_probe(struct platform_device *dev)
41635 if (ypan || pmi_setpal) {
41636 unsigned short *pmi_base;
41638 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
41639 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
41640 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
41642 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41643 + pax_open_kernel();
41644 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
41646 + pmi_code = pmi_base;
41649 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
41650 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
41652 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41653 + pmi_start = ktva_ktla(pmi_start);
41654 + pmi_pal = ktva_ktla(pmi_pal);
41655 + pax_close_kernel();
41658 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
41660 printk(KERN_INFO "vesafb: pmi: ports = ");
41661 @@ -488,6 +514,11 @@ static int __init vesafb_probe(struct platform_device *dev)
41662 info->node, info->fix.id);
41666 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41667 + module_free_exec(NULL, pmi_code);
41670 if (info->screen_base)
41671 iounmap(info->screen_base);
41672 framebuffer_release(info);
41673 diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
41674 index 88714ae..16c2e11 100644
41675 --- a/drivers/video/via/via_clock.h
41676 +++ b/drivers/video/via/via_clock.h
41677 @@ -56,7 +56,7 @@ struct via_clock {
41679 void (*set_engine_pll_state)(u8 state);
41680 void (*set_engine_pll)(struct via_pll_config config);
41685 static inline u32 get_pll_internal_frequency(u32 ref_freq,
41686 diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
41687 index e058ace..2424d93 100644
41688 --- a/drivers/virtio/virtio_balloon.c
41689 +++ b/drivers/virtio/virtio_balloon.c
41690 @@ -174,6 +174,8 @@ static void update_balloon_stats(struct virtio_balloon *vb)
41694 + pax_track_stack();
41696 all_vm_events(events);
41699 diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
41700 index e56c934..fc22f4b 100644
41701 --- a/drivers/xen/xen-pciback/conf_space.h
41702 +++ b/drivers/xen/xen-pciback/conf_space.h
41703 @@ -44,15 +44,15 @@ struct config_field {
41705 conf_dword_write write;
41706 conf_dword_read read;
41710 conf_word_write write;
41711 conf_word_read read;
41715 conf_byte_write write;
41716 conf_byte_read read;
41720 struct list_head list;
41722 diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
41723 index e3c03db..93b0172 100644
41724 --- a/fs/9p/vfs_inode.c
41725 +++ b/fs/9p/vfs_inode.c
41726 @@ -1288,7 +1288,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
41728 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41730 - char *s = nd_get_link(nd);
41731 + const char *s = nd_get_link(nd);
41733 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
41734 IS_ERR(s) ? "<error>" : s);
41735 diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
41736 index 79e2ca7..5828ad1 100644
41737 --- a/fs/Kconfig.binfmt
41738 +++ b/fs/Kconfig.binfmt
41739 @@ -86,7 +86,7 @@ config HAVE_AOUT
41742 tristate "Kernel support for a.out and ECOFF binaries"
41743 - depends on HAVE_AOUT
41744 + depends on HAVE_AOUT && BROKEN
41746 A.out (Assembler.OUTput) is a set of formats for libraries and
41747 executables used in the earliest versions of UNIX. Linux used
41748 diff --git a/fs/aio.c b/fs/aio.c
41749 index e29ec48..f083e5e 100644
41752 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
41753 size += sizeof(struct io_event) * nr_events;
41754 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
41756 - if (nr_pages < 0)
41757 + if (nr_pages <= 0)
41760 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
41761 @@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ctx,
41762 struct aio_timeout to;
41765 + pax_track_stack();
41767 /* needed to zero any padding within an entry (there shouldn't be
41768 * any, but C is fun!
41770 @@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
41771 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
41774 + struct iovec iovstack;
41776 #ifdef CONFIG_COMPAT
41778 ret = compat_rw_copy_check_uvector(type,
41779 (struct compat_iovec __user *)kiocb->ki_buf,
41780 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41781 + kiocb->ki_nbytes, 1, &iovstack,
41785 ret = rw_copy_check_uvector(type,
41786 (struct iovec __user *)kiocb->ki_buf,
41787 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
41788 + kiocb->ki_nbytes, 1, &iovstack,
41793 + if (kiocb->ki_iovec == &iovstack) {
41794 + kiocb->ki_inline_vec = iovstack;
41795 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
41797 kiocb->ki_nr_segs = kiocb->ki_nbytes;
41798 kiocb->ki_cur_seg = 0;
41799 /* ki_nbytes/left now reflect bytes instead of segs */
41800 diff --git a/fs/attr.c b/fs/attr.c
41801 index 538e279..046cc6d 100644
41804 @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
41805 unsigned long limit;
41807 limit = rlimit(RLIMIT_FSIZE);
41808 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
41809 if (limit != RLIM_INFINITY && offset > limit)
41811 if (offset > inode->i_sb->s_maxbytes)
41812 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
41813 index e1fbdee..cd5ea56 100644
41814 --- a/fs/autofs4/waitq.c
41815 +++ b/fs/autofs4/waitq.c
41816 @@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
41818 unsigned long sigpipe, flags;
41820 - const char *data = (const char *)addr;
41821 + const char __user *data = (const char __force_user *)addr;
41824 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
41825 diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
41826 index 720d885..012e7f0 100644
41827 --- a/fs/befs/linuxvfs.c
41828 +++ b/fs/befs/linuxvfs.c
41829 @@ -503,7 +503,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41831 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
41832 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
41833 - char *link = nd_get_link(nd);
41834 + const char *link = nd_get_link(nd);
41838 diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
41839 index a6395bd..a5b24c4 100644
41840 --- a/fs/binfmt_aout.c
41841 +++ b/fs/binfmt_aout.c
41843 #include <linux/string.h>
41844 #include <linux/fs.h>
41845 #include <linux/file.h>
41846 +#include <linux/security.h>
41847 #include <linux/stat.h>
41848 #include <linux/fcntl.h>
41849 #include <linux/ptrace.h>
41850 @@ -86,6 +87,8 @@ static int aout_core_dump(struct coredump_params *cprm)
41852 # define START_STACK(u) ((void __user *)u.start_stack)
41854 + memset(&dump, 0, sizeof(dump));
41859 @@ -97,10 +100,12 @@ static int aout_core_dump(struct coredump_params *cprm)
41861 /* If the size of the dump file exceeds the rlimit, then see what would happen
41862 if we wrote the stack, but not the data area. */
41863 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
41864 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
41867 /* Make sure we have enough room to write the stack and data areas. */
41868 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
41869 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
41872 @@ -234,6 +239,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41873 rlim = rlimit(RLIMIT_DATA);
41874 if (rlim >= RLIM_INFINITY)
41877 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
41878 if (ex.a_data + ex.a_bss > rlim)
41881 @@ -262,6 +269,27 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41882 install_exec_creds(bprm);
41883 current->flags &= ~PF_FORKNOEXEC;
41885 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
41886 + current->mm->pax_flags = 0UL;
41889 +#ifdef CONFIG_PAX_PAGEEXEC
41890 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
41891 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
41893 +#ifdef CONFIG_PAX_EMUTRAMP
41894 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
41895 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
41898 +#ifdef CONFIG_PAX_MPROTECT
41899 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
41900 + current->mm->pax_flags |= MF_PAX_MPROTECT;
41906 if (N_MAGIC(ex) == OMAGIC) {
41907 unsigned long text_addr, map_size;
41909 @@ -334,7 +362,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
41911 down_write(¤t->mm->mmap_sem);
41912 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
41913 - PROT_READ | PROT_WRITE | PROT_EXEC,
41914 + PROT_READ | PROT_WRITE,
41915 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
41916 fd_offset + ex.a_text);
41917 up_write(¤t->mm->mmap_sem);
41918 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
41919 index 21ac5ee..171b1d0 100644
41920 --- a/fs/binfmt_elf.c
41921 +++ b/fs/binfmt_elf.c
41922 @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump_params *cprm);
41923 #define elf_core_dump NULL
41926 +#ifdef CONFIG_PAX_MPROTECT
41927 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
41930 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
41931 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
41933 @@ -70,6 +74,11 @@ static struct linux_binfmt elf_format = {
41934 .load_binary = load_elf_binary,
41935 .load_shlib = load_elf_library,
41936 .core_dump = elf_core_dump,
41938 +#ifdef CONFIG_PAX_MPROTECT
41939 + .handle_mprotect= elf_handle_mprotect,
41942 .min_coredump = ELF_EXEC_PAGESIZE,
41945 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = {
41947 static int set_brk(unsigned long start, unsigned long end)
41949 + unsigned long e = end;
41951 start = ELF_PAGEALIGN(start);
41952 end = ELF_PAGEALIGN(end);
41954 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start, unsigned long end)
41955 if (BAD_ADDR(addr))
41958 - current->mm->start_brk = current->mm->brk = end;
41959 + current->mm->start_brk = current->mm->brk = e;
41963 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41964 elf_addr_t __user *u_rand_bytes;
41965 const char *k_platform = ELF_PLATFORM;
41966 const char *k_base_platform = ELF_BASE_PLATFORM;
41967 - unsigned char k_rand_bytes[16];
41968 + u32 k_rand_bytes[4];
41970 elf_addr_t *elf_info;
41972 const struct cred *cred = current_cred();
41973 struct vm_area_struct *vma;
41974 + unsigned long saved_auxv[AT_VECTOR_SIZE];
41976 + pax_track_stack();
41979 * In some cases (e.g. Hyper-Threading), we want to avoid L1
41980 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41981 * Generate 16 random bytes for userspace PRNG seeding.
41983 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
41984 - u_rand_bytes = (elf_addr_t __user *)
41985 - STACK_ALLOC(p, sizeof(k_rand_bytes));
41986 + srandom32(k_rand_bytes[0] ^ random32());
41987 + srandom32(k_rand_bytes[1] ^ random32());
41988 + srandom32(k_rand_bytes[2] ^ random32());
41989 + srandom32(k_rand_bytes[3] ^ random32());
41990 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
41991 + u_rand_bytes = (elf_addr_t __user *) p;
41992 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
41995 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
41997 current->mm->env_end = p;
41999 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
42001 /* Put the elf_info on the stack in the right place. */
42002 sp = (elf_addr_t __user *)envp + 1;
42003 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
42004 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
42008 @@ -381,10 +401,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42010 struct elf_phdr *elf_phdata;
42011 struct elf_phdr *eppnt;
42012 - unsigned long load_addr = 0;
42013 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
42014 int load_addr_set = 0;
42015 unsigned long last_bss = 0, elf_bss = 0;
42016 - unsigned long error = ~0UL;
42017 + unsigned long error = -EINVAL;
42018 unsigned long total_size;
42019 int retval, i, size;
42021 @@ -430,6 +450,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42025 +#ifdef CONFIG_PAX_SEGMEXEC
42026 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
42027 + pax_task_size = SEGMEXEC_TASK_SIZE;
42030 eppnt = elf_phdata;
42031 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
42032 if (eppnt->p_type == PT_LOAD) {
42033 @@ -473,8 +498,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42034 k = load_addr + eppnt->p_vaddr;
42036 eppnt->p_filesz > eppnt->p_memsz ||
42037 - eppnt->p_memsz > TASK_SIZE ||
42038 - TASK_SIZE - eppnt->p_memsz < k) {
42039 + eppnt->p_memsz > pax_task_size ||
42040 + pax_task_size - eppnt->p_memsz < k) {
42044 @@ -528,6 +553,193 @@ out:
42048 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
42049 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
42051 + unsigned long pax_flags = 0UL;
42053 +#ifdef CONFIG_PAX_PAGEEXEC
42054 + if (elf_phdata->p_flags & PF_PAGEEXEC)
42055 + pax_flags |= MF_PAX_PAGEEXEC;
42058 +#ifdef CONFIG_PAX_SEGMEXEC
42059 + if (elf_phdata->p_flags & PF_SEGMEXEC)
42060 + pax_flags |= MF_PAX_SEGMEXEC;
42063 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42064 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42065 + if ((__supported_pte_mask & _PAGE_NX))
42066 + pax_flags &= ~MF_PAX_SEGMEXEC;
42068 + pax_flags &= ~MF_PAX_PAGEEXEC;
42072 +#ifdef CONFIG_PAX_EMUTRAMP
42073 + if (elf_phdata->p_flags & PF_EMUTRAMP)
42074 + pax_flags |= MF_PAX_EMUTRAMP;
42077 +#ifdef CONFIG_PAX_MPROTECT
42078 + if (elf_phdata->p_flags & PF_MPROTECT)
42079 + pax_flags |= MF_PAX_MPROTECT;
42082 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42083 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42084 + pax_flags |= MF_PAX_RANDMMAP;
42087 + return pax_flags;
42091 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42092 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
42094 + unsigned long pax_flags = 0UL;
42096 +#ifdef CONFIG_PAX_PAGEEXEC
42097 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42098 + pax_flags |= MF_PAX_PAGEEXEC;
42101 +#ifdef CONFIG_PAX_SEGMEXEC
42102 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42103 + pax_flags |= MF_PAX_SEGMEXEC;
42106 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42107 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42108 + if ((__supported_pte_mask & _PAGE_NX))
42109 + pax_flags &= ~MF_PAX_SEGMEXEC;
42111 + pax_flags &= ~MF_PAX_PAGEEXEC;
42115 +#ifdef CONFIG_PAX_EMUTRAMP
42116 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42117 + pax_flags |= MF_PAX_EMUTRAMP;
42120 +#ifdef CONFIG_PAX_MPROTECT
42121 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42122 + pax_flags |= MF_PAX_MPROTECT;
42125 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42126 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42127 + pax_flags |= MF_PAX_RANDMMAP;
42130 + return pax_flags;
42134 +#ifdef CONFIG_PAX_EI_PAX
42135 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42137 + unsigned long pax_flags = 0UL;
42139 +#ifdef CONFIG_PAX_PAGEEXEC
42140 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42141 + pax_flags |= MF_PAX_PAGEEXEC;
42144 +#ifdef CONFIG_PAX_SEGMEXEC
42145 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42146 + pax_flags |= MF_PAX_SEGMEXEC;
42149 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42150 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42151 + if ((__supported_pte_mask & _PAGE_NX))
42152 + pax_flags &= ~MF_PAX_SEGMEXEC;
42154 + pax_flags &= ~MF_PAX_PAGEEXEC;
42158 +#ifdef CONFIG_PAX_EMUTRAMP
42159 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42160 + pax_flags |= MF_PAX_EMUTRAMP;
42163 +#ifdef CONFIG_PAX_MPROTECT
42164 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42165 + pax_flags |= MF_PAX_MPROTECT;
42168 +#ifdef CONFIG_PAX_ASLR
42169 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42170 + pax_flags |= MF_PAX_RANDMMAP;
42173 + return pax_flags;
42177 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42178 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42180 + unsigned long pax_flags = 0UL;
42182 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42184 + int found_flags = 0;
42187 +#ifdef CONFIG_PAX_EI_PAX
42188 + pax_flags = pax_parse_ei_pax(elf_ex);
42191 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42192 + for (i = 0UL; i < elf_ex->e_phnum; i++)
42193 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42194 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42195 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42196 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42197 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42198 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42201 +#ifdef CONFIG_PAX_SOFTMODE
42202 + if (pax_softmode)
42203 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
42207 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
42213 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
42214 + if (found_flags == 0) {
42215 + struct elf_phdr phdr;
42216 + memset(&phdr, 0, sizeof(phdr));
42217 + phdr.p_flags = PF_NOEMUTRAMP;
42218 +#ifdef CONFIG_PAX_SOFTMODE
42219 + if (pax_softmode)
42220 + pax_flags = pax_parse_softmode(&phdr);
42223 + pax_flags = pax_parse_hardmode(&phdr);
42227 + if (0 > pax_check_flags(&pax_flags))
42230 + current->mm->pax_flags = pax_flags;
42236 * These are the functions used to load ELF style executables and shared
42237 * libraries. There is no binary dependent code anywhere else.
42238 @@ -544,6 +756,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
42240 unsigned int random_variable = 0;
42242 +#ifdef CONFIG_PAX_RANDUSTACK
42243 + if (randomize_va_space)
42244 + return stack_top - current->mm->delta_stack;
42247 if ((current->flags & PF_RANDOMIZE) &&
42248 !(current->personality & ADDR_NO_RANDOMIZE)) {
42249 random_variable = get_random_int() & STACK_RND_MASK;
42250 @@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42251 unsigned long load_addr = 0, load_bias = 0;
42252 int load_addr_set = 0;
42253 char * elf_interpreter = NULL;
42254 - unsigned long error;
42255 + unsigned long error = 0;
42256 struct elf_phdr *elf_ppnt, *elf_phdata;
42257 unsigned long elf_bss, elf_brk;
42259 @@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42260 unsigned long start_code, end_code, start_data, end_data;
42261 unsigned long reloc_func_desc __maybe_unused = 0;
42262 int executable_stack = EXSTACK_DEFAULT;
42263 - unsigned long def_flags = 0;
42265 struct elfhdr elf_ex;
42266 struct elfhdr interp_elf_ex;
42268 + unsigned long pax_task_size = TASK_SIZE;
42270 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42272 @@ -713,11 +930,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42274 /* OK, This is the point of no return */
42275 current->flags &= ~PF_FORKNOEXEC;
42276 - current->mm->def_flags = def_flags;
42278 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42279 + current->mm->pax_flags = 0UL;
42282 +#ifdef CONFIG_PAX_DLRESOLVE
42283 + current->mm->call_dl_resolve = 0UL;
42286 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42287 + current->mm->call_syscall = 0UL;
42290 +#ifdef CONFIG_PAX_ASLR
42291 + current->mm->delta_mmap = 0UL;
42292 + current->mm->delta_stack = 0UL;
42295 + current->mm->def_flags = 0;
42297 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42298 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
42299 + send_sig(SIGKILL, current, 0);
42300 + goto out_free_dentry;
42304 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
42305 + pax_set_initial_flags(bprm);
42306 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
42307 + if (pax_set_initial_flags_func)
42308 + (pax_set_initial_flags_func)(bprm);
42311 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
42312 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
42313 + current->mm->context.user_cs_limit = PAGE_SIZE;
42314 + current->mm->def_flags |= VM_PAGEEXEC;
42318 +#ifdef CONFIG_PAX_SEGMEXEC
42319 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
42320 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
42321 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
42322 + pax_task_size = SEGMEXEC_TASK_SIZE;
42323 + current->mm->def_flags |= VM_NOHUGEPAGE;
42327 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
42328 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42329 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
42334 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
42335 may depend on the personality. */
42336 SET_PERSONALITY(loc->elf_ex);
42338 +#ifdef CONFIG_PAX_ASLR
42339 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
42340 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
42341 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
42345 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
42346 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42347 + executable_stack = EXSTACK_DISABLE_X;
42348 + current->personality &= ~READ_IMPLIES_EXEC;
42352 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
42353 current->personality |= READ_IMPLIES_EXEC;
42355 @@ -808,6 +1095,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42357 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
42360 +#ifdef CONFIG_PAX_RANDMMAP
42361 + /* PaX: randomize base address at the default exe base if requested */
42362 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
42363 +#ifdef CONFIG_SPARC64
42364 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
42366 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
42368 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
42369 + elf_flags |= MAP_FIXED;
42375 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
42376 @@ -840,9 +1141,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42377 * allowed task size. Note that p_filesz must always be
42378 * <= p_memsz so it is only necessary to check p_memsz.
42380 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42381 - elf_ppnt->p_memsz > TASK_SIZE ||
42382 - TASK_SIZE - elf_ppnt->p_memsz < k) {
42383 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42384 + elf_ppnt->p_memsz > pax_task_size ||
42385 + pax_task_size - elf_ppnt->p_memsz < k) {
42386 /* set_brk can never work. Avoid overflows. */
42387 send_sig(SIGKILL, current, 0);
42389 @@ -870,6 +1171,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42390 start_data += load_bias;
42391 end_data += load_bias;
42393 +#ifdef CONFIG_PAX_RANDMMAP
42394 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
42395 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
42398 /* Calling set_brk effectively mmaps the pages that we need
42399 * for the bss and break sections. We must do this before
42400 * mapping in the interpreter, to make sure it doesn't wind
42401 @@ -881,9 +1187,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42402 goto out_free_dentry;
42404 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
42405 - send_sig(SIGSEGV, current, 0);
42406 - retval = -EFAULT; /* Nobody gets to see this, but.. */
42407 - goto out_free_dentry;
42409 + * This bss-zeroing can fail if the ELF
42410 + * file specifies odd protections. So
42411 + * we don't check the return value
42415 if (elf_interpreter) {
42416 @@ -1098,7 +1406,7 @@ out:
42417 * Decide what to dump of a segment, part, all or none.
42419 static unsigned long vma_dump_size(struct vm_area_struct *vma,
42420 - unsigned long mm_flags)
42421 + unsigned long mm_flags, long signr)
42423 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
42425 @@ -1132,7 +1440,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
42426 if (vma->vm_file == NULL)
42429 - if (FILTER(MAPPED_PRIVATE))
42430 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
42434 @@ -1354,9 +1662,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
42436 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
42441 - while (auxv[i - 2] != AT_NULL);
42442 + } while (auxv[i - 2] != AT_NULL);
42443 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
42446 @@ -1862,14 +2170,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
42449 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
42450 - unsigned long mm_flags)
42451 + struct coredump_params *cprm)
42453 struct vm_area_struct *vma;
42456 for (vma = first_vma(current, gate_vma); vma != NULL;
42457 vma = next_vma(vma, gate_vma))
42458 - size += vma_dump_size(vma, mm_flags);
42459 + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42463 @@ -1963,7 +2271,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42465 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
42467 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
42468 + offset += elf_core_vma_data_size(gate_vma, cprm);
42469 offset += elf_core_extra_data_size();
42472 @@ -1977,10 +2285,12 @@ static int elf_core_dump(struct coredump_params *cprm)
42475 size += sizeof(*elf);
42476 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
42477 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
42480 size += sizeof(*phdr4note);
42481 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
42482 if (size > cprm->limit
42483 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
42485 @@ -1994,7 +2304,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42486 phdr.p_offset = offset;
42487 phdr.p_vaddr = vma->vm_start;
42489 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
42490 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42491 phdr.p_memsz = vma->vm_end - vma->vm_start;
42492 offset += phdr.p_filesz;
42493 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
42494 @@ -2005,6 +2315,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42495 phdr.p_align = ELF_EXEC_PAGESIZE;
42497 size += sizeof(phdr);
42498 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
42499 if (size > cprm->limit
42500 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
42502 @@ -2029,7 +2340,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42503 unsigned long addr;
42506 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
42507 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
42509 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
42511 @@ -2038,6 +2349,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42512 page = get_dump_page(addr);
42514 void *kaddr = kmap(page);
42515 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
42516 stop = ((size += PAGE_SIZE) > cprm->limit) ||
42517 !dump_write(cprm->file, kaddr,
42519 @@ -2055,6 +2367,7 @@ static int elf_core_dump(struct coredump_params *cprm)
42521 if (e_phnum == PN_XNUM) {
42522 size += sizeof(*shdr4extnum);
42523 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
42524 if (size > cprm->limit
42525 || !dump_write(cprm->file, shdr4extnum,
42526 sizeof(*shdr4extnum)))
42527 @@ -2075,6 +2388,97 @@ out:
42529 #endif /* CONFIG_ELF_CORE */
42531 +#ifdef CONFIG_PAX_MPROTECT
42532 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
42533 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
42534 + * we'll remove VM_MAYWRITE for good on RELRO segments.
42536 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
42537 + * basis because we want to allow the common case and not the special ones.
42539 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
42541 + struct elfhdr elf_h;
42542 + struct elf_phdr elf_p;
42544 + unsigned long oldflags;
42545 + bool is_textrel_rw, is_textrel_rx, is_relro;
42547 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
42550 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
42551 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
42553 +#ifdef CONFIG_PAX_ELFRELOCS
42554 + /* possible TEXTREL */
42555 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
42556 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
42558 + is_textrel_rw = false;
42559 + is_textrel_rx = false;
42562 + /* possible RELRO */
42563 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
42565 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
42568 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
42569 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
42571 +#ifdef CONFIG_PAX_ETEXECRELOCS
42572 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42574 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
42577 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42578 + !elf_check_arch(&elf_h) ||
42579 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
42580 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
42583 + for (i = 0UL; i < elf_h.e_phnum; i++) {
42584 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
42586 + switch (elf_p.p_type) {
42588 + if (!is_textrel_rw && !is_textrel_rx)
42591 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
42594 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
42596 + if (dyn.d_tag == DT_NULL)
42598 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
42599 + gr_log_textrel(vma);
42600 + if (is_textrel_rw)
42601 + vma->vm_flags |= VM_MAYWRITE;
42603 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
42604 + vma->vm_flags &= ~VM_MAYWRITE;
42611 + case PT_GNU_RELRO:
42614 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
42615 + vma->vm_flags &= ~VM_MAYWRITE;
42622 static int __init init_elf_binfmt(void)
42624 return register_binfmt(&elf_format);
42625 diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
42626 index 1bffbe0..c8c283e 100644
42627 --- a/fs/binfmt_flat.c
42628 +++ b/fs/binfmt_flat.c
42629 @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_binprm * bprm,
42630 realdatastart = (unsigned long) -ENOMEM;
42631 printk("Unable to allocate RAM for process data, errno %d\n",
42632 (int)-realdatastart);
42633 + down_write(¤t->mm->mmap_sem);
42634 do_munmap(current->mm, textpos, text_len);
42635 + up_write(¤t->mm->mmap_sem);
42636 ret = realdatastart;
42639 @@ -591,8 +593,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42641 if (IS_ERR_VALUE(result)) {
42642 printk("Unable to read data+bss, errno %d\n", (int)-result);
42643 + down_write(¤t->mm->mmap_sem);
42644 do_munmap(current->mm, textpos, text_len);
42645 do_munmap(current->mm, realdatastart, len);
42646 + up_write(¤t->mm->mmap_sem);
42650 @@ -661,8 +665,10 @@ static int load_flat_file(struct linux_binprm * bprm,
42652 if (IS_ERR_VALUE(result)) {
42653 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
42654 + down_write(¤t->mm->mmap_sem);
42655 do_munmap(current->mm, textpos, text_len + data_len + extra +
42656 MAX_SHARED_LIBS * sizeof(unsigned long));
42657 + up_write(¤t->mm->mmap_sem);
42661 diff --git a/fs/bio.c b/fs/bio.c
42662 index 9bfade8..782f3b9 100644
42665 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
42666 const int read = bio_data_dir(bio) == READ;
42667 struct bio_map_data *bmd = bio->bi_private;
42669 - char *p = bmd->sgvecs[0].iov_base;
42670 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
42672 __bio_for_each_segment(bvec, bio, i, 0) {
42673 char *addr = page_address(bvec->bv_page);
42674 diff --git a/fs/block_dev.c b/fs/block_dev.c
42675 index 1c44b8d..e2507b4 100644
42676 --- a/fs/block_dev.c
42677 +++ b/fs/block_dev.c
42678 @@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
42679 else if (bdev->bd_contains == bdev)
42680 return true; /* is a whole device which isn't held */
42682 - else if (whole->bd_holder == bd_may_claim)
42683 + else if (whole->bd_holder == (void *)bd_may_claim)
42684 return true; /* is a partition of a device that is being partitioned */
42685 else if (whole->bd_holder != NULL)
42686 return false; /* is a partition of a held device */
42687 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
42688 index 011cab3..9ace713 100644
42689 --- a/fs/btrfs/ctree.c
42690 +++ b/fs/btrfs/ctree.c
42691 @@ -488,9 +488,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
42692 free_extent_buffer(buf);
42693 add_root_to_dirty_list(root);
42695 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
42696 - parent_start = parent->start;
42698 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
42700 + parent_start = parent->start;
42702 + parent_start = 0;
42706 WARN_ON(trans->transid != btrfs_header_generation(parent));
42707 diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
42708 index b2d004a..6bb543d 100644
42709 --- a/fs/btrfs/inode.c
42710 +++ b/fs/btrfs/inode.c
42711 @@ -6922,7 +6922,7 @@ fail:
42715 -static int btrfs_getattr(struct vfsmount *mnt,
42716 +int btrfs_getattr(struct vfsmount *mnt,
42717 struct dentry *dentry, struct kstat *stat)
42719 struct inode *inode = dentry->d_inode;
42720 @@ -6934,6 +6934,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
42724 +EXPORT_SYMBOL(btrfs_getattr);
42726 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
42728 + return BTRFS_I(inode)->root->anon_dev;
42730 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
42733 * If a file is moved, it will inherit the cow and compression flags of the new
42735 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
42736 index dae5dfe..6aa01b1 100644
42737 --- a/fs/btrfs/ioctl.c
42738 +++ b/fs/btrfs/ioctl.c
42739 @@ -2704,9 +2704,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42740 for (i = 0; i < num_types; i++) {
42741 struct btrfs_space_info *tmp;
42743 + /* Don't copy in more than we allocated */
42751 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
42752 @@ -2728,15 +2731,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
42753 memcpy(dest, &space, sizeof(space));
42755 space_args.total_spaces++;
42761 up_read(&info->groups_sem);
42764 - user_dest = (struct btrfs_ioctl_space_info *)
42765 + user_dest = (struct btrfs_ioctl_space_info __user *)
42766 (arg + sizeof(struct btrfs_ioctl_space_args));
42768 if (copy_to_user(user_dest, dest_orig, alloc_size))
42769 diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
42770 index 59bb176..be9977d 100644
42771 --- a/fs/btrfs/relocation.c
42772 +++ b/fs/btrfs/relocation.c
42773 @@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
42775 spin_unlock(&rc->reloc_root_tree.lock);
42777 - BUG_ON((struct btrfs_root *)node->data != root);
42778 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
42781 spin_lock(&rc->reloc_root_tree.lock);
42782 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
42783 index 622f469..e8d2d55 100644
42784 --- a/fs/cachefiles/bind.c
42785 +++ b/fs/cachefiles/bind.c
42786 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
42789 /* start by checking things over */
42790 - ASSERT(cache->fstop_percent >= 0 &&
42791 - cache->fstop_percent < cache->fcull_percent &&
42792 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
42793 cache->fcull_percent < cache->frun_percent &&
42794 cache->frun_percent < 100);
42796 - ASSERT(cache->bstop_percent >= 0 &&
42797 - cache->bstop_percent < cache->bcull_percent &&
42798 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
42799 cache->bcull_percent < cache->brun_percent &&
42800 cache->brun_percent < 100);
42802 diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
42803 index 0a1467b..6a53245 100644
42804 --- a/fs/cachefiles/daemon.c
42805 +++ b/fs/cachefiles/daemon.c
42806 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
42810 - if (copy_to_user(_buffer, buffer, n) != 0)
42811 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
42815 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
42816 if (test_bit(CACHEFILES_DEAD, &cache->flags))
42819 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
42820 + if (datalen > PAGE_SIZE - 1)
42821 return -EOPNOTSUPP;
42823 /* drag the command string into the kernel so we can parse it */
42824 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
42825 if (args[0] != '%' || args[1] != '\0')
42828 - if (fstop < 0 || fstop >= cache->fcull_percent)
42829 + if (fstop >= cache->fcull_percent)
42830 return cachefiles_daemon_range_error(cache, args);
42832 cache->fstop_percent = fstop;
42833 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
42834 if (args[0] != '%' || args[1] != '\0')
42837 - if (bstop < 0 || bstop >= cache->bcull_percent)
42838 + if (bstop >= cache->bcull_percent)
42839 return cachefiles_daemon_range_error(cache, args);
42841 cache->bstop_percent = bstop;
42842 diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
42843 index bd6bc1b..b627b53 100644
42844 --- a/fs/cachefiles/internal.h
42845 +++ b/fs/cachefiles/internal.h
42846 @@ -57,7 +57,7 @@ struct cachefiles_cache {
42847 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
42848 struct rb_root active_nodes; /* active nodes (can't be culled) */
42849 rwlock_t active_lock; /* lock for active_nodes */
42850 - atomic_t gravecounter; /* graveyard uniquifier */
42851 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
42852 unsigned frun_percent; /* when to stop culling (% files) */
42853 unsigned fcull_percent; /* when to start culling (% files) */
42854 unsigned fstop_percent; /* when to stop allocating (% files) */
42855 @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
42858 #ifdef CONFIG_CACHEFILES_HISTOGRAM
42859 -extern atomic_t cachefiles_lookup_histogram[HZ];
42860 -extern atomic_t cachefiles_mkdir_histogram[HZ];
42861 -extern atomic_t cachefiles_create_histogram[HZ];
42862 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42863 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42864 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
42866 extern int __init cachefiles_proc_init(void);
42867 extern void cachefiles_proc_cleanup(void);
42869 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
42870 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
42872 unsigned long jif = jiffies - start_jif;
42875 - atomic_inc(&histogram[jif]);
42876 + atomic_inc_unchecked(&histogram[jif]);
42880 diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
42881 index a0358c2..d6137f2 100644
42882 --- a/fs/cachefiles/namei.c
42883 +++ b/fs/cachefiles/namei.c
42884 @@ -318,7 +318,7 @@ try_again:
42885 /* first step is to make up a grave dentry in the graveyard */
42886 sprintf(nbuffer, "%08x%08x",
42887 (uint32_t) get_seconds(),
42888 - (uint32_t) atomic_inc_return(&cache->gravecounter));
42889 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
42891 /* do the multiway lock magic */
42892 trap = lock_rename(cache->graveyard, dir);
42893 diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
42894 index eccd339..4c1d995 100644
42895 --- a/fs/cachefiles/proc.c
42896 +++ b/fs/cachefiles/proc.c
42898 #include <linux/seq_file.h>
42899 #include "internal.h"
42901 -atomic_t cachefiles_lookup_histogram[HZ];
42902 -atomic_t cachefiles_mkdir_histogram[HZ];
42903 -atomic_t cachefiles_create_histogram[HZ];
42904 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42905 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42906 +atomic_unchecked_t cachefiles_create_histogram[HZ];
42909 * display the latency histogram
42910 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
42913 index = (unsigned long) v - 3;
42914 - x = atomic_read(&cachefiles_lookup_histogram[index]);
42915 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
42916 - z = atomic_read(&cachefiles_create_histogram[index]);
42917 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
42918 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
42919 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
42920 if (x == 0 && y == 0 && z == 0)
42923 diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
42924 index 0e3c092..818480e 100644
42925 --- a/fs/cachefiles/rdwr.c
42926 +++ b/fs/cachefiles/rdwr.c
42927 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
42930 ret = file->f_op->write(
42931 - file, (const void __user *) data, len, &pos);
42932 + file, (const void __force_user *) data, len, &pos);
42936 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
42937 index 382abc9..bd89646 100644
42938 --- a/fs/ceph/dir.c
42939 +++ b/fs/ceph/dir.c
42940 @@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
42941 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
42942 struct ceph_mds_client *mdsc = fsc->mdsc;
42943 unsigned frag = fpos_frag(filp->f_pos);
42944 - int off = fpos_off(filp->f_pos);
42945 + unsigned int off = fpos_off(filp->f_pos);
42948 struct ceph_mds_reply_info_parsed *rinfo;
42949 diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
42950 index 6d40656..bc1f825 100644
42951 --- a/fs/cifs/cifs_debug.c
42952 +++ b/fs/cifs/cifs_debug.c
42953 @@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42955 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
42956 #ifdef CONFIG_CIFS_STATS2
42957 - atomic_set(&totBufAllocCount, 0);
42958 - atomic_set(&totSmBufAllocCount, 0);
42959 + atomic_set_unchecked(&totBufAllocCount, 0);
42960 + atomic_set_unchecked(&totSmBufAllocCount, 0);
42961 #endif /* CONFIG_CIFS_STATS2 */
42962 spin_lock(&cifs_tcp_ses_lock);
42963 list_for_each(tmp1, &cifs_tcp_ses_list) {
42964 @@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
42965 tcon = list_entry(tmp3,
42968 - atomic_set(&tcon->num_smbs_sent, 0);
42969 - atomic_set(&tcon->num_writes, 0);
42970 - atomic_set(&tcon->num_reads, 0);
42971 - atomic_set(&tcon->num_oplock_brks, 0);
42972 - atomic_set(&tcon->num_opens, 0);
42973 - atomic_set(&tcon->num_posixopens, 0);
42974 - atomic_set(&tcon->num_posixmkdirs, 0);
42975 - atomic_set(&tcon->num_closes, 0);
42976 - atomic_set(&tcon->num_deletes, 0);
42977 - atomic_set(&tcon->num_mkdirs, 0);
42978 - atomic_set(&tcon->num_rmdirs, 0);
42979 - atomic_set(&tcon->num_renames, 0);
42980 - atomic_set(&tcon->num_t2renames, 0);
42981 - atomic_set(&tcon->num_ffirst, 0);
42982 - atomic_set(&tcon->num_fnext, 0);
42983 - atomic_set(&tcon->num_fclose, 0);
42984 - atomic_set(&tcon->num_hardlinks, 0);
42985 - atomic_set(&tcon->num_symlinks, 0);
42986 - atomic_set(&tcon->num_locks, 0);
42987 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
42988 + atomic_set_unchecked(&tcon->num_writes, 0);
42989 + atomic_set_unchecked(&tcon->num_reads, 0);
42990 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
42991 + atomic_set_unchecked(&tcon->num_opens, 0);
42992 + atomic_set_unchecked(&tcon->num_posixopens, 0);
42993 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
42994 + atomic_set_unchecked(&tcon->num_closes, 0);
42995 + atomic_set_unchecked(&tcon->num_deletes, 0);
42996 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
42997 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
42998 + atomic_set_unchecked(&tcon->num_renames, 0);
42999 + atomic_set_unchecked(&tcon->num_t2renames, 0);
43000 + atomic_set_unchecked(&tcon->num_ffirst, 0);
43001 + atomic_set_unchecked(&tcon->num_fnext, 0);
43002 + atomic_set_unchecked(&tcon->num_fclose, 0);
43003 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
43004 + atomic_set_unchecked(&tcon->num_symlinks, 0);
43005 + atomic_set_unchecked(&tcon->num_locks, 0);
43009 @@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43010 smBufAllocCount.counter, cifs_min_small);
43011 #ifdef CONFIG_CIFS_STATS2
43012 seq_printf(m, "Total Large %d Small %d Allocations\n",
43013 - atomic_read(&totBufAllocCount),
43014 - atomic_read(&totSmBufAllocCount));
43015 + atomic_read_unchecked(&totBufAllocCount),
43016 + atomic_read_unchecked(&totSmBufAllocCount));
43017 #endif /* CONFIG_CIFS_STATS2 */
43019 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
43020 @@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43021 if (tcon->need_reconnect)
43022 seq_puts(m, "\tDISCONNECTED ");
43023 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
43024 - atomic_read(&tcon->num_smbs_sent),
43025 - atomic_read(&tcon->num_oplock_brks));
43026 + atomic_read_unchecked(&tcon->num_smbs_sent),
43027 + atomic_read_unchecked(&tcon->num_oplock_brks));
43028 seq_printf(m, "\nReads: %d Bytes: %lld",
43029 - atomic_read(&tcon->num_reads),
43030 + atomic_read_unchecked(&tcon->num_reads),
43031 (long long)(tcon->bytes_read));
43032 seq_printf(m, "\nWrites: %d Bytes: %lld",
43033 - atomic_read(&tcon->num_writes),
43034 + atomic_read_unchecked(&tcon->num_writes),
43035 (long long)(tcon->bytes_written));
43036 seq_printf(m, "\nFlushes: %d",
43037 - atomic_read(&tcon->num_flushes));
43038 + atomic_read_unchecked(&tcon->num_flushes));
43039 seq_printf(m, "\nLocks: %d HardLinks: %d "
43041 - atomic_read(&tcon->num_locks),
43042 - atomic_read(&tcon->num_hardlinks),
43043 - atomic_read(&tcon->num_symlinks));
43044 + atomic_read_unchecked(&tcon->num_locks),
43045 + atomic_read_unchecked(&tcon->num_hardlinks),
43046 + atomic_read_unchecked(&tcon->num_symlinks));
43047 seq_printf(m, "\nOpens: %d Closes: %d "
43049 - atomic_read(&tcon->num_opens),
43050 - atomic_read(&tcon->num_closes),
43051 - atomic_read(&tcon->num_deletes));
43052 + atomic_read_unchecked(&tcon->num_opens),
43053 + atomic_read_unchecked(&tcon->num_closes),
43054 + atomic_read_unchecked(&tcon->num_deletes));
43055 seq_printf(m, "\nPosix Opens: %d "
43056 "Posix Mkdirs: %d",
43057 - atomic_read(&tcon->num_posixopens),
43058 - atomic_read(&tcon->num_posixmkdirs));
43059 + atomic_read_unchecked(&tcon->num_posixopens),
43060 + atomic_read_unchecked(&tcon->num_posixmkdirs));
43061 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
43062 - atomic_read(&tcon->num_mkdirs),
43063 - atomic_read(&tcon->num_rmdirs));
43064 + atomic_read_unchecked(&tcon->num_mkdirs),
43065 + atomic_read_unchecked(&tcon->num_rmdirs));
43066 seq_printf(m, "\nRenames: %d T2 Renames %d",
43067 - atomic_read(&tcon->num_renames),
43068 - atomic_read(&tcon->num_t2renames));
43069 + atomic_read_unchecked(&tcon->num_renames),
43070 + atomic_read_unchecked(&tcon->num_t2renames));
43071 seq_printf(m, "\nFindFirst: %d FNext %d "
43073 - atomic_read(&tcon->num_ffirst),
43074 - atomic_read(&tcon->num_fnext),
43075 - atomic_read(&tcon->num_fclose));
43076 + atomic_read_unchecked(&tcon->num_ffirst),
43077 + atomic_read_unchecked(&tcon->num_fnext),
43078 + atomic_read_unchecked(&tcon->num_fclose));
43082 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
43083 index 54b8f1e..f6a4c00 100644
43084 --- a/fs/cifs/cifsfs.c
43085 +++ b/fs/cifs/cifsfs.c
43086 @@ -981,7 +981,7 @@ cifs_init_request_bufs(void)
43087 cifs_req_cachep = kmem_cache_create("cifs_request",
43089 MAX_CIFS_HDR_SIZE, 0,
43090 - SLAB_HWCACHE_ALIGN, NULL);
43091 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43092 if (cifs_req_cachep == NULL)
43095 @@ -1008,7 +1008,7 @@ cifs_init_request_bufs(void)
43096 efficient to alloc 1 per page off the slab compared to 17K (5page)
43097 alloc of large cifs buffers even when page debugging is on */
43098 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43099 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43100 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43102 if (cifs_sm_req_cachep == NULL) {
43103 mempool_destroy(cifs_req_poolp);
43104 @@ -1093,8 +1093,8 @@ init_cifs(void)
43105 atomic_set(&bufAllocCount, 0);
43106 atomic_set(&smBufAllocCount, 0);
43107 #ifdef CONFIG_CIFS_STATS2
43108 - atomic_set(&totBufAllocCount, 0);
43109 - atomic_set(&totSmBufAllocCount, 0);
43110 + atomic_set_unchecked(&totBufAllocCount, 0);
43111 + atomic_set_unchecked(&totSmBufAllocCount, 0);
43112 #endif /* CONFIG_CIFS_STATS2 */
43114 atomic_set(&midCount, 0);
43115 diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
43116 index 95dad9d..fe7af1a 100644
43117 --- a/fs/cifs/cifsglob.h
43118 +++ b/fs/cifs/cifsglob.h
43119 @@ -381,28 +381,28 @@ struct cifs_tcon {
43120 __u16 Flags; /* optional support bits */
43121 enum statusEnum tidStatus;
43122 #ifdef CONFIG_CIFS_STATS
43123 - atomic_t num_smbs_sent;
43124 - atomic_t num_writes;
43125 - atomic_t num_reads;
43126 - atomic_t num_flushes;
43127 - atomic_t num_oplock_brks;
43128 - atomic_t num_opens;
43129 - atomic_t num_closes;
43130 - atomic_t num_deletes;
43131 - atomic_t num_mkdirs;
43132 - atomic_t num_posixopens;
43133 - atomic_t num_posixmkdirs;
43134 - atomic_t num_rmdirs;
43135 - atomic_t num_renames;
43136 - atomic_t num_t2renames;
43137 - atomic_t num_ffirst;
43138 - atomic_t num_fnext;
43139 - atomic_t num_fclose;
43140 - atomic_t num_hardlinks;
43141 - atomic_t num_symlinks;
43142 - atomic_t num_locks;
43143 - atomic_t num_acl_get;
43144 - atomic_t num_acl_set;
43145 + atomic_unchecked_t num_smbs_sent;
43146 + atomic_unchecked_t num_writes;
43147 + atomic_unchecked_t num_reads;
43148 + atomic_unchecked_t num_flushes;
43149 + atomic_unchecked_t num_oplock_brks;
43150 + atomic_unchecked_t num_opens;
43151 + atomic_unchecked_t num_closes;
43152 + atomic_unchecked_t num_deletes;
43153 + atomic_unchecked_t num_mkdirs;
43154 + atomic_unchecked_t num_posixopens;
43155 + atomic_unchecked_t num_posixmkdirs;
43156 + atomic_unchecked_t num_rmdirs;
43157 + atomic_unchecked_t num_renames;
43158 + atomic_unchecked_t num_t2renames;
43159 + atomic_unchecked_t num_ffirst;
43160 + atomic_unchecked_t num_fnext;
43161 + atomic_unchecked_t num_fclose;
43162 + atomic_unchecked_t num_hardlinks;
43163 + atomic_unchecked_t num_symlinks;
43164 + atomic_unchecked_t num_locks;
43165 + atomic_unchecked_t num_acl_get;
43166 + atomic_unchecked_t num_acl_set;
43167 #ifdef CONFIG_CIFS_STATS2
43168 unsigned long long time_writes;
43169 unsigned long long time_reads;
43170 @@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim)
43173 #ifdef CONFIG_CIFS_STATS
43174 -#define cifs_stats_inc atomic_inc
43175 +#define cifs_stats_inc atomic_inc_unchecked
43177 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
43178 unsigned int bytes)
43179 @@ -953,8 +953,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
43180 /* Various Debug counters */
43181 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43182 #ifdef CONFIG_CIFS_STATS2
43183 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43184 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43185 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43186 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43188 GLOBAL_EXTERN atomic_t smBufAllocCount;
43189 GLOBAL_EXTERN atomic_t midCount;
43190 diff --git a/fs/cifs/link.c b/fs/cifs/link.c
43191 index db3f18c..1f5955e 100644
43192 --- a/fs/cifs/link.c
43193 +++ b/fs/cifs/link.c
43194 @@ -593,7 +593,7 @@ symlink_exit:
43196 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43198 - char *p = nd_get_link(nd);
43199 + const char *p = nd_get_link(nd);
43203 diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
43204 index 7c16933..c8212b5 100644
43205 --- a/fs/cifs/misc.c
43206 +++ b/fs/cifs/misc.c
43207 @@ -156,7 +156,7 @@ cifs_buf_get(void)
43208 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43209 atomic_inc(&bufAllocCount);
43210 #ifdef CONFIG_CIFS_STATS2
43211 - atomic_inc(&totBufAllocCount);
43212 + atomic_inc_unchecked(&totBufAllocCount);
43213 #endif /* CONFIG_CIFS_STATS2 */
43216 @@ -191,7 +191,7 @@ cifs_small_buf_get(void)
43217 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43218 atomic_inc(&smBufAllocCount);
43219 #ifdef CONFIG_CIFS_STATS2
43220 - atomic_inc(&totSmBufAllocCount);
43221 + atomic_inc_unchecked(&totSmBufAllocCount);
43222 #endif /* CONFIG_CIFS_STATS2 */
43225 diff --git a/fs/coda/cache.c b/fs/coda/cache.c
43226 index 6901578..d402eb5 100644
43227 --- a/fs/coda/cache.c
43228 +++ b/fs/coda/cache.c
43230 #include "coda_linux.h"
43231 #include "coda_cache.h"
43233 -static atomic_t permission_epoch = ATOMIC_INIT(0);
43234 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
43236 /* replace or extend an acl cache hit */
43237 void coda_cache_enter(struct inode *inode, int mask)
43238 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
43239 struct coda_inode_info *cii = ITOC(inode);
43241 spin_lock(&cii->c_lock);
43242 - cii->c_cached_epoch = atomic_read(&permission_epoch);
43243 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
43244 if (cii->c_uid != current_fsuid()) {
43245 cii->c_uid = current_fsuid();
43246 cii->c_cached_perm = mask;
43247 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
43249 struct coda_inode_info *cii = ITOC(inode);
43250 spin_lock(&cii->c_lock);
43251 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
43252 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
43253 spin_unlock(&cii->c_lock);
43256 /* remove all acl caches */
43257 void coda_cache_clear_all(struct super_block *sb)
43259 - atomic_inc(&permission_epoch);
43260 + atomic_inc_unchecked(&permission_epoch);
43264 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
43265 spin_lock(&cii->c_lock);
43266 hit = (mask & cii->c_cached_perm) == mask &&
43267 cii->c_uid == current_fsuid() &&
43268 - cii->c_cached_epoch == atomic_read(&permission_epoch);
43269 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
43270 spin_unlock(&cii->c_lock);
43273 diff --git a/fs/compat.c b/fs/compat.c
43274 index 58b1da4..afcd9b8 100644
43277 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
43278 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
43280 compat_ino_t ino = stat->ino;
43281 - typeof(ubuf->st_uid) uid = 0;
43282 - typeof(ubuf->st_gid) gid = 0;
43283 + typeof(((struct compat_stat *)0)->st_uid) uid = 0;
43284 + typeof(((struct compat_stat *)0)->st_gid) gid = 0;
43287 SET_UID(uid, stat->uid);
43288 @@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
43291 /* The __user pointer cast is valid because of the set_fs() */
43292 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
43293 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
43295 /* truncating is ok because it's a user address */
43297 @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
43301 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
43302 + if (nr_segs > UIO_MAXIOV)
43304 if (nr_segs > fast_segs) {
43306 @@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
43308 struct compat_readdir_callback {
43309 struct compat_old_linux_dirent __user *dirent;
43310 + struct file * file;
43314 @@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
43315 buf->result = -EOVERFLOW;
43319 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43323 dirent = buf->dirent;
43324 if (!access_ok(VERIFY_WRITE, dirent,
43325 @@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
43328 buf.dirent = dirent;
43331 error = vfs_readdir(file, compat_fillonedir, &buf);
43333 @@ -917,6 +923,7 @@ struct compat_linux_dirent {
43334 struct compat_getdents_callback {
43335 struct compat_linux_dirent __user *current_dir;
43336 struct compat_linux_dirent __user *previous;
43337 + struct file * file;
43341 @@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
43342 buf->error = -EOVERFLOW;
43346 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43349 dirent = buf->previous;
43351 if (__put_user(offset, &dirent->d_off))
43352 @@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
43353 buf.previous = NULL;
43358 error = vfs_readdir(file, compat_filldir, &buf);
43360 @@ -1006,6 +1018,7 @@ out:
43361 struct compat_getdents_callback64 {
43362 struct linux_dirent64 __user *current_dir;
43363 struct linux_dirent64 __user *previous;
43364 + struct file * file;
43368 @@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
43369 buf->error = -EINVAL; /* only used if we fail.. */
43370 if (reclen > buf->count)
43373 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43376 dirent = buf->previous;
43379 @@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
43380 buf.previous = NULL;
43385 error = vfs_readdir(file, compat_filldir64, &buf);
43388 lastdirent = buf.previous;
43390 - typeof(lastdirent->d_off) d_off = file->f_pos;
43391 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
43392 if (__put_user_unaligned(d_off, &lastdirent->d_off))
43395 @@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
43396 struct fdtable *fdt;
43397 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
43399 + pax_track_stack();
43404 diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
43405 index 112e45a..b59845b 100644
43406 --- a/fs/compat_binfmt_elf.c
43407 +++ b/fs/compat_binfmt_elf.c
43408 @@ -30,11 +30,13 @@
43414 #define elfhdr elf32_hdr
43415 #define elf_phdr elf32_phdr
43416 #define elf_shdr elf32_shdr
43417 #define elf_note elf32_note
43418 +#define elf_dyn Elf32_Dyn
43419 #define elf_addr_t Elf32_Addr
43422 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
43423 index 51352de..93292ff 100644
43424 --- a/fs/compat_ioctl.c
43425 +++ b/fs/compat_ioctl.c
43426 @@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
43428 err = get_user(palp, &up->palette);
43429 err |= get_user(length, &up->length);
43433 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
43434 err = put_user(compat_ptr(palp), &up_native->palette);
43435 @@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
43437 if (__get_user(udata, &ss32->iomem_base))
43439 - ss.iomem_base = compat_ptr(udata);
43440 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
43441 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
43442 __get_user(ss.port_high, &ss32->port_high))
43444 @@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
43445 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
43446 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
43447 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
43448 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43449 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
43452 return ioctl_preallocate(file, p);
43453 @@ -1644,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
43454 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
43457 - a = *(unsigned int *)p;
43458 - b = *(unsigned int *)q;
43459 + a = *(const unsigned int *)p;
43460 + b = *(const unsigned int *)q;
43464 diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
43465 index 9a37a9b..35792b6 100644
43466 --- a/fs/configfs/dir.c
43467 +++ b/fs/configfs/dir.c
43468 @@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43470 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
43471 struct configfs_dirent *next;
43472 - const char * name;
43473 + const unsigned char * name;
43474 + char d_name[sizeof(next->s_dentry->d_iname)];
43476 struct inode *inode = NULL;
43478 @@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
43481 name = configfs_get_name(next);
43482 - len = strlen(name);
43483 + if (next->s_dentry && name == next->s_dentry->d_iname) {
43484 + len = next->s_dentry->d_name.len;
43485 + memcpy(d_name, name, len);
43488 + len = strlen(name);
43491 * We'll have a dentry and an inode for
43492 diff --git a/fs/dcache.c b/fs/dcache.c
43493 index 8b732a2..6db6c27 100644
43496 @@ -3015,7 +3015,7 @@ void __init vfs_caches_init(unsigned long mempages)
43497 mempages -= reserve;
43499 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
43500 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
43501 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
43505 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
43506 index 528da01..bd8c23d 100644
43507 --- a/fs/ecryptfs/inode.c
43508 +++ b/fs/ecryptfs/inode.c
43509 @@ -691,7 +691,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
43512 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
43513 - (char __user *)lower_buf,
43514 + (char __force_user *)lower_buf,
43518 @@ -737,7 +737,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
43522 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
43523 + rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
43527 @@ -752,7 +752,7 @@ out:
43529 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
43531 - char *buf = nd_get_link(nd);
43532 + const char *buf = nd_get_link(nd);
43533 if (!IS_ERR(buf)) {
43534 /* Free the char* */
43536 diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
43537 index 940a82e..63af89e 100644
43538 --- a/fs/ecryptfs/miscdev.c
43539 +++ b/fs/ecryptfs/miscdev.c
43540 @@ -328,7 +328,7 @@ check_list:
43541 goto out_unlock_msg_ctx;
43543 if (msg_ctx->msg) {
43544 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
43545 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
43546 goto out_unlock_msg_ctx;
43547 i += packet_length_size;
43548 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
43549 diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
43550 index 3745f7c..89cc7a3 100644
43551 --- a/fs/ecryptfs/read_write.c
43552 +++ b/fs/ecryptfs/read_write.c
43553 @@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
43555 fs_save = get_fs();
43557 - rc = vfs_write(lower_file, data, size, &offset);
43558 + rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
43560 mark_inode_dirty_sync(ecryptfs_inode);
43562 @@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
43564 fs_save = get_fs();
43566 - rc = vfs_read(lower_file, data, size, &offset);
43567 + rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
43571 diff --git a/fs/exec.c b/fs/exec.c
43572 index 25dcbe5..4ffaa78 100644
43575 @@ -55,12 +55,24 @@
43576 #include <linux/pipe_fs_i.h>
43577 #include <linux/oom.h>
43578 #include <linux/compat.h>
43579 +#include <linux/random.h>
43580 +#include <linux/seq_file.h>
43582 +#ifdef CONFIG_PAX_REFCOUNT
43583 +#include <linux/kallsyms.h>
43584 +#include <linux/kdebug.h>
43587 #include <asm/uaccess.h>
43588 #include <asm/mmu_context.h>
43589 #include <asm/tlb.h>
43590 #include "internal.h"
43592 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
43593 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
43594 +EXPORT_SYMBOL(pax_set_initial_flags_func);
43598 char core_pattern[CORENAME_MAX_SIZE] = "core";
43599 unsigned int core_pipe_limit;
43600 @@ -70,7 +82,7 @@ struct core_name {
43604 -static atomic_t call_count = ATOMIC_INIT(1);
43605 +static atomic_unchecked_t call_count = ATOMIC_INIT(1);
43607 /* The maximal length of core_pattern is also specified in sysctl.c */
43609 @@ -188,18 +200,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
43615 -#ifdef CONFIG_STACK_GROWSUP
43617 - ret = expand_downwards(bprm->vma, pos);
43622 - ret = get_user_pages(current, bprm->mm, pos,
43623 - 1, write, 1, &page, NULL);
43625 + if (0 > expand_downwards(bprm->vma, pos))
43627 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
43631 @@ -274,6 +278,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43632 vma->vm_end = STACK_TOP_MAX;
43633 vma->vm_start = vma->vm_end - PAGE_SIZE;
43634 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
43636 +#ifdef CONFIG_PAX_SEGMEXEC
43637 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
43640 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
43641 INIT_LIST_HEAD(&vma->anon_vma_chain);
43643 @@ -288,6 +297,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
43644 mm->stack_vm = mm->total_vm = 1;
43645 up_write(&mm->mmap_sem);
43646 bprm->p = vma->vm_end - sizeof(void *);
43648 +#ifdef CONFIG_PAX_RANDUSTACK
43649 + if (randomize_va_space)
43650 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
43655 up_write(&mm->mmap_sem);
43656 @@ -396,19 +411,7 @@ err:
43660 -struct user_arg_ptr {
43661 -#ifdef CONFIG_COMPAT
43665 - const char __user *const __user *native;
43666 -#ifdef CONFIG_COMPAT
43667 - compat_uptr_t __user *compat;
43672 -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43673 +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43675 const char __user *native;
43677 @@ -417,14 +420,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
43678 compat_uptr_t compat;
43680 if (get_user(compat, argv.ptr.compat + nr))
43681 - return ERR_PTR(-EFAULT);
43682 + return (const char __force_user *)ERR_PTR(-EFAULT);
43684 return compat_ptr(compat);
43688 if (get_user(native, argv.ptr.native + nr))
43689 - return ERR_PTR(-EFAULT);
43690 + return (const char __force_user *)ERR_PTR(-EFAULT);
43694 @@ -443,7 +446,7 @@ static int count(struct user_arg_ptr argv, int max)
43699 + if (IS_ERR((const char __force_kernel *)p))
43703 @@ -477,7 +480,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
43706 str = get_user_arg_ptr(argv, argc);
43708 + if (IS_ERR((const char __force_kernel *)str))
43711 len = strnlen_user(str, MAX_ARG_STRLEN);
43712 @@ -559,7 +562,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
43714 mm_segment_t oldfs = get_fs();
43715 struct user_arg_ptr argv = {
43716 - .ptr.native = (const char __user *const __user *)__argv,
43717 + .ptr.native = (const char __force_user *const __force_user *)__argv,
43721 @@ -594,7 +597,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43722 unsigned long new_end = old_end - shift;
43723 struct mmu_gather tlb;
43725 - BUG_ON(new_start > new_end);
43726 + if (new_start >= new_end || new_start < mmap_min_addr)
43730 * ensure there are no vmas between where we want to go
43731 @@ -603,6 +607,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
43732 if (vma != find_vma(mm, new_start))
43735 +#ifdef CONFIG_PAX_SEGMEXEC
43736 + BUG_ON(pax_find_mirror_vma(vma));
43740 * cover the whole range: [new_start, old_end)
43742 @@ -683,10 +691,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43743 stack_top = arch_align_stack(stack_top);
43744 stack_top = PAGE_ALIGN(stack_top);
43746 - if (unlikely(stack_top < mmap_min_addr) ||
43747 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
43750 stack_shift = vma->vm_end - stack_top;
43752 bprm->p -= stack_shift;
43753 @@ -698,8 +702,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
43754 bprm->exec -= stack_shift;
43756 down_write(&mm->mmap_sem);
43758 + /* Move stack pages down in memory. */
43759 + if (stack_shift) {
43760 + ret = shift_arg_pages(vma, stack_shift);
43765 vm_flags = VM_STACK_FLAGS;
43767 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43768 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43769 + vm_flags &= ~VM_EXEC;
43771 +#ifdef CONFIG_PAX_MPROTECT
43772 + if (mm->pax_flags & MF_PAX_MPROTECT)
43773 + vm_flags &= ~VM_MAYEXEC;
43780 * Adjust stack execute permissions; explicitly enable for
43781 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
43782 @@ -718,13 +742,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
43784 BUG_ON(prev != vma);
43786 - /* Move stack pages down in memory. */
43787 - if (stack_shift) {
43788 - ret = shift_arg_pages(vma, stack_shift);
43793 /* mprotect_fixup is overkill to remove the temporary stack flags */
43794 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
43796 @@ -805,7 +822,7 @@ int kernel_read(struct file *file, loff_t offset,
43799 /* The cast to a user pointer is valid due to the set_fs() */
43800 - result = vfs_read(file, (void __user *)addr, count, &pos);
43801 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
43805 @@ -1251,7 +1268,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
43809 - if (p->fs->users > n_fs) {
43810 + if (atomic_read(&p->fs->users) > n_fs) {
43811 bprm->unsafe |= LSM_UNSAFE_SHARE;
43814 @@ -1454,6 +1471,11 @@ static int do_execve_common(const char *filename,
43815 struct user_arg_ptr envp,
43816 struct pt_regs *regs)
43818 +#ifdef CONFIG_GRKERNSEC
43819 + struct file *old_exec_file;
43820 + struct acl_subject_label *old_acl;
43821 + struct rlimit old_rlim[RLIM_NLIMITS];
43823 struct linux_binprm *bprm;
43825 struct files_struct *displaced;
43826 @@ -1461,6 +1483,8 @@ static int do_execve_common(const char *filename,
43828 const struct cred *cred = current_cred();
43830 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
43833 * We move the actual failure in case of RLIMIT_NPROC excess from
43834 * set*uid() to execve() because too many poorly written programs
43835 @@ -1507,6 +1531,16 @@ static int do_execve_common(const char *filename,
43836 bprm->filename = filename;
43837 bprm->interp = filename;
43839 + if (gr_process_user_ban()) {
43844 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
43845 + retval = -EACCES;
43849 retval = bprm_mm_init(bprm);
43852 @@ -1536,9 +1570,40 @@ static int do_execve_common(const char *filename,
43856 + if (!gr_tpe_allow(file)) {
43857 + retval = -EACCES;
43861 + if (gr_check_crash_exec(file)) {
43862 + retval = -EACCES;
43866 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
43868 + gr_handle_exec_args(bprm, argv);
43870 +#ifdef CONFIG_GRKERNSEC
43871 + old_acl = current->acl;
43872 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
43873 + old_exec_file = current->exec_file;
43875 + current->exec_file = file;
43878 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
43879 + bprm->unsafe & LSM_UNSAFE_SHARE);
43883 retval = search_binary_handler(bprm,regs);
43887 +#ifdef CONFIG_GRKERNSEC
43888 + if (old_exec_file)
43889 + fput(old_exec_file);
43892 /* execve succeeded */
43893 current->fs->in_exec = 0;
43894 @@ -1549,6 +1614,14 @@ static int do_execve_common(const char *filename,
43895 put_files_struct(displaced);
43899 +#ifdef CONFIG_GRKERNSEC
43900 + current->acl = old_acl;
43901 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
43902 + fput(current->exec_file);
43903 + current->exec_file = old_exec_file;
43908 acct_arg_size(bprm, 0);
43909 @@ -1622,7 +1695,7 @@ static int expand_corename(struct core_name *cn)
43911 char *old_corename = cn->corename;
43913 - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
43914 + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
43915 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
43917 if (!cn->corename) {
43918 @@ -1719,7 +1792,7 @@ static int format_corename(struct core_name *cn, long signr)
43919 int pid_in_pattern = 0;
43922 - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
43923 + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
43924 cn->corename = kmalloc(cn->size, GFP_KERNEL);
43927 @@ -1816,6 +1889,218 @@ out:
43931 +int pax_check_flags(unsigned long *flags)
43935 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
43936 + if (*flags & MF_PAX_SEGMEXEC)
43938 + *flags &= ~MF_PAX_SEGMEXEC;
43939 + retval = -EINVAL;
43943 + if ((*flags & MF_PAX_PAGEEXEC)
43945 +#ifdef CONFIG_PAX_PAGEEXEC
43946 + && (*flags & MF_PAX_SEGMEXEC)
43951 + *flags &= ~MF_PAX_PAGEEXEC;
43952 + retval = -EINVAL;
43955 + if ((*flags & MF_PAX_MPROTECT)
43957 +#ifdef CONFIG_PAX_MPROTECT
43958 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43963 + *flags &= ~MF_PAX_MPROTECT;
43964 + retval = -EINVAL;
43967 + if ((*flags & MF_PAX_EMUTRAMP)
43969 +#ifdef CONFIG_PAX_EMUTRAMP
43970 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43975 + *flags &= ~MF_PAX_EMUTRAMP;
43976 + retval = -EINVAL;
43982 +EXPORT_SYMBOL(pax_check_flags);
43984 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43985 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
43987 + struct task_struct *tsk = current;
43988 + struct mm_struct *mm = current->mm;
43989 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
43990 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
43991 + char *path_exec = NULL;
43992 + char *path_fault = NULL;
43993 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
43995 + if (buffer_exec && buffer_fault) {
43996 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
43998 + down_read(&mm->mmap_sem);
44000 + while (vma && (!vma_exec || !vma_fault)) {
44001 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
44003 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
44005 + vma = vma->vm_next;
44008 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
44009 + if (IS_ERR(path_exec))
44010 + path_exec = "<path too long>";
44012 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
44015 + path_exec = buffer_exec;
44017 + path_exec = "<path too long>";
44021 + start = vma_fault->vm_start;
44022 + end = vma_fault->vm_end;
44023 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
44024 + if (vma_fault->vm_file) {
44025 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
44026 + if (IS_ERR(path_fault))
44027 + path_fault = "<path too long>";
44029 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
44030 + if (path_fault) {
44032 + path_fault = buffer_fault;
44034 + path_fault = "<path too long>";
44037 + path_fault = "<anonymous mapping>";
44039 + up_read(&mm->mmap_sem);
44041 + if (tsk->signal->curr_ip)
44042 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
44044 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
44045 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
44046 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
44047 + task_uid(tsk), task_euid(tsk), pc, sp);
44048 + free_page((unsigned long)buffer_exec);
44049 + free_page((unsigned long)buffer_fault);
44050 + pax_report_insns(regs, pc, sp);
44051 + do_coredump(SIGKILL, SIGKILL, regs);
44055 +#ifdef CONFIG_PAX_REFCOUNT
44056 +void pax_report_refcount_overflow(struct pt_regs *regs)
44058 + if (current->signal->curr_ip)
44059 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44060 + ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
44062 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44063 + current->comm, task_pid_nr(current), current_uid(), current_euid());
44064 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44066 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
44070 +#ifdef CONFIG_PAX_USERCOPY
44071 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44072 +int object_is_on_stack(const void *obj, unsigned long len)
44074 + const void * const stack = task_stack_page(current);
44075 + const void * const stackend = stack + THREAD_SIZE;
44077 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44078 + const void *frame = NULL;
44079 + const void *oldframe;
44082 + if (obj + len < obj)
44085 + if (obj + len <= stack || stackend <= obj)
44088 + if (obj < stack || stackend < obj + len)
44091 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44092 + oldframe = __builtin_frame_address(1);
44094 + frame = __builtin_frame_address(2);
44096 + low ----------------------------------------------> high
44097 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
44098 + ^----------------^
44099 + allow copies only within here
44101 + while (stack <= frame && frame < stackend) {
44102 + /* if obj + len extends past the last frame, this
44103 + check won't pass and the next frame will be 0,
44104 + causing us to bail out and correctly report
44105 + the copy as invalid
44107 + if (obj + len <= frame)
44108 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44109 + oldframe = frame;
44110 + frame = *(const void * const *)frame;
44118 +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44120 + if (current->signal->curr_ip)
44121 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44122 + ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44124 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44125 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44127 + gr_handle_kernel_exploit();
44128 + do_group_exit(SIGKILL);
44132 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
44133 +void pax_track_stack(void)
44135 + unsigned long sp = (unsigned long)&sp;
44136 + if (sp < current_thread_info()->lowest_stack &&
44137 + sp > (unsigned long)task_stack_page(current))
44138 + current_thread_info()->lowest_stack = sp;
44140 +EXPORT_SYMBOL(pax_track_stack);
44143 static int zap_process(struct task_struct *start, int exit_code)
44145 struct task_struct *t;
44146 @@ -2027,17 +2312,17 @@ static void wait_for_dump_helpers(struct file *file)
44147 pipe = file->f_path.dentry->d_inode->i_pipe;
44152 + atomic_inc(&pipe->readers);
44153 + atomic_dec(&pipe->writers);
44155 - while ((pipe->readers > 1) && (!signal_pending(current))) {
44156 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
44157 wake_up_interruptible_sync(&pipe->wait);
44158 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
44164 + atomic_dec(&pipe->readers);
44165 + atomic_inc(&pipe->writers);
44169 @@ -2098,7 +2383,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44173 - static atomic_t core_dump_count = ATOMIC_INIT(0);
44174 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
44175 struct coredump_params cprm = {
44178 @@ -2113,6 +2398,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44180 audit_core_dumps(signr);
44182 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
44183 + gr_handle_brute_attach(current, cprm.mm_flags);
44185 binfmt = mm->binfmt;
44186 if (!binfmt || !binfmt->core_dump)
44188 @@ -2180,7 +2468,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44190 cprm.limit = RLIM_INFINITY;
44192 - dump_count = atomic_inc_return(&core_dump_count);
44193 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
44194 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
44195 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
44196 task_tgid_vnr(current), current->comm);
44197 @@ -2207,6 +2495,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
44199 struct inode *inode;
44201 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
44203 if (cprm.limit < binfmt->min_coredump)
44206 @@ -2250,7 +2540,7 @@ close_fail:
44207 filp_close(cprm.file, NULL);
44210 - atomic_dec(&core_dump_count);
44211 + atomic_dec_unchecked(&core_dump_count);
44213 kfree(cn.corename);
44215 @@ -2269,7 +2559,7 @@ fail:
44217 int dump_write(struct file *file, const void *addr, int nr)
44219 - return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
44220 + return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
44222 EXPORT_SYMBOL(dump_write);
44224 diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
44225 index 8f44cef..cb07120 100644
44226 --- a/fs/ext2/balloc.c
44227 +++ b/fs/ext2/balloc.c
44228 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
44230 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44231 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44232 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44233 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44234 sbi->s_resuid != current_fsuid() &&
44235 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44237 diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
44238 index 6386d76..0a266b1 100644
44239 --- a/fs/ext3/balloc.c
44240 +++ b/fs/ext3/balloc.c
44241 @@ -1446,7 +1446,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
44243 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
44244 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
44245 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
44246 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
44247 sbi->s_resuid != current_fsuid() &&
44248 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
44250 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
44251 index f8224ad..fbef97c 100644
44252 --- a/fs/ext4/balloc.c
44253 +++ b/fs/ext4/balloc.c
44254 @@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct ext4_sb_info *sbi,
44255 /* Hm, nope. Are (enough) root reserved blocks available? */
44256 if (sbi->s_resuid == current_fsuid() ||
44257 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
44258 - capable(CAP_SYS_RESOURCE) ||
44259 - (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
44260 + (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
44261 + capable_nolog(CAP_SYS_RESOURCE)) {
44263 if (free_blocks >= (nblocks + dirty_blocks))
44265 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
44266 index 5c38120..2291d18 100644
44267 --- a/fs/ext4/ext4.h
44268 +++ b/fs/ext4/ext4.h
44269 @@ -1180,19 +1180,19 @@ struct ext4_sb_info {
44270 unsigned long s_mb_last_start;
44272 /* stats for buddy allocator */
44273 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
44274 - atomic_t s_bal_success; /* we found long enough chunks */
44275 - atomic_t s_bal_allocated; /* in blocks */
44276 - atomic_t s_bal_ex_scanned; /* total extents scanned */
44277 - atomic_t s_bal_goals; /* goal hits */
44278 - atomic_t s_bal_breaks; /* too long searches */
44279 - atomic_t s_bal_2orders; /* 2^order hits */
44280 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
44281 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
44282 + atomic_unchecked_t s_bal_allocated; /* in blocks */
44283 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
44284 + atomic_unchecked_t s_bal_goals; /* goal hits */
44285 + atomic_unchecked_t s_bal_breaks; /* too long searches */
44286 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
44287 spinlock_t s_bal_lock;
44288 unsigned long s_mb_buddies_generated;
44289 unsigned long long s_mb_generation_time;
44290 - atomic_t s_mb_lost_chunks;
44291 - atomic_t s_mb_preallocated;
44292 - atomic_t s_mb_discarded;
44293 + atomic_unchecked_t s_mb_lost_chunks;
44294 + atomic_unchecked_t s_mb_preallocated;
44295 + atomic_unchecked_t s_mb_discarded;
44296 atomic_t s_lock_busy;
44298 /* locality groups */
44299 diff --git a/fs/ext4/file.c b/fs/ext4/file.c
44300 index e4095e9..1c006c5 100644
44301 --- a/fs/ext4/file.c
44302 +++ b/fs/ext4/file.c
44303 @@ -181,8 +181,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
44304 path.dentry = mnt->mnt_root;
44305 cp = d_path(&path, buf, sizeof(buf));
44307 - memcpy(sbi->s_es->s_last_mounted, cp,
44308 - sizeof(sbi->s_es->s_last_mounted));
44309 + strlcpy(sbi->s_es->s_last_mounted, cp,
44310 + sizeof(sbi->s_es->s_last_mounted));
44311 ext4_mark_super_dirty(sb);
44314 diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
44315 index f18bfe3..43759b1 100644
44316 --- a/fs/ext4/ioctl.c
44317 +++ b/fs/ext4/ioctl.c
44318 @@ -348,7 +348,7 @@ mext_out:
44319 if (!blk_queue_discard(q))
44320 return -EOPNOTSUPP;
44322 - if (copy_from_user(&range, (struct fstrim_range *)arg,
44323 + if (copy_from_user(&range, (struct fstrim_range __user *)arg,
44327 @@ -358,7 +358,7 @@ mext_out:
44331 - if (copy_to_user((struct fstrim_range *)arg, &range,
44332 + if (copy_to_user((struct fstrim_range __user *)arg, &range,
44336 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
44337 index 17a5a57..b6be3c5 100644
44338 --- a/fs/ext4/mballoc.c
44339 +++ b/fs/ext4/mballoc.c
44340 @@ -1795,7 +1795,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
44341 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
44343 if (EXT4_SB(sb)->s_mb_stats)
44344 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
44345 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
44349 @@ -2089,7 +2089,7 @@ repeat:
44350 ac->ac_status = AC_STATUS_CONTINUE;
44351 ac->ac_flags |= EXT4_MB_HINT_FIRST;
44353 - atomic_inc(&sbi->s_mb_lost_chunks);
44354 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
44358 @@ -2132,6 +2132,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
44359 ext4_grpblk_t counters[16];
44362 + pax_track_stack();
44366 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
44367 @@ -2573,25 +2575,25 @@ int ext4_mb_release(struct super_block *sb)
44368 if (sbi->s_mb_stats) {
44369 ext4_msg(sb, KERN_INFO,
44370 "mballoc: %u blocks %u reqs (%u success)",
44371 - atomic_read(&sbi->s_bal_allocated),
44372 - atomic_read(&sbi->s_bal_reqs),
44373 - atomic_read(&sbi->s_bal_success));
44374 + atomic_read_unchecked(&sbi->s_bal_allocated),
44375 + atomic_read_unchecked(&sbi->s_bal_reqs),
44376 + atomic_read_unchecked(&sbi->s_bal_success));
44377 ext4_msg(sb, KERN_INFO,
44378 "mballoc: %u extents scanned, %u goal hits, "
44379 "%u 2^N hits, %u breaks, %u lost",
44380 - atomic_read(&sbi->s_bal_ex_scanned),
44381 - atomic_read(&sbi->s_bal_goals),
44382 - atomic_read(&sbi->s_bal_2orders),
44383 - atomic_read(&sbi->s_bal_breaks),
44384 - atomic_read(&sbi->s_mb_lost_chunks));
44385 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
44386 + atomic_read_unchecked(&sbi->s_bal_goals),
44387 + atomic_read_unchecked(&sbi->s_bal_2orders),
44388 + atomic_read_unchecked(&sbi->s_bal_breaks),
44389 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
44390 ext4_msg(sb, KERN_INFO,
44391 "mballoc: %lu generated and it took %Lu",
44392 sbi->s_mb_buddies_generated,
44393 sbi->s_mb_generation_time);
44394 ext4_msg(sb, KERN_INFO,
44395 "mballoc: %u preallocated, %u discarded",
44396 - atomic_read(&sbi->s_mb_preallocated),
44397 - atomic_read(&sbi->s_mb_discarded));
44398 + atomic_read_unchecked(&sbi->s_mb_preallocated),
44399 + atomic_read_unchecked(&sbi->s_mb_discarded));
44402 free_percpu(sbi->s_locality_groups);
44403 @@ -3070,16 +3072,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
44404 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
44406 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
44407 - atomic_inc(&sbi->s_bal_reqs);
44408 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44409 + atomic_inc_unchecked(&sbi->s_bal_reqs);
44410 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44411 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
44412 - atomic_inc(&sbi->s_bal_success);
44413 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
44414 + atomic_inc_unchecked(&sbi->s_bal_success);
44415 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
44416 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
44417 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
44418 - atomic_inc(&sbi->s_bal_goals);
44419 + atomic_inc_unchecked(&sbi->s_bal_goals);
44420 if (ac->ac_found > sbi->s_mb_max_to_scan)
44421 - atomic_inc(&sbi->s_bal_breaks);
44422 + atomic_inc_unchecked(&sbi->s_bal_breaks);
44425 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
44426 @@ -3477,7 +3479,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
44427 trace_ext4_mb_new_inode_pa(ac, pa);
44429 ext4_mb_use_inode_pa(ac, pa);
44430 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44431 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44433 ei = EXT4_I(ac->ac_inode);
44434 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44435 @@ -3537,7 +3539,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
44436 trace_ext4_mb_new_group_pa(ac, pa);
44438 ext4_mb_use_group_pa(ac, pa);
44439 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44440 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44442 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44444 @@ -3625,7 +3627,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
44445 * from the bitmap and continue.
44448 - atomic_add(free, &sbi->s_mb_discarded);
44449 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
44453 @@ -3643,7 +3645,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
44454 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
44455 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
44456 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
44457 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44458 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44459 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
44462 diff --git a/fs/fcntl.c b/fs/fcntl.c
44463 index 22764c7..86372c9 100644
44466 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
44470 + if (gr_handle_chroot_fowner(pid, type))
44472 + if (gr_check_protected_task_fowner(pid, type))
44475 f_modown(filp, pid, type, force);
44478 @@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
44480 static int f_setown_ex(struct file *filp, unsigned long arg)
44482 - struct f_owner_ex * __user owner_p = (void * __user)arg;
44483 + struct f_owner_ex __user *owner_p = (void __user *)arg;
44484 struct f_owner_ex owner;
44487 @@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
44489 static int f_getown_ex(struct file *filp, unsigned long arg)
44491 - struct f_owner_ex * __user owner_p = (void * __user)arg;
44492 + struct f_owner_ex __user *owner_p = (void __user *)arg;
44493 struct f_owner_ex owner;
44496 @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
44499 case F_DUPFD_CLOEXEC:
44500 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
44501 if (arg >= rlimit(RLIMIT_NOFILE))
44503 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
44504 diff --git a/fs/fifo.c b/fs/fifo.c
44505 index b1a524d..4ee270e 100644
44508 @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
44510 filp->f_op = &read_pipefifo_fops;
44512 - if (pipe->readers++ == 0)
44513 + if (atomic_inc_return(&pipe->readers) == 1)
44514 wake_up_partner(inode);
44516 - if (!pipe->writers) {
44517 + if (!atomic_read(&pipe->writers)) {
44518 if ((filp->f_flags & O_NONBLOCK)) {
44519 /* suppress POLLHUP until we have
44521 @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
44522 * errno=ENXIO when there is no process reading the FIFO.
44525 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
44526 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
44529 filp->f_op = &write_pipefifo_fops;
44531 - if (!pipe->writers++)
44532 + if (atomic_inc_return(&pipe->writers) == 1)
44533 wake_up_partner(inode);
44535 - if (!pipe->readers) {
44536 + if (!atomic_read(&pipe->readers)) {
44537 wait_for_partner(inode, &pipe->r_counter);
44538 if (signal_pending(current))
44540 @@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
44542 filp->f_op = &rdwr_pipefifo_fops;
44546 + atomic_inc(&pipe->readers);
44547 + atomic_inc(&pipe->writers);
44550 - if (pipe->readers == 1 || pipe->writers == 1)
44551 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
44552 wake_up_partner(inode);
44555 @@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
44559 - if (!--pipe->readers)
44560 + if (atomic_dec_and_test(&pipe->readers))
44561 wake_up_interruptible(&pipe->wait);
44562 ret = -ERESTARTSYS;
44566 - if (!--pipe->writers)
44567 + if (atomic_dec_and_test(&pipe->writers))
44568 wake_up_interruptible(&pipe->wait);
44569 ret = -ERESTARTSYS;
44573 - if (!pipe->readers && !pipe->writers)
44574 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
44575 free_pipe_info(inode);
44578 diff --git a/fs/file.c b/fs/file.c
44579 index 4c6992d..104cdea 100644
44583 #include <linux/slab.h>
44584 #include <linux/vmalloc.h>
44585 #include <linux/file.h>
44586 +#include <linux/security.h>
44587 #include <linux/fdtable.h>
44588 #include <linux/bitops.h>
44589 #include <linux/interrupt.h>
44590 @@ -254,6 +255,7 @@ int expand_files(struct files_struct *files, int nr)
44591 * N.B. For clone tasks sharing a files structure, this test
44592 * will limit the total number of files that can be opened.
44594 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
44595 if (nr >= rlimit(RLIMIT_NOFILE))
44598 diff --git a/fs/filesystems.c b/fs/filesystems.c
44599 index 0845f84..7b4ebef 100644
44600 --- a/fs/filesystems.c
44601 +++ b/fs/filesystems.c
44602 @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(const char *name)
44603 int len = dot ? dot - name : strlen(name);
44605 fs = __get_fs_type(name, len);
44607 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
44608 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
44610 if (!fs && (request_module("%.*s", len, name) == 0))
44612 fs = __get_fs_type(name, len);
44614 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
44615 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
44616 index 78b519c..212c0d0 100644
44617 --- a/fs/fs_struct.c
44618 +++ b/fs/fs_struct.c
44620 #include <linux/path.h>
44621 #include <linux/slab.h>
44622 #include <linux/fs_struct.h>
44623 +#include <linux/grsecurity.h>
44624 #include "internal.h"
44626 static inline void path_get_longterm(struct path *path)
44627 @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
44628 old_root = fs->root;
44630 path_get_longterm(path);
44631 + gr_set_chroot_entries(current, path);
44632 write_seqcount_end(&fs->seq);
44633 spin_unlock(&fs->lock);
44634 if (old_root.dentry)
44635 @@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
44636 && fs->root.mnt == old_root->mnt) {
44637 path_get_longterm(new_root);
44638 fs->root = *new_root;
44639 + gr_set_chroot_entries(p, new_root);
44642 if (fs->pwd.dentry == old_root->dentry
44643 @@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
44644 spin_lock(&fs->lock);
44645 write_seqcount_begin(&fs->seq);
44647 - kill = !--fs->users;
44648 + gr_clear_chroot_entries(tsk);
44649 + kill = !atomic_dec_return(&fs->users);
44650 write_seqcount_end(&fs->seq);
44651 spin_unlock(&fs->lock);
44653 @@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44654 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
44655 /* We don't need to lock fs - think why ;-) */
44658 + atomic_set(&fs->users, 1);
44660 spin_lock_init(&fs->lock);
44661 seqcount_init(&fs->seq);
44662 @@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
44663 spin_lock(&old->lock);
44664 fs->root = old->root;
44665 path_get_longterm(&fs->root);
44666 + /* instead of calling gr_set_chroot_entries here,
44667 + we call it from every caller of this function
44669 fs->pwd = old->pwd;
44670 path_get_longterm(&fs->pwd);
44671 spin_unlock(&old->lock);
44672 @@ -150,8 +157,9 @@ int unshare_fs_struct(void)
44674 task_lock(current);
44675 spin_lock(&fs->lock);
44676 - kill = !--fs->users;
44677 + kill = !atomic_dec_return(&fs->users);
44678 current->fs = new_fs;
44679 + gr_set_chroot_entries(current, &new_fs->root);
44680 spin_unlock(&fs->lock);
44681 task_unlock(current);
44683 @@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
44685 /* to be mentioned only in INIT_TASK */
44686 struct fs_struct init_fs = {
44688 + .users = ATOMIC_INIT(1),
44689 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
44690 .seq = SEQCNT_ZERO,
44692 @@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
44693 task_lock(current);
44695 spin_lock(&init_fs.lock);
44697 + atomic_inc(&init_fs.users);
44698 spin_unlock(&init_fs.lock);
44700 spin_lock(&fs->lock);
44701 current->fs = &init_fs;
44702 - kill = !--fs->users;
44703 + gr_set_chroot_entries(current, ¤t->fs->root);
44704 + kill = !atomic_dec_return(&fs->users);
44705 spin_unlock(&fs->lock);
44707 task_unlock(current);
44708 diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
44709 index 9905350..02eaec4 100644
44710 --- a/fs/fscache/cookie.c
44711 +++ b/fs/fscache/cookie.c
44712 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
44713 parent ? (char *) parent->def->name : "<no-parent>",
44714 def->name, netfs_data);
44716 - fscache_stat(&fscache_n_acquires);
44717 + fscache_stat_unchecked(&fscache_n_acquires);
44719 /* if there's no parent cookie, then we don't create one here either */
44721 - fscache_stat(&fscache_n_acquires_null);
44722 + fscache_stat_unchecked(&fscache_n_acquires_null);
44723 _leave(" [no parent]");
44726 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
44727 /* allocate and initialise a cookie */
44728 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
44730 - fscache_stat(&fscache_n_acquires_oom);
44731 + fscache_stat_unchecked(&fscache_n_acquires_oom);
44732 _leave(" [ENOMEM]");
44735 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44737 switch (cookie->def->type) {
44738 case FSCACHE_COOKIE_TYPE_INDEX:
44739 - fscache_stat(&fscache_n_cookie_index);
44740 + fscache_stat_unchecked(&fscache_n_cookie_index);
44742 case FSCACHE_COOKIE_TYPE_DATAFILE:
44743 - fscache_stat(&fscache_n_cookie_data);
44744 + fscache_stat_unchecked(&fscache_n_cookie_data);
44747 - fscache_stat(&fscache_n_cookie_special);
44748 + fscache_stat_unchecked(&fscache_n_cookie_special);
44752 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
44753 if (fscache_acquire_non_index_cookie(cookie) < 0) {
44754 atomic_dec(&parent->n_children);
44755 __fscache_cookie_put(cookie);
44756 - fscache_stat(&fscache_n_acquires_nobufs);
44757 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
44763 - fscache_stat(&fscache_n_acquires_ok);
44764 + fscache_stat_unchecked(&fscache_n_acquires_ok);
44765 _leave(" = %p", cookie);
44768 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
44769 cache = fscache_select_cache_for_object(cookie->parent);
44771 up_read(&fscache_addremove_sem);
44772 - fscache_stat(&fscache_n_acquires_no_cache);
44773 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
44774 _leave(" = -ENOMEDIUM [no cache]");
44777 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
44778 object = cache->ops->alloc_object(cache, cookie);
44779 fscache_stat_d(&fscache_n_cop_alloc_object);
44780 if (IS_ERR(object)) {
44781 - fscache_stat(&fscache_n_object_no_alloc);
44782 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
44783 ret = PTR_ERR(object);
44787 - fscache_stat(&fscache_n_object_alloc);
44788 + fscache_stat_unchecked(&fscache_n_object_alloc);
44790 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
44792 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
44793 struct fscache_object *object;
44794 struct hlist_node *_p;
44796 - fscache_stat(&fscache_n_updates);
44797 + fscache_stat_unchecked(&fscache_n_updates);
44800 - fscache_stat(&fscache_n_updates_null);
44801 + fscache_stat_unchecked(&fscache_n_updates_null);
44802 _leave(" [no cookie]");
44805 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44806 struct fscache_object *object;
44807 unsigned long event;
44809 - fscache_stat(&fscache_n_relinquishes);
44810 + fscache_stat_unchecked(&fscache_n_relinquishes);
44812 - fscache_stat(&fscache_n_relinquishes_retire);
44813 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
44816 - fscache_stat(&fscache_n_relinquishes_null);
44817 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
44818 _leave(" [no cookie]");
44821 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
44823 /* wait for the cookie to finish being instantiated (or to fail) */
44824 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
44825 - fscache_stat(&fscache_n_relinquishes_waitcrt);
44826 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
44827 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
44828 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
44830 diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
44831 index f6aad48..88dcf26 100644
44832 --- a/fs/fscache/internal.h
44833 +++ b/fs/fscache/internal.h
44834 @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
44835 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
44836 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
44838 -extern atomic_t fscache_n_op_pend;
44839 -extern atomic_t fscache_n_op_run;
44840 -extern atomic_t fscache_n_op_enqueue;
44841 -extern atomic_t fscache_n_op_deferred_release;
44842 -extern atomic_t fscache_n_op_release;
44843 -extern atomic_t fscache_n_op_gc;
44844 -extern atomic_t fscache_n_op_cancelled;
44845 -extern atomic_t fscache_n_op_rejected;
44846 +extern atomic_unchecked_t fscache_n_op_pend;
44847 +extern atomic_unchecked_t fscache_n_op_run;
44848 +extern atomic_unchecked_t fscache_n_op_enqueue;
44849 +extern atomic_unchecked_t fscache_n_op_deferred_release;
44850 +extern atomic_unchecked_t fscache_n_op_release;
44851 +extern atomic_unchecked_t fscache_n_op_gc;
44852 +extern atomic_unchecked_t fscache_n_op_cancelled;
44853 +extern atomic_unchecked_t fscache_n_op_rejected;
44855 -extern atomic_t fscache_n_attr_changed;
44856 -extern atomic_t fscache_n_attr_changed_ok;
44857 -extern atomic_t fscache_n_attr_changed_nobufs;
44858 -extern atomic_t fscache_n_attr_changed_nomem;
44859 -extern atomic_t fscache_n_attr_changed_calls;
44860 +extern atomic_unchecked_t fscache_n_attr_changed;
44861 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
44862 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
44863 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
44864 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
44866 -extern atomic_t fscache_n_allocs;
44867 -extern atomic_t fscache_n_allocs_ok;
44868 -extern atomic_t fscache_n_allocs_wait;
44869 -extern atomic_t fscache_n_allocs_nobufs;
44870 -extern atomic_t fscache_n_allocs_intr;
44871 -extern atomic_t fscache_n_allocs_object_dead;
44872 -extern atomic_t fscache_n_alloc_ops;
44873 -extern atomic_t fscache_n_alloc_op_waits;
44874 +extern atomic_unchecked_t fscache_n_allocs;
44875 +extern atomic_unchecked_t fscache_n_allocs_ok;
44876 +extern atomic_unchecked_t fscache_n_allocs_wait;
44877 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
44878 +extern atomic_unchecked_t fscache_n_allocs_intr;
44879 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
44880 +extern atomic_unchecked_t fscache_n_alloc_ops;
44881 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
44883 -extern atomic_t fscache_n_retrievals;
44884 -extern atomic_t fscache_n_retrievals_ok;
44885 -extern atomic_t fscache_n_retrievals_wait;
44886 -extern atomic_t fscache_n_retrievals_nodata;
44887 -extern atomic_t fscache_n_retrievals_nobufs;
44888 -extern atomic_t fscache_n_retrievals_intr;
44889 -extern atomic_t fscache_n_retrievals_nomem;
44890 -extern atomic_t fscache_n_retrievals_object_dead;
44891 -extern atomic_t fscache_n_retrieval_ops;
44892 -extern atomic_t fscache_n_retrieval_op_waits;
44893 +extern atomic_unchecked_t fscache_n_retrievals;
44894 +extern atomic_unchecked_t fscache_n_retrievals_ok;
44895 +extern atomic_unchecked_t fscache_n_retrievals_wait;
44896 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
44897 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
44898 +extern atomic_unchecked_t fscache_n_retrievals_intr;
44899 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
44900 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
44901 +extern atomic_unchecked_t fscache_n_retrieval_ops;
44902 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
44904 -extern atomic_t fscache_n_stores;
44905 -extern atomic_t fscache_n_stores_ok;
44906 -extern atomic_t fscache_n_stores_again;
44907 -extern atomic_t fscache_n_stores_nobufs;
44908 -extern atomic_t fscache_n_stores_oom;
44909 -extern atomic_t fscache_n_store_ops;
44910 -extern atomic_t fscache_n_store_calls;
44911 -extern atomic_t fscache_n_store_pages;
44912 -extern atomic_t fscache_n_store_radix_deletes;
44913 -extern atomic_t fscache_n_store_pages_over_limit;
44914 +extern atomic_unchecked_t fscache_n_stores;
44915 +extern atomic_unchecked_t fscache_n_stores_ok;
44916 +extern atomic_unchecked_t fscache_n_stores_again;
44917 +extern atomic_unchecked_t fscache_n_stores_nobufs;
44918 +extern atomic_unchecked_t fscache_n_stores_oom;
44919 +extern atomic_unchecked_t fscache_n_store_ops;
44920 +extern atomic_unchecked_t fscache_n_store_calls;
44921 +extern atomic_unchecked_t fscache_n_store_pages;
44922 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
44923 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
44925 -extern atomic_t fscache_n_store_vmscan_not_storing;
44926 -extern atomic_t fscache_n_store_vmscan_gone;
44927 -extern atomic_t fscache_n_store_vmscan_busy;
44928 -extern atomic_t fscache_n_store_vmscan_cancelled;
44929 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
44930 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
44931 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
44932 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
44934 -extern atomic_t fscache_n_marks;
44935 -extern atomic_t fscache_n_uncaches;
44936 +extern atomic_unchecked_t fscache_n_marks;
44937 +extern atomic_unchecked_t fscache_n_uncaches;
44939 -extern atomic_t fscache_n_acquires;
44940 -extern atomic_t fscache_n_acquires_null;
44941 -extern atomic_t fscache_n_acquires_no_cache;
44942 -extern atomic_t fscache_n_acquires_ok;
44943 -extern atomic_t fscache_n_acquires_nobufs;
44944 -extern atomic_t fscache_n_acquires_oom;
44945 +extern atomic_unchecked_t fscache_n_acquires;
44946 +extern atomic_unchecked_t fscache_n_acquires_null;
44947 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
44948 +extern atomic_unchecked_t fscache_n_acquires_ok;
44949 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
44950 +extern atomic_unchecked_t fscache_n_acquires_oom;
44952 -extern atomic_t fscache_n_updates;
44953 -extern atomic_t fscache_n_updates_null;
44954 -extern atomic_t fscache_n_updates_run;
44955 +extern atomic_unchecked_t fscache_n_updates;
44956 +extern atomic_unchecked_t fscache_n_updates_null;
44957 +extern atomic_unchecked_t fscache_n_updates_run;
44959 -extern atomic_t fscache_n_relinquishes;
44960 -extern atomic_t fscache_n_relinquishes_null;
44961 -extern atomic_t fscache_n_relinquishes_waitcrt;
44962 -extern atomic_t fscache_n_relinquishes_retire;
44963 +extern atomic_unchecked_t fscache_n_relinquishes;
44964 +extern atomic_unchecked_t fscache_n_relinquishes_null;
44965 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
44966 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
44968 -extern atomic_t fscache_n_cookie_index;
44969 -extern atomic_t fscache_n_cookie_data;
44970 -extern atomic_t fscache_n_cookie_special;
44971 +extern atomic_unchecked_t fscache_n_cookie_index;
44972 +extern atomic_unchecked_t fscache_n_cookie_data;
44973 +extern atomic_unchecked_t fscache_n_cookie_special;
44975 -extern atomic_t fscache_n_object_alloc;
44976 -extern atomic_t fscache_n_object_no_alloc;
44977 -extern atomic_t fscache_n_object_lookups;
44978 -extern atomic_t fscache_n_object_lookups_negative;
44979 -extern atomic_t fscache_n_object_lookups_positive;
44980 -extern atomic_t fscache_n_object_lookups_timed_out;
44981 -extern atomic_t fscache_n_object_created;
44982 -extern atomic_t fscache_n_object_avail;
44983 -extern atomic_t fscache_n_object_dead;
44984 +extern atomic_unchecked_t fscache_n_object_alloc;
44985 +extern atomic_unchecked_t fscache_n_object_no_alloc;
44986 +extern atomic_unchecked_t fscache_n_object_lookups;
44987 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
44988 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
44989 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
44990 +extern atomic_unchecked_t fscache_n_object_created;
44991 +extern atomic_unchecked_t fscache_n_object_avail;
44992 +extern atomic_unchecked_t fscache_n_object_dead;
44994 -extern atomic_t fscache_n_checkaux_none;
44995 -extern atomic_t fscache_n_checkaux_okay;
44996 -extern atomic_t fscache_n_checkaux_update;
44997 -extern atomic_t fscache_n_checkaux_obsolete;
44998 +extern atomic_unchecked_t fscache_n_checkaux_none;
44999 +extern atomic_unchecked_t fscache_n_checkaux_okay;
45000 +extern atomic_unchecked_t fscache_n_checkaux_update;
45001 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
45003 extern atomic_t fscache_n_cop_alloc_object;
45004 extern atomic_t fscache_n_cop_lookup_object;
45005 @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t *stat)
45009 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
45011 + atomic_inc_unchecked(stat);
45014 static inline void fscache_stat_d(atomic_t *stat)
45017 @@ -267,6 +272,7 @@ extern const struct file_operations fscache_stats_fops;
45019 #define __fscache_stat(stat) (NULL)
45020 #define fscache_stat(stat) do {} while (0)
45021 +#define fscache_stat_unchecked(stat) do {} while (0)
45022 #define fscache_stat_d(stat) do {} while (0)
45025 diff --git a/fs/fscache/object.c b/fs/fscache/object.c
45026 index b6b897c..0ffff9c 100644
45027 --- a/fs/fscache/object.c
45028 +++ b/fs/fscache/object.c
45029 @@ -128,7 +128,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45030 /* update the object metadata on disk */
45031 case FSCACHE_OBJECT_UPDATING:
45032 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
45033 - fscache_stat(&fscache_n_updates_run);
45034 + fscache_stat_unchecked(&fscache_n_updates_run);
45035 fscache_stat(&fscache_n_cop_update_object);
45036 object->cache->ops->update_object(object);
45037 fscache_stat_d(&fscache_n_cop_update_object);
45038 @@ -217,7 +217,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45039 spin_lock(&object->lock);
45040 object->state = FSCACHE_OBJECT_DEAD;
45041 spin_unlock(&object->lock);
45042 - fscache_stat(&fscache_n_object_dead);
45043 + fscache_stat_unchecked(&fscache_n_object_dead);
45044 goto terminal_transit;
45046 /* handle the parent cache of this object being withdrawn from
45047 @@ -232,7 +232,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45048 spin_lock(&object->lock);
45049 object->state = FSCACHE_OBJECT_DEAD;
45050 spin_unlock(&object->lock);
45051 - fscache_stat(&fscache_n_object_dead);
45052 + fscache_stat_unchecked(&fscache_n_object_dead);
45053 goto terminal_transit;
45055 /* complain about the object being woken up once it is
45056 @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45057 parent->cookie->def->name, cookie->def->name,
45058 object->cache->tag->name);
45060 - fscache_stat(&fscache_n_object_lookups);
45061 + fscache_stat_unchecked(&fscache_n_object_lookups);
45062 fscache_stat(&fscache_n_cop_lookup_object);
45063 ret = object->cache->ops->lookup_object(object);
45064 fscache_stat_d(&fscache_n_cop_lookup_object);
45065 @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45066 if (ret == -ETIMEDOUT) {
45067 /* probably stuck behind another object, so move this one to
45068 * the back of the queue */
45069 - fscache_stat(&fscache_n_object_lookups_timed_out);
45070 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
45071 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45074 @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
45076 spin_lock(&object->lock);
45077 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45078 - fscache_stat(&fscache_n_object_lookups_negative);
45079 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
45081 /* transit here to allow write requests to begin stacking up
45082 * and read requests to begin returning ENODATA */
45083 @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fscache_object *object)
45084 * result, in which case there may be data available */
45085 spin_lock(&object->lock);
45086 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45087 - fscache_stat(&fscache_n_object_lookups_positive);
45088 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
45090 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
45092 @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fscache_object *object)
45093 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45095 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
45096 - fscache_stat(&fscache_n_object_created);
45097 + fscache_stat_unchecked(&fscache_n_object_created);
45099 object->state = FSCACHE_OBJECT_AVAILABLE;
45100 spin_unlock(&object->lock);
45101 @@ -602,7 +602,7 @@ static void fscache_object_available(struct fscache_object *object)
45102 fscache_enqueue_dependents(object);
45104 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
45105 - fscache_stat(&fscache_n_object_avail);
45106 + fscache_stat_unchecked(&fscache_n_object_avail);
45110 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45111 enum fscache_checkaux result;
45113 if (!object->cookie->def->check_aux) {
45114 - fscache_stat(&fscache_n_checkaux_none);
45115 + fscache_stat_unchecked(&fscache_n_checkaux_none);
45116 return FSCACHE_CHECKAUX_OKAY;
45119 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
45121 /* entry okay as is */
45122 case FSCACHE_CHECKAUX_OKAY:
45123 - fscache_stat(&fscache_n_checkaux_okay);
45124 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
45127 /* entry requires update */
45128 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
45129 - fscache_stat(&fscache_n_checkaux_update);
45130 + fscache_stat_unchecked(&fscache_n_checkaux_update);
45133 /* entry requires deletion */
45134 case FSCACHE_CHECKAUX_OBSOLETE:
45135 - fscache_stat(&fscache_n_checkaux_obsolete);
45136 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
45140 diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
45141 index 30afdfa..2256596 100644
45142 --- a/fs/fscache/operation.c
45143 +++ b/fs/fscache/operation.c
45145 #include <linux/slab.h>
45146 #include "internal.h"
45148 -atomic_t fscache_op_debug_id;
45149 +atomic_unchecked_t fscache_op_debug_id;
45150 EXPORT_SYMBOL(fscache_op_debug_id);
45153 @@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
45154 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
45155 ASSERTCMP(atomic_read(&op->usage), >, 0);
45157 - fscache_stat(&fscache_n_op_enqueue);
45158 + fscache_stat_unchecked(&fscache_n_op_enqueue);
45159 switch (op->flags & FSCACHE_OP_TYPE) {
45160 case FSCACHE_OP_ASYNC:
45161 _debug("queue async");
45162 @@ -69,7 +69,7 @@ static void fscache_run_op(struct fscache_object *object,
45163 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
45165 fscache_enqueue_operation(op);
45166 - fscache_stat(&fscache_n_op_run);
45167 + fscache_stat_unchecked(&fscache_n_op_run);
45171 @@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45172 if (object->n_ops > 1) {
45173 atomic_inc(&op->usage);
45174 list_add_tail(&op->pend_link, &object->pending_ops);
45175 - fscache_stat(&fscache_n_op_pend);
45176 + fscache_stat_unchecked(&fscache_n_op_pend);
45177 } else if (!list_empty(&object->pending_ops)) {
45178 atomic_inc(&op->usage);
45179 list_add_tail(&op->pend_link, &object->pending_ops);
45180 - fscache_stat(&fscache_n_op_pend);
45181 + fscache_stat_unchecked(&fscache_n_op_pend);
45182 fscache_start_operations(object);
45184 ASSERTCMP(object->n_in_progress, ==, 0);
45185 @@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
45186 object->n_exclusive++; /* reads and writes must wait */
45187 atomic_inc(&op->usage);
45188 list_add_tail(&op->pend_link, &object->pending_ops);
45189 - fscache_stat(&fscache_n_op_pend);
45190 + fscache_stat_unchecked(&fscache_n_op_pend);
45193 /* not allowed to submit ops in any other state */
45194 @@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_object *object,
45195 if (object->n_exclusive > 0) {
45196 atomic_inc(&op->usage);
45197 list_add_tail(&op->pend_link, &object->pending_ops);
45198 - fscache_stat(&fscache_n_op_pend);
45199 + fscache_stat_unchecked(&fscache_n_op_pend);
45200 } else if (!list_empty(&object->pending_ops)) {
45201 atomic_inc(&op->usage);
45202 list_add_tail(&op->pend_link, &object->pending_ops);
45203 - fscache_stat(&fscache_n_op_pend);
45204 + fscache_stat_unchecked(&fscache_n_op_pend);
45205 fscache_start_operations(object);
45207 ASSERTCMP(object->n_exclusive, ==, 0);
45208 @@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_object *object,
45210 atomic_inc(&op->usage);
45211 list_add_tail(&op->pend_link, &object->pending_ops);
45212 - fscache_stat(&fscache_n_op_pend);
45213 + fscache_stat_unchecked(&fscache_n_op_pend);
45215 } else if (object->state == FSCACHE_OBJECT_DYING ||
45216 object->state == FSCACHE_OBJECT_LC_DYING ||
45217 object->state == FSCACHE_OBJECT_WITHDRAWING) {
45218 - fscache_stat(&fscache_n_op_rejected);
45219 + fscache_stat_unchecked(&fscache_n_op_rejected);
45221 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
45222 fscache_report_unexpected_submission(object, op, ostate);
45223 @@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_operation *op)
45226 if (!list_empty(&op->pend_link)) {
45227 - fscache_stat(&fscache_n_op_cancelled);
45228 + fscache_stat_unchecked(&fscache_n_op_cancelled);
45229 list_del_init(&op->pend_link);
45231 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
45232 @@ -331,7 +331,7 @@ void fscache_put_operation(struct fscache_operation *op)
45233 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
45236 - fscache_stat(&fscache_n_op_release);
45237 + fscache_stat_unchecked(&fscache_n_op_release);
45241 @@ -348,7 +348,7 @@ void fscache_put_operation(struct fscache_operation *op)
45242 * lock, and defer it otherwise */
45243 if (!spin_trylock(&object->lock)) {
45244 _debug("defer put");
45245 - fscache_stat(&fscache_n_op_deferred_release);
45246 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
45248 cache = object->cache;
45249 spin_lock(&cache->op_gc_list_lock);
45250 @@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_struct *work)
45252 _debug("GC DEFERRED REL OBJ%x OP%x",
45253 object->debug_id, op->debug_id);
45254 - fscache_stat(&fscache_n_op_gc);
45255 + fscache_stat_unchecked(&fscache_n_op_gc);
45257 ASSERTCMP(atomic_read(&op->usage), ==, 0);
45259 diff --git a/fs/fscache/page.c b/fs/fscache/page.c
45260 index 3f7a59b..cf196cc 100644
45261 --- a/fs/fscache/page.c
45262 +++ b/fs/fscache/page.c
45263 @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45264 val = radix_tree_lookup(&cookie->stores, page->index);
45267 - fscache_stat(&fscache_n_store_vmscan_not_storing);
45268 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
45269 __fscache_uncache_page(cookie, page);
45272 @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
45273 spin_unlock(&cookie->stores_lock);
45276 - fscache_stat(&fscache_n_store_vmscan_cancelled);
45277 - fscache_stat(&fscache_n_store_radix_deletes);
45278 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
45279 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45280 ASSERTCMP(xpage, ==, page);
45282 - fscache_stat(&fscache_n_store_vmscan_gone);
45283 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
45286 wake_up_bit(&cookie->flags, 0);
45287 @@ -107,7 +107,7 @@ page_busy:
45288 /* we might want to wait here, but that could deadlock the allocator as
45289 * the work threads writing to the cache may all end up sleeping
45290 * on memory allocation */
45291 - fscache_stat(&fscache_n_store_vmscan_busy);
45292 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
45295 EXPORT_SYMBOL(__fscache_maybe_release_page);
45296 @@ -131,7 +131,7 @@ static void fscache_end_page_write(struct fscache_object *object,
45297 FSCACHE_COOKIE_STORING_TAG);
45298 if (!radix_tree_tag_get(&cookie->stores, page->index,
45299 FSCACHE_COOKIE_PENDING_TAG)) {
45300 - fscache_stat(&fscache_n_store_radix_deletes);
45301 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45302 xpage = radix_tree_delete(&cookie->stores, page->index);
45304 spin_unlock(&cookie->stores_lock);
45305 @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
45307 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
45309 - fscache_stat(&fscache_n_attr_changed_calls);
45310 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
45312 if (fscache_object_is_active(object)) {
45313 fscache_stat(&fscache_n_cop_attr_changed);
45314 @@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45316 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45318 - fscache_stat(&fscache_n_attr_changed);
45319 + fscache_stat_unchecked(&fscache_n_attr_changed);
45321 op = kzalloc(sizeof(*op), GFP_KERNEL);
45323 - fscache_stat(&fscache_n_attr_changed_nomem);
45324 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
45325 _leave(" = -ENOMEM");
45328 @@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45329 if (fscache_submit_exclusive_op(object, op) < 0)
45331 spin_unlock(&cookie->lock);
45332 - fscache_stat(&fscache_n_attr_changed_ok);
45333 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
45334 fscache_put_operation(op);
45337 @@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
45339 spin_unlock(&cookie->lock);
45341 - fscache_stat(&fscache_n_attr_changed_nobufs);
45342 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
45343 _leave(" = %d", -ENOBUFS);
45346 @@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
45347 /* allocate a retrieval operation and attempt to submit it */
45348 op = kzalloc(sizeof(*op), GFP_NOIO);
45350 - fscache_stat(&fscache_n_retrievals_nomem);
45351 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45355 @@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45359 - fscache_stat(&fscache_n_retrievals_wait);
45360 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
45363 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
45364 fscache_wait_bit_interruptible,
45365 TASK_INTERRUPTIBLE) != 0) {
45366 - fscache_stat(&fscache_n_retrievals_intr);
45367 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
45368 _leave(" = -ERESTARTSYS");
45369 return -ERESTARTSYS;
45371 @@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
45373 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45374 struct fscache_retrieval *op,
45375 - atomic_t *stat_op_waits,
45376 - atomic_t *stat_object_dead)
45377 + atomic_unchecked_t *stat_op_waits,
45378 + atomic_unchecked_t *stat_object_dead)
45382 @@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45383 goto check_if_dead;
45386 - fscache_stat(stat_op_waits);
45387 + fscache_stat_unchecked(stat_op_waits);
45388 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
45389 fscache_wait_bit_interruptible,
45390 TASK_INTERRUPTIBLE) < 0) {
45391 @@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
45394 if (unlikely(fscache_object_is_dead(object))) {
45395 - fscache_stat(stat_object_dead);
45396 + fscache_stat_unchecked(stat_object_dead);
45400 @@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45402 _enter("%p,%p,,,", cookie, page);
45404 - fscache_stat(&fscache_n_retrievals);
45405 + fscache_stat_unchecked(&fscache_n_retrievals);
45407 if (hlist_empty(&cookie->backing_objects))
45409 @@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45410 goto nobufs_unlock;
45411 spin_unlock(&cookie->lock);
45413 - fscache_stat(&fscache_n_retrieval_ops);
45414 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
45416 /* pin the netfs read context in case we need to do the actual netfs
45417 * read because we've encountered a cache read failure */
45418 @@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
45421 if (ret == -ENOMEM)
45422 - fscache_stat(&fscache_n_retrievals_nomem);
45423 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45424 else if (ret == -ERESTARTSYS)
45425 - fscache_stat(&fscache_n_retrievals_intr);
45426 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
45427 else if (ret == -ENODATA)
45428 - fscache_stat(&fscache_n_retrievals_nodata);
45429 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45431 - fscache_stat(&fscache_n_retrievals_nobufs);
45432 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45434 - fscache_stat(&fscache_n_retrievals_ok);
45435 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
45437 fscache_put_retrieval(op);
45438 _leave(" = %d", ret);
45439 @@ -429,7 +429,7 @@ nobufs_unlock:
45440 spin_unlock(&cookie->lock);
45443 - fscache_stat(&fscache_n_retrievals_nobufs);
45444 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45445 _leave(" = -ENOBUFS");
45448 @@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45450 _enter("%p,,%d,,,", cookie, *nr_pages);
45452 - fscache_stat(&fscache_n_retrievals);
45453 + fscache_stat_unchecked(&fscache_n_retrievals);
45455 if (hlist_empty(&cookie->backing_objects))
45457 @@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45458 goto nobufs_unlock;
45459 spin_unlock(&cookie->lock);
45461 - fscache_stat(&fscache_n_retrieval_ops);
45462 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
45464 /* pin the netfs read context in case we need to do the actual netfs
45465 * read because we've encountered a cache read failure */
45466 @@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
45469 if (ret == -ENOMEM)
45470 - fscache_stat(&fscache_n_retrievals_nomem);
45471 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45472 else if (ret == -ERESTARTSYS)
45473 - fscache_stat(&fscache_n_retrievals_intr);
45474 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
45475 else if (ret == -ENODATA)
45476 - fscache_stat(&fscache_n_retrievals_nodata);
45477 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45479 - fscache_stat(&fscache_n_retrievals_nobufs);
45480 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45482 - fscache_stat(&fscache_n_retrievals_ok);
45483 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
45485 fscache_put_retrieval(op);
45486 _leave(" = %d", ret);
45487 @@ -545,7 +545,7 @@ nobufs_unlock:
45488 spin_unlock(&cookie->lock);
45491 - fscache_stat(&fscache_n_retrievals_nobufs);
45492 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45493 _leave(" = -ENOBUFS");
45496 @@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45498 _enter("%p,%p,,,", cookie, page);
45500 - fscache_stat(&fscache_n_allocs);
45501 + fscache_stat_unchecked(&fscache_n_allocs);
45503 if (hlist_empty(&cookie->backing_objects))
45505 @@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45506 goto nobufs_unlock;
45507 spin_unlock(&cookie->lock);
45509 - fscache_stat(&fscache_n_alloc_ops);
45510 + fscache_stat_unchecked(&fscache_n_alloc_ops);
45512 ret = fscache_wait_for_retrieval_activation(
45514 @@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
45517 if (ret == -ERESTARTSYS)
45518 - fscache_stat(&fscache_n_allocs_intr);
45519 + fscache_stat_unchecked(&fscache_n_allocs_intr);
45521 - fscache_stat(&fscache_n_allocs_nobufs);
45522 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45524 - fscache_stat(&fscache_n_allocs_ok);
45525 + fscache_stat_unchecked(&fscache_n_allocs_ok);
45527 fscache_put_retrieval(op);
45528 _leave(" = %d", ret);
45529 @@ -625,7 +625,7 @@ nobufs_unlock:
45530 spin_unlock(&cookie->lock);
45533 - fscache_stat(&fscache_n_allocs_nobufs);
45534 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45535 _leave(" = -ENOBUFS");
45538 @@ -666,7 +666,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45540 spin_lock(&cookie->stores_lock);
45542 - fscache_stat(&fscache_n_store_calls);
45543 + fscache_stat_unchecked(&fscache_n_store_calls);
45545 /* find a page to store */
45547 @@ -677,7 +677,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45549 _debug("gang %d [%lx]", n, page->index);
45550 if (page->index > op->store_limit) {
45551 - fscache_stat(&fscache_n_store_pages_over_limit);
45552 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
45556 @@ -689,7 +689,7 @@ static void fscache_write_op(struct fscache_operation *_op)
45557 spin_unlock(&cookie->stores_lock);
45558 spin_unlock(&object->lock);
45560 - fscache_stat(&fscache_n_store_pages);
45561 + fscache_stat_unchecked(&fscache_n_store_pages);
45562 fscache_stat(&fscache_n_cop_write_page);
45563 ret = object->cache->ops->write_page(op, page);
45564 fscache_stat_d(&fscache_n_cop_write_page);
45565 @@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45566 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45567 ASSERT(PageFsCache(page));
45569 - fscache_stat(&fscache_n_stores);
45570 + fscache_stat_unchecked(&fscache_n_stores);
45572 op = kzalloc(sizeof(*op), GFP_NOIO);
45574 @@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45575 spin_unlock(&cookie->stores_lock);
45576 spin_unlock(&object->lock);
45578 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
45579 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
45580 op->store_limit = object->store_limit;
45582 if (fscache_submit_op(object, &op->op) < 0)
45583 @@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45585 spin_unlock(&cookie->lock);
45586 radix_tree_preload_end();
45587 - fscache_stat(&fscache_n_store_ops);
45588 - fscache_stat(&fscache_n_stores_ok);
45589 + fscache_stat_unchecked(&fscache_n_store_ops);
45590 + fscache_stat_unchecked(&fscache_n_stores_ok);
45592 /* the work queue now carries its own ref on the object */
45593 fscache_put_operation(&op->op);
45594 @@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
45598 - fscache_stat(&fscache_n_stores_again);
45599 + fscache_stat_unchecked(&fscache_n_stores_again);
45601 spin_unlock(&cookie->stores_lock);
45602 spin_unlock(&object->lock);
45603 spin_unlock(&cookie->lock);
45604 radix_tree_preload_end();
45606 - fscache_stat(&fscache_n_stores_ok);
45607 + fscache_stat_unchecked(&fscache_n_stores_ok);
45611 @@ -851,14 +851,14 @@ nobufs:
45612 spin_unlock(&cookie->lock);
45613 radix_tree_preload_end();
45615 - fscache_stat(&fscache_n_stores_nobufs);
45616 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
45617 _leave(" = -ENOBUFS");
45623 - fscache_stat(&fscache_n_stores_oom);
45624 + fscache_stat_unchecked(&fscache_n_stores_oom);
45625 _leave(" = -ENOMEM");
45628 @@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
45629 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45630 ASSERTCMP(page, !=, NULL);
45632 - fscache_stat(&fscache_n_uncaches);
45633 + fscache_stat_unchecked(&fscache_n_uncaches);
45635 /* cache withdrawal may beat us to it */
45636 if (!PageFsCache(page))
45637 @@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
45638 unsigned long loop;
45640 #ifdef CONFIG_FSCACHE_STATS
45641 - atomic_add(pagevec->nr, &fscache_n_marks);
45642 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
45645 for (loop = 0; loop < pagevec->nr; loop++) {
45646 diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
45647 index 4765190..2a067f2 100644
45648 --- a/fs/fscache/stats.c
45649 +++ b/fs/fscache/stats.c
45650 @@ -18,95 +18,95 @@
45652 * operation counters
45654 -atomic_t fscache_n_op_pend;
45655 -atomic_t fscache_n_op_run;
45656 -atomic_t fscache_n_op_enqueue;
45657 -atomic_t fscache_n_op_requeue;
45658 -atomic_t fscache_n_op_deferred_release;
45659 -atomic_t fscache_n_op_release;
45660 -atomic_t fscache_n_op_gc;
45661 -atomic_t fscache_n_op_cancelled;
45662 -atomic_t fscache_n_op_rejected;
45663 +atomic_unchecked_t fscache_n_op_pend;
45664 +atomic_unchecked_t fscache_n_op_run;
45665 +atomic_unchecked_t fscache_n_op_enqueue;
45666 +atomic_unchecked_t fscache_n_op_requeue;
45667 +atomic_unchecked_t fscache_n_op_deferred_release;
45668 +atomic_unchecked_t fscache_n_op_release;
45669 +atomic_unchecked_t fscache_n_op_gc;
45670 +atomic_unchecked_t fscache_n_op_cancelled;
45671 +atomic_unchecked_t fscache_n_op_rejected;
45673 -atomic_t fscache_n_attr_changed;
45674 -atomic_t fscache_n_attr_changed_ok;
45675 -atomic_t fscache_n_attr_changed_nobufs;
45676 -atomic_t fscache_n_attr_changed_nomem;
45677 -atomic_t fscache_n_attr_changed_calls;
45678 +atomic_unchecked_t fscache_n_attr_changed;
45679 +atomic_unchecked_t fscache_n_attr_changed_ok;
45680 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
45681 +atomic_unchecked_t fscache_n_attr_changed_nomem;
45682 +atomic_unchecked_t fscache_n_attr_changed_calls;
45684 -atomic_t fscache_n_allocs;
45685 -atomic_t fscache_n_allocs_ok;
45686 -atomic_t fscache_n_allocs_wait;
45687 -atomic_t fscache_n_allocs_nobufs;
45688 -atomic_t fscache_n_allocs_intr;
45689 -atomic_t fscache_n_allocs_object_dead;
45690 -atomic_t fscache_n_alloc_ops;
45691 -atomic_t fscache_n_alloc_op_waits;
45692 +atomic_unchecked_t fscache_n_allocs;
45693 +atomic_unchecked_t fscache_n_allocs_ok;
45694 +atomic_unchecked_t fscache_n_allocs_wait;
45695 +atomic_unchecked_t fscache_n_allocs_nobufs;
45696 +atomic_unchecked_t fscache_n_allocs_intr;
45697 +atomic_unchecked_t fscache_n_allocs_object_dead;
45698 +atomic_unchecked_t fscache_n_alloc_ops;
45699 +atomic_unchecked_t fscache_n_alloc_op_waits;
45701 -atomic_t fscache_n_retrievals;
45702 -atomic_t fscache_n_retrievals_ok;
45703 -atomic_t fscache_n_retrievals_wait;
45704 -atomic_t fscache_n_retrievals_nodata;
45705 -atomic_t fscache_n_retrievals_nobufs;
45706 -atomic_t fscache_n_retrievals_intr;
45707 -atomic_t fscache_n_retrievals_nomem;
45708 -atomic_t fscache_n_retrievals_object_dead;
45709 -atomic_t fscache_n_retrieval_ops;
45710 -atomic_t fscache_n_retrieval_op_waits;
45711 +atomic_unchecked_t fscache_n_retrievals;
45712 +atomic_unchecked_t fscache_n_retrievals_ok;
45713 +atomic_unchecked_t fscache_n_retrievals_wait;
45714 +atomic_unchecked_t fscache_n_retrievals_nodata;
45715 +atomic_unchecked_t fscache_n_retrievals_nobufs;
45716 +atomic_unchecked_t fscache_n_retrievals_intr;
45717 +atomic_unchecked_t fscache_n_retrievals_nomem;
45718 +atomic_unchecked_t fscache_n_retrievals_object_dead;
45719 +atomic_unchecked_t fscache_n_retrieval_ops;
45720 +atomic_unchecked_t fscache_n_retrieval_op_waits;
45722 -atomic_t fscache_n_stores;
45723 -atomic_t fscache_n_stores_ok;
45724 -atomic_t fscache_n_stores_again;
45725 -atomic_t fscache_n_stores_nobufs;
45726 -atomic_t fscache_n_stores_oom;
45727 -atomic_t fscache_n_store_ops;
45728 -atomic_t fscache_n_store_calls;
45729 -atomic_t fscache_n_store_pages;
45730 -atomic_t fscache_n_store_radix_deletes;
45731 -atomic_t fscache_n_store_pages_over_limit;
45732 +atomic_unchecked_t fscache_n_stores;
45733 +atomic_unchecked_t fscache_n_stores_ok;
45734 +atomic_unchecked_t fscache_n_stores_again;
45735 +atomic_unchecked_t fscache_n_stores_nobufs;
45736 +atomic_unchecked_t fscache_n_stores_oom;
45737 +atomic_unchecked_t fscache_n_store_ops;
45738 +atomic_unchecked_t fscache_n_store_calls;
45739 +atomic_unchecked_t fscache_n_store_pages;
45740 +atomic_unchecked_t fscache_n_store_radix_deletes;
45741 +atomic_unchecked_t fscache_n_store_pages_over_limit;
45743 -atomic_t fscache_n_store_vmscan_not_storing;
45744 -atomic_t fscache_n_store_vmscan_gone;
45745 -atomic_t fscache_n_store_vmscan_busy;
45746 -atomic_t fscache_n_store_vmscan_cancelled;
45747 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45748 +atomic_unchecked_t fscache_n_store_vmscan_gone;
45749 +atomic_unchecked_t fscache_n_store_vmscan_busy;
45750 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45752 -atomic_t fscache_n_marks;
45753 -atomic_t fscache_n_uncaches;
45754 +atomic_unchecked_t fscache_n_marks;
45755 +atomic_unchecked_t fscache_n_uncaches;
45757 -atomic_t fscache_n_acquires;
45758 -atomic_t fscache_n_acquires_null;
45759 -atomic_t fscache_n_acquires_no_cache;
45760 -atomic_t fscache_n_acquires_ok;
45761 -atomic_t fscache_n_acquires_nobufs;
45762 -atomic_t fscache_n_acquires_oom;
45763 +atomic_unchecked_t fscache_n_acquires;
45764 +atomic_unchecked_t fscache_n_acquires_null;
45765 +atomic_unchecked_t fscache_n_acquires_no_cache;
45766 +atomic_unchecked_t fscache_n_acquires_ok;
45767 +atomic_unchecked_t fscache_n_acquires_nobufs;
45768 +atomic_unchecked_t fscache_n_acquires_oom;
45770 -atomic_t fscache_n_updates;
45771 -atomic_t fscache_n_updates_null;
45772 -atomic_t fscache_n_updates_run;
45773 +atomic_unchecked_t fscache_n_updates;
45774 +atomic_unchecked_t fscache_n_updates_null;
45775 +atomic_unchecked_t fscache_n_updates_run;
45777 -atomic_t fscache_n_relinquishes;
45778 -atomic_t fscache_n_relinquishes_null;
45779 -atomic_t fscache_n_relinquishes_waitcrt;
45780 -atomic_t fscache_n_relinquishes_retire;
45781 +atomic_unchecked_t fscache_n_relinquishes;
45782 +atomic_unchecked_t fscache_n_relinquishes_null;
45783 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45784 +atomic_unchecked_t fscache_n_relinquishes_retire;
45786 -atomic_t fscache_n_cookie_index;
45787 -atomic_t fscache_n_cookie_data;
45788 -atomic_t fscache_n_cookie_special;
45789 +atomic_unchecked_t fscache_n_cookie_index;
45790 +atomic_unchecked_t fscache_n_cookie_data;
45791 +atomic_unchecked_t fscache_n_cookie_special;
45793 -atomic_t fscache_n_object_alloc;
45794 -atomic_t fscache_n_object_no_alloc;
45795 -atomic_t fscache_n_object_lookups;
45796 -atomic_t fscache_n_object_lookups_negative;
45797 -atomic_t fscache_n_object_lookups_positive;
45798 -atomic_t fscache_n_object_lookups_timed_out;
45799 -atomic_t fscache_n_object_created;
45800 -atomic_t fscache_n_object_avail;
45801 -atomic_t fscache_n_object_dead;
45802 +atomic_unchecked_t fscache_n_object_alloc;
45803 +atomic_unchecked_t fscache_n_object_no_alloc;
45804 +atomic_unchecked_t fscache_n_object_lookups;
45805 +atomic_unchecked_t fscache_n_object_lookups_negative;
45806 +atomic_unchecked_t fscache_n_object_lookups_positive;
45807 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
45808 +atomic_unchecked_t fscache_n_object_created;
45809 +atomic_unchecked_t fscache_n_object_avail;
45810 +atomic_unchecked_t fscache_n_object_dead;
45812 -atomic_t fscache_n_checkaux_none;
45813 -atomic_t fscache_n_checkaux_okay;
45814 -atomic_t fscache_n_checkaux_update;
45815 -atomic_t fscache_n_checkaux_obsolete;
45816 +atomic_unchecked_t fscache_n_checkaux_none;
45817 +atomic_unchecked_t fscache_n_checkaux_okay;
45818 +atomic_unchecked_t fscache_n_checkaux_update;
45819 +atomic_unchecked_t fscache_n_checkaux_obsolete;
45821 atomic_t fscache_n_cop_alloc_object;
45822 atomic_t fscache_n_cop_lookup_object;
45823 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
45824 seq_puts(m, "FS-Cache statistics\n");
45826 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
45827 - atomic_read(&fscache_n_cookie_index),
45828 - atomic_read(&fscache_n_cookie_data),
45829 - atomic_read(&fscache_n_cookie_special));
45830 + atomic_read_unchecked(&fscache_n_cookie_index),
45831 + atomic_read_unchecked(&fscache_n_cookie_data),
45832 + atomic_read_unchecked(&fscache_n_cookie_special));
45834 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
45835 - atomic_read(&fscache_n_object_alloc),
45836 - atomic_read(&fscache_n_object_no_alloc),
45837 - atomic_read(&fscache_n_object_avail),
45838 - atomic_read(&fscache_n_object_dead));
45839 + atomic_read_unchecked(&fscache_n_object_alloc),
45840 + atomic_read_unchecked(&fscache_n_object_no_alloc),
45841 + atomic_read_unchecked(&fscache_n_object_avail),
45842 + atomic_read_unchecked(&fscache_n_object_dead));
45843 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
45844 - atomic_read(&fscache_n_checkaux_none),
45845 - atomic_read(&fscache_n_checkaux_okay),
45846 - atomic_read(&fscache_n_checkaux_update),
45847 - atomic_read(&fscache_n_checkaux_obsolete));
45848 + atomic_read_unchecked(&fscache_n_checkaux_none),
45849 + atomic_read_unchecked(&fscache_n_checkaux_okay),
45850 + atomic_read_unchecked(&fscache_n_checkaux_update),
45851 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
45853 seq_printf(m, "Pages : mrk=%u unc=%u\n",
45854 - atomic_read(&fscache_n_marks),
45855 - atomic_read(&fscache_n_uncaches));
45856 + atomic_read_unchecked(&fscache_n_marks),
45857 + atomic_read_unchecked(&fscache_n_uncaches));
45859 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
45861 - atomic_read(&fscache_n_acquires),
45862 - atomic_read(&fscache_n_acquires_null),
45863 - atomic_read(&fscache_n_acquires_no_cache),
45864 - atomic_read(&fscache_n_acquires_ok),
45865 - atomic_read(&fscache_n_acquires_nobufs),
45866 - atomic_read(&fscache_n_acquires_oom));
45867 + atomic_read_unchecked(&fscache_n_acquires),
45868 + atomic_read_unchecked(&fscache_n_acquires_null),
45869 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
45870 + atomic_read_unchecked(&fscache_n_acquires_ok),
45871 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
45872 + atomic_read_unchecked(&fscache_n_acquires_oom));
45874 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
45875 - atomic_read(&fscache_n_object_lookups),
45876 - atomic_read(&fscache_n_object_lookups_negative),
45877 - atomic_read(&fscache_n_object_lookups_positive),
45878 - atomic_read(&fscache_n_object_created),
45879 - atomic_read(&fscache_n_object_lookups_timed_out));
45880 + atomic_read_unchecked(&fscache_n_object_lookups),
45881 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
45882 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
45883 + atomic_read_unchecked(&fscache_n_object_created),
45884 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
45886 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
45887 - atomic_read(&fscache_n_updates),
45888 - atomic_read(&fscache_n_updates_null),
45889 - atomic_read(&fscache_n_updates_run));
45890 + atomic_read_unchecked(&fscache_n_updates),
45891 + atomic_read_unchecked(&fscache_n_updates_null),
45892 + atomic_read_unchecked(&fscache_n_updates_run));
45894 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
45895 - atomic_read(&fscache_n_relinquishes),
45896 - atomic_read(&fscache_n_relinquishes_null),
45897 - atomic_read(&fscache_n_relinquishes_waitcrt),
45898 - atomic_read(&fscache_n_relinquishes_retire));
45899 + atomic_read_unchecked(&fscache_n_relinquishes),
45900 + atomic_read_unchecked(&fscache_n_relinquishes_null),
45901 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
45902 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
45904 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
45905 - atomic_read(&fscache_n_attr_changed),
45906 - atomic_read(&fscache_n_attr_changed_ok),
45907 - atomic_read(&fscache_n_attr_changed_nobufs),
45908 - atomic_read(&fscache_n_attr_changed_nomem),
45909 - atomic_read(&fscache_n_attr_changed_calls));
45910 + atomic_read_unchecked(&fscache_n_attr_changed),
45911 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
45912 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
45913 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
45914 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
45916 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
45917 - atomic_read(&fscache_n_allocs),
45918 - atomic_read(&fscache_n_allocs_ok),
45919 - atomic_read(&fscache_n_allocs_wait),
45920 - atomic_read(&fscache_n_allocs_nobufs),
45921 - atomic_read(&fscache_n_allocs_intr));
45922 + atomic_read_unchecked(&fscache_n_allocs),
45923 + atomic_read_unchecked(&fscache_n_allocs_ok),
45924 + atomic_read_unchecked(&fscache_n_allocs_wait),
45925 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
45926 + atomic_read_unchecked(&fscache_n_allocs_intr));
45927 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
45928 - atomic_read(&fscache_n_alloc_ops),
45929 - atomic_read(&fscache_n_alloc_op_waits),
45930 - atomic_read(&fscache_n_allocs_object_dead));
45931 + atomic_read_unchecked(&fscache_n_alloc_ops),
45932 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
45933 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
45935 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
45936 " int=%u oom=%u\n",
45937 - atomic_read(&fscache_n_retrievals),
45938 - atomic_read(&fscache_n_retrievals_ok),
45939 - atomic_read(&fscache_n_retrievals_wait),
45940 - atomic_read(&fscache_n_retrievals_nodata),
45941 - atomic_read(&fscache_n_retrievals_nobufs),
45942 - atomic_read(&fscache_n_retrievals_intr),
45943 - atomic_read(&fscache_n_retrievals_nomem));
45944 + atomic_read_unchecked(&fscache_n_retrievals),
45945 + atomic_read_unchecked(&fscache_n_retrievals_ok),
45946 + atomic_read_unchecked(&fscache_n_retrievals_wait),
45947 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
45948 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
45949 + atomic_read_unchecked(&fscache_n_retrievals_intr),
45950 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
45951 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
45952 - atomic_read(&fscache_n_retrieval_ops),
45953 - atomic_read(&fscache_n_retrieval_op_waits),
45954 - atomic_read(&fscache_n_retrievals_object_dead));
45955 + atomic_read_unchecked(&fscache_n_retrieval_ops),
45956 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
45957 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
45959 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
45960 - atomic_read(&fscache_n_stores),
45961 - atomic_read(&fscache_n_stores_ok),
45962 - atomic_read(&fscache_n_stores_again),
45963 - atomic_read(&fscache_n_stores_nobufs),
45964 - atomic_read(&fscache_n_stores_oom));
45965 + atomic_read_unchecked(&fscache_n_stores),
45966 + atomic_read_unchecked(&fscache_n_stores_ok),
45967 + atomic_read_unchecked(&fscache_n_stores_again),
45968 + atomic_read_unchecked(&fscache_n_stores_nobufs),
45969 + atomic_read_unchecked(&fscache_n_stores_oom));
45970 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
45971 - atomic_read(&fscache_n_store_ops),
45972 - atomic_read(&fscache_n_store_calls),
45973 - atomic_read(&fscache_n_store_pages),
45974 - atomic_read(&fscache_n_store_radix_deletes),
45975 - atomic_read(&fscache_n_store_pages_over_limit));
45976 + atomic_read_unchecked(&fscache_n_store_ops),
45977 + atomic_read_unchecked(&fscache_n_store_calls),
45978 + atomic_read_unchecked(&fscache_n_store_pages),
45979 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
45980 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
45982 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
45983 - atomic_read(&fscache_n_store_vmscan_not_storing),
45984 - atomic_read(&fscache_n_store_vmscan_gone),
45985 - atomic_read(&fscache_n_store_vmscan_busy),
45986 - atomic_read(&fscache_n_store_vmscan_cancelled));
45987 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
45988 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
45989 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
45990 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
45992 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
45993 - atomic_read(&fscache_n_op_pend),
45994 - atomic_read(&fscache_n_op_run),
45995 - atomic_read(&fscache_n_op_enqueue),
45996 - atomic_read(&fscache_n_op_cancelled),
45997 - atomic_read(&fscache_n_op_rejected));
45998 + atomic_read_unchecked(&fscache_n_op_pend),
45999 + atomic_read_unchecked(&fscache_n_op_run),
46000 + atomic_read_unchecked(&fscache_n_op_enqueue),
46001 + atomic_read_unchecked(&fscache_n_op_cancelled),
46002 + atomic_read_unchecked(&fscache_n_op_rejected));
46003 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
46004 - atomic_read(&fscache_n_op_deferred_release),
46005 - atomic_read(&fscache_n_op_release),
46006 - atomic_read(&fscache_n_op_gc));
46007 + atomic_read_unchecked(&fscache_n_op_deferred_release),
46008 + atomic_read_unchecked(&fscache_n_op_release),
46009 + atomic_read_unchecked(&fscache_n_op_gc));
46011 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
46012 atomic_read(&fscache_n_cop_alloc_object),
46013 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
46014 index b6cca47..ec782c3 100644
46015 --- a/fs/fuse/cuse.c
46016 +++ b/fs/fuse/cuse.c
46017 @@ -586,10 +586,12 @@ static int __init cuse_init(void)
46018 INIT_LIST_HEAD(&cuse_conntbl[i]);
46020 /* inherit and extend fuse_dev_operations */
46021 - cuse_channel_fops = fuse_dev_operations;
46022 - cuse_channel_fops.owner = THIS_MODULE;
46023 - cuse_channel_fops.open = cuse_channel_open;
46024 - cuse_channel_fops.release = cuse_channel_release;
46025 + pax_open_kernel();
46026 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
46027 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
46028 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
46029 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
46030 + pax_close_kernel();
46032 cuse_class = class_create(THIS_MODULE, "cuse");
46033 if (IS_ERR(cuse_class))
46034 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
46035 index 2aaf3ea..8e50863 100644
46036 --- a/fs/fuse/dev.c
46037 +++ b/fs/fuse/dev.c
46038 @@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
46042 - if (!pipe->readers) {
46043 + if (!atomic_read(&pipe->readers)) {
46044 send_sig(SIGPIPE, current, 0);
46047 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
46048 index 9f63e49..d8a64c0 100644
46049 --- a/fs/fuse/dir.c
46050 +++ b/fs/fuse/dir.c
46051 @@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *dentry)
46055 -static void free_link(char *link)
46056 +static void free_link(const char *link)
46059 free_page((unsigned long) link);
46060 diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
46061 index 900cf98..3896726 100644
46062 --- a/fs/gfs2/inode.c
46063 +++ b/fs/gfs2/inode.c
46064 @@ -1517,7 +1517,7 @@ out:
46066 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
46068 - char *s = nd_get_link(nd);
46069 + const char *s = nd_get_link(nd);
46073 diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
46074 index 4dfbfec..947c9c2 100644
46075 --- a/fs/hfsplus/catalog.c
46076 +++ b/fs/hfsplus/catalog.c
46077 @@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
46081 + pax_track_stack();
46083 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
46084 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
46086 @@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
46090 + pax_track_stack();
46092 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
46093 str->name, cnid, inode->i_nlink);
46094 err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
46095 @@ -353,6 +357,8 @@ int hfsplus_rename_cat(u32 cnid,
46096 int entry_size, type;
46099 + pax_track_stack();
46101 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
46102 cnid, src_dir->i_ino, src_name->name,
46103 dst_dir->i_ino, dst_name->name);
46104 diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
46105 index 25b2443..09a3341 100644
46106 --- a/fs/hfsplus/dir.c
46107 +++ b/fs/hfsplus/dir.c
46108 @@ -131,6 +131,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
46109 struct hfsplus_readdir_data *rd;
46112 + pax_track_stack();
46114 if (filp->f_pos >= inode->i_size)
46117 diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
46118 index 4cc1e3a..ad0f70b 100644
46119 --- a/fs/hfsplus/inode.c
46120 +++ b/fs/hfsplus/inode.c
46121 @@ -501,6 +501,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
46125 + pax_track_stack();
46127 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
46129 HFSPLUS_I(inode)->linkid = 0;
46130 @@ -564,6 +566,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
46131 struct hfs_find_data fd;
46132 hfsplus_cat_entry entry;
46134 + pax_track_stack();
46136 if (HFSPLUS_IS_RSRC(inode))
46137 main_inode = HFSPLUS_I(inode)->rsrc_inode;
46139 diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
46140 index fbaa669..c548cd0 100644
46141 --- a/fs/hfsplus/ioctl.c
46142 +++ b/fs/hfsplus/ioctl.c
46143 @@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
46144 struct hfsplus_cat_file *file;
46147 + pax_track_stack();
46149 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46150 return -EOPNOTSUPP;
46152 @@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
46153 struct hfsplus_cat_file *file;
46156 + pax_track_stack();
46158 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46159 return -EOPNOTSUPP;
46161 diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
46162 index d24a9b6..dd9b3dd 100644
46163 --- a/fs/hfsplus/super.c
46164 +++ b/fs/hfsplus/super.c
46165 @@ -347,6 +347,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
46166 u64 last_fs_block, last_fs_page;
46169 + pax_track_stack();
46172 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
46174 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
46175 index ec88953..cb5e98e 100644
46176 --- a/fs/hugetlbfs/inode.c
46177 +++ b/fs/hugetlbfs/inode.c
46178 @@ -915,7 +915,7 @@ static struct file_system_type hugetlbfs_fs_type = {
46179 .kill_sb = kill_litter_super,
46182 -static struct vfsmount *hugetlbfs_vfsmount;
46183 +struct vfsmount *hugetlbfs_vfsmount;
46185 static int can_do_hugetlb_shm(void)
46187 diff --git a/fs/inode.c b/fs/inode.c
46188 index ec79246..054c36a 100644
46191 @@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
46194 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
46195 - static atomic_t shared_last_ino;
46196 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
46197 + static atomic_unchecked_t shared_last_ino;
46198 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
46200 res = next - LAST_INO_BATCH;
46202 diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
46203 index f94fc48..3bb8d30 100644
46204 --- a/fs/jbd/checkpoint.c
46205 +++ b/fs/jbd/checkpoint.c
46206 @@ -358,6 +358,8 @@ int log_do_checkpoint(journal_t *journal)
46210 + pax_track_stack();
46212 jbd_debug(1, "Start checkpoint\n");
46215 diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
46216 index 16a5047..88ff6ca 100644
46217 --- a/fs/jffs2/compr_rtime.c
46218 +++ b/fs/jffs2/compr_rtime.c
46219 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
46223 + pax_track_stack();
46225 memset(positions,0,sizeof(positions));
46227 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
46228 @@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
46232 + pax_track_stack();
46234 memset(positions,0,sizeof(positions));
46236 while (outpos<destlen) {
46237 diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
46238 index 9e7cec8..4713089 100644
46239 --- a/fs/jffs2/compr_rubin.c
46240 +++ b/fs/jffs2/compr_rubin.c
46241 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
46243 uint32_t mysrclen, mydstlen;
46245 + pax_track_stack();
46247 mysrclen = *sourcelen;
46248 mydstlen = *dstlen - 8;
46250 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
46251 index e513f19..2ab1351 100644
46252 --- a/fs/jffs2/erase.c
46253 +++ b/fs/jffs2/erase.c
46254 @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
46255 struct jffs2_unknown_node marker = {
46256 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
46257 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46258 - .totlen = cpu_to_je32(c->cleanmarker_size)
46259 + .totlen = cpu_to_je32(c->cleanmarker_size),
46260 + .hdr_crc = cpu_to_je32(0)
46263 jffs2_prealloc_raw_node_refs(c, jeb, 1);
46264 diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
46265 index 4515bea..178f2d6 100644
46266 --- a/fs/jffs2/wbuf.c
46267 +++ b/fs/jffs2/wbuf.c
46268 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
46270 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
46271 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
46272 - .totlen = constant_cpu_to_je32(8)
46273 + .totlen = constant_cpu_to_je32(8),
46274 + .hdr_crc = constant_cpu_to_je32(0)
46278 diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
46279 index 3e93cdd..c8a80e1 100644
46280 --- a/fs/jffs2/xattr.c
46281 +++ b/fs/jffs2/xattr.c
46282 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
46284 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
46286 + pax_track_stack();
46288 /* Phase.1 : Merge same xref */
46289 for (i=0; i < XREF_TMPHASH_SIZE; i++)
46290 xref_tmphash[i] = NULL;
46291 diff --git a/fs/jfs/super.c b/fs/jfs/super.c
46292 index 06c8a67..589dbbd 100644
46293 --- a/fs/jfs/super.c
46294 +++ b/fs/jfs/super.c
46295 @@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
46298 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
46299 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
46300 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
46302 if (jfs_inode_cachep == NULL)
46304 diff --git a/fs/libfs.c b/fs/libfs.c
46305 index c18e9a1..0b04e2c 100644
46308 @@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46310 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
46311 struct dentry *next;
46312 + char d_name[sizeof(next->d_iname)];
46313 + const unsigned char *name;
46315 next = list_entry(p, struct dentry, d_u.d_child);
46316 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
46317 if (!simple_positive(next)) {
46318 @@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
46320 spin_unlock(&next->d_lock);
46321 spin_unlock(&dentry->d_lock);
46322 - if (filldir(dirent, next->d_name.name,
46323 + name = next->d_name.name;
46324 + if (name == next->d_iname) {
46325 + memcpy(d_name, name, next->d_name.len);
46328 + if (filldir(dirent, name,
46329 next->d_name.len, filp->f_pos,
46330 next->d_inode->i_ino,
46331 dt_type(next->d_inode)) < 0)
46332 diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
46333 index 8392cb8..ae8ed40 100644
46334 --- a/fs/lockd/clntproc.c
46335 +++ b/fs/lockd/clntproc.c
46336 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
46338 * Cookie counter for NLM requests
46340 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
46341 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
46343 void nlmclnt_next_cookie(struct nlm_cookie *c)
46345 - u32 cookie = atomic_inc_return(&nlm_cookie);
46346 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
46348 memcpy(c->data, &cookie, 4);
46350 @@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
46351 struct nlm_rqst reqst, *req;
46354 + pax_track_stack();
46357 memset(req, 0, sizeof(*req));
46358 locks_init_lock(&req->a_args.lock.fl);
46359 diff --git a/fs/locks.c b/fs/locks.c
46360 index 703f545..150a552 100644
46363 @@ -2022,16 +2022,16 @@ void locks_remove_flock(struct file *filp)
46366 if (filp->f_op && filp->f_op->flock) {
46367 - struct file_lock fl = {
46368 + struct file_lock flock = {
46369 .fl_pid = current->tgid,
46371 .fl_flags = FL_FLOCK,
46372 .fl_type = F_UNLCK,
46373 .fl_end = OFFSET_MAX,
46375 - filp->f_op->flock(filp, F_SETLKW, &fl);
46376 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
46377 - fl.fl_ops->fl_release_private(&fl);
46378 + filp->f_op->flock(filp, F_SETLKW, &flock);
46379 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
46380 + flock.fl_ops->fl_release_private(&flock);
46384 diff --git a/fs/logfs/super.c b/fs/logfs/super.c
46385 index ce03a18..ac8c14f 100644
46386 --- a/fs/logfs/super.c
46387 +++ b/fs/logfs/super.c
46388 @@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super_block *sb)
46389 struct logfs_disk_super _ds1, *ds1 = &_ds1;
46390 int err, valid0, valid1;
46392 + pax_track_stack();
46394 /* read first superblock */
46395 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
46397 diff --git a/fs/minix/bitmap.c b/fs/minix/bitmap.c
46398 index 3f32bcb..7c82c29 100644
46399 --- a/fs/minix/bitmap.c
46400 +++ b/fs/minix/bitmap.c
46401 @@ -20,10 +20,11 @@ static const int nibblemap[] = { 4,3,3,2,3,2,2,1,3,2,2,1,2,1,1,0 };
46403 static DEFINE_SPINLOCK(bitmap_lock);
46405 -static unsigned long count_free(struct buffer_head *map[], unsigned numblocks, __u32 numbits)
46406 +static unsigned long count_free(struct buffer_head *map[], unsigned blocksize, __u32 numbits)
46408 unsigned i, j, sum = 0;
46409 struct buffer_head *bh;
46410 + unsigned numblocks = minix_blocks_needed(numbits, blocksize);
46412 for (i=0; i<numblocks-1; i++) {
46414 @@ -105,10 +106,12 @@ int minix_new_block(struct inode * inode)
46418 -unsigned long minix_count_free_blocks(struct minix_sb_info *sbi)
46419 +unsigned long minix_count_free_blocks(struct super_block *sb)
46421 - return (count_free(sbi->s_zmap, sbi->s_zmap_blocks,
46422 - sbi->s_nzones - sbi->s_firstdatazone + 1)
46423 + struct minix_sb_info *sbi = minix_sb(sb);
46424 + u32 bits = sbi->s_nzones - (sbi->s_firstdatazone + 1);
46426 + return (count_free(sbi->s_zmap, sb->s_blocksize, bits)
46427 << sbi->s_log_zone_size);
46430 @@ -273,7 +276,10 @@ struct inode *minix_new_inode(const struct inode *dir, int mode, int *error)
46434 -unsigned long minix_count_free_inodes(struct minix_sb_info *sbi)
46435 +unsigned long minix_count_free_inodes(struct super_block *sb)
46437 - return count_free(sbi->s_imap, sbi->s_imap_blocks, sbi->s_ninodes + 1);
46438 + struct minix_sb_info *sbi = minix_sb(sb);
46439 + u32 bits = sbi->s_ninodes + 1;
46441 + return count_free(sbi->s_imap, sb->s_blocksize, bits);
46443 diff --git a/fs/minix/inode.c b/fs/minix/inode.c
46444 index e7d23e2..1ed1351 100644
46445 --- a/fs/minix/inode.c
46446 +++ b/fs/minix/inode.c
46447 @@ -279,6 +279,27 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
46448 else if (sbi->s_mount_state & MINIX_ERROR_FS)
46449 printk("MINIX-fs: mounting file system with errors, "
46450 "running fsck is recommended\n");
46452 + /* Apparently minix can create filesystems that allocate more blocks for
46453 + * the bitmaps than needed. We simply ignore that, but verify it didn't
46454 + * create one with not enough blocks and bail out if so.
46456 + block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
46457 + if (sbi->s_imap_blocks < block) {
46458 + printk("MINIX-fs: file system does not have enough "
46459 + "imap blocks allocated. Refusing to mount\n");
46463 + block = minix_blocks_needed(
46464 + (sbi->s_nzones - (sbi->s_firstdatazone + 1)),
46466 + if (sbi->s_zmap_blocks < block) {
46467 + printk("MINIX-fs: file system does not have enough "
46468 + "zmap blocks allocated. Refusing to mount.\n");
46475 @@ -339,10 +360,10 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)
46476 buf->f_type = sb->s_magic;
46477 buf->f_bsize = sb->s_blocksize;
46478 buf->f_blocks = (sbi->s_nzones - sbi->s_firstdatazone) << sbi->s_log_zone_size;
46479 - buf->f_bfree = minix_count_free_blocks(sbi);
46480 + buf->f_bfree = minix_count_free_blocks(sb);
46481 buf->f_bavail = buf->f_bfree;
46482 buf->f_files = sbi->s_ninodes;
46483 - buf->f_ffree = minix_count_free_inodes(sbi);
46484 + buf->f_ffree = minix_count_free_inodes(sb);
46485 buf->f_namelen = sbi->s_namelen;
46486 buf->f_fsid.val[0] = (u32)id;
46487 buf->f_fsid.val[1] = (u32)(id >> 32);
46488 diff --git a/fs/minix/minix.h b/fs/minix/minix.h
46489 index 341e212..6415fe0 100644
46490 --- a/fs/minix/minix.h
46491 +++ b/fs/minix/minix.h
46492 @@ -48,10 +48,10 @@ extern struct minix_inode * minix_V1_raw_inode(struct super_block *, ino_t, stru
46493 extern struct minix2_inode * minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
46494 extern struct inode * minix_new_inode(const struct inode *, int, int *);
46495 extern void minix_free_inode(struct inode * inode);
46496 -extern unsigned long minix_count_free_inodes(struct minix_sb_info *sbi);
46497 +extern unsigned long minix_count_free_inodes(struct super_block *sb);
46498 extern int minix_new_block(struct inode * inode);
46499 extern void minix_free_block(struct inode *inode, unsigned long block);
46500 -extern unsigned long minix_count_free_blocks(struct minix_sb_info *sbi);
46501 +extern unsigned long minix_count_free_blocks(struct super_block *sb);
46502 extern int minix_getattr(struct vfsmount *, struct dentry *, struct kstat *);
46503 extern int minix_prepare_chunk(struct page *page, loff_t pos, unsigned len);
46505 @@ -88,6 +88,11 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
46506 return list_entry(inode, struct minix_inode_info, vfs_inode);
46509 +static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
46511 + return DIV_ROUND_UP(bits, blocksize * 8);
46514 #if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
46515 defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
46517 diff --git a/fs/namei.c b/fs/namei.c
46518 index 3d15072..c1ddf9c 100644
46521 @@ -281,16 +281,32 @@ int generic_permission(struct inode *inode, int mask)
46522 if (ret != -EACCES)
46525 +#ifdef CONFIG_GRKERNSEC
46526 + /* we'll block if we have to log due to a denied capability use */
46527 + if (mask & MAY_NOT_BLOCK)
46531 if (S_ISDIR(inode->i_mode)) {
46532 /* DACs are overridable for directories */
46533 - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46535 if (!(mask & MAY_WRITE))
46536 - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46537 + if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46538 + ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46540 + if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46545 + * Searching includes executable on directories, else just read.
46547 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46548 + if (mask == MAY_READ)
46549 + if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) ||
46550 + ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46554 * Read/write DACs are always overridable.
46555 * Executable DACs are overridable when there is
46556 * at least one exec bit set.
46557 @@ -299,14 +315,6 @@ int generic_permission(struct inode *inode, int mask)
46558 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
46562 - * Searching includes executable on directories, else just read.
46564 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46565 - if (mask == MAY_READ)
46566 - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
46572 @@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
46576 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
46577 + dentry->d_inode, dentry, nd->path.mnt)) {
46579 + *p = ERR_PTR(error); /* no ->put_link(), please */
46580 + path_put(&nd->path);
46584 nd->last_type = LAST_BIND;
46585 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
46586 error = PTR_ERR(*p);
46588 - char *s = nd_get_link(nd);
46589 + const char *s = nd_get_link(nd);
46592 error = __vfs_follow_link(nd, s);
46593 @@ -1622,6 +1638,21 @@ static int path_lookupat(int dfd, const char *name,
46595 err = complete_walk(nd);
46597 + if (!(nd->flags & LOOKUP_PARENT)) {
46598 +#ifdef CONFIG_GRKERNSEC
46599 + if (flags & LOOKUP_RCU) {
46601 + path_put(&nd->path);
46605 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46607 + path_put(&nd->path);
46612 if (!err && nd->flags & LOOKUP_DIRECTORY) {
46613 if (!nd->inode->i_op->lookup) {
46614 path_put(&nd->path);
46615 @@ -1649,6 +1680,15 @@ static int do_path_lookup(int dfd, const char *name,
46616 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
46618 if (likely(!retval)) {
46619 + if (*name != '/' && nd->path.dentry && nd->inode) {
46620 +#ifdef CONFIG_GRKERNSEC
46621 + if (flags & LOOKUP_RCU)
46624 + if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
46628 if (unlikely(!audit_dummy_context())) {
46629 if (nd->path.dentry && nd->inode)
46630 audit_inode(name, nd->path.dentry);
46631 @@ -2049,7 +2089,27 @@ static int may_open(struct path *path, int acc_mode, int flag)
46633 * Ensure there are no outstanding leases on the file.
46635 - return break_lease(inode, flag);
46636 + error = break_lease(inode, flag);
46641 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
46646 + if (gr_handle_rawio(inode)) {
46651 + if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
46659 static int handle_truncate(struct file *filp)
46660 @@ -2110,6 +2170,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46661 error = complete_walk(nd);
46663 return ERR_PTR(error);
46664 +#ifdef CONFIG_GRKERNSEC
46665 + if (nd->flags & LOOKUP_RCU) {
46670 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46674 audit_inode(pathname, nd->path.dentry);
46675 if (open_flag & O_CREAT) {
46677 @@ -2120,6 +2190,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46678 error = complete_walk(nd);
46680 return ERR_PTR(error);
46681 +#ifdef CONFIG_GRKERNSEC
46682 + if (nd->flags & LOOKUP_RCU) {
46687 + if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
46691 audit_inode(pathname, dir);
46694 @@ -2141,6 +2221,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46695 error = complete_walk(nd);
46697 return ERR_PTR(-ECHILD);
46698 +#ifdef CONFIG_GRKERNSEC
46699 + if (nd->flags & LOOKUP_RCU) {
46704 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46710 if (nd->flags & LOOKUP_DIRECTORY) {
46711 @@ -2181,6 +2271,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46712 /* Negative dentry, just create the file */
46713 if (!dentry->d_inode) {
46714 int mode = op->mode;
46716 + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, open_flag, acc_mode, mode)) {
46718 + goto exit_mutex_unlock;
46721 if (!IS_POSIXACL(dir->d_inode))
46722 mode &= ~current_umask();
46724 @@ -2204,6 +2300,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46725 error = vfs_create(dir->d_inode, dentry, mode, nd);
46727 goto exit_mutex_unlock;
46729 + gr_handle_create(path->dentry, path->mnt);
46730 mutex_unlock(&dir->d_inode->i_mutex);
46731 dput(nd->path.dentry);
46732 nd->path.dentry = dentry;
46733 @@ -2213,6 +2311,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
46735 * It already exists.
46738 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
46740 + goto exit_mutex_unlock;
46743 + /* only check if O_CREAT is specified, all other checks need to go
46745 + if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
46747 + goto exit_mutex_unlock;
46750 mutex_unlock(&dir->d_inode->i_mutex);
46751 audit_inode(pathname, path->dentry);
46753 @@ -2425,6 +2536,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
46757 + if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt)) {
46759 + dentry = ERR_PTR(-ENOENT);
46763 dentry = ERR_PTR(-EEXIST);
46765 @@ -2447,6 +2563,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
46767 EXPORT_SYMBOL(user_path_create);
46769 +static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, char **to, int is_dir)
46771 + char *tmp = getname(pathname);
46772 + struct dentry *res;
46774 + return ERR_CAST(tmp);
46775 + res = kern_path_create(dfd, tmp, path, is_dir);
46783 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
46785 int error = may_create(dir, dentry);
46786 @@ -2514,6 +2644,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46787 error = mnt_want_write(path.mnt);
46791 + if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
46793 + goto out_drop_write;
46796 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
46798 + goto out_drop_write;
46801 error = security_path_mknod(&path, dentry, mode, dev);
46803 goto out_drop_write;
46804 @@ -2531,6 +2672,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
46807 mnt_drop_write(path.mnt);
46810 + gr_handle_create(dentry, path.mnt);
46813 mutex_unlock(&path.dentry->d_inode->i_mutex);
46814 @@ -2580,12 +2724,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
46815 error = mnt_want_write(path.mnt);
46819 + if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
46821 + goto out_drop_write;
46824 error = security_path_mkdir(&path, dentry, mode);
46826 goto out_drop_write;
46827 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
46829 mnt_drop_write(path.mnt);
46832 + gr_handle_create(dentry, path.mnt);
46835 mutex_unlock(&path.dentry->d_inode->i_mutex);
46836 @@ -2665,6 +2818,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46838 struct dentry *dentry;
46839 struct nameidata nd;
46840 + ino_t saved_ino = 0;
46841 + dev_t saved_dev = 0;
46843 error = user_path_parent(dfd, pathname, &nd, &name);
46845 @@ -2693,6 +2848,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
46850 + saved_ino = dentry->d_inode->i_ino;
46851 + saved_dev = gr_get_dev_from_dentry(dentry);
46853 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
46858 error = mnt_want_write(nd.path.mnt);
46861 @@ -2700,6 +2864,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
46864 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
46865 + if (!error && (saved_dev || saved_ino))
46866 + gr_handle_delete(saved_ino, saved_dev);
46868 mnt_drop_write(nd.path.mnt);
46870 @@ -2762,6 +2928,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46871 struct dentry *dentry;
46872 struct nameidata nd;
46873 struct inode *inode = NULL;
46874 + ino_t saved_ino = 0;
46875 + dev_t saved_dev = 0;
46877 error = user_path_parent(dfd, pathname, &nd, &name);
46879 @@ -2784,6 +2952,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46884 + if (inode->i_nlink <= 1) {
46885 + saved_ino = inode->i_ino;
46886 + saved_dev = gr_get_dev_from_dentry(dentry);
46888 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
46893 error = mnt_want_write(nd.path.mnt);
46896 @@ -2791,6 +2969,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
46899 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
46900 + if (!error && (saved_ino || saved_dev))
46901 + gr_handle_delete(saved_ino, saved_dev);
46903 mnt_drop_write(nd.path.mnt);
46905 @@ -2866,10 +3046,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
46906 error = mnt_want_write(path.mnt);
46910 + if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
46912 + goto out_drop_write;
46915 error = security_path_symlink(&path, dentry, from);
46917 goto out_drop_write;
46918 error = vfs_symlink(path.dentry->d_inode, dentry, from);
46920 + gr_handle_create(dentry, path.mnt);
46922 mnt_drop_write(path.mnt);
46924 @@ -2941,6 +3129,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46926 struct dentry *new_dentry;
46927 struct path old_path, new_path;
46932 @@ -2964,7 +3153,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46936 - new_dentry = user_path_create(newdfd, newname, &new_path, 0);
46937 + new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to, 0);
46938 error = PTR_ERR(new_dentry);
46939 if (IS_ERR(new_dentry))
46941 @@ -2975,13 +3164,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
46942 error = mnt_want_write(new_path.mnt);
46946 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
46947 + old_path.dentry->d_inode,
46948 + old_path.dentry->d_inode->i_mode, to)) {
46950 + goto out_drop_write;
46953 + if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
46954 + old_path.dentry, old_path.mnt, to)) {
46956 + goto out_drop_write;
46959 error = security_path_link(old_path.dentry, &new_path, new_dentry);
46961 goto out_drop_write;
46962 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
46964 + gr_handle_create(new_dentry, new_path.mnt);
46966 mnt_drop_write(new_path.mnt);
46970 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
46971 path_put(&new_path);
46972 @@ -3153,6 +3359,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46976 + pax_track_stack();
46978 error = user_path_parent(olddfd, oldname, &oldnd, &from);
46981 @@ -3209,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46982 if (new_dentry == trap)
46985 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
46986 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
46991 error = mnt_want_write(oldnd.path.mnt);
46994 @@ -3218,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
46996 error = vfs_rename(old_dir->d_inode, old_dentry,
46997 new_dir->d_inode, new_dentry);
46999 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
47000 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
47002 mnt_drop_write(oldnd.path.mnt);
47004 @@ -3243,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
47006 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
47009 + const char *newlink;
47012 len = PTR_ERR(link);
47013 @@ -3252,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
47014 len = strlen(link);
47015 if (len > (unsigned) buflen)
47017 - if (copy_to_user(buffer, link, len))
47019 + if (len < sizeof(tmpbuf)) {
47020 + memcpy(tmpbuf, link, len);
47021 + newlink = tmpbuf;
47025 + if (copy_to_user(buffer, newlink, len))
47029 diff --git a/fs/namespace.c b/fs/namespace.c
47030 index 5e7f2e9..cd13685 100644
47031 --- a/fs/namespace.c
47032 +++ b/fs/namespace.c
47033 @@ -1326,6 +1326,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47034 if (!(sb->s_flags & MS_RDONLY))
47035 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
47036 up_write(&sb->s_umount);
47038 + gr_log_remount(mnt->mnt_devname, retval);
47043 @@ -1345,6 +1348,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
47044 br_write_unlock(vfsmount_lock);
47045 up_write(&namespace_sem);
47046 release_mounts(&umount_list);
47048 + gr_log_unmount(mnt->mnt_devname, retval);
47053 @@ -2336,6 +2342,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47054 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
47057 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
47062 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47067 if (flags & MS_REMOUNT)
47068 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47070 @@ -2350,6 +2366,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47071 dev_name, data_page);
47075 + gr_log_mount(dev_name, dir_name, retval);
47080 @@ -2573,6 +2592,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
47084 + if (gr_handle_chroot_pivot()) {
47089 get_fs_root(current->fs, &root);
47090 error = lock_mount(&old);
47092 diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
47093 index 9c51f62..503b252 100644
47094 --- a/fs/ncpfs/dir.c
47095 +++ b/fs/ncpfs/dir.c
47096 @@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentry, struct nameidata *nd)
47097 int res, val = 0, len;
47098 __u8 __name[NCP_MAXPATHLEN + 1];
47100 + pax_track_stack();
47102 if (dentry == dentry->d_sb->s_root)
47105 @@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
47106 int error, res, len;
47107 __u8 __name[NCP_MAXPATHLEN + 1];
47109 + pax_track_stack();
47112 if (!ncp_conn_valid(server))
47114 @@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
47115 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
47116 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
47118 + pax_track_stack();
47120 ncp_age_dentry(server, dentry);
47121 len = sizeof(__name);
47122 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
47123 @@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
47125 __u8 __name[NCP_MAXPATHLEN + 1];
47127 + pax_track_stack();
47129 DPRINTK("ncp_mkdir: making %s/%s\n",
47130 dentry->d_parent->d_name.name, dentry->d_name.name);
47132 @@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
47133 int old_len, new_len;
47134 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
47136 + pax_track_stack();
47138 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
47139 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
47140 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
47141 diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
47142 index 202f370..9d4565e 100644
47143 --- a/fs/ncpfs/inode.c
47144 +++ b/fs/ncpfs/inode.c
47145 @@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
47147 struct ncp_entry_info finfo;
47149 + pax_track_stack();
47151 memset(&data, 0, sizeof(data));
47152 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
47154 diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
47155 index 281ae95..dd895b9 100644
47156 --- a/fs/nfs/blocklayout/blocklayout.c
47157 +++ b/fs/nfs/blocklayout/blocklayout.c
47158 @@ -90,7 +90,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
47160 struct parallel_io {
47161 struct kref refcnt;
47162 - struct rpc_call_ops call_ops;
47163 + rpc_call_ops_no_const call_ops;
47164 void (*pnfs_callback) (void *data);
47167 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
47168 index 679d2f5..ef1ffec 100644
47169 --- a/fs/nfs/inode.c
47170 +++ b/fs/nfs/inode.c
47171 @@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
47172 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47173 nfsi->attrtimeo_timestamp = jiffies;
47175 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47176 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47177 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47178 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47180 @@ -1002,16 +1002,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
47181 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47184 -static atomic_long_t nfs_attr_generation_counter;
47185 +static atomic_long_unchecked_t nfs_attr_generation_counter;
47187 static unsigned long nfs_read_attr_generation_counter(void)
47189 - return atomic_long_read(&nfs_attr_generation_counter);
47190 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47193 unsigned long nfs_inc_attr_generation_counter(void)
47195 - return atomic_long_inc_return(&nfs_attr_generation_counter);
47196 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47199 void nfs_fattr_init(struct nfs_fattr *fattr)
47200 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
47201 index 6f8bcc7..8f823c5 100644
47202 --- a/fs/nfsd/nfs4state.c
47203 +++ b/fs/nfsd/nfs4state.c
47204 @@ -3999,6 +3999,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
47205 unsigned int strhashval;
47208 + pax_track_stack();
47210 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
47211 (long long) lock->lk_offset,
47212 (long long) lock->lk_length);
47213 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
47214 index f810996..cec8977 100644
47215 --- a/fs/nfsd/nfs4xdr.c
47216 +++ b/fs/nfsd/nfs4xdr.c
47217 @@ -1875,6 +1875,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
47221 + pax_track_stack();
47223 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
47224 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
47225 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
47226 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
47227 index acf88ae..4fd6245 100644
47228 --- a/fs/nfsd/vfs.c
47229 +++ b/fs/nfsd/vfs.c
47230 @@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47234 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47235 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47239 @@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47241 /* Write the data. */
47242 oldfs = get_fs(); set_fs(KERNEL_DS);
47243 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47244 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47248 @@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
47251 oldfs = get_fs(); set_fs(KERNEL_DS);
47252 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
47253 + host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
47257 diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
47258 index 41d6743..b805df9 100644
47259 --- a/fs/nilfs2/ioctl.c
47260 +++ b/fs/nilfs2/ioctl.c
47261 @@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
47262 if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
47265 + if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
47268 len = argv[n].v_size * argv[n].v_nmembs;
47269 base = (void __user *)(unsigned long)argv[n].v_base;
47271 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
47272 index 9fde1c0..14e8827 100644
47273 --- a/fs/notify/fanotify/fanotify_user.c
47274 +++ b/fs/notify/fanotify/fanotify_user.c
47275 @@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
47279 - if (copy_to_user(buf, &fanotify_event_metadata,
47280 + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
47281 + copy_to_user(buf, &fanotify_event_metadata,
47282 fanotify_event_metadata.event_len))
47283 goto out_kill_access_response;
47285 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
47286 index ee18815..7aa5d01 100644
47287 --- a/fs/notify/notification.c
47288 +++ b/fs/notify/notification.c
47289 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
47290 * get set to 0 so it will never get 'freed'
47292 static struct fsnotify_event *q_overflow_event;
47293 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47294 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47297 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
47298 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47300 u32 fsnotify_get_cookie(void)
47302 - return atomic_inc_return(&fsnotify_sync_cookie);
47303 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
47305 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
47307 diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
47308 index 99e3610..02c1068 100644
47309 --- a/fs/ntfs/dir.c
47310 +++ b/fs/ntfs/dir.c
47311 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
47312 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
47313 ~(s64)(ndir->itype.index.block_size - 1)));
47314 /* Bounds checks. */
47315 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47316 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47317 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
47318 "inode 0x%lx or driver bug.", vdir->i_ino);
47320 diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
47321 index c587e2d..3641eaa 100644
47322 --- a/fs/ntfs/file.c
47323 +++ b/fs/ntfs/file.c
47324 @@ -2229,6 +2229,6 @@ const struct inode_operations ntfs_file_inode_ops = {
47325 #endif /* NTFS_RW */
47328 -const struct file_operations ntfs_empty_file_ops = {};
47329 +const struct file_operations ntfs_empty_file_ops __read_only;
47331 -const struct inode_operations ntfs_empty_inode_ops = {};
47332 +const struct inode_operations ntfs_empty_inode_ops __read_only;
47333 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
47334 index 210c352..a174f83 100644
47335 --- a/fs/ocfs2/localalloc.c
47336 +++ b/fs/ocfs2/localalloc.c
47337 @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
47341 - atomic_inc(&osb->alloc_stats.moves);
47342 + atomic_inc_unchecked(&osb->alloc_stats.moves);
47346 diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
47347 index 53aa41e..d7df9f1 100644
47348 --- a/fs/ocfs2/namei.c
47349 +++ b/fs/ocfs2/namei.c
47350 @@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *old_dir,
47351 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
47352 struct ocfs2_dir_lookup_result target_insert = { NULL, };
47354 + pax_track_stack();
47356 /* At some point it might be nice to break this function up a
47359 diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
47360 index 4092858..51c70ff 100644
47361 --- a/fs/ocfs2/ocfs2.h
47362 +++ b/fs/ocfs2/ocfs2.h
47363 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
47365 struct ocfs2_alloc_stats
47368 - atomic_t local_data;
47369 - atomic_t bitmap_data;
47370 - atomic_t bg_allocs;
47371 - atomic_t bg_extends;
47372 + atomic_unchecked_t moves;
47373 + atomic_unchecked_t local_data;
47374 + atomic_unchecked_t bitmap_data;
47375 + atomic_unchecked_t bg_allocs;
47376 + atomic_unchecked_t bg_extends;
47379 enum ocfs2_local_alloc_state
47380 diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
47381 index ba5d97e..c77db25 100644
47382 --- a/fs/ocfs2/suballoc.c
47383 +++ b/fs/ocfs2/suballoc.c
47384 @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
47385 mlog_errno(status);
47388 - atomic_inc(&osb->alloc_stats.bg_extends);
47389 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
47391 /* You should never ask for this much metadata */
47392 BUG_ON(bits_wanted >
47393 @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handle,
47394 mlog_errno(status);
47397 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47398 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47400 *suballoc_loc = res.sr_bg_blkno;
47401 *suballoc_bit_start = res.sr_bit_offset;
47402 @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
47403 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
47406 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47407 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47409 BUG_ON(res->sr_bits != 1);
47411 @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
47412 mlog_errno(status);
47415 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47416 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47418 BUG_ON(res.sr_bits != 1);
47420 @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47424 - atomic_inc(&osb->alloc_stats.local_data);
47425 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
47427 if (min_clusters > (osb->bitmap_cpg - 1)) {
47428 /* The only paths asking for contiguousness
47429 @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
47430 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
47432 res.sr_bit_offset);
47433 - atomic_inc(&osb->alloc_stats.bitmap_data);
47434 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
47435 *num_clusters = res.sr_bits;
47438 diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
47439 index 56f6102..1433c29 100644
47440 --- a/fs/ocfs2/super.c
47441 +++ b/fs/ocfs2/super.c
47442 @@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
47443 "%10s => GlobalAllocs: %d LocalAllocs: %d "
47444 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
47446 - atomic_read(&osb->alloc_stats.bitmap_data),
47447 - atomic_read(&osb->alloc_stats.local_data),
47448 - atomic_read(&osb->alloc_stats.bg_allocs),
47449 - atomic_read(&osb->alloc_stats.moves),
47450 - atomic_read(&osb->alloc_stats.bg_extends));
47451 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
47452 + atomic_read_unchecked(&osb->alloc_stats.local_data),
47453 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
47454 + atomic_read_unchecked(&osb->alloc_stats.moves),
47455 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
47457 out += snprintf(buf + out, len - out,
47458 "%10s => State: %u Descriptor: %llu Size: %u bits "
47459 @@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
47460 spin_lock_init(&osb->osb_xattr_lock);
47461 ocfs2_init_steal_slots(osb);
47463 - atomic_set(&osb->alloc_stats.moves, 0);
47464 - atomic_set(&osb->alloc_stats.local_data, 0);
47465 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
47466 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
47467 - atomic_set(&osb->alloc_stats.bg_extends, 0);
47468 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
47469 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
47470 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
47471 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
47472 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
47474 /* Copy the blockcheck stats from the superblock probe */
47475 osb->osb_ecc_stats = *stats;
47476 diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
47477 index 5d22872..523db20 100644
47478 --- a/fs/ocfs2/symlink.c
47479 +++ b/fs/ocfs2/symlink.c
47480 @@ -142,7 +142,7 @@ bail:
47482 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47484 - char *link = nd_get_link(nd);
47485 + const char *link = nd_get_link(nd);
47489 diff --git a/fs/open.c b/fs/open.c
47490 index f711921..28d5958 100644
47493 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
47494 error = locks_verify_truncate(inode, NULL, length);
47496 error = security_path_truncate(&path);
47498 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
47502 error = do_truncate(path.dentry, length, 0, NULL);
47504 @@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
47505 if (__mnt_is_readonly(path.mnt))
47508 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
47514 @@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
47518 + gr_log_chdir(path.dentry, path.mnt);
47520 set_fs_pwd(current->fs, &path);
47523 @@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
47526 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
47528 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
47532 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
47535 set_fs_pwd(current->fs, &file->f_path);
47537 @@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
47541 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
47542 + goto dput_and_out;
47544 set_fs_root(current->fs, &path);
47546 + gr_handle_chroot_chdir(&path);
47551 @@ -456,6 +478,16 @@ static int chmod_common(struct path *path, umode_t mode)
47554 mutex_lock(&inode->i_mutex);
47556 + if (!gr_acl_handle_fchmod(path->dentry, path->mnt, mode)) {
47560 + if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
47565 error = security_path_chmod(path->dentry, path->mnt, mode);
47568 @@ -506,6 +538,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
47570 struct iattr newattrs;
47572 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
47575 newattrs.ia_valid = ATTR_CTIME;
47576 if (user != (uid_t) -1) {
47577 newattrs.ia_valid |= ATTR_UID;
47578 diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
47579 index 6296b40..417c00f 100644
47580 --- a/fs/partitions/efi.c
47581 +++ b/fs/partitions/efi.c
47582 @@ -234,14 +234,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
47586 + if (!le32_to_cpu(gpt->num_partition_entries))
47588 + pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
47592 count = le32_to_cpu(gpt->num_partition_entries) *
47593 le32_to_cpu(gpt->sizeof_partition_entry);
47596 - pte = kzalloc(count, GFP_KERNEL);
47600 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
47603 diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
47604 index af9fdf0..75b15c3 100644
47605 --- a/fs/partitions/ldm.c
47606 +++ b/fs/partitions/ldm.c
47607 @@ -1322,7 +1322,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
47611 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
47612 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
47614 ldm_crit ("Out of memory.");
47616 diff --git a/fs/pipe.c b/fs/pipe.c
47617 index 0e0be1d..f62a72d 100644
47620 @@ -420,9 +420,9 @@ redo:
47622 if (bufs) /* More to do? */
47624 - if (!pipe->writers)
47625 + if (!atomic_read(&pipe->writers))
47627 - if (!pipe->waiting_writers) {
47628 + if (!atomic_read(&pipe->waiting_writers)) {
47629 /* syscall merging: Usually we must not sleep
47630 * if O_NONBLOCK is set, or if we got some data.
47631 * But if a writer sleeps in kernel space, then
47632 @@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
47633 mutex_lock(&inode->i_mutex);
47634 pipe = inode->i_pipe;
47636 - if (!pipe->readers) {
47637 + if (!atomic_read(&pipe->readers)) {
47638 send_sig(SIGPIPE, current, 0);
47641 @@ -530,7 +530,7 @@ redo1:
47645 - if (!pipe->readers) {
47646 + if (!atomic_read(&pipe->readers)) {
47647 send_sig(SIGPIPE, current, 0);
47650 @@ -616,9 +616,9 @@ redo2:
47651 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
47654 - pipe->waiting_writers++;
47655 + atomic_inc(&pipe->waiting_writers);
47657 - pipe->waiting_writers--;
47658 + atomic_dec(&pipe->waiting_writers);
47661 mutex_unlock(&inode->i_mutex);
47662 @@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47664 if (filp->f_mode & FMODE_READ) {
47665 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
47666 - if (!pipe->writers && filp->f_version != pipe->w_counter)
47667 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
47671 @@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table *wait)
47672 * Most Unices do not set POLLERR for FIFOs but on Linux they
47673 * behave exactly like pipes for poll().
47675 - if (!pipe->readers)
47676 + if (!atomic_read(&pipe->readers))
47680 @@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int decr, int decw)
47682 mutex_lock(&inode->i_mutex);
47683 pipe = inode->i_pipe;
47684 - pipe->readers -= decr;
47685 - pipe->writers -= decw;
47686 + atomic_sub(decr, &pipe->readers);
47687 + atomic_sub(decw, &pipe->writers);
47689 - if (!pipe->readers && !pipe->writers) {
47690 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
47691 free_pipe_info(inode);
47693 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
47694 @@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
47696 if (inode->i_pipe) {
47698 - inode->i_pipe->readers++;
47699 + atomic_inc(&inode->i_pipe->readers);
47702 mutex_unlock(&inode->i_mutex);
47703 @@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
47705 if (inode->i_pipe) {
47707 - inode->i_pipe->writers++;
47708 + atomic_inc(&inode->i_pipe->writers);
47711 mutex_unlock(&inode->i_mutex);
47712 @@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
47713 if (inode->i_pipe) {
47715 if (filp->f_mode & FMODE_READ)
47716 - inode->i_pipe->readers++;
47717 + atomic_inc(&inode->i_pipe->readers);
47718 if (filp->f_mode & FMODE_WRITE)
47719 - inode->i_pipe->writers++;
47720 + atomic_inc(&inode->i_pipe->writers);
47723 mutex_unlock(&inode->i_mutex);
47724 @@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
47725 inode->i_pipe = NULL;
47728 -static struct vfsmount *pipe_mnt __read_mostly;
47729 +struct vfsmount *pipe_mnt __read_mostly;
47732 * pipefs_dname() is called from d_path().
47733 @@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(void)
47735 inode->i_pipe = pipe;
47737 - pipe->readers = pipe->writers = 1;
47738 + atomic_set(&pipe->readers, 1);
47739 + atomic_set(&pipe->writers, 1);
47740 inode->i_fop = &rdwr_pipefifo_fops;
47743 diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
47744 index 15af622..0e9f4467 100644
47745 --- a/fs/proc/Kconfig
47746 +++ b/fs/proc/Kconfig
47747 @@ -30,12 +30,12 @@ config PROC_FS
47750 bool "/proc/kcore support" if !ARM
47751 - depends on PROC_FS && MMU
47752 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
47755 bool "/proc/vmcore support"
47756 - depends on PROC_FS && CRASH_DUMP
47758 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
47761 Exports the dump image of crashed kernel in ELF format.
47763 @@ -59,8 +59,8 @@ config PROC_SYSCTL
47766 config PROC_PAGE_MONITOR
47768 - depends on PROC_FS && MMU
47770 + depends on PROC_FS && MMU && !GRKERNSEC
47771 bool "Enable /proc page monitoring" if EXPERT
47773 Various /proc files exist to monitor process memory utilization:
47774 diff --git a/fs/proc/array.c b/fs/proc/array.c
47775 index 3a1dafd..c7fed72 100644
47776 --- a/fs/proc/array.c
47777 +++ b/fs/proc/array.c
47779 #include <linux/tty.h>
47780 #include <linux/string.h>
47781 #include <linux/mman.h>
47782 +#include <linux/grsecurity.h>
47783 #include <linux/proc_fs.h>
47784 #include <linux/ioport.h>
47785 #include <linux/uaccess.h>
47786 @@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
47790 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47791 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
47794 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
47795 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
47796 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
47797 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
47798 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
47799 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
47801 + seq_printf(m, "PaX:\t-----\n");
47805 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47806 struct pid *pid, struct task_struct *task)
47808 @@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47809 task_cpus_allowed(m, task);
47810 cpuset_task_status_allowed(m, task);
47811 task_context_switch_counts(m, task);
47813 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47814 + task_pax(m, task);
47817 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
47818 + task_grsec_rbac(m, task);
47824 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47825 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47826 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
47827 + _mm->pax_flags & MF_PAX_SEGMEXEC))
47830 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47831 struct pid *pid, struct task_struct *task, int whole)
47833 @@ -378,6 +409,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47834 char tcomm[sizeof(task->comm)];
47835 unsigned long flags;
47837 + pax_track_stack();
47839 state = *get_task_state(task);
47840 vsize = eip = esp = 0;
47841 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
47842 @@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47843 gtime = task->gtime;
47846 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47847 + if (PAX_RAND_FLAGS(mm)) {
47853 +#ifdef CONFIG_GRKERNSEC_HIDESYM
47859 /* scale priority and nice values from timeslices to -20..20 */
47860 /* to make it look like a "normal" Unix priority/nice value */
47861 priority = task_prio(task);
47862 @@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47864 mm ? get_mm_rss(mm) : 0,
47866 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47867 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
47868 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
47869 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
47871 mm ? (permitted ? mm->start_code : 1) : 0,
47872 mm ? (permitted ? mm->end_code : 1) : 0,
47873 (permitted && mm) ? mm->start_stack : 0,
47877 /* The signal information here is obsolete.
47878 @@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
47883 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
47884 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
47887 + unsigned long flags;
47889 + if (lock_task_sighand(task, &flags)) {
47890 + curr_ip = task->signal->curr_ip;
47891 + unlock_task_sighand(task, &flags);
47894 + return sprintf(buffer, "%pI4\n", &curr_ip);
47897 diff --git a/fs/proc/base.c b/fs/proc/base.c
47898 index 5eb0206..fe01db4 100644
47899 --- a/fs/proc/base.c
47900 +++ b/fs/proc/base.c
47901 @@ -107,6 +107,22 @@ struct pid_entry {
47905 +struct getdents_callback {
47906 + struct linux_dirent __user * current_dir;
47907 + struct linux_dirent __user * previous;
47908 + struct file * file;
47913 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
47914 + loff_t offset, u64 ino, unsigned int d_type)
47916 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
47917 + buf->error = -EINVAL;
47921 #define NOD(NAME, MODE, IOP, FOP, OP) { \
47923 .len = sizeof(NAME) - 1, \
47924 @@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_permission(struct task_struct *task)
47925 if (task == current)
47928 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
47929 + return ERR_PTR(-EPERM);
47932 * If current is actively ptrace'ing, and would also be
47933 * permitted to freshly attach with ptrace now, permit it.
47934 @@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
47936 goto out_mm; /* Shh! No looking before we're done */
47938 + if (gr_acl_handle_procpidmem(task))
47941 len = mm->arg_end - mm->arg_start;
47943 if (len > PAGE_SIZE)
47944 @@ -309,12 +331,28 @@ out:
47948 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47949 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47950 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
47951 + _mm->pax_flags & MF_PAX_SEGMEXEC))
47954 static int proc_pid_auxv(struct task_struct *task, char *buffer)
47956 struct mm_struct *mm = mm_for_maps(task);
47957 int res = PTR_ERR(mm);
47958 if (mm && !IS_ERR(mm)) {
47959 unsigned int nwords = 0;
47961 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47962 + /* allow if we're currently ptracing this task */
47963 + if (PAX_RAND_FLAGS(mm) &&
47964 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
47972 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
47973 @@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
47977 -#ifdef CONFIG_KALLSYMS
47978 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47980 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
47981 * Returns the resolved symbol. If that fails, simply return the address.
47982 @@ -367,7 +405,7 @@ static void unlock_trace(struct task_struct *task)
47983 mutex_unlock(&task->signal->cred_guard_mutex);
47986 -#ifdef CONFIG_STACKTRACE
47987 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47989 #define MAX_STACK_TRACE_DEPTH 64
47991 @@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
47995 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47996 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47997 static int proc_pid_syscall(struct task_struct *task, char *buffer)
48000 @@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
48001 /************************************************************************/
48003 /* permission checks */
48004 -static int proc_fd_access_allowed(struct inode *inode)
48005 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
48007 struct task_struct *task;
48009 @@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct inode *inode)
48011 task = get_proc_task(inode);
48013 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48015 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
48017 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48018 put_task_struct(task);
48021 @@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
48025 + if (gr_acl_handle_procpidmem(task))
48029 page = (char *)__get_free_page(GFP_TEMPORARY);
48031 @@ -1613,7 +1657,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
48032 path_put(&nd->path);
48034 /* Are we allowed to snoop on the tasks file descriptors? */
48035 - if (!proc_fd_access_allowed(inode))
48036 + if (!proc_fd_access_allowed(inode,0))
48039 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
48040 @@ -1652,8 +1696,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
48043 /* Are we allowed to snoop on the tasks file descriptors? */
48044 - if (!proc_fd_access_allowed(inode))
48046 + /* logging this is needed for learning on chromium to work properly,
48047 + but we don't want to flood the logs from 'ps' which does a readlink
48048 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
48049 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
48051 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
48052 + if (!proc_fd_access_allowed(inode,0))
48055 + if (!proc_fd_access_allowed(inode,1))
48059 error = PROC_I(inode)->op.proc_get_link(inode, &path);
48061 @@ -1718,7 +1772,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
48063 cred = __task_cred(task);
48064 inode->i_uid = cred->euid;
48065 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48066 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48068 inode->i_gid = cred->egid;
48072 security_task_to_inode(task, inode);
48073 @@ -1736,6 +1794,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48074 struct inode *inode = dentry->d_inode;
48075 struct task_struct *task;
48076 const struct cred *cred;
48077 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48078 + const struct cred *tmpcred = current_cred();
48081 generic_fillattr(inode, stat);
48083 @@ -1743,13 +1804,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48086 task = pid_task(proc_pid(inode), PIDTYPE_PID);
48088 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
48089 + rcu_read_unlock();
48094 + cred = __task_cred(task);
48095 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48096 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48097 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48098 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48102 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48103 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48104 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48105 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48106 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48108 task_dumpable(task)) {
48109 - cred = __task_cred(task);
48110 stat->uid = cred->euid;
48111 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48112 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48114 stat->gid = cred->egid;
48117 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48119 + rcu_read_unlock();
48126 @@ -1786,11 +1875,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
48129 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48130 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48131 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48132 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48133 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48135 task_dumpable(task)) {
48137 cred = __task_cred(task);
48138 inode->i_uid = cred->euid;
48139 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48140 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48142 inode->i_gid = cred->egid;
48147 @@ -1908,7 +2006,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
48148 int fd = proc_fd(inode);
48151 - files = get_files_struct(task);
48152 + if (!gr_acl_handle_procpidmem(task))
48153 + files = get_files_struct(task);
48154 put_task_struct(task);
48157 @@ -2176,11 +2275,21 @@ static const struct file_operations proc_fd_operations = {
48159 static int proc_fd_permission(struct inode *inode, int mask)
48161 + struct task_struct *task;
48162 int rv = generic_permission(inode, mask);
48166 if (task_pid(current) == proc_pid(inode))
48169 + task = get_proc_task(inode);
48170 + if (task == NULL)
48173 + if (gr_acl_handle_procpidmem(task))
48176 + put_task_struct(task);
48181 @@ -2290,6 +2399,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
48185 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48189 * Yes, it does not scale. And it should not. Don't add
48190 * new entries into /proc/<tgid>/ without very good reasons.
48191 @@ -2334,6 +2446,9 @@ static int proc_pident_readdir(struct file *filp,
48195 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48201 @@ -2604,7 +2719,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
48202 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48205 - char *s = nd_get_link(nd);
48206 + const char *s = nd_get_link(nd);
48210 @@ -2802,7 +2917,7 @@ static const struct pid_entry tgid_base_stuff[] = {
48211 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
48213 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48214 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48215 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48216 INF("syscall", S_IRUGO, proc_pid_syscall),
48218 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48219 @@ -2827,10 +2942,10 @@ static const struct pid_entry tgid_base_stuff[] = {
48220 #ifdef CONFIG_SECURITY
48221 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48223 -#ifdef CONFIG_KALLSYMS
48224 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48225 INF("wchan", S_IRUGO, proc_pid_wchan),
48227 -#ifdef CONFIG_STACKTRACE
48228 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48229 ONE("stack", S_IRUGO, proc_pid_stack),
48231 #ifdef CONFIG_SCHEDSTATS
48232 @@ -2864,6 +2979,9 @@ static const struct pid_entry tgid_base_stuff[] = {
48233 #ifdef CONFIG_HARDWALL
48234 INF("hardwall", S_IRUGO, proc_pid_hardwall),
48236 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48237 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
48241 static int proc_tgid_base_readdir(struct file * filp,
48242 @@ -2989,7 +3107,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
48246 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48247 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
48248 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48249 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48250 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
48252 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
48254 inode->i_op = &proc_tgid_base_inode_operations;
48255 inode->i_fop = &proc_tgid_base_operations;
48256 inode->i_flags|=S_IMMUTABLE;
48257 @@ -3031,7 +3156,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
48261 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48262 + goto out_put_task;
48264 result = proc_pid_instantiate(dir, dentry, task, NULL);
48266 put_task_struct(task);
48269 @@ -3096,6 +3225,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48272 struct task_struct *reaper;
48273 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48274 + const struct cred *tmpcred = current_cred();
48275 + const struct cred *itercred;
48277 + filldir_t __filldir = filldir;
48278 struct tgid_iter iter;
48279 struct pid_namespace *ns;
48281 @@ -3119,8 +3253,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
48282 for (iter = next_tgid(ns, iter);
48284 iter.tgid += 1, iter = next_tgid(ns, iter)) {
48285 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48287 + itercred = __task_cred(iter.task);
48289 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
48290 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48291 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
48292 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48293 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48298 + __filldir = &gr_fake_filldir;
48300 + __filldir = filldir;
48301 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48302 + rcu_read_unlock();
48304 filp->f_pos = iter.tgid + TGID_OFFSET;
48305 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
48306 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
48307 put_task_struct(iter.task);
48310 @@ -3148,7 +3301,7 @@ static const struct pid_entry tid_base_stuff[] = {
48311 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
48313 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48314 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48315 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48316 INF("syscall", S_IRUGO, proc_pid_syscall),
48318 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48319 @@ -3172,10 +3325,10 @@ static const struct pid_entry tid_base_stuff[] = {
48320 #ifdef CONFIG_SECURITY
48321 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48323 -#ifdef CONFIG_KALLSYMS
48324 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48325 INF("wchan", S_IRUGO, proc_pid_wchan),
48327 -#ifdef CONFIG_STACKTRACE
48328 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48329 ONE("stack", S_IRUGO, proc_pid_stack),
48331 #ifdef CONFIG_SCHEDSTATS
48332 diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
48333 index 82676e3..5f8518a 100644
48334 --- a/fs/proc/cmdline.c
48335 +++ b/fs/proc/cmdline.c
48336 @@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
48338 static int __init proc_cmdline_init(void)
48340 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
48341 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
48343 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
48347 module_init(proc_cmdline_init);
48348 diff --git a/fs/proc/devices.c b/fs/proc/devices.c
48349 index b143471..bb105e5 100644
48350 --- a/fs/proc/devices.c
48351 +++ b/fs/proc/devices.c
48352 @@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
48354 static int __init proc_devices_init(void)
48356 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
48357 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
48359 proc_create("devices", 0, NULL, &proc_devinfo_operations);
48363 module_init(proc_devices_init);
48364 diff --git a/fs/proc/inode.c b/fs/proc/inode.c
48365 index 7ed72d6..d5f061a 100644
48366 --- a/fs/proc/inode.c
48367 +++ b/fs/proc/inode.c
48368 @@ -18,12 +18,18 @@
48369 #include <linux/module.h>
48370 #include <linux/sysctl.h>
48371 #include <linux/slab.h>
48372 +#include <linux/grsecurity.h>
48374 #include <asm/system.h>
48375 #include <asm/uaccess.h>
48377 #include "internal.h"
48379 +#ifdef CONFIG_PROC_SYSCTL
48380 +extern const struct inode_operations proc_sys_inode_operations;
48381 +extern const struct inode_operations proc_sys_dir_operations;
48384 static void proc_evict_inode(struct inode *inode)
48386 struct proc_dir_entry *de;
48387 @@ -49,6 +55,13 @@ static void proc_evict_inode(struct inode *inode)
48388 ns_ops = PROC_I(inode)->ns_ops;
48389 if (ns_ops && ns_ops->put)
48390 ns_ops->put(PROC_I(inode)->ns);
48392 +#ifdef CONFIG_PROC_SYSCTL
48393 + if (inode->i_op == &proc_sys_inode_operations ||
48394 + inode->i_op == &proc_sys_dir_operations)
48395 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
48400 static struct kmem_cache * proc_inode_cachep;
48401 @@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
48403 inode->i_mode = de->mode;
48404 inode->i_uid = de->uid;
48405 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48406 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48408 inode->i_gid = de->gid;
48412 inode->i_size = de->size;
48413 diff --git a/fs/proc/internal.h b/fs/proc/internal.h
48414 index 7838e5c..ff92cbc 100644
48415 --- a/fs/proc/internal.h
48416 +++ b/fs/proc/internal.h
48417 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48418 struct pid *pid, struct task_struct *task);
48419 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48420 struct pid *pid, struct task_struct *task);
48421 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48422 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
48424 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
48426 extern const struct file_operations proc_maps_operations;
48427 diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
48428 index d245cb2..7e645bd 100644
48429 --- a/fs/proc/kcore.c
48430 +++ b/fs/proc/kcore.c
48431 @@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
48433 struct kcore_list *m;
48435 + pax_track_stack();
48437 /* setup ELF header */
48438 elf = (struct elfhdr *) bufp;
48439 bufp += sizeof(struct elfhdr);
48440 @@ -478,9 +480,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48441 * the addresses in the elf_phdr on our list.
48443 start = kc_offset_to_vaddr(*fpos - elf_buflen);
48444 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
48445 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
48446 + if (tsz > buflen)
48451 struct kcore_list *m;
48453 @@ -509,20 +512,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48456 if (kern_addr_valid(start)) {
48459 + mm_segment_t oldfs;
48461 - n = copy_to_user(buffer, (char *)start, tsz);
48463 - * We cannot distingush between fault on source
48464 - * and fault on destination. When this happens
48465 - * we clear too and hope it will trigger the
48469 - if (clear_user(buffer + tsz - n,
48471 + elf_buf = kmalloc(tsz, GFP_KERNEL);
48474 + oldfs = get_fs();
48475 + set_fs(KERNEL_DS);
48476 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
48478 + if (copy_to_user(buffer, elf_buf, tsz)) {
48486 if (clear_user(buffer, tsz))
48488 @@ -542,6 +548,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
48490 static int open_kcore(struct inode *inode, struct file *filp)
48492 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
48495 if (!capable(CAP_SYS_RAWIO))
48497 if (kcore_need_update)
48498 diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
48499 index 80e4645..d2689e9 100644
48500 --- a/fs/proc/meminfo.c
48501 +++ b/fs/proc/meminfo.c
48502 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48503 unsigned long pages[NR_LRU_LISTS];
48506 + pax_track_stack();
48509 * display in kilobytes.
48511 @@ -158,7 +160,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
48513 vmi.largest_chunk >> 10
48514 #ifdef CONFIG_MEMORY_FAILURE
48515 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
48516 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
48518 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
48519 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
48520 diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
48521 index b1822dd..df622cb 100644
48522 --- a/fs/proc/nommu.c
48523 +++ b/fs/proc/nommu.c
48524 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
48527 seq_printf(m, "%*c", len, ' ');
48528 - seq_path(m, &file->f_path, "");
48529 + seq_path(m, &file->f_path, "\n\\");
48533 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
48534 index f738024..876984a 100644
48535 --- a/fs/proc/proc_net.c
48536 +++ b/fs/proc/proc_net.c
48537 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
48538 struct task_struct *task;
48539 struct nsproxy *ns;
48540 struct net *net = NULL;
48541 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48542 + const struct cred *cred = current_cred();
48545 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48548 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48549 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
48554 task = pid_task(proc_pid(dir), PIDTYPE_PID);
48555 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
48556 index 1a77dbe..56ec911 100644
48557 --- a/fs/proc/proc_sysctl.c
48558 +++ b/fs/proc/proc_sysctl.c
48560 #include <linux/namei.h>
48561 #include "internal.h"
48563 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
48565 static const struct dentry_operations proc_sys_dentry_operations;
48566 static const struct file_operations proc_sys_file_operations;
48567 -static const struct inode_operations proc_sys_inode_operations;
48568 +const struct inode_operations proc_sys_inode_operations;
48569 static const struct file_operations proc_sys_dir_file_operations;
48570 -static const struct inode_operations proc_sys_dir_operations;
48571 +const struct inode_operations proc_sys_dir_operations;
48573 static struct inode *proc_sys_make_inode(struct super_block *sb,
48574 struct ctl_table_header *head, struct ctl_table *table)
48575 @@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
48578 d_set_d_op(dentry, &proc_sys_dentry_operations);
48580 + gr_handle_proc_create(dentry, inode);
48582 d_add(dentry, inode);
48584 + if (gr_handle_sysctl(p, MAY_EXEC))
48585 + err = ERR_PTR(-ENOENT);
48588 sysctl_head_finish(head);
48590 @@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
48593 d_set_d_op(child, &proc_sys_dentry_operations);
48595 + gr_handle_proc_create(child, inode);
48597 d_add(child, inode);
48600 @@ -230,6 +241,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
48601 if (*pos < file->f_pos)
48604 + if (gr_handle_sysctl(table, 0))
48607 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
48610 @@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
48612 return PTR_ERR(head);
48614 + if (table && gr_handle_sysctl(table, MAY_EXEC))
48617 generic_fillattr(inode, stat);
48619 stat->mode = (stat->mode & S_IFMT) | table->mode;
48620 @@ -370,17 +387,18 @@ static const struct file_operations proc_sys_file_operations = {
48623 static const struct file_operations proc_sys_dir_file_operations = {
48624 + .read = generic_read_dir,
48625 .readdir = proc_sys_readdir,
48626 .llseek = generic_file_llseek,
48629 -static const struct inode_operations proc_sys_inode_operations = {
48630 +const struct inode_operations proc_sys_inode_operations = {
48631 .permission = proc_sys_permission,
48632 .setattr = proc_sys_setattr,
48633 .getattr = proc_sys_getattr,
48636 -static const struct inode_operations proc_sys_dir_operations = {
48637 +const struct inode_operations proc_sys_dir_operations = {
48638 .lookup = proc_sys_lookup,
48639 .permission = proc_sys_permission,
48640 .setattr = proc_sys_setattr,
48641 diff --git a/fs/proc/root.c b/fs/proc/root.c
48642 index 9a8a2b7..3018df6 100644
48643 --- a/fs/proc/root.c
48644 +++ b/fs/proc/root.c
48645 @@ -123,7 +123,15 @@ void __init proc_root_init(void)
48646 #ifdef CONFIG_PROC_DEVICETREE
48647 proc_device_tree_init();
48649 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
48650 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48651 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
48652 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48653 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48656 proc_mkdir("bus", NULL);
48661 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
48662 index c7d4ee6..41c5564 100644
48663 --- a/fs/proc/task_mmu.c
48664 +++ b/fs/proc/task_mmu.c
48665 @@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48666 "VmExe:\t%8lu kB\n"
48667 "VmLib:\t%8lu kB\n"
48668 "VmPTE:\t%8lu kB\n"
48669 - "VmSwap:\t%8lu kB\n",
48670 - hiwater_vm << (PAGE_SHIFT-10),
48671 + "VmSwap:\t%8lu kB\n"
48673 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48674 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
48677 + ,hiwater_vm << (PAGE_SHIFT-10),
48678 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
48679 mm->locked_vm << (PAGE_SHIFT-10),
48680 hiwater_rss << (PAGE_SHIFT-10),
48681 @@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48682 data << (PAGE_SHIFT-10),
48683 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
48684 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
48685 - swap << (PAGE_SHIFT-10));
48686 + swap << (PAGE_SHIFT-10)
48688 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48689 + , mm->context.user_cs_base, mm->context.user_cs_limit
48695 unsigned long task_vsize(struct mm_struct *mm)
48696 @@ -207,6 +218,12 @@ static int do_maps_open(struct inode *inode, struct file *file,
48700 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48701 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48702 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
48703 + _mm->pax_flags & MF_PAX_SEGMEXEC))
48706 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48708 struct mm_struct *mm = vma->vm_mm;
48709 @@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48710 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
48713 - /* We don't show the stack guard page in /proc/maps */
48714 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48715 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
48716 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
48718 start = vma->vm_start;
48719 - if (stack_guard_page_start(vma, start))
48720 - start += PAGE_SIZE;
48722 - if (stack_guard_page_end(vma, end))
48723 - end -= PAGE_SIZE;
48726 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
48728 @@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48729 flags & VM_WRITE ? 'w' : '-',
48730 flags & VM_EXEC ? 'x' : '-',
48731 flags & VM_MAYSHARE ? 's' : 'p',
48732 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48733 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
48737 MAJOR(dev), MINOR(dev), ino, &len);
48740 @@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48743 pad_len_spaces(m, len);
48744 - seq_path(m, &file->f_path, "\n");
48745 + seq_path(m, &file->f_path, "\n\\");
48747 const char *name = arch_vma_name(vma);
48749 @@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48750 if (vma->vm_start <= mm->brk &&
48751 vma->vm_end >= mm->start_brk) {
48753 - } else if (vma->vm_start <= mm->start_stack &&
48754 - vma->vm_end >= mm->start_stack) {
48755 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
48756 + (vma->vm_start <= mm->start_stack &&
48757 + vma->vm_end >= mm->start_stack)) {
48761 @@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m, void *v)
48764 memset(&mss, 0, sizeof mss);
48766 - /* mmap_sem is held in m_start */
48767 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48768 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48770 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48771 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
48774 + /* mmap_sem is held in m_start */
48775 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48776 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48777 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48780 show_map_vma(m, vma);
48783 @@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m, void *v)
48784 "KernelPageSize: %8lu kB\n"
48785 "MMUPageSize: %8lu kB\n"
48786 "Locked: %8lu kB\n",
48787 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48788 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
48790 (vma->vm_end - vma->vm_start) >> 10,
48792 mss.resident >> 10,
48793 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
48794 mss.shared_clean >> 10,
48795 @@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file *m, void *v)
48798 seq_printf(m, " file=");
48799 - seq_path(m, &file->f_path, "\n\t= ");
48800 + seq_path(m, &file->f_path, "\n\t\\= ");
48801 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
48802 seq_printf(m, " heap");
48803 } else if (vma->vm_start <= mm->start_stack &&
48804 diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
48805 index 980de54..2a4db5f 100644
48806 --- a/fs/proc/task_nommu.c
48807 +++ b/fs/proc/task_nommu.c
48808 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
48810 bytes += kobjsize(mm);
48812 - if (current->fs && current->fs->users > 1)
48813 + if (current->fs && atomic_read(¤t->fs->users) > 1)
48814 sbytes += kobjsize(current->fs);
48816 bytes += kobjsize(current->fs);
48817 @@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
48820 pad_len_spaces(m, len);
48821 - seq_path(m, &file->f_path, "");
48822 + seq_path(m, &file->f_path, "\n\\");
48824 if (vma->vm_start <= mm->start_stack &&
48825 vma->vm_end >= mm->start_stack) {
48826 diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
48827 index d67908b..d13f6a6 100644
48828 --- a/fs/quota/netlink.c
48829 +++ b/fs/quota/netlink.c
48830 @@ -33,7 +33,7 @@ static struct genl_family quota_genl_family = {
48831 void quota_send_warning(short type, unsigned int id, dev_t dev,
48832 const char warntype)
48834 - static atomic_t seq;
48835 + static atomic_unchecked_t seq;
48836 struct sk_buff *skb;
48839 @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsigned int id, dev_t dev,
48840 "VFS: Not enough memory to send quota warning.\n");
48843 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
48844 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
48845 "a_genl_family, 0, QUOTA_NL_C_WARNING);
48848 diff --git a/fs/readdir.c b/fs/readdir.c
48849 index 356f715..c918d38 100644
48853 #include <linux/security.h>
48854 #include <linux/syscalls.h>
48855 #include <linux/unistd.h>
48856 +#include <linux/namei.h>
48858 #include <asm/uaccess.h>
48860 @@ -67,6 +68,7 @@ struct old_linux_dirent {
48862 struct readdir_callback {
48863 struct old_linux_dirent __user * dirent;
48864 + struct file * file;
48868 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
48869 buf->result = -EOVERFLOW;
48873 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48877 dirent = buf->dirent;
48878 if (!access_ok(VERIFY_WRITE, dirent,
48879 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
48882 buf.dirent = dirent;
48885 error = vfs_readdir(file, fillonedir, &buf);
48887 @@ -142,6 +149,7 @@ struct linux_dirent {
48888 struct getdents_callback {
48889 struct linux_dirent __user * current_dir;
48890 struct linux_dirent __user * previous;
48891 + struct file * file;
48895 @@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
48896 buf->error = -EOVERFLOW;
48900 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48903 dirent = buf->previous;
48905 if (__put_user(offset, &dirent->d_off))
48906 @@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
48907 buf.previous = NULL;
48912 error = vfs_readdir(file, filldir, &buf);
48914 @@ -229,6 +242,7 @@ out:
48915 struct getdents_callback64 {
48916 struct linux_dirent64 __user * current_dir;
48917 struct linux_dirent64 __user * previous;
48918 + struct file *file;
48922 @@ -244,6 +258,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
48923 buf->error = -EINVAL; /* only used if we fail.. */
48924 if (reclen > buf->count)
48927 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48930 dirent = buf->previous;
48932 if (__put_user(offset, &dirent->d_off))
48933 @@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48935 buf.current_dir = dirent;
48936 buf.previous = NULL;
48941 @@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
48943 lastdirent = buf.previous;
48945 - typeof(lastdirent->d_off) d_off = file->f_pos;
48946 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
48947 if (__put_user(d_off, &lastdirent->d_off))
48950 diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
48951 index 133e935..349ef18 100644
48952 --- a/fs/reiserfs/dir.c
48953 +++ b/fs/reiserfs/dir.c
48954 @@ -75,6 +75,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
48955 struct reiserfs_dir_entry de;
48958 + pax_track_stack();
48960 reiserfs_write_lock(inode->i_sb);
48962 reiserfs_check_lock_depth(inode->i_sb, "readdir");
48963 diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
48964 index 60c0804..d814f98 100644
48965 --- a/fs/reiserfs/do_balan.c
48966 +++ b/fs/reiserfs/do_balan.c
48967 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
48971 - atomic_inc(&(fs_generation(tb->tb_sb)));
48972 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
48973 do_balance_starts(tb);
48975 /* balance leaf returns 0 except if combining L R and S into
48976 diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
48977 index a159ba5..0396a76 100644
48978 --- a/fs/reiserfs/journal.c
48979 +++ b/fs/reiserfs/journal.c
48980 @@ -2289,6 +2289,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
48981 struct buffer_head *bh;
48984 + pax_track_stack();
48986 bh = __getblk(dev, block, bufsize);
48987 if (buffer_uptodate(bh))
48989 diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
48990 index ef39232..0fa91ba 100644
48991 --- a/fs/reiserfs/namei.c
48992 +++ b/fs/reiserfs/namei.c
48993 @@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
48994 unsigned long savelink = 1;
48995 struct timespec ctime;
48997 + pax_track_stack();
48999 /* three balancings: (1) old name removal, (2) new name insertion
49000 and (3) maybe "save" link insertion
49001 stat data updates: (1) old directory,
49002 diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
49003 index 7a99811..2c9286f 100644
49004 --- a/fs/reiserfs/procfs.c
49005 +++ b/fs/reiserfs/procfs.c
49006 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
49007 "SMALL_TAILS " : "NO_TAILS ",
49008 replay_only(sb) ? "REPLAY_ONLY " : "",
49009 convert_reiserfs(sb) ? "CONV " : "",
49010 - atomic_read(&r->s_generation_counter),
49011 + atomic_read_unchecked(&r->s_generation_counter),
49012 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
49013 SF(s_do_balance), SF(s_unneeded_left_neighbor),
49014 SF(s_good_search_by_key_reada), SF(s_bmaps),
49015 @@ -299,6 +299,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
49016 struct journal_params *jp = &rs->s_v1.s_journal;
49017 char b[BDEVNAME_SIZE];
49019 + pax_track_stack();
49021 seq_printf(m, /* on-disk fields */
49022 "jp_journal_1st_block: \t%i\n"
49023 "jp_journal_dev: \t%s[%x]\n"
49024 diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
49025 index 313d39d..3a5811b 100644
49026 --- a/fs/reiserfs/stree.c
49027 +++ b/fs/reiserfs/stree.c
49028 @@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
49032 + pax_track_stack();
49034 BUG_ON(!th->t_trans_id);
49036 init_tb_struct(th, &s_del_balance, sb, path,
49037 @@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
49039 int quota_cut_bytes = 0;
49041 + pax_track_stack();
49043 BUG_ON(!th->t_trans_id);
49045 le_key2cpu_key(&cpu_key, key);
49046 @@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
49047 int quota_cut_bytes;
49048 loff_t tail_pos = 0;
49050 + pax_track_stack();
49052 BUG_ON(!th->t_trans_id);
49054 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
49055 @@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
49059 + pax_track_stack();
49061 BUG_ON(!th->t_trans_id);
49063 fs_gen = get_generation(inode->i_sb);
49064 @@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
49066 int quota_bytes = 0;
49068 + pax_track_stack();
49070 BUG_ON(!th->t_trans_id);
49072 if (inode) { /* Do we count quotas for item? */
49073 diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
49074 index 14363b9..dd95a04 100644
49075 --- a/fs/reiserfs/super.c
49076 +++ b/fs/reiserfs/super.c
49077 @@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
49078 {.option_name = NULL}
49081 + pax_track_stack();
49084 if (!options || !*options)
49085 /* use default configuration: create tails, journaling on, no
49086 diff --git a/fs/select.c b/fs/select.c
49087 index d33418f..f8e06bc 100644
49091 #include <linux/module.h>
49092 #include <linux/slab.h>
49093 #include <linux/poll.h>
49094 +#include <linux/security.h>
49095 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49096 #include <linux/file.h>
49097 #include <linux/fdtable.h>
49098 @@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
49099 int retval, i, timed_out = 0;
49100 unsigned long slack = 0;
49102 + pax_track_stack();
49105 retval = max_select_fd(n, fds);
49107 @@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
49108 /* Allocate small arguments on the stack to save memory and be faster */
49109 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
49111 + pax_track_stack();
49116 @@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
49117 struct poll_list *walk = head;
49118 unsigned long todo = nfds;
49120 + pax_track_stack();
49122 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49123 if (nfds > rlimit(RLIMIT_NOFILE))
49126 diff --git a/fs/seq_file.c b/fs/seq_file.c
49127 index dba43c3..a99fb63 100644
49128 --- a/fs/seq_file.c
49129 +++ b/fs/seq_file.c
49130 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49134 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49135 + m->size = PAGE_SIZE;
49136 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49140 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, loff_t offset)
49144 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49146 + m->buf = kmalloc(m->size, GFP_KERNEL);
49147 return !m->buf ? -ENOMEM : -EAGAIN;
49150 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49151 m->version = file->f_version;
49152 /* grab buffer if we didn't have one */
49154 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49155 + m->size = PAGE_SIZE;
49156 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49160 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49164 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49166 + m->buf = kmalloc(m->size, GFP_KERNEL);
49170 @@ -549,7 +553,7 @@ static void single_stop(struct seq_file *p, void *v)
49171 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49174 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49175 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49179 diff --git a/fs/splice.c b/fs/splice.c
49180 index fa2defa..9a697a5 100644
49183 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49187 - if (!pipe->readers) {
49188 + if (!atomic_read(&pipe->readers)) {
49189 send_sig(SIGPIPE, current, 0);
49192 @@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49196 - pipe->waiting_writers++;
49197 + atomic_inc(&pipe->waiting_writers);
49199 - pipe->waiting_writers--;
49200 + atomic_dec(&pipe->waiting_writers);
49204 @@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
49205 .spd_release = spd_release_page,
49208 + pax_track_stack();
49210 if (splice_grow_spd(pipe, &spd))
49213 @@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
49216 /* The cast to a user pointer is valid due to the set_fs() */
49217 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
49218 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
49222 @@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
49225 /* The cast to a user pointer is valid due to the set_fs() */
49226 - res = vfs_write(file, (const char __user *)buf, count, &pos);
49227 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
49231 @@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49232 .spd_release = spd_release_page,
49235 + pax_track_stack();
49237 if (splice_grow_spd(pipe, &spd))
49240 @@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49243 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
49244 - vec[i].iov_base = (void __user *) page_address(page);
49245 + vec[i].iov_base = (void __force_user *) page_address(page);
49246 vec[i].iov_len = this_len;
49247 spd.pages[i] = page;
49249 @@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
49250 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
49252 while (!pipe->nrbufs) {
49253 - if (!pipe->writers)
49254 + if (!atomic_read(&pipe->writers))
49257 - if (!pipe->waiting_writers && sd->num_spliced)
49258 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
49261 if (sd->flags & SPLICE_F_NONBLOCK)
49262 @@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
49263 * out of the pipe right after the splice_to_pipe(). So set
49264 * PIPE_READERS appropriately.
49266 - pipe->readers = 1;
49267 + atomic_set(&pipe->readers, 1);
49269 current->splice_pipe = pipe;
49271 @@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
49275 + pax_track_stack();
49277 pipe = get_pipe_info(file);
49280 @@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49281 ret = -ERESTARTSYS;
49284 - if (!pipe->writers)
49285 + if (!atomic_read(&pipe->writers))
49287 - if (!pipe->waiting_writers) {
49288 + if (!atomic_read(&pipe->waiting_writers)) {
49289 if (flags & SPLICE_F_NONBLOCK) {
49292 @@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49295 while (pipe->nrbufs >= pipe->buffers) {
49296 - if (!pipe->readers) {
49297 + if (!atomic_read(&pipe->readers)) {
49298 send_sig(SIGPIPE, current, 0);
49301 @@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49302 ret = -ERESTARTSYS;
49305 - pipe->waiting_writers++;
49306 + atomic_inc(&pipe->waiting_writers);
49308 - pipe->waiting_writers--;
49309 + atomic_dec(&pipe->waiting_writers);
49313 @@ -1819,14 +1825,14 @@ retry:
49314 pipe_double_lock(ipipe, opipe);
49317 - if (!opipe->readers) {
49318 + if (!atomic_read(&opipe->readers)) {
49319 send_sig(SIGPIPE, current, 0);
49325 - if (!ipipe->nrbufs && !ipipe->writers)
49326 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
49330 @@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49331 pipe_double_lock(ipipe, opipe);
49334 - if (!opipe->readers) {
49335 + if (!atomic_read(&opipe->readers)) {
49336 send_sig(SIGPIPE, current, 0);
49339 @@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49340 * return EAGAIN if we have the potential of some data in the
49341 * future, otherwise just return 0
49343 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
49344 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
49347 pipe_unlock(ipipe);
49348 diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
49349 index 1ad8c93..6633545 100644
49350 --- a/fs/sysfs/file.c
49351 +++ b/fs/sysfs/file.c
49352 @@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
49354 struct sysfs_open_dirent {
49357 + atomic_unchecked_t event;
49358 wait_queue_head_t poll;
49359 struct list_head buffers; /* goes through sysfs_buffer.list */
49361 @@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
49362 if (!sysfs_get_active(attr_sd))
49365 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
49366 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
49367 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
49369 sysfs_put_active(attr_sd);
49370 @@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
49373 atomic_set(&new_od->refcnt, 0);
49374 - atomic_set(&new_od->event, 1);
49375 + atomic_set_unchecked(&new_od->event, 1);
49376 init_waitqueue_head(&new_od->poll);
49377 INIT_LIST_HEAD(&new_od->buffers);
49379 @@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
49381 sysfs_put_active(attr_sd);
49383 - if (buffer->event != atomic_read(&od->event))
49384 + if (buffer->event != atomic_read_unchecked(&od->event))
49387 return DEFAULT_POLLMASK;
49388 @@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
49390 od = sd->s_attr.open;
49392 - atomic_inc(&od->event);
49393 + atomic_inc_unchecked(&od->event);
49394 wake_up_interruptible(&od->poll);
49397 diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
49398 index e34f0d9..740ea7b 100644
49399 --- a/fs/sysfs/mount.c
49400 +++ b/fs/sysfs/mount.c
49401 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
49403 .s_count = ATOMIC_INIT(1),
49404 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
49405 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
49406 + .s_mode = S_IFDIR | S_IRWXU,
49408 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
49413 diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
49414 index a7ac78f..02158e1 100644
49415 --- a/fs/sysfs/symlink.c
49416 +++ b/fs/sysfs/symlink.c
49417 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
49419 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49421 - char *page = nd_get_link(nd);
49422 + const char *page = nd_get_link(nd);
49424 free_page((unsigned long)page);
49426 diff --git a/fs/udf/inode.c b/fs/udf/inode.c
49427 index 1d1358e..408bedb 100644
49428 --- a/fs/udf/inode.c
49429 +++ b/fs/udf/inode.c
49430 @@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
49431 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
49434 + pax_track_stack();
49436 prev_epos.offset = udf_file_entry_alloc_offset(inode);
49437 prev_epos.block = iinfo->i_location;
49438 prev_epos.bh = NULL;
49439 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
49440 index 9215700..bf1f68e 100644
49441 --- a/fs/udf/misc.c
49442 +++ b/fs/udf/misc.c
49443 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
49445 u8 udf_tag_checksum(const struct tag *t)
49447 - u8 *data = (u8 *)t;
49448 + const u8 *data = (const u8 *)t;
49451 for (i = 0; i < sizeof(struct tag); ++i)
49452 diff --git a/fs/utimes.c b/fs/utimes.c
49453 index ba653f3..06ea4b1 100644
49457 #include <linux/compiler.h>
49458 #include <linux/file.h>
49459 #include <linux/fs.h>
49460 +#include <linux/security.h>
49461 #include <linux/linkage.h>
49462 #include <linux/mount.h>
49463 #include <linux/namei.h>
49464 @@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
49465 goto mnt_drop_write_and_out;
49469 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
49471 + goto mnt_drop_write_and_out;
49474 mutex_lock(&inode->i_mutex);
49475 error = notify_change(path->dentry, &newattrs);
49476 mutex_unlock(&inode->i_mutex);
49477 diff --git a/fs/xattr.c b/fs/xattr.c
49478 index f060663..def7007 100644
49481 @@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
49482 * Extended attribute SET operations
49485 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
49486 +setxattr(struct path *path, const char __user *name, const void __user *value,
49487 size_t size, int flags)
49490 @@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
49491 return PTR_ERR(kvalue);
49494 - error = vfs_setxattr(d, kname, kvalue, size, flags);
49495 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
49500 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
49505 @@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
49507 error = mnt_want_write(path.mnt);
49509 - error = setxattr(path.dentry, name, value, size, flags);
49510 + error = setxattr(&path, name, value, size, flags);
49511 mnt_drop_write(path.mnt);
49514 @@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
49516 error = mnt_want_write(path.mnt);
49518 - error = setxattr(path.dentry, name, value, size, flags);
49519 + error = setxattr(&path, name, value, size, flags);
49520 mnt_drop_write(path.mnt);
49523 @@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
49524 const void __user *,value, size_t, size, int, flags)
49527 - struct dentry *dentry;
49528 int error = -EBADF;
49533 - dentry = f->f_path.dentry;
49534 - audit_inode(NULL, dentry);
49535 + audit_inode(NULL, f->f_path.dentry);
49536 error = mnt_want_write_file(f);
49538 - error = setxattr(dentry, name, value, size, flags);
49539 + error = setxattr(&f->f_path, name, value, size, flags);
49540 mnt_drop_write(f->f_path.mnt);
49543 diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
49544 index 8d5a506..7f62712 100644
49545 --- a/fs/xattr_acl.c
49546 +++ b/fs/xattr_acl.c
49549 posix_acl_from_xattr(const void *value, size_t size)
49551 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
49552 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
49553 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
49554 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
49556 struct posix_acl *acl;
49557 struct posix_acl_entry *acl_e;
49558 diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
49559 index 452a291..91a95f3b 100644
49560 --- a/fs/xfs/xfs_bmap.c
49561 +++ b/fs/xfs/xfs_bmap.c
49562 @@ -250,7 +250,7 @@ xfs_bmap_validate_ret(
49566 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
49567 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
49571 diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
49572 index 79d05e8..e3e5861 100644
49573 --- a/fs/xfs/xfs_dir2_sf.c
49574 +++ b/fs/xfs/xfs_dir2_sf.c
49575 @@ -852,7 +852,15 @@ xfs_dir2_sf_getdents(
49578 ino = xfs_dir2_sfe_get_ino(sfp, sfep);
49579 - if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49580 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
49581 + char name[sfep->namelen];
49582 + memcpy(name, sfep->name, sfep->namelen);
49583 + if (filldir(dirent, name, sfep->namelen,
49584 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
49585 + *offset = off & 0x7fffffff;
49588 + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
49589 off & 0x7fffffff, ino, DT_UNKNOWN)) {
49590 *offset = off & 0x7fffffff;
49592 diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
49593 index f7ce7de..e1a5db0 100644
49594 --- a/fs/xfs/xfs_ioctl.c
49595 +++ b/fs/xfs/xfs_ioctl.c
49596 @@ -128,7 +128,7 @@ xfs_find_handle(
49600 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
49601 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
49602 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
49605 diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
49606 index 474920b..97169a9 100644
49607 --- a/fs/xfs/xfs_iops.c
49608 +++ b/fs/xfs/xfs_iops.c
49609 @@ -446,7 +446,7 @@ xfs_vn_put_link(
49610 struct nameidata *nd,
49613 - char *s = nd_get_link(nd);
49614 + const char *s = nd_get_link(nd);
49618 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
49619 new file mode 100644
49620 index 0000000..4639511
49622 +++ b/grsecurity/Kconfig
49625 +# grecurity configuration
49631 + bool "Grsecurity"
49633 + select CRYPTO_SHA256
49635 + If you say Y here, you will be able to configure many features
49636 + that will enhance the security of your system. It is highly
49637 + recommended that you say Y here and read through the help
49638 + for each option so that you fully understand the features and
49639 + can evaluate their usefulness for your machine.
49642 + prompt "Security Level"
49643 + depends on GRKERNSEC
49644 + default GRKERNSEC_CUSTOM
49646 +config GRKERNSEC_LOW
49648 + select GRKERNSEC_LINK
49649 + select GRKERNSEC_FIFO
49650 + select GRKERNSEC_RANDNET
49651 + select GRKERNSEC_DMESG
49652 + select GRKERNSEC_CHROOT
49653 + select GRKERNSEC_CHROOT_CHDIR
49656 + If you choose this option, several of the grsecurity options will
49657 + be enabled that will give you greater protection against a number
49658 + of attacks, while assuring that none of your software will have any
49659 + conflicts with the additional security measures. If you run a lot
49660 + of unusual software, or you are having problems with the higher
49661 + security levels, you should say Y here. With this option, the
49662 + following features are enabled:
49664 + - Linking restrictions
49665 + - FIFO restrictions
49666 + - Restricted dmesg
49667 + - Enforced chdir("/") on chroot
49668 + - Runtime module disabling
49670 +config GRKERNSEC_MEDIUM
49673 + select PAX_EI_PAX
49674 + select PAX_PT_PAX_FLAGS
49675 + select PAX_HAVE_ACL_FLAGS
49676 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49677 + select GRKERNSEC_CHROOT
49678 + select GRKERNSEC_CHROOT_SYSCTL
49679 + select GRKERNSEC_LINK
49680 + select GRKERNSEC_FIFO
49681 + select GRKERNSEC_DMESG
49682 + select GRKERNSEC_RANDNET
49683 + select GRKERNSEC_FORKFAIL
49684 + select GRKERNSEC_TIME
49685 + select GRKERNSEC_SIGNAL
49686 + select GRKERNSEC_CHROOT
49687 + select GRKERNSEC_CHROOT_UNIX
49688 + select GRKERNSEC_CHROOT_MOUNT
49689 + select GRKERNSEC_CHROOT_PIVOT
49690 + select GRKERNSEC_CHROOT_DOUBLE
49691 + select GRKERNSEC_CHROOT_CHDIR
49692 + select GRKERNSEC_CHROOT_MKNOD
49693 + select GRKERNSEC_PROC
49694 + select GRKERNSEC_PROC_USERGROUP
49695 + select PAX_RANDUSTACK
49697 + select PAX_RANDMMAP
49698 + select PAX_REFCOUNT if (X86 || SPARC64)
49699 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
49702 + If you say Y here, several features in addition to those included
49703 + in the low additional security level will be enabled. These
49704 + features provide even more security to your system, though in rare
49705 + cases they may be incompatible with very old or poorly written
49706 + software. If you enable this option, make sure that your auth
49707 + service (identd) is running as gid 1001. With this option,
49708 + the following features (in addition to those provided in the
49709 + low additional security level) will be enabled:
49711 + - Failed fork logging
49712 + - Time change logging
49714 + - Deny mounts in chroot
49715 + - Deny double chrooting
49716 + - Deny sysctl writes in chroot
49717 + - Deny mknod in chroot
49718 + - Deny access to abstract AF_UNIX sockets out of chroot
49719 + - Deny pivot_root in chroot
49720 + - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
49721 + - /proc restrictions with special GID set to 10 (usually wheel)
49722 + - Address Space Layout Randomization (ASLR)
49723 + - Prevent exploitation of most refcount overflows
49724 + - Bounds checking of copying between the kernel and userland
49726 +config GRKERNSEC_HIGH
49728 + select GRKERNSEC_LINK
49729 + select GRKERNSEC_FIFO
49730 + select GRKERNSEC_DMESG
49731 + select GRKERNSEC_FORKFAIL
49732 + select GRKERNSEC_TIME
49733 + select GRKERNSEC_SIGNAL
49734 + select GRKERNSEC_CHROOT
49735 + select GRKERNSEC_CHROOT_SHMAT
49736 + select GRKERNSEC_CHROOT_UNIX
49737 + select GRKERNSEC_CHROOT_MOUNT
49738 + select GRKERNSEC_CHROOT_FCHDIR
49739 + select GRKERNSEC_CHROOT_PIVOT
49740 + select GRKERNSEC_CHROOT_DOUBLE
49741 + select GRKERNSEC_CHROOT_CHDIR
49742 + select GRKERNSEC_CHROOT_MKNOD
49743 + select GRKERNSEC_CHROOT_CAPS
49744 + select GRKERNSEC_CHROOT_SYSCTL
49745 + select GRKERNSEC_CHROOT_FINDTASK
49746 + select GRKERNSEC_SYSFS_RESTRICT
49747 + select GRKERNSEC_PROC
49748 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
49749 + select GRKERNSEC_HIDESYM
49750 + select GRKERNSEC_BRUTE
49751 + select GRKERNSEC_PROC_USERGROUP
49752 + select GRKERNSEC_KMEM
49753 + select GRKERNSEC_RESLOG
49754 + select GRKERNSEC_RANDNET
49755 + select GRKERNSEC_PROC_ADD
49756 + select GRKERNSEC_CHROOT_CHMOD
49757 + select GRKERNSEC_CHROOT_NICE
49758 + select GRKERNSEC_SETXID
49759 + select GRKERNSEC_AUDIT_MOUNT
49760 + select GRKERNSEC_MODHARDEN if (MODULES)
49761 + select GRKERNSEC_HARDEN_PTRACE
49762 + select GRKERNSEC_VM86 if (X86_32)
49763 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
49765 + select PAX_RANDUSTACK
49767 + select PAX_RANDMMAP
49768 + select PAX_NOEXEC
49769 + select PAX_MPROTECT
49770 + select PAX_EI_PAX
49771 + select PAX_PT_PAX_FLAGS
49772 + select PAX_HAVE_ACL_FLAGS
49773 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
49774 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
49775 + select PAX_RANDKSTACK if (X86_TSC && X86)
49776 + select PAX_SEGMEXEC if (X86_32)
49777 + select PAX_PAGEEXEC
49778 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
49779 + select PAX_EMUTRAMP if (PARISC)
49780 + select PAX_EMUSIGRT if (PARISC)
49781 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
49782 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
49783 + select PAX_REFCOUNT if (X86 || SPARC64)
49784 + select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
49786 + If you say Y here, many of the features of grsecurity will be
49787 + enabled, which will protect you against many kinds of attacks
49788 + against your system. The heightened security comes at a cost
49789 + of an increased chance of incompatibilities with rare software
49790 + on your machine. Since this security level enables PaX, you should
49791 + view <http://pax.grsecurity.net> and read about the PaX
49792 + project. While you are there, download chpax and run it on
49793 + binaries that cause problems with PaX. Also remember that
49794 + since the /proc restrictions are enabled, you must run your
49795 + identd as gid 1001. This security level enables the following
49796 + features in addition to those listed in the low and medium
49799 + - Additional /proc restrictions
49800 + - Chmod restrictions in chroot
49801 + - No signals, ptrace, or viewing of processes outside of chroot
49802 + - Capability restrictions in chroot
49803 + - Deny fchdir out of chroot
49804 + - Priority restrictions in chroot
49805 + - Segmentation-based implementation of PaX
49806 + - Mprotect restrictions
49807 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
49808 + - Kernel stack randomization
49809 + - Mount/unmount/remount logging
49810 + - Kernel symbol hiding
49811 + - Hardening of module auto-loading
49812 + - Ptrace restrictions
49813 + - Restricted vm86 mode
49814 + - Restricted sysfs/debugfs
49815 + - Active kernel exploit response
49817 +config GRKERNSEC_CUSTOM
49820 + If you say Y here, you will be able to configure every grsecurity
49821 + option, which allows you to enable many more features that aren't
49822 + covered in the basic security levels. These additional features
49823 + include TPE, socket restrictions, and the sysctl system for
49824 + grsecurity. It is advised that you read through the help for
49825 + each option to determine its usefulness in your situation.
49829 +menu "Address Space Protection"
49830 +depends on GRKERNSEC
49832 +config GRKERNSEC_KMEM
49833 + bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
49834 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
49836 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
49837 + be written to or read from to modify or leak the contents of the running
49838 + kernel. /dev/port will also not be allowed to be opened. If you have module
49839 + support disabled, enabling this will close up four ways that are
49840 + currently used to insert malicious code into the running kernel.
49841 + Even with all these features enabled, we still highly recommend that
49842 + you use the RBAC system, as it is still possible for an attacker to
49843 + modify the running kernel through privileged I/O granted by ioperm/iopl.
49844 + If you are not using XFree86, you may be able to stop this additional
49845 + case by enabling the 'Disable privileged I/O' option. Though nothing
49846 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
49847 + but only to video memory, which is the only writing we allow in this
49848 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
49849 + not be allowed to mprotect it with PROT_WRITE later.
49850 + It is highly recommended that you say Y here if you meet all the
49851 + conditions above.
49853 +config GRKERNSEC_VM86
49854 + bool "Restrict VM86 mode"
49855 + depends on X86_32
49858 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
49859 + make use of a special execution mode on 32bit x86 processors called
49860 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
49861 + video cards and will still work with this option enabled. The purpose
49862 + of the option is to prevent exploitation of emulation errors in
49863 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
49864 + Nearly all users should be able to enable this option.
49866 +config GRKERNSEC_IO
49867 + bool "Disable privileged I/O"
49870 + select RTC_INTF_DEV
49871 + select RTC_DRV_CMOS
49874 + If you say Y here, all ioperm and iopl calls will return an error.
49875 + Ioperm and iopl can be used to modify the running kernel.
49876 + Unfortunately, some programs need this access to operate properly,
49877 + the most notable of which are XFree86 and hwclock. hwclock can be
49878 + remedied by having RTC support in the kernel, so real-time
49879 + clock support is enabled if this option is enabled, to ensure
49880 + that hwclock operates correctly. XFree86 still will not
49881 + operate correctly with this option enabled, so DO NOT CHOOSE Y
49882 + IF YOU USE XFree86. If you use XFree86 and you still want to
49883 + protect your kernel against modification, use the RBAC system.
49885 +config GRKERNSEC_PROC_MEMMAP
49886 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
49887 + default y if (PAX_NOEXEC || PAX_ASLR)
49888 + depends on PAX_NOEXEC || PAX_ASLR
49890 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
49891 + give no information about the addresses of its mappings if
49892 + PaX features that rely on random addresses are enabled on the task.
49893 + If you use PaX it is greatly recommended that you say Y here as it
49894 + closes up a hole that makes the full ASLR useless for suid
49897 +config GRKERNSEC_BRUTE
49898 + bool "Deter exploit bruteforcing"
49900 + If you say Y here, attempts to bruteforce exploits against forking
49901 + daemons such as apache or sshd, as well as against suid/sgid binaries
49902 + will be deterred. When a child of a forking daemon is killed by PaX
49903 + or crashes due to an illegal instruction or other suspicious signal,
49904 + the parent process will be delayed 30 seconds upon every subsequent
49905 + fork until the administrator is able to assess the situation and
49906 + restart the daemon.
49907 + In the suid/sgid case, the attempt is logged, the user has all their
49908 + processes terminated, and they are prevented from executing any further
49909 + processes for 15 minutes.
49910 + It is recommended that you also enable signal logging in the auditing
49911 + section so that logs are generated when a process triggers a suspicious
49913 + If the sysctl option is enabled, a sysctl option with name
49914 + "deter_bruteforce" is created.
49917 +config GRKERNSEC_MODHARDEN
49918 + bool "Harden module auto-loading"
49919 + depends on MODULES
49921 + If you say Y here, module auto-loading in response to use of some
49922 + feature implemented by an unloaded module will be restricted to
49923 + root users. Enabling this option helps defend against attacks
49924 + by unprivileged users who abuse the auto-loading behavior to
49925 + cause a vulnerable module to load that is then exploited.
49927 + If this option prevents a legitimate use of auto-loading for a
49928 + non-root user, the administrator can execute modprobe manually
49929 + with the exact name of the module mentioned in the alert log.
49930 + Alternatively, the administrator can add the module to the list
49931 + of modules loaded at boot by modifying init scripts.
49933 + Modification of init scripts will most likely be needed on
49934 + Ubuntu servers with encrypted home directory support enabled,
49935 + as the first non-root user logging in will cause the ecb(aes),
49936 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
49938 +config GRKERNSEC_HIDESYM
49939 + bool "Hide kernel symbols"
49941 + If you say Y here, getting information on loaded modules, and
49942 + displaying all kernel symbols through a syscall will be restricted
49943 + to users with CAP_SYS_MODULE. For software compatibility reasons,
49944 + /proc/kallsyms will be restricted to the root user. The RBAC
49945 + system can hide that entry even from root.
49947 + This option also prevents leaking of kernel addresses through
49948 + several /proc entries.
49950 + Note that this option is only effective provided the following
49951 + conditions are met:
49952 + 1) The kernel using grsecurity is not precompiled by some distribution
49953 + 2) You have also enabled GRKERNSEC_DMESG
49954 + 3) You are using the RBAC system and hiding other files such as your
49955 + kernel image and System.map. Alternatively, enabling this option
49956 + causes the permissions on /boot, /lib/modules, and the kernel
49957 + source directory to change at compile time to prevent
49958 + reading by non-root users.
49959 + If the above conditions are met, this option will aid in providing a
49960 + useful protection against local kernel exploitation of overflows
49961 + and arbitrary read/write vulnerabilities.
49963 +config GRKERNSEC_KERN_LOCKOUT
49964 + bool "Active kernel exploit response"
49965 + depends on X86 || ARM || PPC || SPARC
49967 + If you say Y here, when a PaX alert is triggered due to suspicious
49968 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
49969 + or an OOPs occurs due to bad memory accesses, instead of just
49970 + terminating the offending process (and potentially allowing
49971 + a subsequent exploit from the same user), we will take one of two
49973 + If the user was root, we will panic the system
49974 + If the user was non-root, we will log the attempt, terminate
49975 + all processes owned by the user, then prevent them from creating
49976 + any new processes until the system is restarted
49977 + This deters repeated kernel exploitation/bruteforcing attempts
49978 + and is useful for later forensics.
49981 +menu "Role Based Access Control Options"
49982 +depends on GRKERNSEC
49984 +config GRKERNSEC_RBAC_DEBUG
49987 +config GRKERNSEC_NO_RBAC
49988 + bool "Disable RBAC system"
49990 + If you say Y here, the /dev/grsec device will be removed from the kernel,
49991 + preventing the RBAC system from being enabled. You should only say Y
49992 + here if you have no intention of using the RBAC system, so as to prevent
49993 + an attacker with root access from misusing the RBAC system to hide files
49994 + and processes when loadable module support and /dev/[k]mem have been
49997 +config GRKERNSEC_ACL_HIDEKERN
49998 + bool "Hide kernel processes"
50000 + If you say Y here, all kernel threads will be hidden to all
50001 + processes but those whose subject has the "view hidden processes"
50004 +config GRKERNSEC_ACL_MAXTRIES
50005 + int "Maximum tries before password lockout"
50008 + This option enforces the maximum number of times a user can attempt
50009 + to authorize themselves with the grsecurity RBAC system before being
50010 + denied the ability to attempt authorization again for a specified time.
50011 + The lower the number, the harder it will be to brute-force a password.
50013 +config GRKERNSEC_ACL_TIMEOUT
50014 + int "Time to wait after max password tries, in seconds"
50017 + This option specifies the time the user must wait after attempting to
50018 + authorize to the RBAC system with the maximum number of invalid
50019 + passwords. The higher the number, the harder it will be to brute-force
50023 +menu "Filesystem Protections"
50024 +depends on GRKERNSEC
50026 +config GRKERNSEC_PROC
50027 + bool "Proc restrictions"
50029 + If you say Y here, the permissions of the /proc filesystem
50030 + will be altered to enhance system security and privacy. You MUST
50031 + choose either a user only restriction or a user and group restriction.
50032 + Depending upon the option you choose, you can either restrict users to
50033 + see only the processes they themselves run, or choose a group that can
50034 + view all processes and files normally restricted to root if you choose
50035 + the "restrict to user only" option. NOTE: If you're running identd as
50036 + a non-root user, you will have to run it as the group you specify here.
50038 +config GRKERNSEC_PROC_USER
50039 + bool "Restrict /proc to user only"
50040 + depends on GRKERNSEC_PROC
50042 + If you say Y here, non-root users will only be able to view their own
50043 + processes, and restricts them from viewing network-related information,
50044 + and viewing kernel symbol and module information.
50046 +config GRKERNSEC_PROC_USERGROUP
50047 + bool "Allow special group"
50048 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
50050 + If you say Y here, you will be able to select a group that will be
50051 + able to view all processes and network-related information. If you've
50052 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
50053 + remain hidden. This option is useful if you want to run identd as
50056 +config GRKERNSEC_PROC_GID
50057 + int "GID for special group"
50058 + depends on GRKERNSEC_PROC_USERGROUP
50061 +config GRKERNSEC_PROC_ADD
50062 + bool "Additional restrictions"
50063 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
50065 + If you say Y here, additional restrictions will be placed on
50066 + /proc that keep normal users from viewing device information and
50067 + slabinfo information that could be useful for exploits.
50069 +config GRKERNSEC_LINK
50070 + bool "Linking restrictions"
50072 + If you say Y here, /tmp race exploits will be prevented, since users
50073 + will no longer be able to follow symlinks owned by other users in
50074 + world-writable +t directories (e.g. /tmp), unless the owner of the
50075 + symlink is the owner of the directory. users will also not be
50076 + able to hardlink to files they do not own. If the sysctl option is
50077 + enabled, a sysctl option with name "linking_restrictions" is created.
50079 +config GRKERNSEC_FIFO
50080 + bool "FIFO restrictions"
50082 + If you say Y here, users will not be able to write to FIFOs they don't
50083 + own in world-writable +t directories (e.g. /tmp), unless the owner of
50084 + the FIFO is the same owner of the directory it's held in. If the sysctl
50085 + option is enabled, a sysctl option with name "fifo_restrictions" is
50088 +config GRKERNSEC_SYSFS_RESTRICT
50089 + bool "Sysfs/debugfs restriction"
50092 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
50093 + any filesystem normally mounted under it (e.g. debugfs) will only
50094 + be accessible by root. These filesystems generally provide access
50095 + to hardware and debug information that isn't appropriate for unprivileged
50096 + users of the system. Sysfs and debugfs have also become a large source
50097 + of new vulnerabilities, ranging from infoleaks to local compromise.
50098 + There has been very little oversight with an eye toward security involved
50099 + in adding new exporters of information to these filesystems, so their
50100 + use is discouraged.
50101 + This option is equivalent to a chmod 0700 of the mount paths.
50103 +config GRKERNSEC_ROFS
50104 + bool "Runtime read-only mount protection"
50106 + If you say Y here, a sysctl option with name "romount_protect" will
50107 + be created. By setting this option to 1 at runtime, filesystems
50108 + will be protected in the following ways:
50109 + * No new writable mounts will be allowed
50110 + * Existing read-only mounts won't be able to be remounted read/write
50111 + * Write operations will be denied on all block devices
50112 + This option acts independently of grsec_lock: once it is set to 1,
50113 + it cannot be turned off. Therefore, please be mindful of the resulting
50114 + behavior if this option is enabled in an init script on a read-only
50115 + filesystem. This feature is mainly intended for secure embedded systems.
50117 +config GRKERNSEC_CHROOT
50118 + bool "Chroot jail restrictions"
50120 + If you say Y here, you will be able to choose several options that will
50121 + make breaking out of a chrooted jail much more difficult. If you
50122 + encounter no software incompatibilities with the following options, it
50123 + is recommended that you enable each one.
50125 +config GRKERNSEC_CHROOT_MOUNT
50126 + bool "Deny mounts"
50127 + depends on GRKERNSEC_CHROOT
50129 + If you say Y here, processes inside a chroot will not be able to
50130 + mount or remount filesystems. If the sysctl option is enabled, a
50131 + sysctl option with name "chroot_deny_mount" is created.
50133 +config GRKERNSEC_CHROOT_DOUBLE
50134 + bool "Deny double-chroots"
50135 + depends on GRKERNSEC_CHROOT
50137 + If you say Y here, processes inside a chroot will not be able to chroot
50138 + again outside the chroot. This is a widely used method of breaking
50139 + out of a chroot jail and should not be allowed. If the sysctl
50140 + option is enabled, a sysctl option with name
50141 + "chroot_deny_chroot" is created.
50143 +config GRKERNSEC_CHROOT_PIVOT
50144 + bool "Deny pivot_root in chroot"
50145 + depends on GRKERNSEC_CHROOT
50147 + If you say Y here, processes inside a chroot will not be able to use
50148 + a function called pivot_root() that was introduced in Linux 2.3.41. It
50149 + works similar to chroot in that it changes the root filesystem. This
50150 + function could be misused in a chrooted process to attempt to break out
50151 + of the chroot, and therefore should not be allowed. If the sysctl
50152 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
50155 +config GRKERNSEC_CHROOT_CHDIR
50156 + bool "Enforce chdir(\"/\") on all chroots"
50157 + depends on GRKERNSEC_CHROOT
50159 + If you say Y here, the current working directory of all newly-chrooted
50160 + applications will be set to the the root directory of the chroot.
50161 + The man page on chroot(2) states:
50162 + Note that this call does not change the current working
50163 + directory, so that `.' can be outside the tree rooted at
50164 + `/'. In particular, the super-user can escape from a
50165 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
50167 + It is recommended that you say Y here, since it's not known to break
50168 + any software. If the sysctl option is enabled, a sysctl option with
50169 + name "chroot_enforce_chdir" is created.
50171 +config GRKERNSEC_CHROOT_CHMOD
50172 + bool "Deny (f)chmod +s"
50173 + depends on GRKERNSEC_CHROOT
50175 + If you say Y here, processes inside a chroot will not be able to chmod
50176 + or fchmod files to make them have suid or sgid bits. This protects
50177 + against another published method of breaking a chroot. If the sysctl
50178 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
50181 +config GRKERNSEC_CHROOT_FCHDIR
50182 + bool "Deny fchdir out of chroot"
50183 + depends on GRKERNSEC_CHROOT
50185 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
50186 + to a file descriptor of the chrooting process that points to a directory
50187 + outside the filesystem will be stopped. If the sysctl option
50188 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
50190 +config GRKERNSEC_CHROOT_MKNOD
50191 + bool "Deny mknod"
50192 + depends on GRKERNSEC_CHROOT
50194 + If you say Y here, processes inside a chroot will not be allowed to
50195 + mknod. The problem with using mknod inside a chroot is that it
50196 + would allow an attacker to create a device entry that is the same
50197 + as one on the physical root of your system, which could range from
50198 + anything from the console device to a device for your harddrive (which
50199 + they could then use to wipe the drive or steal data). It is recommended
50200 + that you say Y here, unless you run into software incompatibilities.
50201 + If the sysctl option is enabled, a sysctl option with name
50202 + "chroot_deny_mknod" is created.
50204 +config GRKERNSEC_CHROOT_SHMAT
50205 + bool "Deny shmat() out of chroot"
50206 + depends on GRKERNSEC_CHROOT
50208 + If you say Y here, processes inside a chroot will not be able to attach
50209 + to shared memory segments that were created outside of the chroot jail.
50210 + It is recommended that you say Y here. If the sysctl option is enabled,
50211 + a sysctl option with name "chroot_deny_shmat" is created.
50213 +config GRKERNSEC_CHROOT_UNIX
50214 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
50215 + depends on GRKERNSEC_CHROOT
50217 + If you say Y here, processes inside a chroot will not be able to
50218 + connect to abstract (meaning not belonging to a filesystem) Unix
50219 + domain sockets that were bound outside of a chroot. It is recommended
50220 + that you say Y here. If the sysctl option is enabled, a sysctl option
50221 + with name "chroot_deny_unix" is created.
50223 +config GRKERNSEC_CHROOT_FINDTASK
50224 + bool "Protect outside processes"
50225 + depends on GRKERNSEC_CHROOT
50227 + If you say Y here, processes inside a chroot will not be able to
50228 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
50229 + getsid, or view any process outside of the chroot. If the sysctl
50230 + option is enabled, a sysctl option with name "chroot_findtask" is
50233 +config GRKERNSEC_CHROOT_NICE
50234 + bool "Restrict priority changes"
50235 + depends on GRKERNSEC_CHROOT
50237 + If you say Y here, processes inside a chroot will not be able to raise
50238 + the priority of processes in the chroot, or alter the priority of
50239 + processes outside the chroot. This provides more security than simply
50240 + removing CAP_SYS_NICE from the process' capability set. If the
50241 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
50244 +config GRKERNSEC_CHROOT_SYSCTL
50245 + bool "Deny sysctl writes"
50246 + depends on GRKERNSEC_CHROOT
50248 + If you say Y here, an attacker in a chroot will not be able to
50249 + write to sysctl entries, either by sysctl(2) or through a /proc
50250 + interface. It is strongly recommended that you say Y here. If the
50251 + sysctl option is enabled, a sysctl option with name
50252 + "chroot_deny_sysctl" is created.
50254 +config GRKERNSEC_CHROOT_CAPS
50255 + bool "Capability restrictions"
50256 + depends on GRKERNSEC_CHROOT
50258 + If you say Y here, the capabilities on all processes within a
50259 + chroot jail will be lowered to stop module insertion, raw i/o,
50260 + system and net admin tasks, rebooting the system, modifying immutable
50261 + files, modifying IPC owned by another, and changing the system time.
50262 + This is left an option because it can break some apps. Disable this
50263 + if your chrooted apps are having problems performing those kinds of
50264 + tasks. If the sysctl option is enabled, a sysctl option with
50265 + name "chroot_caps" is created.
50268 +menu "Kernel Auditing"
50269 +depends on GRKERNSEC
50271 +config GRKERNSEC_AUDIT_GROUP
50272 + bool "Single group for auditing"
50274 + If you say Y here, the exec, chdir, and (un)mount logging features
50275 + will only operate on a group you specify. This option is recommended
50276 + if you only want to watch certain users instead of having a large
50277 + amount of logs from the entire system. If the sysctl option is enabled,
50278 + a sysctl option with name "audit_group" is created.
50280 +config GRKERNSEC_AUDIT_GID
50281 + int "GID for auditing"
50282 + depends on GRKERNSEC_AUDIT_GROUP
50285 +config GRKERNSEC_EXECLOG
50286 + bool "Exec logging"
50288 + If you say Y here, all execve() calls will be logged (since the
50289 + other exec*() calls are frontends to execve(), all execution
50290 + will be logged). Useful for shell-servers that like to keep track
50291 + of their users. If the sysctl option is enabled, a sysctl option with
50292 + name "exec_logging" is created.
50293 + WARNING: This option when enabled will produce a LOT of logs, especially
50294 + on an active system.
50296 +config GRKERNSEC_RESLOG
50297 + bool "Resource logging"
50299 + If you say Y here, all attempts to overstep resource limits will
50300 + be logged with the resource name, the requested size, and the current
50301 + limit. It is highly recommended that you say Y here. If the sysctl
50302 + option is enabled, a sysctl option with name "resource_logging" is
50303 + created. If the RBAC system is enabled, the sysctl value is ignored.
50305 +config GRKERNSEC_CHROOT_EXECLOG
50306 + bool "Log execs within chroot"
50308 + If you say Y here, all executions inside a chroot jail will be logged
50309 + to syslog. This can cause a large amount of logs if certain
50310 + applications (eg. djb's daemontools) are installed on the system, and
50311 + is therefore left as an option. If the sysctl option is enabled, a
50312 + sysctl option with name "chroot_execlog" is created.
50314 +config GRKERNSEC_AUDIT_PTRACE
50315 + bool "Ptrace logging"
50317 + If you say Y here, all attempts to attach to a process via ptrace
50318 + will be logged. If the sysctl option is enabled, a sysctl option
50319 + with name "audit_ptrace" is created.
50321 +config GRKERNSEC_AUDIT_CHDIR
50322 + bool "Chdir logging"
50324 + If you say Y here, all chdir() calls will be logged. If the sysctl
50325 + option is enabled, a sysctl option with name "audit_chdir" is created.
50327 +config GRKERNSEC_AUDIT_MOUNT
50328 + bool "(Un)Mount logging"
50330 + If you say Y here, all mounts and unmounts will be logged. If the
50331 + sysctl option is enabled, a sysctl option with name "audit_mount" is
50334 +config GRKERNSEC_SIGNAL
50335 + bool "Signal logging"
50337 + If you say Y here, certain important signals will be logged, such as
50338 + SIGSEGV, which will as a result inform you of when a error in a program
50339 + occurred, which in some cases could mean a possible exploit attempt.
50340 + If the sysctl option is enabled, a sysctl option with name
50341 + "signal_logging" is created.
50343 +config GRKERNSEC_FORKFAIL
50344 + bool "Fork failure logging"
50346 + If you say Y here, all failed fork() attempts will be logged.
50347 + This could suggest a fork bomb, or someone attempting to overstep
50348 + their process limit. If the sysctl option is enabled, a sysctl option
50349 + with name "forkfail_logging" is created.
50351 +config GRKERNSEC_TIME
50352 + bool "Time change logging"
50354 + If you say Y here, any changes of the system clock will be logged.
50355 + If the sysctl option is enabled, a sysctl option with name
50356 + "timechange_logging" is created.
50358 +config GRKERNSEC_PROC_IPADDR
50359 + bool "/proc/<pid>/ipaddr support"
50361 + If you say Y here, a new entry will be added to each /proc/<pid>
50362 + directory that contains the IP address of the person using the task.
50363 + The IP is carried across local TCP and AF_UNIX stream sockets.
50364 + This information can be useful for IDS/IPSes to perform remote response
50365 + to a local attack. The entry is readable by only the owner of the
50366 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
50367 + the RBAC system), and thus does not create privacy concerns.
50369 +config GRKERNSEC_RWXMAP_LOG
50370 + bool 'Denied RWX mmap/mprotect logging'
50371 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
50373 + If you say Y here, calls to mmap() and mprotect() with explicit
50374 + usage of PROT_WRITE and PROT_EXEC together will be logged when
50375 + denied by the PAX_MPROTECT feature. If the sysctl option is
50376 + enabled, a sysctl option with name "rwxmap_logging" is created.
50378 +config GRKERNSEC_AUDIT_TEXTREL
50379 + bool 'ELF text relocations logging (READ HELP)'
50380 + depends on PAX_MPROTECT
50382 + If you say Y here, text relocations will be logged with the filename
50383 + of the offending library or binary. The purpose of the feature is
50384 + to help Linux distribution developers get rid of libraries and
50385 + binaries that need text relocations which hinder the future progress
50386 + of PaX. Only Linux distribution developers should say Y here, and
50387 + never on a production machine, as this option creates an information
50388 + leak that could aid an attacker in defeating the randomization of
50389 + a single memory region. If the sysctl option is enabled, a sysctl
50390 + option with name "audit_textrel" is created.
50394 +menu "Executable Protections"
50395 +depends on GRKERNSEC
50397 +config GRKERNSEC_DMESG
50398 + bool "Dmesg(8) restriction"
50400 + If you say Y here, non-root users will not be able to use dmesg(8)
50401 + to view up to the last 4kb of messages in the kernel's log buffer.
50402 + The kernel's log buffer often contains kernel addresses and other
50403 + identifying information useful to an attacker in fingerprinting a
50404 + system for a targeted exploit.
50405 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
50408 +config GRKERNSEC_HARDEN_PTRACE
50409 + bool "Deter ptrace-based process snooping"
50411 + If you say Y here, TTY sniffers and other malicious monitoring
50412 + programs implemented through ptrace will be defeated. If you
50413 + have been using the RBAC system, this option has already been
50414 + enabled for several years for all users, with the ability to make
50415 + fine-grained exceptions.
50417 + This option only affects the ability of non-root users to ptrace
50418 + processes that are not a descendent of the ptracing process.
50419 + This means that strace ./binary and gdb ./binary will still work,
50420 + but attaching to arbitrary processes will not. If the sysctl
50421 + option is enabled, a sysctl option with name "harden_ptrace" is
50424 +config GRKERNSEC_SETXID
50425 + bool "Enforce consistent multithreaded privileges"
50427 + If you say Y here, a change from a root uid to a non-root uid
50428 + in a multithreaded application will cause the resulting uids,
50429 + gids, supplementary groups, and capabilities in that thread
50430 + to be propagated to the other threads of the process. In most
50431 + cases this is unnecessary, as glibc will emulate this behavior
50432 + on behalf of the application. Other libcs do not act in the
50433 + same way, allowing the other threads of the process to continue
50434 + running with root privileges. If the sysctl option is enabled,
50435 + a sysctl option with name "consistent_setxid" is created.
50437 +config GRKERNSEC_TPE
50438 + bool "Trusted Path Execution (TPE)"
50440 + If you say Y here, you will be able to choose a gid to add to the
50441 + supplementary groups of users you want to mark as "untrusted."
50442 + These users will not be able to execute any files that are not in
50443 + root-owned directories writable only by root. If the sysctl option
50444 + is enabled, a sysctl option with name "tpe" is created.
50446 +config GRKERNSEC_TPE_ALL
50447 + bool "Partially restrict all non-root users"
50448 + depends on GRKERNSEC_TPE
50450 + If you say Y here, all non-root users will be covered under
50451 + a weaker TPE restriction. This is separate from, and in addition to,
50452 + the main TPE options that you have selected elsewhere. Thus, if a
50453 + "trusted" GID is chosen, this restriction applies to even that GID.
50454 + Under this restriction, all non-root users will only be allowed to
50455 + execute files in directories they own that are not group or
50456 + world-writable, or in directories owned by root and writable only by
50457 + root. If the sysctl option is enabled, a sysctl option with name
50458 + "tpe_restrict_all" is created.
50460 +config GRKERNSEC_TPE_INVERT
50461 + bool "Invert GID option"
50462 + depends on GRKERNSEC_TPE
50464 + If you say Y here, the group you specify in the TPE configuration will
50465 + decide what group TPE restrictions will be *disabled* for. This
50466 + option is useful if you want TPE restrictions to be applied to most
50467 + users on the system. If the sysctl option is enabled, a sysctl option
50468 + with name "tpe_invert" is created. Unlike other sysctl options, this
50469 + entry will default to on for backward-compatibility.
50471 +config GRKERNSEC_TPE_GID
50472 + int "GID for untrusted users"
50473 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
50476 + Setting this GID determines what group TPE restrictions will be
50477 + *enabled* for. If the sysctl option is enabled, a sysctl option
50478 + with name "tpe_gid" is created.
50480 +config GRKERNSEC_TPE_GID
50481 + int "GID for trusted users"
50482 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
50485 + Setting this GID determines what group TPE restrictions will be
50486 + *disabled* for. If the sysctl option is enabled, a sysctl option
50487 + with name "tpe_gid" is created.
50490 +menu "Network Protections"
50491 +depends on GRKERNSEC
50493 +config GRKERNSEC_RANDNET
50494 + bool "Larger entropy pools"
50496 + If you say Y here, the entropy pools used for many features of Linux
50497 + and grsecurity will be doubled in size. Since several grsecurity
50498 + features use additional randomness, it is recommended that you say Y
50499 + here. Saying Y here has a similar effect as modifying
50500 + /proc/sys/kernel/random/poolsize.
50502 +config GRKERNSEC_BLACKHOLE
50503 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
50506 + If you say Y here, neither TCP resets nor ICMP
50507 + destination-unreachable packets will be sent in response to packets
50508 + sent to ports for which no associated listening process exists.
50509 + This feature supports both IPV4 and IPV6 and exempts the
50510 + loopback interface from blackholing. Enabling this feature
50511 + makes a host more resilient to DoS attacks and reduces network
50512 + visibility against scanners.
50514 + The blackhole feature as-implemented is equivalent to the FreeBSD
50515 + blackhole feature, as it prevents RST responses to all packets, not
50516 + just SYNs. Under most application behavior this causes no
50517 + problems, but applications (like haproxy) may not close certain
50518 + connections in a way that cleanly terminates them on the remote
50519 + end, leaving the remote host in LAST_ACK state. Because of this
50520 + side-effect and to prevent intentional LAST_ACK DoSes, this
50521 + feature also adds automatic mitigation against such attacks.
50522 + The mitigation drastically reduces the amount of time a socket
50523 + can spend in LAST_ACK state. If you're using haproxy and not
50524 + all servers it connects to have this option enabled, consider
50525 + disabling this feature on the haproxy host.
50527 + If the sysctl option is enabled, two sysctl options with names
50528 + "ip_blackhole" and "lastack_retries" will be created.
50529 + While "ip_blackhole" takes the standard zero/non-zero on/off
50530 + toggle, "lastack_retries" uses the same kinds of values as
50531 + "tcp_retries1" and "tcp_retries2". The default value of 4
50532 + prevents a socket from lasting more than 45 seconds in LAST_ACK
50535 +config GRKERNSEC_SOCKET
50536 + bool "Socket restrictions"
50539 + If you say Y here, you will be able to choose from several options.
50540 + If you assign a GID on your system and add it to the supplementary
50541 + groups of users you want to restrict socket access to, this patch
50542 + will perform up to three things, based on the option(s) you choose.
50544 +config GRKERNSEC_SOCKET_ALL
50545 + bool "Deny any sockets to group"
50546 + depends on GRKERNSEC_SOCKET
50548 + If you say Y here, you will be able to choose a GID of whose users will
50549 + be unable to connect to other hosts from your machine or run server
50550 + applications from your machine. If the sysctl option is enabled, a
50551 + sysctl option with name "socket_all" is created.
50553 +config GRKERNSEC_SOCKET_ALL_GID
50554 + int "GID to deny all sockets for"
50555 + depends on GRKERNSEC_SOCKET_ALL
50558 + Here you can choose the GID to disable socket access for. Remember to
50559 + add the users you want socket access disabled for to the GID
50560 + specified here. If the sysctl option is enabled, a sysctl option
50561 + with name "socket_all_gid" is created.
50563 +config GRKERNSEC_SOCKET_CLIENT
50564 + bool "Deny client sockets to group"
50565 + depends on GRKERNSEC_SOCKET
50567 + If you say Y here, you will be able to choose a GID of whose users will
50568 + be unable to connect to other hosts from your machine, but will be
50569 + able to run servers. If this option is enabled, all users in the group
50570 + you specify will have to use passive mode when initiating ftp transfers
50571 + from the shell on your machine. If the sysctl option is enabled, a
50572 + sysctl option with name "socket_client" is created.
50574 +config GRKERNSEC_SOCKET_CLIENT_GID
50575 + int "GID to deny client sockets for"
50576 + depends on GRKERNSEC_SOCKET_CLIENT
50579 + Here you can choose the GID to disable client socket access for.
50580 + Remember to add the users you want client socket access disabled for to
50581 + the GID specified here. If the sysctl option is enabled, a sysctl
50582 + option with name "socket_client_gid" is created.
50584 +config GRKERNSEC_SOCKET_SERVER
50585 + bool "Deny server sockets to group"
50586 + depends on GRKERNSEC_SOCKET
50588 + If you say Y here, you will be able to choose a GID of whose users will
50589 + be unable to run server applications from your machine. If the sysctl
50590 + option is enabled, a sysctl option with name "socket_server" is created.
50592 +config GRKERNSEC_SOCKET_SERVER_GID
50593 + int "GID to deny server sockets for"
50594 + depends on GRKERNSEC_SOCKET_SERVER
50597 + Here you can choose the GID to disable server socket access for.
50598 + Remember to add the users you want server socket access disabled for to
50599 + the GID specified here. If the sysctl option is enabled, a sysctl
50600 + option with name "socket_server_gid" is created.
50603 +menu "Sysctl support"
50604 +depends on GRKERNSEC && SYSCTL
50606 +config GRKERNSEC_SYSCTL
50607 + bool "Sysctl support"
50609 + If you say Y here, you will be able to change the options that
50610 + grsecurity runs with at bootup, without having to recompile your
50611 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
50612 + to enable (1) or disable (0) various features. All the sysctl entries
50613 + are mutable until the "grsec_lock" entry is set to a non-zero value.
50614 + All features enabled in the kernel configuration are disabled at boot
50615 + if you do not say Y to the "Turn on features by default" option.
50616 + All options should be set at startup, and the grsec_lock entry should
50617 + be set to a non-zero value after all the options are set.
50618 + *THIS IS EXTREMELY IMPORTANT*
50620 +config GRKERNSEC_SYSCTL_DISTRO
50621 + bool "Extra sysctl support for distro makers (READ HELP)"
50622 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
50624 + If you say Y here, additional sysctl options will be created
50625 + for features that affect processes running as root. Therefore,
50626 + it is critical when using this option that the grsec_lock entry be
50627 + enabled after boot. Only distros with prebuilt kernel packages
50628 + with this option enabled that can ensure grsec_lock is enabled
50629 + after boot should use this option.
50630 + *Failure to set grsec_lock after boot makes all grsec features
50631 + this option covers useless*
50633 + Currently this option creates the following sysctl entries:
50634 + "Disable Privileged I/O": "disable_priv_io"
50636 +config GRKERNSEC_SYSCTL_ON
50637 + bool "Turn on features by default"
50638 + depends on GRKERNSEC_SYSCTL
50640 + If you say Y here, instead of having all features enabled in the
50641 + kernel configuration disabled at boot time, the features will be
50642 + enabled at boot time. It is recommended you say Y here unless
50643 + there is some reason you would want all sysctl-tunable features to
50644 + be disabled by default. As mentioned elsewhere, it is important
50645 + to enable the grsec_lock entry once you have finished modifying
50646 + the sysctl entries.
50649 +menu "Logging Options"
50650 +depends on GRKERNSEC
50652 +config GRKERNSEC_FLOODTIME
50653 + int "Seconds in between log messages (minimum)"
50656 + This option allows you to enforce the number of seconds between
50657 + grsecurity log messages. The default should be suitable for most
50658 + people, however, if you choose to change it, choose a value small enough
50659 + to allow informative logs to be produced, but large enough to
50660 + prevent flooding.
50662 +config GRKERNSEC_FLOODBURST
50663 + int "Number of messages in a burst (maximum)"
50666 + This option allows you to choose the maximum number of messages allowed
50667 + within the flood time interval you chose in a separate option. The
50668 + default should be suitable for most people, however if you find that
50669 + many of your logs are being interpreted as flooding, you may want to
50670 + raise this value.
50675 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
50676 new file mode 100644
50677 index 0000000..be9ae3a
50679 +++ b/grsecurity/Makefile
50681 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
50682 +# during 2001-2009 it has been completely redesigned by Brad Spengler
50683 +# into an RBAC system
50685 +# All code in this directory and various hooks inserted throughout the kernel
50686 +# are copyright Brad Spengler - Open Source Security, Inc., and released
50687 +# under the GPL v2 or higher
50689 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
50690 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
50691 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
50693 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
50694 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
50695 + gracl_learn.o grsec_log.o
50696 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
50699 +obj-y += grsec_sock.o
50700 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
50703 +ifndef CONFIG_GRKERNSEC
50704 +obj-y += grsec_disabled.o
50707 +ifdef CONFIG_GRKERNSEC_HIDESYM
50708 +extra-y := grsec_hidesym.o
50709 +$(obj)/grsec_hidesym.o:
50710 + @-chmod -f 500 /boot
50711 + @-chmod -f 500 /lib/modules
50712 + @-chmod -f 500 /lib64/modules
50713 + @-chmod -f 500 /lib32/modules
50715 + @echo ' grsec: protected kernel image paths'
50717 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
50718 new file mode 100644
50719 index 0000000..09258e0
50721 +++ b/grsecurity/gracl.c
50723 +#include <linux/kernel.h>
50724 +#include <linux/module.h>
50725 +#include <linux/sched.h>
50726 +#include <linux/mm.h>
50727 +#include <linux/file.h>
50728 +#include <linux/fs.h>
50729 +#include <linux/namei.h>
50730 +#include <linux/mount.h>
50731 +#include <linux/tty.h>
50732 +#include <linux/proc_fs.h>
50733 +#include <linux/lglock.h>
50734 +#include <linux/slab.h>
50735 +#include <linux/vmalloc.h>
50736 +#include <linux/types.h>
50737 +#include <linux/sysctl.h>
50738 +#include <linux/netdevice.h>
50739 +#include <linux/ptrace.h>
50740 +#include <linux/gracl.h>
50741 +#include <linux/gralloc.h>
50742 +#include <linux/grsecurity.h>
50743 +#include <linux/grinternal.h>
50744 +#include <linux/pid_namespace.h>
50745 +#include <linux/fdtable.h>
50746 +#include <linux/percpu.h>
50748 +#include <asm/uaccess.h>
50749 +#include <asm/errno.h>
50750 +#include <asm/mman.h>
50752 +static struct acl_role_db acl_role_set;
50753 +static struct name_db name_set;
50754 +static struct inodev_db inodev_set;
50756 +/* for keeping track of userspace pointers used for subjects, so we
50757 + can share references in the kernel as well
50760 +static struct path real_root;
50762 +static struct acl_subj_map_db subj_map_set;
50764 +static struct acl_role_label *default_role;
50766 +static struct acl_role_label *role_list;
50768 +static u16 acl_sp_role_value;
50770 +extern char *gr_shared_page[4];
50771 +static DEFINE_MUTEX(gr_dev_mutex);
50772 +DEFINE_RWLOCK(gr_inode_lock);
50774 +struct gr_arg *gr_usermode;
50776 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
50778 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
50779 +extern void gr_clear_learn_entries(void);
50781 +#ifdef CONFIG_GRKERNSEC_RESLOG
50782 +extern void gr_log_resource(const struct task_struct *task,
50783 + const int res, const unsigned long wanted, const int gt);
50786 +unsigned char *gr_system_salt;
50787 +unsigned char *gr_system_sum;
50789 +static struct sprole_pw **acl_special_roles = NULL;
50790 +static __u16 num_sprole_pws = 0;
50792 +static struct acl_role_label *kernel_role = NULL;
50794 +static unsigned int gr_auth_attempts = 0;
50795 +static unsigned long gr_auth_expires = 0UL;
50798 +extern struct vfsmount *sock_mnt;
50801 +extern struct vfsmount *pipe_mnt;
50802 +extern struct vfsmount *shm_mnt;
50803 +#ifdef CONFIG_HUGETLBFS
50804 +extern struct vfsmount *hugetlbfs_vfsmount;
50807 +static struct acl_object_label *fakefs_obj_rw;
50808 +static struct acl_object_label *fakefs_obj_rwx;
50810 +extern int gr_init_uidset(void);
50811 +extern void gr_free_uidset(void);
50812 +extern void gr_remove_uid(uid_t uid);
50813 +extern int gr_find_uid(uid_t uid);
50815 +DECLARE_BRLOCK(vfsmount_lock);
50818 +gr_acl_is_enabled(void)
50820 + return (gr_status & GR_READY);
50823 +#ifdef CONFIG_BTRFS_FS
50824 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
50825 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
50828 +static inline dev_t __get_dev(const struct dentry *dentry)
50830 +#ifdef CONFIG_BTRFS_FS
50831 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
50832 + return get_btrfs_dev_from_inode(dentry->d_inode);
50835 + return dentry->d_inode->i_sb->s_dev;
50838 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
50840 + return __get_dev(dentry);
50843 +static char gr_task_roletype_to_char(struct task_struct *task)
50845 + switch (task->role->roletype &
50846 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
50847 + GR_ROLE_SPECIAL)) {
50848 + case GR_ROLE_DEFAULT:
50850 + case GR_ROLE_USER:
50852 + case GR_ROLE_GROUP:
50854 + case GR_ROLE_SPECIAL:
50861 +char gr_roletype_to_char(void)
50863 + return gr_task_roletype_to_char(current);
50867 +gr_acl_tpe_check(void)
50869 + if (unlikely(!(gr_status & GR_READY)))
50871 + if (current->role->roletype & GR_ROLE_TPE)
50878 +gr_handle_rawio(const struct inode *inode)
50880 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
50881 + if (inode && S_ISBLK(inode->i_mode) &&
50882 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
50883 + !capable(CAP_SYS_RAWIO))
50890 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
50892 + if (likely(lena != lenb))
50895 + return !memcmp(a, b, lena);
50898 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
50900 + *buflen -= namelen;
50902 + return -ENAMETOOLONG;
50903 + *buffer -= namelen;
50904 + memcpy(*buffer, str, namelen);
50908 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
50910 + return prepend(buffer, buflen, name->name, name->len);
50913 +static int prepend_path(const struct path *path, struct path *root,
50914 + char **buffer, int *buflen)
50916 + struct dentry *dentry = path->dentry;
50917 + struct vfsmount *vfsmnt = path->mnt;
50918 + bool slash = false;
50921 + while (dentry != root->dentry || vfsmnt != root->mnt) {
50922 + struct dentry * parent;
50924 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
50925 + /* Global root? */
50926 + if (vfsmnt->mnt_parent == vfsmnt) {
50929 + dentry = vfsmnt->mnt_mountpoint;
50930 + vfsmnt = vfsmnt->mnt_parent;
50933 + parent = dentry->d_parent;
50934 + prefetch(parent);
50935 + spin_lock(&dentry->d_lock);
50936 + error = prepend_name(buffer, buflen, &dentry->d_name);
50937 + spin_unlock(&dentry->d_lock);
50939 + error = prepend(buffer, buflen, "/", 1);
50948 + if (!error && !slash)
50949 + error = prepend(buffer, buflen, "/", 1);
50954 +/* this must be called with vfsmount_lock and rename_lock held */
50956 +static char *__our_d_path(const struct path *path, struct path *root,
50957 + char *buf, int buflen)
50959 + char *res = buf + buflen;
50962 + prepend(&res, &buflen, "\0", 1);
50963 + error = prepend_path(path, root, &res, &buflen);
50965 + return ERR_PTR(error);
50971 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
50975 + retval = __our_d_path(path, root, buf, buflen);
50976 + if (unlikely(IS_ERR(retval)))
50977 + retval = strcpy(buf, "<path too long>");
50978 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
50979 + retval[1] = '\0';
50985 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50986 + char *buf, int buflen)
50988 + struct path path;
50991 + path.dentry = (struct dentry *)dentry;
50992 + path.mnt = (struct vfsmount *)vfsmnt;
50994 + /* we can use real_root.dentry, real_root.mnt, because this is only called
50995 + by the RBAC system */
50996 + res = gen_full_path(&path, &real_root, buf, buflen);
51002 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51003 + char *buf, int buflen)
51006 + struct path path;
51007 + struct path root;
51008 + struct task_struct *reaper = &init_task;
51010 + path.dentry = (struct dentry *)dentry;
51011 + path.mnt = (struct vfsmount *)vfsmnt;
51013 + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51014 + get_fs_root(reaper->fs, &root);
51016 + write_seqlock(&rename_lock);
51017 + br_read_lock(vfsmount_lock);
51018 + res = gen_full_path(&path, &root, buf, buflen);
51019 + br_read_unlock(vfsmount_lock);
51020 + write_sequnlock(&rename_lock);
51027 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51030 + write_seqlock(&rename_lock);
51031 + br_read_lock(vfsmount_lock);
51032 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51034 + br_read_unlock(vfsmount_lock);
51035 + write_sequnlock(&rename_lock);
51040 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51046 + write_seqlock(&rename_lock);
51047 + br_read_lock(vfsmount_lock);
51048 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51049 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
51050 + buflen = (int)(ret - buf);
51052 + prepend(&ret, &buflen, "/proc", 5);
51054 + ret = strcpy(buf, "<path too long>");
51055 + br_read_unlock(vfsmount_lock);
51056 + write_sequnlock(&rename_lock);
51061 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51063 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51068 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51070 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51075 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51077 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51082 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51084 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51089 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51091 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51096 +to_gr_audit(const __u32 reqmode)
51098 + /* masks off auditable permission flags, then shifts them to create
51099 + auditing flags, and adds the special case of append auditing if
51100 + we're requesting write */
51101 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51104 +struct acl_subject_label *
51105 +lookup_subject_map(const struct acl_subject_label *userp)
51107 + unsigned int index = shash(userp, subj_map_set.s_size);
51108 + struct subject_map *match;
51110 + match = subj_map_set.s_hash[index];
51112 + while (match && match->user != userp)
51113 + match = match->next;
51115 + if (match != NULL)
51116 + return match->kernel;
51122 +insert_subj_map_entry(struct subject_map *subjmap)
51124 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51125 + struct subject_map **curr;
51127 + subjmap->prev = NULL;
51129 + curr = &subj_map_set.s_hash[index];
51130 + if (*curr != NULL)
51131 + (*curr)->prev = subjmap;
51133 + subjmap->next = *curr;
51139 +static struct acl_role_label *
51140 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51143 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51144 + struct acl_role_label *match;
51145 + struct role_allowed_ip *ipp;
51147 + u32 curr_ip = task->signal->curr_ip;
51149 + task->signal->saved_ip = curr_ip;
51151 + match = acl_role_set.r_hash[index];
51154 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51155 + for (x = 0; x < match->domain_child_num; x++) {
51156 + if (match->domain_children[x] == uid)
51159 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51161 + match = match->next;
51164 + if (match == NULL) {
51166 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51167 + match = acl_role_set.r_hash[index];
51170 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51171 + for (x = 0; x < match->domain_child_num; x++) {
51172 + if (match->domain_children[x] == gid)
51175 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51177 + match = match->next;
51180 + if (match == NULL)
51181 + match = default_role;
51182 + if (match->allowed_ips == NULL)
51185 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51187 + ((ntohl(curr_ip) & ipp->netmask) ==
51188 + (ntohl(ipp->addr) & ipp->netmask)))
51191 + match = default_role;
51193 + } else if (match->allowed_ips == NULL) {
51196 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51198 + ((ntohl(curr_ip) & ipp->netmask) ==
51199 + (ntohl(ipp->addr) & ipp->netmask)))
51208 +struct acl_subject_label *
51209 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51210 + const struct acl_role_label *role)
51212 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51213 + struct acl_subject_label *match;
51215 + match = role->subj_hash[index];
51217 + while (match && (match->inode != ino || match->device != dev ||
51218 + (match->mode & GR_DELETED))) {
51219 + match = match->next;
51222 + if (match && !(match->mode & GR_DELETED))
51228 +struct acl_subject_label *
51229 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51230 + const struct acl_role_label *role)
51232 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51233 + struct acl_subject_label *match;
51235 + match = role->subj_hash[index];
51237 + while (match && (match->inode != ino || match->device != dev ||
51238 + !(match->mode & GR_DELETED))) {
51239 + match = match->next;
51242 + if (match && (match->mode & GR_DELETED))
51248 +static struct acl_object_label *
51249 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51250 + const struct acl_subject_label *subj)
51252 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51253 + struct acl_object_label *match;
51255 + match = subj->obj_hash[index];
51257 + while (match && (match->inode != ino || match->device != dev ||
51258 + (match->mode & GR_DELETED))) {
51259 + match = match->next;
51262 + if (match && !(match->mode & GR_DELETED))
51268 +static struct acl_object_label *
51269 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51270 + const struct acl_subject_label *subj)
51272 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51273 + struct acl_object_label *match;
51275 + match = subj->obj_hash[index];
51277 + while (match && (match->inode != ino || match->device != dev ||
51278 + !(match->mode & GR_DELETED))) {
51279 + match = match->next;
51282 + if (match && (match->mode & GR_DELETED))
51285 + match = subj->obj_hash[index];
51287 + while (match && (match->inode != ino || match->device != dev ||
51288 + (match->mode & GR_DELETED))) {
51289 + match = match->next;
51292 + if (match && !(match->mode & GR_DELETED))
51298 +static struct name_entry *
51299 +lookup_name_entry(const char *name)
51301 + unsigned int len = strlen(name);
51302 + unsigned int key = full_name_hash(name, len);
51303 + unsigned int index = key % name_set.n_size;
51304 + struct name_entry *match;
51306 + match = name_set.n_hash[index];
51308 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51309 + match = match->next;
51314 +static struct name_entry *
51315 +lookup_name_entry_create(const char *name)
51317 + unsigned int len = strlen(name);
51318 + unsigned int key = full_name_hash(name, len);
51319 + unsigned int index = key % name_set.n_size;
51320 + struct name_entry *match;
51322 + match = name_set.n_hash[index];
51324 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51325 + !match->deleted))
51326 + match = match->next;
51328 + if (match && match->deleted)
51331 + match = name_set.n_hash[index];
51333 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51335 + match = match->next;
51337 + if (match && !match->deleted)
51343 +static struct inodev_entry *
51344 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
51346 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
51347 + struct inodev_entry *match;
51349 + match = inodev_set.i_hash[index];
51351 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51352 + match = match->next;
51358 +insert_inodev_entry(struct inodev_entry *entry)
51360 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51361 + inodev_set.i_size);
51362 + struct inodev_entry **curr;
51364 + entry->prev = NULL;
51366 + curr = &inodev_set.i_hash[index];
51367 + if (*curr != NULL)
51368 + (*curr)->prev = entry;
51370 + entry->next = *curr;
51377 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51379 + unsigned int index =
51380 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51381 + struct acl_role_label **curr;
51382 + struct acl_role_label *tmp;
51384 + curr = &acl_role_set.r_hash[index];
51386 + /* if role was already inserted due to domains and already has
51387 + a role in the same bucket as it attached, then we need to
51388 + combine these two buckets
51390 + if (role->next) {
51391 + tmp = role->next;
51392 + while (tmp->next)
51394 + tmp->next = *curr;
51396 + role->next = *curr;
51403 +insert_acl_role_label(struct acl_role_label *role)
51407 + if (role_list == NULL) {
51408 + role_list = role;
51409 + role->prev = NULL;
51411 + role->prev = role_list;
51412 + role_list = role;
51415 + /* used for hash chains */
51416 + role->next = NULL;
51418 + if (role->roletype & GR_ROLE_DOMAIN) {
51419 + for (i = 0; i < role->domain_child_num; i++)
51420 + __insert_acl_role_label(role, role->domain_children[i]);
51422 + __insert_acl_role_label(role, role->uidgid);
51426 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51428 + struct name_entry **curr, *nentry;
51429 + struct inodev_entry *ientry;
51430 + unsigned int len = strlen(name);
51431 + unsigned int key = full_name_hash(name, len);
51432 + unsigned int index = key % name_set.n_size;
51434 + curr = &name_set.n_hash[index];
51436 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51437 + curr = &((*curr)->next);
51439 + if (*curr != NULL)
51442 + nentry = acl_alloc(sizeof (struct name_entry));
51443 + if (nentry == NULL)
51445 + ientry = acl_alloc(sizeof (struct inodev_entry));
51446 + if (ientry == NULL)
51448 + ientry->nentry = nentry;
51450 + nentry->key = key;
51451 + nentry->name = name;
51452 + nentry->inode = inode;
51453 + nentry->device = device;
51454 + nentry->len = len;
51455 + nentry->deleted = deleted;
51457 + nentry->prev = NULL;
51458 + curr = &name_set.n_hash[index];
51459 + if (*curr != NULL)
51460 + (*curr)->prev = nentry;
51461 + nentry->next = *curr;
51464 + /* insert us into the table searchable by inode/dev */
51465 + insert_inodev_entry(ientry);
51471 +insert_acl_obj_label(struct acl_object_label *obj,
51472 + struct acl_subject_label *subj)
51474 + unsigned int index =
51475 + fhash(obj->inode, obj->device, subj->obj_hash_size);
51476 + struct acl_object_label **curr;
51479 + obj->prev = NULL;
51481 + curr = &subj->obj_hash[index];
51482 + if (*curr != NULL)
51483 + (*curr)->prev = obj;
51485 + obj->next = *curr;
51492 +insert_acl_subj_label(struct acl_subject_label *obj,
51493 + struct acl_role_label *role)
51495 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
51496 + struct acl_subject_label **curr;
51498 + obj->prev = NULL;
51500 + curr = &role->subj_hash[index];
51501 + if (*curr != NULL)
51502 + (*curr)->prev = obj;
51504 + obj->next = *curr;
51510 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
51513 +create_table(__u32 * len, int elementsize)
51515 + unsigned int table_sizes[] = {
51516 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
51517 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
51518 + 4194301, 8388593, 16777213, 33554393, 67108859
51520 + void *newtable = NULL;
51521 + unsigned int pwr = 0;
51523 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
51524 + table_sizes[pwr] <= *len)
51527 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
51530 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
51532 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
51534 + newtable = vmalloc(table_sizes[pwr] * elementsize);
51536 + *len = table_sizes[pwr];
51542 +init_variables(const struct gr_arg *arg)
51544 + struct task_struct *reaper = &init_task;
51545 + unsigned int stacksize;
51547 + subj_map_set.s_size = arg->role_db.num_subjects;
51548 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
51549 + name_set.n_size = arg->role_db.num_objects;
51550 + inodev_set.i_size = arg->role_db.num_objects;
51552 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
51553 + !name_set.n_size || !inodev_set.i_size)
51556 + if (!gr_init_uidset())
51559 + /* set up the stack that holds allocation info */
51561 + stacksize = arg->role_db.num_pointers + 5;
51563 + if (!acl_alloc_stack_init(stacksize))
51566 + /* grab reference for the real root dentry and vfsmount */
51567 + get_fs_root(reaper->fs, &real_root);
51569 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51570 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
51573 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
51574 + if (fakefs_obj_rw == NULL)
51576 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
51578 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
51579 + if (fakefs_obj_rwx == NULL)
51581 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
51583 + subj_map_set.s_hash =
51584 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
51585 + acl_role_set.r_hash =
51586 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
51587 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
51588 + inodev_set.i_hash =
51589 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
51591 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
51592 + !name_set.n_hash || !inodev_set.i_hash)
51595 + memset(subj_map_set.s_hash, 0,
51596 + sizeof(struct subject_map *) * subj_map_set.s_size);
51597 + memset(acl_role_set.r_hash, 0,
51598 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
51599 + memset(name_set.n_hash, 0,
51600 + sizeof (struct name_entry *) * name_set.n_size);
51601 + memset(inodev_set.i_hash, 0,
51602 + sizeof (struct inodev_entry *) * inodev_set.i_size);
51607 +/* free information not needed after startup
51608 + currently contains user->kernel pointer mappings for subjects
51612 +free_init_variables(void)
51616 + if (subj_map_set.s_hash) {
51617 + for (i = 0; i < subj_map_set.s_size; i++) {
51618 + if (subj_map_set.s_hash[i]) {
51619 + kfree(subj_map_set.s_hash[i]);
51620 + subj_map_set.s_hash[i] = NULL;
51624 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
51626 + kfree(subj_map_set.s_hash);
51628 + vfree(subj_map_set.s_hash);
51635 +free_variables(void)
51637 + struct acl_subject_label *s;
51638 + struct acl_role_label *r;
51639 + struct task_struct *task, *task2;
51642 + gr_clear_learn_entries();
51644 + read_lock(&tasklist_lock);
51645 + do_each_thread(task2, task) {
51646 + task->acl_sp_role = 0;
51647 + task->acl_role_id = 0;
51648 + task->acl = NULL;
51649 + task->role = NULL;
51650 + } while_each_thread(task2, task);
51651 + read_unlock(&tasklist_lock);
51653 + /* release the reference to the real root dentry and vfsmount */
51654 + path_put(&real_root);
51656 + /* free all object hash tables */
51658 + FOR_EACH_ROLE_START(r)
51659 + if (r->subj_hash == NULL)
51661 + FOR_EACH_SUBJECT_START(r, s, x)
51662 + if (s->obj_hash == NULL)
51664 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51665 + kfree(s->obj_hash);
51667 + vfree(s->obj_hash);
51668 + FOR_EACH_SUBJECT_END(s, x)
51669 + FOR_EACH_NESTED_SUBJECT_START(r, s)
51670 + if (s->obj_hash == NULL)
51672 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51673 + kfree(s->obj_hash);
51675 + vfree(s->obj_hash);
51676 + FOR_EACH_NESTED_SUBJECT_END(s)
51677 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
51678 + kfree(r->subj_hash);
51680 + vfree(r->subj_hash);
51681 + r->subj_hash = NULL;
51683 + FOR_EACH_ROLE_END(r)
51687 + if (acl_role_set.r_hash) {
51688 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
51690 + kfree(acl_role_set.r_hash);
51692 + vfree(acl_role_set.r_hash);
51694 + if (name_set.n_hash) {
51695 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
51697 + kfree(name_set.n_hash);
51699 + vfree(name_set.n_hash);
51702 + if (inodev_set.i_hash) {
51703 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
51705 + kfree(inodev_set.i_hash);
51707 + vfree(inodev_set.i_hash);
51710 + gr_free_uidset();
51712 + memset(&name_set, 0, sizeof (struct name_db));
51713 + memset(&inodev_set, 0, sizeof (struct inodev_db));
51714 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
51715 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
51717 + default_role = NULL;
51718 + role_list = NULL;
51724 +count_user_objs(struct acl_object_label *userp)
51726 + struct acl_object_label o_tmp;
51730 + if (copy_from_user(&o_tmp, userp,
51731 + sizeof (struct acl_object_label)))
51734 + userp = o_tmp.prev;
51741 +static struct acl_subject_label *
51742 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
51745 +copy_user_glob(struct acl_object_label *obj)
51747 + struct acl_object_label *g_tmp, **guser;
51748 + unsigned int len;
51751 + if (obj->globbed == NULL)
51754 + guser = &obj->globbed;
51756 + g_tmp = (struct acl_object_label *)
51757 + acl_alloc(sizeof (struct acl_object_label));
51758 + if (g_tmp == NULL)
51761 + if (copy_from_user(g_tmp, *guser,
51762 + sizeof (struct acl_object_label)))
51765 + len = strnlen_user(g_tmp->filename, PATH_MAX);
51767 + if (!len || len >= PATH_MAX)
51770 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51773 + if (copy_from_user(tmp, g_tmp->filename, len))
51775 + tmp[len-1] = '\0';
51776 + g_tmp->filename = tmp;
51779 + guser = &(g_tmp->next);
51786 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
51787 + struct acl_role_label *role)
51789 + struct acl_object_label *o_tmp;
51790 + unsigned int len;
51795 + if ((o_tmp = (struct acl_object_label *)
51796 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
51799 + if (copy_from_user(o_tmp, userp,
51800 + sizeof (struct acl_object_label)))
51803 + userp = o_tmp->prev;
51805 + len = strnlen_user(o_tmp->filename, PATH_MAX);
51807 + if (!len || len >= PATH_MAX)
51810 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51813 + if (copy_from_user(tmp, o_tmp->filename, len))
51815 + tmp[len-1] = '\0';
51816 + o_tmp->filename = tmp;
51818 + insert_acl_obj_label(o_tmp, subj);
51819 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
51820 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
51823 + ret = copy_user_glob(o_tmp);
51827 + if (o_tmp->nested) {
51828 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
51829 + if (IS_ERR(o_tmp->nested))
51830 + return PTR_ERR(o_tmp->nested);
51832 + /* insert into nested subject list */
51833 + o_tmp->nested->next = role->hash->first;
51834 + role->hash->first = o_tmp->nested;
51842 +count_user_subjs(struct acl_subject_label *userp)
51844 + struct acl_subject_label s_tmp;
51848 + if (copy_from_user(&s_tmp, userp,
51849 + sizeof (struct acl_subject_label)))
51852 + userp = s_tmp.prev;
51853 + /* do not count nested subjects against this count, since
51854 + they are not included in the hash table, but are
51855 + attached to objects. We have already counted
51856 + the subjects in userspace for the allocation
51859 + if (!(s_tmp.mode & GR_NESTED))
51867 +copy_user_allowedips(struct acl_role_label *rolep)
51869 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
51871 + ruserip = rolep->allowed_ips;
51873 + while (ruserip) {
51876 + if ((rtmp = (struct role_allowed_ip *)
51877 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
51880 + if (copy_from_user(rtmp, ruserip,
51881 + sizeof (struct role_allowed_ip)))
51884 + ruserip = rtmp->prev;
51887 + rtmp->prev = NULL;
51888 + rolep->allowed_ips = rtmp;
51890 + rlast->next = rtmp;
51891 + rtmp->prev = rlast;
51895 + rtmp->next = NULL;
51902 +copy_user_transitions(struct acl_role_label *rolep)
51904 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
51906 + unsigned int len;
51909 + rusertp = rolep->transitions;
51911 + while (rusertp) {
51914 + if ((rtmp = (struct role_transition *)
51915 + acl_alloc(sizeof (struct role_transition))) == NULL)
51918 + if (copy_from_user(rtmp, rusertp,
51919 + sizeof (struct role_transition)))
51922 + rusertp = rtmp->prev;
51924 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
51926 + if (!len || len >= GR_SPROLE_LEN)
51929 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51932 + if (copy_from_user(tmp, rtmp->rolename, len))
51934 + tmp[len-1] = '\0';
51935 + rtmp->rolename = tmp;
51938 + rtmp->prev = NULL;
51939 + rolep->transitions = rtmp;
51941 + rlast->next = rtmp;
51942 + rtmp->prev = rlast;
51946 + rtmp->next = NULL;
51952 +static struct acl_subject_label *
51953 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
51955 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
51956 + unsigned int len;
51959 + struct acl_ip_label **i_tmp, *i_utmp2;
51960 + struct gr_hash_struct ghash;
51961 + struct subject_map *subjmap;
51962 + unsigned int i_num;
51965 + s_tmp = lookup_subject_map(userp);
51967 + /* we've already copied this subject into the kernel, just return
51968 + the reference to it, and don't copy it over again
51973 + if ((s_tmp = (struct acl_subject_label *)
51974 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
51975 + return ERR_PTR(-ENOMEM);
51977 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
51978 + if (subjmap == NULL)
51979 + return ERR_PTR(-ENOMEM);
51981 + subjmap->user = userp;
51982 + subjmap->kernel = s_tmp;
51983 + insert_subj_map_entry(subjmap);
51985 + if (copy_from_user(s_tmp, userp,
51986 + sizeof (struct acl_subject_label)))
51987 + return ERR_PTR(-EFAULT);
51989 + len = strnlen_user(s_tmp->filename, PATH_MAX);
51991 + if (!len || len >= PATH_MAX)
51992 + return ERR_PTR(-EINVAL);
51994 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51995 + return ERR_PTR(-ENOMEM);
51997 + if (copy_from_user(tmp, s_tmp->filename, len))
51998 + return ERR_PTR(-EFAULT);
51999 + tmp[len-1] = '\0';
52000 + s_tmp->filename = tmp;
52002 + if (!strcmp(s_tmp->filename, "/"))
52003 + role->root_label = s_tmp;
52005 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52006 + return ERR_PTR(-EFAULT);
52008 + /* copy user and group transition tables */
52010 + if (s_tmp->user_trans_num) {
52013 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52014 + if (uidlist == NULL)
52015 + return ERR_PTR(-ENOMEM);
52016 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52017 + return ERR_PTR(-EFAULT);
52019 + s_tmp->user_transitions = uidlist;
52022 + if (s_tmp->group_trans_num) {
52025 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52026 + if (gidlist == NULL)
52027 + return ERR_PTR(-ENOMEM);
52028 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52029 + return ERR_PTR(-EFAULT);
52031 + s_tmp->group_transitions = gidlist;
52034 + /* set up object hash table */
52035 + num_objs = count_user_objs(ghash.first);
52037 + s_tmp->obj_hash_size = num_objs;
52038 + s_tmp->obj_hash =
52039 + (struct acl_object_label **)
52040 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52042 + if (!s_tmp->obj_hash)
52043 + return ERR_PTR(-ENOMEM);
52045 + memset(s_tmp->obj_hash, 0,
52046 + s_tmp->obj_hash_size *
52047 + sizeof (struct acl_object_label *));
52049 + /* add in objects */
52050 + err = copy_user_objs(ghash.first, s_tmp, role);
52053 + return ERR_PTR(err);
52055 + /* set pointer for parent subject */
52056 + if (s_tmp->parent_subject) {
52057 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52059 + if (IS_ERR(s_tmp2))
52062 + s_tmp->parent_subject = s_tmp2;
52065 + /* add in ip acls */
52067 + if (!s_tmp->ip_num) {
52068 + s_tmp->ips = NULL;
52073 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52074 + sizeof (struct acl_ip_label *));
52077 + return ERR_PTR(-ENOMEM);
52079 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52080 + *(i_tmp + i_num) =
52081 + (struct acl_ip_label *)
52082 + acl_alloc(sizeof (struct acl_ip_label));
52083 + if (!*(i_tmp + i_num))
52084 + return ERR_PTR(-ENOMEM);
52086 + if (copy_from_user
52087 + (&i_utmp2, s_tmp->ips + i_num,
52088 + sizeof (struct acl_ip_label *)))
52089 + return ERR_PTR(-EFAULT);
52091 + if (copy_from_user
52092 + (*(i_tmp + i_num), i_utmp2,
52093 + sizeof (struct acl_ip_label)))
52094 + return ERR_PTR(-EFAULT);
52096 + if ((*(i_tmp + i_num))->iface == NULL)
52099 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52100 + if (!len || len >= IFNAMSIZ)
52101 + return ERR_PTR(-EINVAL);
52102 + tmp = acl_alloc(len);
52104 + return ERR_PTR(-ENOMEM);
52105 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52106 + return ERR_PTR(-EFAULT);
52107 + (*(i_tmp + i_num))->iface = tmp;
52110 + s_tmp->ips = i_tmp;
52113 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52114 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52115 + return ERR_PTR(-ENOMEM);
52121 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52123 + struct acl_subject_label s_pre;
52124 + struct acl_subject_label * ret;
52128 + if (copy_from_user(&s_pre, userp,
52129 + sizeof (struct acl_subject_label)))
52132 + /* do not add nested subjects here, add
52133 + while parsing objects
52136 + if (s_pre.mode & GR_NESTED) {
52137 + userp = s_pre.prev;
52141 + ret = do_copy_user_subj(userp, role);
52143 + err = PTR_ERR(ret);
52147 + insert_acl_subj_label(ret, role);
52149 + userp = s_pre.prev;
52156 +copy_user_acl(struct gr_arg *arg)
52158 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52159 + struct sprole_pw *sptmp;
52160 + struct gr_hash_struct *ghash;
52161 + uid_t *domainlist;
52162 + unsigned int r_num;
52163 + unsigned int len;
52169 + /* we need a default and kernel role */
52170 + if (arg->role_db.num_roles < 2)
52173 + /* copy special role authentication info from userspace */
52175 + num_sprole_pws = arg->num_sprole_pws;
52176 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52178 + if (!acl_special_roles) {
52183 + for (i = 0; i < num_sprole_pws; i++) {
52184 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52189 + if (copy_from_user(sptmp, arg->sprole_pws + i,
52190 + sizeof (struct sprole_pw))) {
52196 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52198 + if (!len || len >= GR_SPROLE_LEN) {
52203 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52208 + if (copy_from_user(tmp, sptmp->rolename, len)) {
52212 + tmp[len-1] = '\0';
52213 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52214 + printk(KERN_ALERT "Copying special role %s\n", tmp);
52216 + sptmp->rolename = tmp;
52217 + acl_special_roles[i] = sptmp;
52220 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52222 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52223 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
52230 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
52231 + sizeof (struct acl_role_label *))) {
52236 + if (copy_from_user(r_tmp, r_utmp2,
52237 + sizeof (struct acl_role_label))) {
52242 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52244 + if (!len || len >= PATH_MAX) {
52249 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52253 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
52257 + tmp[len-1] = '\0';
52258 + r_tmp->rolename = tmp;
52260 + if (!strcmp(r_tmp->rolename, "default")
52261 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52262 + default_role = r_tmp;
52263 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52264 + kernel_role = r_tmp;
52267 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52271 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52276 + r_tmp->hash = ghash;
52278 + num_subjs = count_user_subjs(r_tmp->hash->first);
52280 + r_tmp->subj_hash_size = num_subjs;
52281 + r_tmp->subj_hash =
52282 + (struct acl_subject_label **)
52283 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52285 + if (!r_tmp->subj_hash) {
52290 + err = copy_user_allowedips(r_tmp);
52294 + /* copy domain info */
52295 + if (r_tmp->domain_children != NULL) {
52296 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52297 + if (domainlist == NULL) {
52301 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52305 + r_tmp->domain_children = domainlist;
52308 + err = copy_user_transitions(r_tmp);
52312 + memset(r_tmp->subj_hash, 0,
52313 + r_tmp->subj_hash_size *
52314 + sizeof (struct acl_subject_label *));
52316 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52321 + /* set nested subject list to null */
52322 + r_tmp->hash->first = NULL;
52324 + insert_acl_role_label(r_tmp);
52329 + free_variables();
52336 +gracl_init(struct gr_arg *args)
52340 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52341 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52343 + if (init_variables(args)) {
52344 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52346 + free_variables();
52350 + error = copy_user_acl(args);
52351 + free_init_variables();
52353 + free_variables();
52357 + if ((error = gr_set_acls(0))) {
52358 + free_variables();
52362 + pax_open_kernel();
52363 + gr_status |= GR_READY;
52364 + pax_close_kernel();
52370 +/* derived from glibc fnmatch() 0: match, 1: no match*/
52373 +glob_match(const char *p, const char *n)
52377 + while ((c = *p++) != '\0') {
52382 + else if (*n == '/')
52390 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
52393 + else if (c == '?') {
52403 + const char *endp;
52405 + if ((endp = strchr(n, '/')) == NULL)
52406 + endp = n + strlen(n);
52409 + for (--p; n < endp; ++n)
52410 + if (!glob_match(p, n))
52412 + } else if (c == '/') {
52413 + while (*n != '\0' && *n != '/')
52415 + if (*n == '/' && !glob_match(p, n + 1))
52418 + for (--p; n < endp; ++n)
52419 + if (*n == c && !glob_match(p, n))
52430 + if (*n == '\0' || *n == '/')
52433 + not = (*p == '!' || *p == '^');
52439 + unsigned char fn = (unsigned char)*n;
52449 + if (c == '-' && *p != ']') {
52450 + unsigned char cend = *p++;
52452 + if (cend == '\0')
52455 + if (cold <= fn && fn <= cend)
52469 + while (c != ']') {
52496 +static struct acl_object_label *
52497 +chk_glob_label(struct acl_object_label *globbed,
52498 + struct dentry *dentry, struct vfsmount *mnt, char **path)
52500 + struct acl_object_label *tmp;
52502 + if (*path == NULL)
52503 + *path = gr_to_filename_nolock(dentry, mnt);
52508 + if (!glob_match(tmp->filename, *path))
52516 +static struct acl_object_label *
52517 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52518 + const ino_t curr_ino, const dev_t curr_dev,
52519 + const struct acl_subject_label *subj, char **path, const int checkglob)
52521 + struct acl_subject_label *tmpsubj;
52522 + struct acl_object_label *retval;
52523 + struct acl_object_label *retval2;
52525 + tmpsubj = (struct acl_subject_label *) subj;
52526 + read_lock(&gr_inode_lock);
52528 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
52530 + if (checkglob && retval->globbed) {
52531 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
52532 + (struct vfsmount *)orig_mnt, path);
52534 + retval = retval2;
52538 + } while ((tmpsubj = tmpsubj->parent_subject));
52539 + read_unlock(&gr_inode_lock);
52544 +static __inline__ struct acl_object_label *
52545 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52546 + struct dentry *curr_dentry,
52547 + const struct acl_subject_label *subj, char **path, const int checkglob)
52549 + int newglob = checkglob;
52553 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
52554 + as we don't want a / * rule to match instead of the / object
52555 + don't do this for create lookups that call this function though, since they're looking up
52556 + on the parent and thus need globbing checks on all paths
52558 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
52559 + newglob = GR_NO_GLOB;
52561 + spin_lock(&curr_dentry->d_lock);
52562 + inode = curr_dentry->d_inode->i_ino;
52563 + device = __get_dev(curr_dentry);
52564 + spin_unlock(&curr_dentry->d_lock);
52566 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
52569 +static struct acl_object_label *
52570 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52571 + const struct acl_subject_label *subj, char *path, const int checkglob)
52573 + struct dentry *dentry = (struct dentry *) l_dentry;
52574 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52575 + struct acl_object_label *retval;
52576 + struct dentry *parent;
52578 + write_seqlock(&rename_lock);
52579 + br_read_lock(vfsmount_lock);
52581 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
52583 + mnt == sock_mnt ||
52585 +#ifdef CONFIG_HUGETLBFS
52586 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
52588 + /* ignore Eric Biederman */
52589 + IS_PRIVATE(l_dentry->d_inode))) {
52590 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
52595 + if (dentry == real_root.dentry && mnt == real_root.mnt)
52598 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52599 + if (mnt->mnt_parent == mnt)
52602 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52603 + if (retval != NULL)
52606 + dentry = mnt->mnt_mountpoint;
52607 + mnt = mnt->mnt_parent;
52611 + parent = dentry->d_parent;
52612 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52613 + if (retval != NULL)
52619 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52621 + /* real_root is pinned so we don't have to hold a reference */
52622 + if (retval == NULL)
52623 + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
52625 + br_read_unlock(vfsmount_lock);
52626 + write_sequnlock(&rename_lock);
52628 + BUG_ON(retval == NULL);
52633 +static __inline__ struct acl_object_label *
52634 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52635 + const struct acl_subject_label *subj)
52637 + char *path = NULL;
52638 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
52641 +static __inline__ struct acl_object_label *
52642 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52643 + const struct acl_subject_label *subj)
52645 + char *path = NULL;
52646 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
52649 +static __inline__ struct acl_object_label *
52650 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52651 + const struct acl_subject_label *subj, char *path)
52653 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
52656 +static struct acl_subject_label *
52657 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52658 + const struct acl_role_label *role)
52660 + struct dentry *dentry = (struct dentry *) l_dentry;
52661 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52662 + struct acl_subject_label *retval;
52663 + struct dentry *parent;
52665 + write_seqlock(&rename_lock);
52666 + br_read_lock(vfsmount_lock);
52669 + if (dentry == real_root.dentry && mnt == real_root.mnt)
52671 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52672 + if (mnt->mnt_parent == mnt)
52675 + spin_lock(&dentry->d_lock);
52676 + read_lock(&gr_inode_lock);
52678 + lookup_acl_subj_label(dentry->d_inode->i_ino,
52679 + __get_dev(dentry), role);
52680 + read_unlock(&gr_inode_lock);
52681 + spin_unlock(&dentry->d_lock);
52682 + if (retval != NULL)
52685 + dentry = mnt->mnt_mountpoint;
52686 + mnt = mnt->mnt_parent;
52690 + spin_lock(&dentry->d_lock);
52691 + read_lock(&gr_inode_lock);
52692 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52693 + __get_dev(dentry), role);
52694 + read_unlock(&gr_inode_lock);
52695 + parent = dentry->d_parent;
52696 + spin_unlock(&dentry->d_lock);
52698 + if (retval != NULL)
52704 + spin_lock(&dentry->d_lock);
52705 + read_lock(&gr_inode_lock);
52706 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52707 + __get_dev(dentry), role);
52708 + read_unlock(&gr_inode_lock);
52709 + spin_unlock(&dentry->d_lock);
52711 + if (unlikely(retval == NULL)) {
52712 + /* real_root is pinned, we don't need to hold a reference */
52713 + read_lock(&gr_inode_lock);
52714 + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
52715 + __get_dev(real_root.dentry), role);
52716 + read_unlock(&gr_inode_lock);
52719 + br_read_unlock(vfsmount_lock);
52720 + write_sequnlock(&rename_lock);
52722 + BUG_ON(retval == NULL);
52728 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
52730 + struct task_struct *task = current;
52731 + const struct cred *cred = current_cred();
52733 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52734 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52735 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52736 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
52742 +gr_log_learn_sysctl(const char *path, const __u32 mode)
52744 + struct task_struct *task = current;
52745 + const struct cred *cred = current_cred();
52747 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52748 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52749 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52750 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
52756 +gr_log_learn_id_change(const char type, const unsigned int real,
52757 + const unsigned int effective, const unsigned int fs)
52759 + struct task_struct *task = current;
52760 + const struct cred *cred = current_cred();
52762 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
52763 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52764 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52765 + type, real, effective, fs, &task->signal->saved_ip);
52771 +gr_search_file(const struct dentry * dentry, const __u32 mode,
52772 + const struct vfsmount * mnt)
52774 + __u32 retval = mode;
52775 + struct acl_subject_label *curracl;
52776 + struct acl_object_label *currobj;
52778 + if (unlikely(!(gr_status & GR_READY)))
52779 + return (mode & ~GR_AUDITS);
52781 + curracl = current->acl;
52783 + currobj = chk_obj_label(dentry, mnt, curracl);
52784 + retval = currobj->mode & mode;
52786 + /* if we're opening a specified transfer file for writing
52787 + (e.g. /dev/initctl), then transfer our role to init
52789 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
52790 + current->role->roletype & GR_ROLE_PERSIST)) {
52791 + struct task_struct *task = init_pid_ns.child_reaper;
52793 + if (task->role != current->role) {
52794 + task->acl_sp_role = 0;
52795 + task->acl_role_id = current->acl_role_id;
52796 + task->role = current->role;
52798 + read_lock(&grsec_exec_file_lock);
52799 + gr_apply_subject_to_task(task);
52800 + read_unlock(&grsec_exec_file_lock);
52801 + rcu_read_unlock();
52802 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
52807 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
52808 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
52809 + __u32 new_mode = mode;
52811 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52813 + retval = new_mode;
52815 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
52816 + new_mode |= GR_INHERIT;
52818 + if (!(mode & GR_NOLEARN))
52819 + gr_log_learn(dentry, mnt, new_mode);
52825 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
52826 + const struct dentry *parent,
52827 + const struct vfsmount *mnt)
52829 + struct name_entry *match;
52830 + struct acl_object_label *matchpo;
52831 + struct acl_subject_label *curracl;
52834 + if (unlikely(!(gr_status & GR_READY)))
52837 + preempt_disable();
52838 + path = gr_to_filename_rbac(new_dentry, mnt);
52839 + match = lookup_name_entry_create(path);
52841 + curracl = current->acl;
52844 + read_lock(&gr_inode_lock);
52845 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
52846 + read_unlock(&gr_inode_lock);
52849 + preempt_enable();
52856 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
52858 + preempt_enable();
52863 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
52864 + const struct vfsmount * mnt, const __u32 mode)
52866 + struct acl_object_label *matchpo;
52869 + if (unlikely(!(gr_status & GR_READY)))
52870 + return (mode & ~GR_AUDITS);
52872 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
52874 + retval = matchpo->mode & mode;
52876 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
52877 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
52878 + __u32 new_mode = mode;
52880 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52882 + gr_log_learn(new_dentry, mnt, new_mode);
52890 +gr_check_link(const struct dentry * new_dentry,
52891 + const struct dentry * parent_dentry,
52892 + const struct vfsmount * parent_mnt,
52893 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
52895 + struct acl_object_label *obj;
52896 + __u32 oldmode, newmode;
52898 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
52899 + GR_DELETE | GR_INHERIT;
52901 + if (unlikely(!(gr_status & GR_READY)))
52902 + return (GR_CREATE | GR_LINK);
52904 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
52905 + oldmode = obj->mode;
52907 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
52908 + newmode = obj->mode;
52910 + needmode = newmode & checkmodes;
52912 + // old name for hardlink must have at least the permissions of the new name
52913 + if ((oldmode & needmode) != needmode)
52916 + // if old name had restrictions/auditing, make sure the new name does as well
52917 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
52919 + // don't allow hardlinking of suid/sgid files without permission
52920 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52921 + needmode |= GR_SETID;
52923 + if ((newmode & needmode) != needmode)
52926 + // enforce minimum permissions
52927 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
52930 + needmode = oldmode;
52931 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52932 + needmode |= GR_SETID;
52934 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
52935 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
52936 + return (GR_CREATE | GR_LINK);
52937 + } else if (newmode & GR_SUPPRESS)
52938 + return GR_SUPPRESS;
52944 +gr_check_hidden_task(const struct task_struct *task)
52946 + if (unlikely(!(gr_status & GR_READY)))
52949 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
52956 +gr_check_protected_task(const struct task_struct *task)
52958 + if (unlikely(!(gr_status & GR_READY) || !task))
52961 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52962 + task->acl != current->acl)
52969 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
52971 + struct task_struct *p;
52974 + if (unlikely(!(gr_status & GR_READY) || !pid))
52977 + read_lock(&tasklist_lock);
52978 + do_each_pid_task(pid, type, p) {
52979 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52980 + p->acl != current->acl) {
52984 + } while_each_pid_task(pid, type, p);
52986 + read_unlock(&tasklist_lock);
52992 +gr_copy_label(struct task_struct *tsk)
52994 + tsk->signal->used_accept = 0;
52995 + tsk->acl_sp_role = 0;
52996 + tsk->acl_role_id = current->acl_role_id;
52997 + tsk->acl = current->acl;
52998 + tsk->role = current->role;
52999 + tsk->signal->curr_ip = current->signal->curr_ip;
53000 + tsk->signal->saved_ip = current->signal->saved_ip;
53001 + if (current->exec_file)
53002 + get_file(current->exec_file);
53003 + tsk->exec_file = current->exec_file;
53004 + tsk->is_writable = current->is_writable;
53005 + if (unlikely(current->signal->used_accept)) {
53006 + current->signal->curr_ip = 0;
53007 + current->signal->saved_ip = 0;
53014 +gr_set_proc_res(struct task_struct *task)
53016 + struct acl_subject_label *proc;
53017 + unsigned short i;
53019 + proc = task->acl;
53021 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53024 + for (i = 0; i < RLIM_NLIMITS; i++) {
53025 + if (!(proc->resmask & (1 << i)))
53028 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53029 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53035 +extern int __gr_process_user_ban(struct user_struct *user);
53038 +gr_check_user_change(int real, int effective, int fs)
53045 + int effectiveok = 0;
53048 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53049 + struct user_struct *user;
53054 + user = find_user(real);
53055 + if (user == NULL)
53058 + if (__gr_process_user_ban(user)) {
53059 + /* for find_user */
53064 + /* for find_user */
53070 + if (unlikely(!(gr_status & GR_READY)))
53073 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53074 + gr_log_learn_id_change('u', real, effective, fs);
53076 + num = current->acl->user_trans_num;
53077 + uidlist = current->acl->user_transitions;
53079 + if (uidlist == NULL)
53084 + if (effective == -1)
53089 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
53090 + for (i = 0; i < num; i++) {
53091 + curuid = (int)uidlist[i];
53092 + if (real == curuid)
53094 + if (effective == curuid)
53096 + if (fs == curuid)
53099 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
53100 + for (i = 0; i < num; i++) {
53101 + curuid = (int)uidlist[i];
53102 + if (real == curuid)
53104 + if (effective == curuid)
53106 + if (fs == curuid)
53109 + /* not in deny list */
53117 + if (realok && effectiveok && fsok)
53120 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53126 +gr_check_group_change(int real, int effective, int fs)
53133 + int effectiveok = 0;
53136 + if (unlikely(!(gr_status & GR_READY)))
53139 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53140 + gr_log_learn_id_change('g', real, effective, fs);
53142 + num = current->acl->group_trans_num;
53143 + gidlist = current->acl->group_transitions;
53145 + if (gidlist == NULL)
53150 + if (effective == -1)
53155 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
53156 + for (i = 0; i < num; i++) {
53157 + curgid = (int)gidlist[i];
53158 + if (real == curgid)
53160 + if (effective == curgid)
53162 + if (fs == curgid)
53165 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
53166 + for (i = 0; i < num; i++) {
53167 + curgid = (int)gidlist[i];
53168 + if (real == curgid)
53170 + if (effective == curgid)
53172 + if (fs == curgid)
53175 + /* not in deny list */
53183 + if (realok && effectiveok && fsok)
53186 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53192 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53194 + struct acl_role_label *role = task->role;
53195 + struct acl_subject_label *subj = NULL;
53196 + struct acl_object_label *obj;
53197 + struct file *filp;
53199 + if (unlikely(!(gr_status & GR_READY)))
53202 + filp = task->exec_file;
53204 + /* kernel process, we'll give them the kernel role */
53205 + if (unlikely(!filp)) {
53206 + task->role = kernel_role;
53207 + task->acl = kernel_role->root_label;
53209 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53210 + role = lookup_acl_role_label(task, uid, gid);
53212 + /* perform subject lookup in possibly new role
53213 + we can use this result below in the case where role == task->role
53215 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53217 + /* if we changed uid/gid, but result in the same role
53218 + and are using inheritance, don't lose the inherited subject
53219 + if current subject is other than what normal lookup
53220 + would result in, we arrived via inheritance, don't
53223 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53224 + (subj == task->acl)))
53225 + task->acl = subj;
53227 + task->role = role;
53229 + task->is_writable = 0;
53231 + /* ignore additional mmap checks for processes that are writable
53232 + by the default ACL */
53233 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53234 + if (unlikely(obj->mode & GR_WRITE))
53235 + task->is_writable = 1;
53236 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53237 + if (unlikely(obj->mode & GR_WRITE))
53238 + task->is_writable = 1;
53240 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53241 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53244 + gr_set_proc_res(task);
53250 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53251 + const int unsafe_share)
53253 + struct task_struct *task = current;
53254 + struct acl_subject_label *newacl;
53255 + struct acl_object_label *obj;
53258 + if (unlikely(!(gr_status & GR_READY)))
53261 + newacl = chk_subj_label(dentry, mnt, task->role);
53264 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53265 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53266 + !(task->role->roletype & GR_ROLE_GOD) &&
53267 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53268 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53269 + task_unlock(task);
53270 + if (unsafe_share)
53271 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53273 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53276 + task_unlock(task);
53278 + obj = chk_obj_label(dentry, mnt, task->acl);
53279 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53281 + if (!(task->acl->mode & GR_INHERITLEARN) &&
53282 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53284 + task->acl = obj->nested;
53286 + task->acl = newacl;
53287 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53288 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53290 + task->is_writable = 0;
53292 + /* ignore additional mmap checks for processes that are writable
53293 + by the default ACL */
53294 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
53295 + if (unlikely(obj->mode & GR_WRITE))
53296 + task->is_writable = 1;
53297 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
53298 + if (unlikely(obj->mode & GR_WRITE))
53299 + task->is_writable = 1;
53301 + gr_set_proc_res(task);
53303 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53304 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53309 +/* always called with valid inodev ptr */
53311 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53313 + struct acl_object_label *matchpo;
53314 + struct acl_subject_label *matchps;
53315 + struct acl_subject_label *subj;
53316 + struct acl_role_label *role;
53319 + FOR_EACH_ROLE_START(role)
53320 + FOR_EACH_SUBJECT_START(role, subj, x)
53321 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53322 + matchpo->mode |= GR_DELETED;
53323 + FOR_EACH_SUBJECT_END(subj,x)
53324 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
53325 + if (subj->inode == ino && subj->device == dev)
53326 + subj->mode |= GR_DELETED;
53327 + FOR_EACH_NESTED_SUBJECT_END(subj)
53328 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53329 + matchps->mode |= GR_DELETED;
53330 + FOR_EACH_ROLE_END(role)
53332 + inodev->nentry->deleted = 1;
53338 +gr_handle_delete(const ino_t ino, const dev_t dev)
53340 + struct inodev_entry *inodev;
53342 + if (unlikely(!(gr_status & GR_READY)))
53345 + write_lock(&gr_inode_lock);
53346 + inodev = lookup_inodev_entry(ino, dev);
53347 + if (inodev != NULL)
53348 + do_handle_delete(inodev, ino, dev);
53349 + write_unlock(&gr_inode_lock);
53355 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53356 + const ino_t newinode, const dev_t newdevice,
53357 + struct acl_subject_label *subj)
53359 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53360 + struct acl_object_label *match;
53362 + match = subj->obj_hash[index];
53364 + while (match && (match->inode != oldinode ||
53365 + match->device != olddevice ||
53366 + !(match->mode & GR_DELETED)))
53367 + match = match->next;
53369 + if (match && (match->inode == oldinode)
53370 + && (match->device == olddevice)
53371 + && (match->mode & GR_DELETED)) {
53372 + if (match->prev == NULL) {
53373 + subj->obj_hash[index] = match->next;
53374 + if (match->next != NULL)
53375 + match->next->prev = NULL;
53377 + match->prev->next = match->next;
53378 + if (match->next != NULL)
53379 + match->next->prev = match->prev;
53381 + match->prev = NULL;
53382 + match->next = NULL;
53383 + match->inode = newinode;
53384 + match->device = newdevice;
53385 + match->mode &= ~GR_DELETED;
53387 + insert_acl_obj_label(match, subj);
53394 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53395 + const ino_t newinode, const dev_t newdevice,
53396 + struct acl_role_label *role)
53398 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53399 + struct acl_subject_label *match;
53401 + match = role->subj_hash[index];
53403 + while (match && (match->inode != oldinode ||
53404 + match->device != olddevice ||
53405 + !(match->mode & GR_DELETED)))
53406 + match = match->next;
53408 + if (match && (match->inode == oldinode)
53409 + && (match->device == olddevice)
53410 + && (match->mode & GR_DELETED)) {
53411 + if (match->prev == NULL) {
53412 + role->subj_hash[index] = match->next;
53413 + if (match->next != NULL)
53414 + match->next->prev = NULL;
53416 + match->prev->next = match->next;
53417 + if (match->next != NULL)
53418 + match->next->prev = match->prev;
53420 + match->prev = NULL;
53421 + match->next = NULL;
53422 + match->inode = newinode;
53423 + match->device = newdevice;
53424 + match->mode &= ~GR_DELETED;
53426 + insert_acl_subj_label(match, role);
53433 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53434 + const ino_t newinode, const dev_t newdevice)
53436 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53437 + struct inodev_entry *match;
53439 + match = inodev_set.i_hash[index];
53441 + while (match && (match->nentry->inode != oldinode ||
53442 + match->nentry->device != olddevice || !match->nentry->deleted))
53443 + match = match->next;
53445 + if (match && (match->nentry->inode == oldinode)
53446 + && (match->nentry->device == olddevice) &&
53447 + match->nentry->deleted) {
53448 + if (match->prev == NULL) {
53449 + inodev_set.i_hash[index] = match->next;
53450 + if (match->next != NULL)
53451 + match->next->prev = NULL;
53453 + match->prev->next = match->next;
53454 + if (match->next != NULL)
53455 + match->next->prev = match->prev;
53457 + match->prev = NULL;
53458 + match->next = NULL;
53459 + match->nentry->inode = newinode;
53460 + match->nentry->device = newdevice;
53461 + match->nentry->deleted = 0;
53463 + insert_inodev_entry(match);
53470 +__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
53472 + struct acl_subject_label *subj;
53473 + struct acl_role_label *role;
53476 + FOR_EACH_ROLE_START(role)
53477 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
53479 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
53480 + if ((subj->inode == ino) && (subj->device == dev)) {
53481 + subj->inode = ino;
53482 + subj->device = dev;
53484 + FOR_EACH_NESTED_SUBJECT_END(subj)
53485 + FOR_EACH_SUBJECT_START(role, subj, x)
53486 + update_acl_obj_label(matchn->inode, matchn->device,
53488 + FOR_EACH_SUBJECT_END(subj,x)
53489 + FOR_EACH_ROLE_END(role)
53491 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
53497 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
53498 + const struct vfsmount *mnt)
53500 + ino_t ino = dentry->d_inode->i_ino;
53501 + dev_t dev = __get_dev(dentry);
53503 + __do_handle_create(matchn, ino, dev);
53509 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53511 + struct name_entry *matchn;
53513 + if (unlikely(!(gr_status & GR_READY)))
53516 + preempt_disable();
53517 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
53519 + if (unlikely((unsigned long)matchn)) {
53520 + write_lock(&gr_inode_lock);
53521 + do_handle_create(matchn, dentry, mnt);
53522 + write_unlock(&gr_inode_lock);
53524 + preempt_enable();
53530 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53532 + struct name_entry *matchn;
53534 + if (unlikely(!(gr_status & GR_READY)))
53537 + preempt_disable();
53538 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
53540 + if (unlikely((unsigned long)matchn)) {
53541 + write_lock(&gr_inode_lock);
53542 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
53543 + write_unlock(&gr_inode_lock);
53545 + preempt_enable();
53551 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53552 + struct dentry *old_dentry,
53553 + struct dentry *new_dentry,
53554 + struct vfsmount *mnt, const __u8 replace)
53556 + struct name_entry *matchn;
53557 + struct inodev_entry *inodev;
53558 + struct inode *inode = new_dentry->d_inode;
53559 + ino_t old_ino = old_dentry->d_inode->i_ino;
53560 + dev_t old_dev = __get_dev(old_dentry);
53562 + /* vfs_rename swaps the name and parent link for old_dentry and
53564 + at this point, old_dentry has the new name, parent link, and inode
53565 + for the renamed file
53566 + if a file is being replaced by a rename, new_dentry has the inode
53567 + and name for the replaced file
53570 + if (unlikely(!(gr_status & GR_READY)))
53573 + preempt_disable();
53574 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
53576 + /* we wouldn't have to check d_inode if it weren't for
53577 + NFS silly-renaming
53580 + write_lock(&gr_inode_lock);
53581 + if (unlikely(replace && inode)) {
53582 + ino_t new_ino = inode->i_ino;
53583 + dev_t new_dev = __get_dev(new_dentry);
53585 + inodev = lookup_inodev_entry(new_ino, new_dev);
53586 + if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
53587 + do_handle_delete(inodev, new_ino, new_dev);
53590 + inodev = lookup_inodev_entry(old_ino, old_dev);
53591 + if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
53592 + do_handle_delete(inodev, old_ino, old_dev);
53594 + if (unlikely((unsigned long)matchn))
53595 + do_handle_create(matchn, old_dentry, mnt);
53597 + write_unlock(&gr_inode_lock);
53598 + preempt_enable();
53604 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
53605 + unsigned char **sum)
53607 + struct acl_role_label *r;
53608 + struct role_allowed_ip *ipp;
53609 + struct role_transition *trans;
53612 + u32 curr_ip = current->signal->curr_ip;
53614 + current->signal->saved_ip = curr_ip;
53616 + /* check transition table */
53618 + for (trans = current->role->transitions; trans; trans = trans->next) {
53619 + if (!strcmp(rolename, trans->rolename)) {
53628 + /* handle special roles that do not require authentication
53631 + FOR_EACH_ROLE_START(r)
53632 + if (!strcmp(rolename, r->rolename) &&
53633 + (r->roletype & GR_ROLE_SPECIAL)) {
53635 + if (r->allowed_ips != NULL) {
53636 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
53637 + if ((ntohl(curr_ip) & ipp->netmask) ==
53638 + (ntohl(ipp->addr) & ipp->netmask))
53646 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
53647 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
53653 + FOR_EACH_ROLE_END(r)
53655 + for (i = 0; i < num_sprole_pws; i++) {
53656 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
53657 + *salt = acl_special_roles[i]->salt;
53658 + *sum = acl_special_roles[i]->sum;
53667 +assign_special_role(char *rolename)
53669 + struct acl_object_label *obj;
53670 + struct acl_role_label *r;
53671 + struct acl_role_label *assigned = NULL;
53672 + struct task_struct *tsk;
53673 + struct file *filp;
53675 + FOR_EACH_ROLE_START(r)
53676 + if (!strcmp(rolename, r->rolename) &&
53677 + (r->roletype & GR_ROLE_SPECIAL)) {
53681 + FOR_EACH_ROLE_END(r)
53686 + read_lock(&tasklist_lock);
53687 + read_lock(&grsec_exec_file_lock);
53689 + tsk = current->real_parent;
53693 + filp = tsk->exec_file;
53694 + if (filp == NULL)
53697 + tsk->is_writable = 0;
53699 + tsk->acl_sp_role = 1;
53700 + tsk->acl_role_id = ++acl_sp_role_value;
53701 + tsk->role = assigned;
53702 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
53704 + /* ignore additional mmap checks for processes that are writable
53705 + by the default ACL */
53706 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53707 + if (unlikely(obj->mode & GR_WRITE))
53708 + tsk->is_writable = 1;
53709 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
53710 + if (unlikely(obj->mode & GR_WRITE))
53711 + tsk->is_writable = 1;
53713 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53714 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
53718 + read_unlock(&grsec_exec_file_lock);
53719 + read_unlock(&tasklist_lock);
53723 +int gr_check_secure_terminal(struct task_struct *task)
53725 + struct task_struct *p, *p2, *p3;
53726 + struct files_struct *files;
53727 + struct fdtable *fdt;
53728 + struct file *our_file = NULL, *file;
53731 + if (task->signal->tty == NULL)
53734 + files = get_files_struct(task);
53735 + if (files != NULL) {
53737 + fdt = files_fdtable(files);
53738 + for (i=0; i < fdt->max_fds; i++) {
53739 + file = fcheck_files(files, i);
53740 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
53745 + rcu_read_unlock();
53746 + put_files_struct(files);
53749 + if (our_file == NULL)
53752 + read_lock(&tasklist_lock);
53753 + do_each_thread(p2, p) {
53754 + files = get_files_struct(p);
53755 + if (files == NULL ||
53756 + (p->signal && p->signal->tty == task->signal->tty)) {
53757 + if (files != NULL)
53758 + put_files_struct(files);
53762 + fdt = files_fdtable(files);
53763 + for (i=0; i < fdt->max_fds; i++) {
53764 + file = fcheck_files(files, i);
53765 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
53766 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
53768 + while (p3->pid > 0) {
53771 + p3 = p3->real_parent;
53775 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
53776 + gr_handle_alertkill(p);
53777 + rcu_read_unlock();
53778 + put_files_struct(files);
53779 + read_unlock(&tasklist_lock);
53784 + rcu_read_unlock();
53785 + put_files_struct(files);
53786 + } while_each_thread(p2, p);
53787 + read_unlock(&tasklist_lock);
53794 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
53796 + struct gr_arg_wrapper uwrap;
53797 + unsigned char *sprole_salt = NULL;
53798 + unsigned char *sprole_sum = NULL;
53799 + int error = sizeof (struct gr_arg_wrapper);
53802 + mutex_lock(&gr_dev_mutex);
53804 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
53809 + if (count != sizeof (struct gr_arg_wrapper)) {
53810 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
53816 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
53817 + gr_auth_expires = 0;
53818 + gr_auth_attempts = 0;
53821 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
53826 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
53831 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
53836 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53837 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53838 + time_after(gr_auth_expires, get_seconds())) {
53843 + /* if non-root trying to do anything other than use a special role,
53844 + do not attempt authentication, do not count towards authentication
53848 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
53849 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53855 + /* ensure pw and special role name are null terminated */
53857 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
53858 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
53861 + * We have our enough of the argument structure..(we have yet
53862 + * to copy_from_user the tables themselves) . Copy the tables
53863 + * only if we need them, i.e. for loading operations. */
53865 + switch (gr_usermode->mode) {
53867 + if (gr_status & GR_READY) {
53869 + if (!gr_check_secure_terminal(current))
53874 + case GR_SHUTDOWN:
53875 + if ((gr_status & GR_READY)
53876 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53877 + pax_open_kernel();
53878 + gr_status &= ~GR_READY;
53879 + pax_close_kernel();
53881 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
53882 + free_variables();
53883 + memset(gr_usermode, 0, sizeof (struct gr_arg));
53884 + memset(gr_system_salt, 0, GR_SALT_LEN);
53885 + memset(gr_system_sum, 0, GR_SHA_LEN);
53886 + } else if (gr_status & GR_READY) {
53887 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
53890 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
53895 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
53896 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
53898 + if (gr_status & GR_READY)
53902 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
53906 + if (!(gr_status & GR_READY)) {
53907 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
53909 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53910 + preempt_disable();
53912 + pax_open_kernel();
53913 + gr_status &= ~GR_READY;
53914 + pax_close_kernel();
53916 + free_variables();
53917 + if (!(error2 = gracl_init(gr_usermode))) {
53918 + preempt_enable();
53919 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
53921 + preempt_enable();
53923 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53926 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53931 + if (unlikely(!(gr_status & GR_READY))) {
53932 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
53937 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53938 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
53939 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
53940 + struct acl_subject_label *segvacl;
53942 + lookup_acl_subj_label(gr_usermode->segv_inode,
53943 + gr_usermode->segv_device,
53946 + segvacl->crashes = 0;
53947 + segvacl->expires = 0;
53949 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
53950 + gr_remove_uid(gr_usermode->segv_uid);
53953 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
53958 + case GR_SPROLEPAM:
53959 + if (unlikely(!(gr_status & GR_READY))) {
53960 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
53965 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
53966 + current->role->expires = 0;
53967 + current->role->auth_attempts = 0;
53970 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53971 + time_after(current->role->expires, get_seconds())) {
53976 + if (lookup_special_role_auth
53977 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
53978 + && ((!sprole_salt && !sprole_sum)
53979 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
53981 + assign_special_role(gr_usermode->sp_role);
53982 + read_lock(&tasklist_lock);
53983 + if (current->real_parent)
53984 + p = current->real_parent->role->rolename;
53985 + read_unlock(&tasklist_lock);
53986 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
53987 + p, acl_sp_role_value);
53989 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
53991 + if(!(current->role->auth_attempts++))
53992 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53997 + case GR_UNSPROLE:
53998 + if (unlikely(!(gr_status & GR_READY))) {
53999 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54004 + if (current->role->roletype & GR_ROLE_SPECIAL) {
54008 + read_lock(&tasklist_lock);
54009 + if (current->real_parent) {
54010 + p = current->real_parent->role->rolename;
54011 + i = current->real_parent->acl_role_id;
54013 + read_unlock(&tasklist_lock);
54015 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54023 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54028 + if (error != -EPERM)
54031 + if(!(gr_auth_attempts++))
54032 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54035 + mutex_unlock(&gr_dev_mutex);
54039 +/* must be called with
54041 + read_lock(&tasklist_lock);
54042 + read_lock(&grsec_exec_file_lock);
54044 +int gr_apply_subject_to_task(struct task_struct *task)
54046 + struct acl_object_label *obj;
54048 + struct acl_subject_label *tmpsubj;
54049 + struct file *filp;
54050 + struct name_entry *nmatch;
54052 + filp = task->exec_file;
54053 + if (filp == NULL)
54056 + /* the following is to apply the correct subject
54057 + on binaries running when the RBAC system
54058 + is enabled, when the binaries have been
54059 + replaced or deleted since their execution
54061 + when the RBAC system starts, the inode/dev
54062 + from exec_file will be one the RBAC system
54063 + is unaware of. It only knows the inode/dev
54064 + of the present file on disk, or the absence
54067 + preempt_disable();
54068 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54070 + nmatch = lookup_name_entry(tmpname);
54071 + preempt_enable();
54074 + if (nmatch->deleted)
54075 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54077 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54078 + if (tmpsubj != NULL)
54079 + task->acl = tmpsubj;
54081 + if (tmpsubj == NULL)
54082 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54085 + task->is_writable = 0;
54086 + /* ignore additional mmap checks for processes that are writable
54087 + by the default ACL */
54088 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54089 + if (unlikely(obj->mode & GR_WRITE))
54090 + task->is_writable = 1;
54091 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54092 + if (unlikely(obj->mode & GR_WRITE))
54093 + task->is_writable = 1;
54095 + gr_set_proc_res(task);
54097 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54098 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54108 +gr_set_acls(const int type)
54110 + struct task_struct *task, *task2;
54111 + struct acl_role_label *role = current->role;
54112 + __u16 acl_role_id = current->acl_role_id;
54113 + const struct cred *cred;
54117 + read_lock(&tasklist_lock);
54118 + read_lock(&grsec_exec_file_lock);
54119 + do_each_thread(task2, task) {
54120 + /* check to see if we're called from the exit handler,
54121 + if so, only replace ACLs that have inherited the admin
54124 + if (type && (task->role != role ||
54125 + task->acl_role_id != acl_role_id))
54128 + task->acl_role_id = 0;
54129 + task->acl_sp_role = 0;
54131 + if (task->exec_file) {
54132 + cred = __task_cred(task);
54133 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54134 + ret = gr_apply_subject_to_task(task);
54136 + read_unlock(&grsec_exec_file_lock);
54137 + read_unlock(&tasklist_lock);
54138 + rcu_read_unlock();
54139 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54143 + // it's a kernel process
54144 + task->role = kernel_role;
54145 + task->acl = kernel_role->root_label;
54146 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54147 + task->acl->mode &= ~GR_PROCFIND;
54150 + } while_each_thread(task2, task);
54151 + read_unlock(&grsec_exec_file_lock);
54152 + read_unlock(&tasklist_lock);
54153 + rcu_read_unlock();
54159 +gr_learn_resource(const struct task_struct *task,
54160 + const int res, const unsigned long wanted, const int gt)
54162 + struct acl_subject_label *acl;
54163 + const struct cred *cred;
54165 + if (unlikely((gr_status & GR_READY) &&
54166 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54167 + goto skip_reslog;
54169 +#ifdef CONFIG_GRKERNSEC_RESLOG
54170 + gr_log_resource(task, res, wanted, gt);
54174 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54179 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54180 + !(acl->resmask & (1 << (unsigned short) res))))
54183 + if (wanted >= acl->res[res].rlim_cur) {
54184 + unsigned long res_add;
54186 + res_add = wanted;
54189 + res_add += GR_RLIM_CPU_BUMP;
54191 + case RLIMIT_FSIZE:
54192 + res_add += GR_RLIM_FSIZE_BUMP;
54194 + case RLIMIT_DATA:
54195 + res_add += GR_RLIM_DATA_BUMP;
54197 + case RLIMIT_STACK:
54198 + res_add += GR_RLIM_STACK_BUMP;
54200 + case RLIMIT_CORE:
54201 + res_add += GR_RLIM_CORE_BUMP;
54204 + res_add += GR_RLIM_RSS_BUMP;
54206 + case RLIMIT_NPROC:
54207 + res_add += GR_RLIM_NPROC_BUMP;
54209 + case RLIMIT_NOFILE:
54210 + res_add += GR_RLIM_NOFILE_BUMP;
54212 + case RLIMIT_MEMLOCK:
54213 + res_add += GR_RLIM_MEMLOCK_BUMP;
54216 + res_add += GR_RLIM_AS_BUMP;
54218 + case RLIMIT_LOCKS:
54219 + res_add += GR_RLIM_LOCKS_BUMP;
54221 + case RLIMIT_SIGPENDING:
54222 + res_add += GR_RLIM_SIGPENDING_BUMP;
54224 + case RLIMIT_MSGQUEUE:
54225 + res_add += GR_RLIM_MSGQUEUE_BUMP;
54227 + case RLIMIT_NICE:
54228 + res_add += GR_RLIM_NICE_BUMP;
54230 + case RLIMIT_RTPRIO:
54231 + res_add += GR_RLIM_RTPRIO_BUMP;
54233 + case RLIMIT_RTTIME:
54234 + res_add += GR_RLIM_RTTIME_BUMP;
54238 + acl->res[res].rlim_cur = res_add;
54240 + if (wanted > acl->res[res].rlim_max)
54241 + acl->res[res].rlim_max = res_add;
54243 + /* only log the subject filename, since resource logging is supported for
54244 + single-subject learning only */
54246 + cred = __task_cred(task);
54247 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54248 + task->role->roletype, cred->uid, cred->gid, acl->filename,
54249 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54250 + "", (unsigned long) res, &task->signal->saved_ip);
54251 + rcu_read_unlock();
54257 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54259 +pax_set_initial_flags(struct linux_binprm *bprm)
54261 + struct task_struct *task = current;
54262 + struct acl_subject_label *proc;
54263 + unsigned long flags;
54265 + if (unlikely(!(gr_status & GR_READY)))
54268 + flags = pax_get_flags(task);
54270 + proc = task->acl;
54272 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54273 + flags &= ~MF_PAX_PAGEEXEC;
54274 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54275 + flags &= ~MF_PAX_SEGMEXEC;
54276 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54277 + flags &= ~MF_PAX_RANDMMAP;
54278 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54279 + flags &= ~MF_PAX_EMUTRAMP;
54280 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54281 + flags &= ~MF_PAX_MPROTECT;
54283 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54284 + flags |= MF_PAX_PAGEEXEC;
54285 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54286 + flags |= MF_PAX_SEGMEXEC;
54287 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54288 + flags |= MF_PAX_RANDMMAP;
54289 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54290 + flags |= MF_PAX_EMUTRAMP;
54291 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54292 + flags |= MF_PAX_MPROTECT;
54294 + pax_set_flags(task, flags);
54300 +#ifdef CONFIG_SYSCTL
54301 +/* Eric Biederman likes breaking userland ABI and every inode-based security
54302 + system to save 35kb of memory */
54304 +/* we modify the passed in filename, but adjust it back before returning */
54305 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54307 + struct name_entry *nmatch;
54308 + char *p, *lastp = NULL;
54309 + struct acl_object_label *obj = NULL, *tmp;
54310 + struct acl_subject_label *tmpsubj;
54313 + read_lock(&gr_inode_lock);
54315 + p = name + len - 1;
54317 + nmatch = lookup_name_entry(name);
54318 + if (lastp != NULL)
54321 + if (nmatch == NULL)
54322 + goto next_component;
54323 + tmpsubj = current->acl;
54325 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54326 + if (obj != NULL) {
54327 + tmp = obj->globbed;
54329 + if (!glob_match(tmp->filename, name)) {
54337 + } while ((tmpsubj = tmpsubj->parent_subject));
54343 + while (*p != '/')
54355 + read_unlock(&gr_inode_lock);
54356 + /* obj returned will always be non-null */
54360 +/* returns 0 when allowing, non-zero on error
54361 + op of 0 is used for readdir, so we don't log the names of hidden files
54364 +gr_handle_sysctl(const struct ctl_table *table, const int op)
54366 + struct ctl_table *tmp;
54367 + const char *proc_sys = "/proc/sys";
54369 + struct acl_object_label *obj;
54370 + unsigned short len = 0, pos = 0, depth = 0, i;
54374 + if (unlikely(!(gr_status & GR_READY)))
54377 + /* for now, ignore operations on non-sysctl entries if it's not a
54379 + if (table->child != NULL && op != 0)
54383 + /* it's only a read if it's an entry, read on dirs is for readdir */
54384 + if (op & MAY_READ)
54386 + if (op & MAY_WRITE)
54387 + mode |= GR_WRITE;
54389 + preempt_disable();
54391 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54393 + /* it's only a read/write if it's an actual entry, not a dir
54394 + (which are opened for readdir)
54397 + /* convert the requested sysctl entry into a pathname */
54399 + for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54400 + len += strlen(tmp->procname);
54405 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54410 + memset(path, 0, PAGE_SIZE);
54412 + memcpy(path, proc_sys, strlen(proc_sys));
54414 + pos += strlen(proc_sys);
54416 + for (; depth > 0; depth--) {
54419 + for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54420 + if (depth == i) {
54421 + memcpy(path + pos, tmp->procname,
54422 + strlen(tmp->procname));
54423 + pos += strlen(tmp->procname);
54429 + obj = gr_lookup_by_name(path, pos);
54430 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54432 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54433 + ((err & mode) != mode))) {
54434 + __u32 new_mode = mode;
54436 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54439 + gr_log_learn_sysctl(path, new_mode);
54440 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54441 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54443 + } else if (!(err & GR_FIND)) {
54445 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54446 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54447 + path, (mode & GR_READ) ? " reading" : "",
54448 + (mode & GR_WRITE) ? " writing" : "");
54450 + } else if ((err & mode) != mode) {
54452 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54453 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54454 + path, (mode & GR_READ) ? " reading" : "",
54455 + (mode & GR_WRITE) ? " writing" : "");
54461 + preempt_enable();
54468 +gr_handle_proc_ptrace(struct task_struct *task)
54470 + struct file *filp;
54471 + struct task_struct *tmp = task;
54472 + struct task_struct *curtemp = current;
54475 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54476 + if (unlikely(!(gr_status & GR_READY)))
54480 + read_lock(&tasklist_lock);
54481 + read_lock(&grsec_exec_file_lock);
54482 + filp = task->exec_file;
54484 + while (tmp->pid > 0) {
54485 + if (tmp == curtemp)
54487 + tmp = tmp->real_parent;
54490 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54491 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54492 + read_unlock(&grsec_exec_file_lock);
54493 + read_unlock(&tasklist_lock);
54497 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54498 + if (!(gr_status & GR_READY)) {
54499 + read_unlock(&grsec_exec_file_lock);
54500 + read_unlock(&tasklist_lock);
54505 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
54506 + read_unlock(&grsec_exec_file_lock);
54507 + read_unlock(&tasklist_lock);
54509 + if (retmode & GR_NOPTRACE)
54512 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
54513 + && (current->acl != task->acl || (current->acl != current->role->root_label
54514 + && current->pid != task->pid)))
54520 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
54522 + if (unlikely(!(gr_status & GR_READY)))
54525 + if (!(current->role->roletype & GR_ROLE_GOD))
54528 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
54529 + p->role->rolename, gr_task_roletype_to_char(p),
54530 + p->acl->filename);
54534 +gr_handle_ptrace(struct task_struct *task, const long request)
54536 + struct task_struct *tmp = task;
54537 + struct task_struct *curtemp = current;
54540 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54541 + if (unlikely(!(gr_status & GR_READY)))
54545 + read_lock(&tasklist_lock);
54546 + while (tmp->pid > 0) {
54547 + if (tmp == curtemp)
54549 + tmp = tmp->real_parent;
54552 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54553 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
54554 + read_unlock(&tasklist_lock);
54555 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54558 + read_unlock(&tasklist_lock);
54560 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54561 + if (!(gr_status & GR_READY))
54565 + read_lock(&grsec_exec_file_lock);
54566 + if (unlikely(!task->exec_file)) {
54567 + read_unlock(&grsec_exec_file_lock);
54571 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
54572 + read_unlock(&grsec_exec_file_lock);
54574 + if (retmode & GR_NOPTRACE) {
54575 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54579 + if (retmode & GR_PTRACERD) {
54580 + switch (request) {
54581 + case PTRACE_SEIZE:
54582 + case PTRACE_POKETEXT:
54583 + case PTRACE_POKEDATA:
54584 + case PTRACE_POKEUSR:
54585 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
54586 + case PTRACE_SETREGS:
54587 + case PTRACE_SETFPREGS:
54590 + case PTRACE_SETFPXREGS:
54592 +#ifdef CONFIG_ALTIVEC
54593 + case PTRACE_SETVRREGS:
54599 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
54600 + !(current->role->roletype & GR_ROLE_GOD) &&
54601 + (current->acl != task->acl)) {
54602 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54609 +static int is_writable_mmap(const struct file *filp)
54611 + struct task_struct *task = current;
54612 + struct acl_object_label *obj, *obj2;
54614 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
54615 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
54616 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54617 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
54618 + task->role->root_label);
54619 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
54620 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
54628 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
54632 + if (unlikely(!file || !(prot & PROT_EXEC)))
54635 + if (is_writable_mmap(file))
54639 + gr_search_file(file->f_path.dentry,
54640 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54641 + file->f_path.mnt);
54643 + if (!gr_tpe_allow(file))
54646 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54647 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54649 + } else if (unlikely(!(mode & GR_EXEC))) {
54651 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54652 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54660 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
54664 + if (unlikely(!file || !(prot & PROT_EXEC)))
54667 + if (is_writable_mmap(file))
54671 + gr_search_file(file->f_path.dentry,
54672 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54673 + file->f_path.mnt);
54675 + if (!gr_tpe_allow(file))
54678 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54679 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54681 + } else if (unlikely(!(mode & GR_EXEC))) {
54683 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54684 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54692 +gr_acl_handle_psacct(struct task_struct *task, const long code)
54694 + unsigned long runtime;
54695 + unsigned long cputime;
54696 + unsigned int wday, cday;
54700 + struct timespec timeval;
54702 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
54703 + !(task->acl->mode & GR_PROCACCT)))
54706 + do_posix_clock_monotonic_gettime(&timeval);
54707 + runtime = timeval.tv_sec - task->start_time.tv_sec;
54708 + wday = runtime / (3600 * 24);
54709 + runtime -= wday * (3600 * 24);
54710 + whr = runtime / 3600;
54711 + runtime -= whr * 3600;
54712 + wmin = runtime / 60;
54713 + runtime -= wmin * 60;
54716 + cputime = (task->utime + task->stime) / HZ;
54717 + cday = cputime / (3600 * 24);
54718 + cputime -= cday * (3600 * 24);
54719 + chr = cputime / 3600;
54720 + cputime -= chr * 3600;
54721 + cmin = cputime / 60;
54722 + cputime -= cmin * 60;
54725 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
54730 +void gr_set_kernel_label(struct task_struct *task)
54732 + if (gr_status & GR_READY) {
54733 + task->role = kernel_role;
54734 + task->acl = kernel_role->root_label;
54739 +#ifdef CONFIG_TASKSTATS
54740 +int gr_is_taskstats_denied(int pid)
54742 + struct task_struct *task;
54743 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54744 + const struct cred *cred;
54748 + /* restrict taskstats viewing to un-chrooted root users
54749 + who have the 'view' subject flag if the RBAC system is enabled
54753 + read_lock(&tasklist_lock);
54754 + task = find_task_by_vpid(pid);
54756 +#ifdef CONFIG_GRKERNSEC_CHROOT
54757 + if (proc_is_chrooted(task))
54760 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54761 + cred = __task_cred(task);
54762 +#ifdef CONFIG_GRKERNSEC_PROC_USER
54763 + if (cred->uid != 0)
54765 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54766 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
54770 + if (gr_status & GR_READY) {
54771 + if (!(task->acl->mode & GR_VIEW))
54777 + read_unlock(&tasklist_lock);
54778 + rcu_read_unlock();
54784 +/* AUXV entries are filled via a descendant of search_binary_handler
54785 + after we've already applied the subject for the target
54787 +int gr_acl_enable_at_secure(void)
54789 + if (unlikely(!(gr_status & GR_READY)))
54792 + if (current->acl->mode & GR_ATSECURE)
54798 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
54800 + struct task_struct *task = current;
54801 + struct dentry *dentry = file->f_path.dentry;
54802 + struct vfsmount *mnt = file->f_path.mnt;
54803 + struct acl_object_label *obj, *tmp;
54804 + struct acl_subject_label *subj;
54805 + unsigned int bufsize;
54808 + dev_t dev = __get_dev(dentry);
54810 + if (unlikely(!(gr_status & GR_READY)))
54813 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54816 + /* ignore Eric Biederman */
54817 + if (IS_PRIVATE(dentry->d_inode))
54820 + subj = task->acl;
54822 + obj = lookup_acl_obj_label(ino, dev, subj);
54824 + return (obj->mode & GR_FIND) ? 1 : 0;
54825 + } while ((subj = subj->parent_subject));
54827 + /* this is purely an optimization since we're looking for an object
54828 + for the directory we're doing a readdir on
54829 + if it's possible for any globbed object to match the entry we're
54830 + filling into the directory, then the object we find here will be
54831 + an anchor point with attached globbed objects
54833 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
54834 + if (obj->globbed == NULL)
54835 + return (obj->mode & GR_FIND) ? 1 : 0;
54837 + is_not_root = ((obj->filename[0] == '/') &&
54838 + (obj->filename[1] == '\0')) ? 0 : 1;
54839 + bufsize = PAGE_SIZE - namelen - is_not_root;
54841 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
54842 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
54845 + preempt_disable();
54846 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
54849 + bufsize = strlen(path);
54851 + /* if base is "/", don't append an additional slash */
54853 + *(path + bufsize) = '/';
54854 + memcpy(path + bufsize + is_not_root, name, namelen);
54855 + *(path + bufsize + namelen + is_not_root) = '\0';
54857 + tmp = obj->globbed;
54859 + if (!glob_match(tmp->filename, path)) {
54860 + preempt_enable();
54861 + return (tmp->mode & GR_FIND) ? 1 : 0;
54865 + preempt_enable();
54866 + return (obj->mode & GR_FIND) ? 1 : 0;
54869 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
54870 +EXPORT_SYMBOL(gr_acl_is_enabled);
54872 +EXPORT_SYMBOL(gr_learn_resource);
54873 +EXPORT_SYMBOL(gr_set_kernel_label);
54874 +#ifdef CONFIG_SECURITY
54875 +EXPORT_SYMBOL(gr_check_user_change);
54876 +EXPORT_SYMBOL(gr_check_group_change);
54879 diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
54880 new file mode 100644
54881 index 0000000..34fefda
54883 +++ b/grsecurity/gracl_alloc.c
54885 +#include <linux/kernel.h>
54886 +#include <linux/mm.h>
54887 +#include <linux/slab.h>
54888 +#include <linux/vmalloc.h>
54889 +#include <linux/gracl.h>
54890 +#include <linux/grsecurity.h>
54892 +static unsigned long alloc_stack_next = 1;
54893 +static unsigned long alloc_stack_size = 1;
54894 +static void **alloc_stack;
54896 +static __inline__ int
54899 + if (alloc_stack_next == 1)
54902 + kfree(alloc_stack[alloc_stack_next - 2]);
54904 + alloc_stack_next--;
54909 +static __inline__ int
54910 +alloc_push(void *buf)
54912 + if (alloc_stack_next >= alloc_stack_size)
54915 + alloc_stack[alloc_stack_next - 1] = buf;
54917 + alloc_stack_next++;
54923 +acl_alloc(unsigned long len)
54925 + void *ret = NULL;
54927 + if (!len || len > PAGE_SIZE)
54930 + ret = kmalloc(len, GFP_KERNEL);
54933 + if (alloc_push(ret)) {
54944 +acl_alloc_num(unsigned long num, unsigned long len)
54946 + if (!len || (num > (PAGE_SIZE / len)))
54949 + return acl_alloc(num * len);
54953 +acl_free_all(void)
54955 + if (gr_acl_is_enabled() || !alloc_stack)
54958 + while (alloc_pop()) ;
54960 + if (alloc_stack) {
54961 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
54962 + kfree(alloc_stack);
54964 + vfree(alloc_stack);
54967 + alloc_stack = NULL;
54968 + alloc_stack_size = 1;
54969 + alloc_stack_next = 1;
54975 +acl_alloc_stack_init(unsigned long size)
54977 + if ((size * sizeof (void *)) <= PAGE_SIZE)
54979 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
54981 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
54983 + alloc_stack_size = size;
54985 + if (!alloc_stack)
54990 diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
54991 new file mode 100644
54992 index 0000000..955ddfb
54994 +++ b/grsecurity/gracl_cap.c
54996 +#include <linux/kernel.h>
54997 +#include <linux/module.h>
54998 +#include <linux/sched.h>
54999 +#include <linux/gracl.h>
55000 +#include <linux/grsecurity.h>
55001 +#include <linux/grinternal.h>
55003 +extern const char *captab_log[];
55004 +extern int captab_log_entries;
55007 +gr_acl_is_capable(const int cap)
55009 + struct task_struct *task = current;
55010 + const struct cred *cred = current_cred();
55011 + struct acl_subject_label *curracl;
55012 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55013 + kernel_cap_t cap_audit = __cap_empty_set;
55015 + if (!gr_acl_is_enabled())
55018 + curracl = task->acl;
55020 + cap_drop = curracl->cap_lower;
55021 + cap_mask = curracl->cap_mask;
55022 + cap_audit = curracl->cap_invert_audit;
55024 + while ((curracl = curracl->parent_subject)) {
55025 + /* if the cap isn't specified in the current computed mask but is specified in the
55026 + current level subject, and is lowered in the current level subject, then add
55027 + it to the set of dropped capabilities
55028 + otherwise, add the current level subject's mask to the current computed mask
55030 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55031 + cap_raise(cap_mask, cap);
55032 + if (cap_raised(curracl->cap_lower, cap))
55033 + cap_raise(cap_drop, cap);
55034 + if (cap_raised(curracl->cap_invert_audit, cap))
55035 + cap_raise(cap_audit, cap);
55039 + if (!cap_raised(cap_drop, cap)) {
55040 + if (cap_raised(cap_audit, cap))
55041 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55045 + curracl = task->acl;
55047 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55048 + && cap_raised(cred->cap_effective, cap)) {
55049 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55050 + task->role->roletype, cred->uid,
55051 + cred->gid, task->exec_file ?
55052 + gr_to_filename(task->exec_file->f_path.dentry,
55053 + task->exec_file->f_path.mnt) : curracl->filename,
55054 + curracl->filename, 0UL,
55055 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55059 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55060 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55065 +gr_acl_is_capable_nolog(const int cap)
55067 + struct acl_subject_label *curracl;
55068 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55070 + if (!gr_acl_is_enabled())
55073 + curracl = current->acl;
55075 + cap_drop = curracl->cap_lower;
55076 + cap_mask = curracl->cap_mask;
55078 + while ((curracl = curracl->parent_subject)) {
55079 + /* if the cap isn't specified in the current computed mask but is specified in the
55080 + current level subject, and is lowered in the current level subject, then add
55081 + it to the set of dropped capabilities
55082 + otherwise, add the current level subject's mask to the current computed mask
55084 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55085 + cap_raise(cap_mask, cap);
55086 + if (cap_raised(curracl->cap_lower, cap))
55087 + cap_raise(cap_drop, cap);
55091 + if (!cap_raised(cap_drop, cap))
55097 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
55098 new file mode 100644
55099 index 0000000..4eda5c3
55101 +++ b/grsecurity/gracl_fs.c
55103 +#include <linux/kernel.h>
55104 +#include <linux/sched.h>
55105 +#include <linux/types.h>
55106 +#include <linux/fs.h>
55107 +#include <linux/file.h>
55108 +#include <linux/stat.h>
55109 +#include <linux/grsecurity.h>
55110 +#include <linux/grinternal.h>
55111 +#include <linux/gracl.h>
55114 +gr_acl_handle_hidden_file(const struct dentry * dentry,
55115 + const struct vfsmount * mnt)
55119 + if (unlikely(!dentry->d_inode))
55123 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55125 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55126 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55128 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55129 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55131 + } else if (unlikely(!(mode & GR_FIND)))
55138 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55141 + __u32 reqmode = GR_FIND;
55144 + if (unlikely(!dentry->d_inode))
55147 + if (acc_mode & MAY_APPEND)
55148 + reqmode |= GR_APPEND;
55149 + else if (acc_mode & MAY_WRITE)
55150 + reqmode |= GR_WRITE;
55151 + if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
55152 + reqmode |= GR_READ;
55155 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55158 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55159 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55160 + reqmode & GR_READ ? " reading" : "",
55161 + reqmode & GR_WRITE ? " writing" : reqmode &
55162 + GR_APPEND ? " appending" : "");
55165 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55167 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55168 + reqmode & GR_READ ? " reading" : "",
55169 + reqmode & GR_WRITE ? " writing" : reqmode &
55170 + GR_APPEND ? " appending" : "");
55172 + } else if (unlikely((mode & reqmode) != reqmode))
55179 +gr_acl_handle_creat(const struct dentry * dentry,
55180 + const struct dentry * p_dentry,
55181 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
55184 + __u32 reqmode = GR_WRITE | GR_CREATE;
55187 + if (acc_mode & MAY_APPEND)
55188 + reqmode |= GR_APPEND;
55189 + // if a directory was required or the directory already exists, then
55190 + // don't count this open as a read
55191 + if ((acc_mode & MAY_READ) &&
55192 + !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
55193 + reqmode |= GR_READ;
55194 + if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
55195 + reqmode |= GR_SETID;
55198 + gr_check_create(dentry, p_dentry, p_mnt,
55199 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55201 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55202 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55203 + reqmode & GR_READ ? " reading" : "",
55204 + reqmode & GR_WRITE ? " writing" : reqmode &
55205 + GR_APPEND ? " appending" : "");
55208 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55210 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55211 + reqmode & GR_READ ? " reading" : "",
55212 + reqmode & GR_WRITE ? " writing" : reqmode &
55213 + GR_APPEND ? " appending" : "");
55215 + } else if (unlikely((mode & reqmode) != reqmode))
55222 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55225 + __u32 mode, reqmode = GR_FIND;
55227 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55228 + reqmode |= GR_EXEC;
55229 + if (fmode & S_IWOTH)
55230 + reqmode |= GR_WRITE;
55231 + if (fmode & S_IROTH)
55232 + reqmode |= GR_READ;
55235 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55238 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55239 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55240 + reqmode & GR_READ ? " reading" : "",
55241 + reqmode & GR_WRITE ? " writing" : "",
55242 + reqmode & GR_EXEC ? " executing" : "");
55245 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55247 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55248 + reqmode & GR_READ ? " reading" : "",
55249 + reqmode & GR_WRITE ? " writing" : "",
55250 + reqmode & GR_EXEC ? " executing" : "");
55252 + } else if (unlikely((mode & reqmode) != reqmode))
55258 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55262 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55264 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55265 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55267 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55268 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55270 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55273 + return (reqmode);
55277 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55279 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55283 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55285 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55289 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55291 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55295 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55297 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55301 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55304 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55307 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55308 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55309 + GR_FCHMOD_ACL_MSG);
55311 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55316 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55319 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55320 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55321 + GR_CHMOD_ACL_MSG);
55323 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55328 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55330 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55334 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55336 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55340 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55342 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55346 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55348 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55349 + GR_UNIXCONNECT_ACL_MSG);
55352 +/* hardlinks require at minimum create and link permission,
55353 + any additional privilege required is based on the
55354 + privilege of the file being linked to
55357 +gr_acl_handle_link(const struct dentry * new_dentry,
55358 + const struct dentry * parent_dentry,
55359 + const struct vfsmount * parent_mnt,
55360 + const struct dentry * old_dentry,
55361 + const struct vfsmount * old_mnt, const char *to)
55364 + __u32 needmode = GR_CREATE | GR_LINK;
55365 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55368 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55371 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55372 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55374 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55375 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55377 + } else if (unlikely((mode & needmode) != needmode))
55384 +gr_acl_handle_symlink(const struct dentry * new_dentry,
55385 + const struct dentry * parent_dentry,
55386 + const struct vfsmount * parent_mnt, const char *from)
55388 + __u32 needmode = GR_WRITE | GR_CREATE;
55392 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
55393 + GR_CREATE | GR_AUDIT_CREATE |
55394 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55396 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55397 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55399 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55400 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55402 + } else if (unlikely((mode & needmode) != needmode))
55405 + return (GR_WRITE | GR_CREATE);
55408 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55412 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55414 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55415 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55417 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55418 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55420 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55423 + return (reqmode);
55427 +gr_acl_handle_mknod(const struct dentry * new_dentry,
55428 + const struct dentry * parent_dentry,
55429 + const struct vfsmount * parent_mnt,
55432 + __u32 reqmode = GR_WRITE | GR_CREATE;
55433 + if (unlikely(mode & (S_ISUID | S_ISGID)))
55434 + reqmode |= GR_SETID;
55436 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55437 + reqmode, GR_MKNOD_ACL_MSG);
55441 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
55442 + const struct dentry *parent_dentry,
55443 + const struct vfsmount *parent_mnt)
55445 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55446 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55449 +#define RENAME_CHECK_SUCCESS(old, new) \
55450 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55451 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55454 +gr_acl_handle_rename(struct dentry *new_dentry,
55455 + struct dentry *parent_dentry,
55456 + const struct vfsmount *parent_mnt,
55457 + struct dentry *old_dentry,
55458 + struct inode *old_parent_inode,
55459 + struct vfsmount *old_mnt, const char *newname)
55461 + __u32 comp1, comp2;
55464 + if (unlikely(!gr_acl_is_enabled()))
55467 + if (!new_dentry->d_inode) {
55468 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55469 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55470 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55471 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55472 + GR_DELETE | GR_AUDIT_DELETE |
55473 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55474 + GR_SUPPRESS, old_mnt);
55476 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55477 + GR_CREATE | GR_DELETE |
55478 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55479 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55480 + GR_SUPPRESS, parent_mnt);
55482 + gr_search_file(old_dentry,
55483 + GR_READ | GR_WRITE | GR_AUDIT_READ |
55484 + GR_DELETE | GR_AUDIT_DELETE |
55485 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55488 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55489 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55490 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55491 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55492 + && !(comp2 & GR_SUPPRESS)) {
55493 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55495 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55502 +gr_acl_handle_exit(void)
55506 + struct file *exec_file;
55508 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55509 + !(current->role->roletype & GR_ROLE_PERSIST))) {
55510 + id = current->acl_role_id;
55511 + rolename = current->role->rolename;
55513 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55516 + write_lock(&grsec_exec_file_lock);
55517 + exec_file = current->exec_file;
55518 + current->exec_file = NULL;
55519 + write_unlock(&grsec_exec_file_lock);
55526 +gr_acl_handle_procpidmem(const struct task_struct *task)
55528 + if (unlikely(!gr_acl_is_enabled()))
55531 + if (task != current && task->acl->mode & GR_PROTPROCFD)
55536 diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
55537 new file mode 100644
55538 index 0000000..17050ca
55540 +++ b/grsecurity/gracl_ip.c
55542 +#include <linux/kernel.h>
55543 +#include <asm/uaccess.h>
55544 +#include <asm/errno.h>
55545 +#include <net/sock.h>
55546 +#include <linux/file.h>
55547 +#include <linux/fs.h>
55548 +#include <linux/net.h>
55549 +#include <linux/in.h>
55550 +#include <linux/skbuff.h>
55551 +#include <linux/ip.h>
55552 +#include <linux/udp.h>
55553 +#include <linux/types.h>
55554 +#include <linux/sched.h>
55555 +#include <linux/netdevice.h>
55556 +#include <linux/inetdevice.h>
55557 +#include <linux/gracl.h>
55558 +#include <linux/grsecurity.h>
55559 +#include <linux/grinternal.h>
55561 +#define GR_BIND 0x01
55562 +#define GR_CONNECT 0x02
55563 +#define GR_INVERT 0x04
55564 +#define GR_BINDOVERRIDE 0x08
55565 +#define GR_CONNECTOVERRIDE 0x10
55566 +#define GR_SOCK_FAMILY 0x20
55568 +static const char * gr_protocols[IPPROTO_MAX] = {
55569 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55570 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55571 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55572 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55573 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55574 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55575 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55576 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55577 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55578 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55579 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55580 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55581 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55582 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55583 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55584 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55585 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
55586 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
55587 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
55588 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
55589 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
55590 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
55591 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
55592 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
55593 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
55594 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
55595 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
55596 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
55597 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
55598 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
55599 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
55600 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
55603 +static const char * gr_socktypes[SOCK_MAX] = {
55604 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
55605 + "unknown:7", "unknown:8", "unknown:9", "packet"
55608 +static const char * gr_sockfamilies[AF_MAX+1] = {
55609 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
55610 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
55611 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
55612 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
55616 +gr_proto_to_name(unsigned char proto)
55618 + return gr_protocols[proto];
55622 +gr_socktype_to_name(unsigned char type)
55624 + return gr_socktypes[type];
55628 +gr_sockfamily_to_name(unsigned char family)
55630 + return gr_sockfamilies[family];
55634 +gr_search_socket(const int domain, const int type, const int protocol)
55636 + struct acl_subject_label *curr;
55637 + const struct cred *cred = current_cred();
55639 + if (unlikely(!gr_acl_is_enabled()))
55642 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
55643 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
55644 + goto exit; // let the kernel handle it
55646 + curr = current->acl;
55648 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
55649 + /* the family is allowed, if this is PF_INET allow it only if
55650 + the extra sock type/protocol checks pass */
55651 + if (domain == PF_INET)
55655 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55656 + __u32 fakeip = 0;
55657 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55658 + current->role->roletype, cred->uid,
55659 + cred->gid, current->exec_file ?
55660 + gr_to_filename(current->exec_file->f_path.dentry,
55661 + current->exec_file->f_path.mnt) :
55662 + curr->filename, curr->filename,
55663 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
55664 + ¤t->signal->saved_ip);
55671 + /* the rest of this checking is for IPv4 only */
55675 + if ((curr->ip_type & (1 << type)) &&
55676 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
55679 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55680 + /* we don't place acls on raw sockets , and sometimes
55681 + dgram/ip sockets are opened for ioctl and not
55682 + bind/connect, so we'll fake a bind learn log */
55683 + if (type == SOCK_RAW || type == SOCK_PACKET) {
55684 + __u32 fakeip = 0;
55685 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55686 + current->role->roletype, cred->uid,
55687 + cred->gid, current->exec_file ?
55688 + gr_to_filename(current->exec_file->f_path.dentry,
55689 + current->exec_file->f_path.mnt) :
55690 + curr->filename, curr->filename,
55691 + &fakeip, 0, type,
55692 + protocol, GR_CONNECT, ¤t->signal->saved_ip);
55693 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
55694 + __u32 fakeip = 0;
55695 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55696 + current->role->roletype, cred->uid,
55697 + cred->gid, current->exec_file ?
55698 + gr_to_filename(current->exec_file->f_path.dentry,
55699 + current->exec_file->f_path.mnt) :
55700 + curr->filename, curr->filename,
55701 + &fakeip, 0, type,
55702 + protocol, GR_BIND, ¤t->signal->saved_ip);
55704 + /* we'll log when they use connect or bind */
55709 + if (domain == PF_INET)
55710 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
55711 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
55713 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
55714 + gr_socktype_to_name(type), protocol);
55721 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
55723 + if ((ip->mode & mode) &&
55724 + (ip_port >= ip->low) &&
55725 + (ip_port <= ip->high) &&
55726 + ((ntohl(ip_addr) & our_netmask) ==
55727 + (ntohl(our_addr) & our_netmask))
55728 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
55729 + && (ip->type & (1 << type))) {
55730 + if (ip->mode & GR_INVERT)
55731 + return 2; // specifically denied
55733 + return 1; // allowed
55736 + return 0; // not specifically allowed, may continue parsing
55740 +gr_search_connectbind(const int full_mode, struct sock *sk,
55741 + struct sockaddr_in *addr, const int type)
55743 + char iface[IFNAMSIZ] = {0};
55744 + struct acl_subject_label *curr;
55745 + struct acl_ip_label *ip;
55746 + struct inet_sock *isk;
55747 + struct net_device *dev;
55748 + struct in_device *idev;
55751 + int mode = full_mode & (GR_BIND | GR_CONNECT);
55752 + __u32 ip_addr = 0;
55754 + __u32 our_netmask;
55756 + __u16 ip_port = 0;
55757 + const struct cred *cred = current_cred();
55759 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
55762 + curr = current->acl;
55763 + isk = inet_sk(sk);
55765 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
55766 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
55767 + addr->sin_addr.s_addr = curr->inaddr_any_override;
55768 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
55769 + struct sockaddr_in saddr;
55772 + saddr.sin_family = AF_INET;
55773 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
55774 + saddr.sin_port = isk->inet_sport;
55776 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55780 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55788 + ip_addr = addr->sin_addr.s_addr;
55789 + ip_port = ntohs(addr->sin_port);
55791 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55792 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55793 + current->role->roletype, cred->uid,
55794 + cred->gid, current->exec_file ?
55795 + gr_to_filename(current->exec_file->f_path.dentry,
55796 + current->exec_file->f_path.mnt) :
55797 + curr->filename, curr->filename,
55798 + &ip_addr, ip_port, type,
55799 + sk->sk_protocol, mode, ¤t->signal->saved_ip);
55803 + for (i = 0; i < curr->ip_num; i++) {
55804 + ip = *(curr->ips + i);
55805 + if (ip->iface != NULL) {
55806 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
55807 + p = strchr(iface, ':');
55810 + dev = dev_get_by_name(sock_net(sk), iface);
55813 + idev = in_dev_get(dev);
55814 + if (idev == NULL) {
55820 + if (!strcmp(ip->iface, ifa->ifa_label)) {
55821 + our_addr = ifa->ifa_address;
55822 + our_netmask = 0xffffffff;
55823 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55825 + rcu_read_unlock();
55826 + in_dev_put(idev);
55829 + } else if (ret == 2) {
55830 + rcu_read_unlock();
55831 + in_dev_put(idev);
55836 + } endfor_ifa(idev);
55837 + rcu_read_unlock();
55838 + in_dev_put(idev);
55841 + our_addr = ip->addr;
55842 + our_netmask = ip->netmask;
55843 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55846 + else if (ret == 2)
55852 + if (mode == GR_BIND)
55853 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55854 + else if (mode == GR_CONNECT)
55855 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55861 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
55863 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
55867 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
55869 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
55872 +int gr_search_listen(struct socket *sock)
55874 + struct sock *sk = sock->sk;
55875 + struct sockaddr_in addr;
55877 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55878 + addr.sin_port = inet_sk(sk)->inet_sport;
55880 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55883 +int gr_search_accept(struct socket *sock)
55885 + struct sock *sk = sock->sk;
55886 + struct sockaddr_in addr;
55888 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
55889 + addr.sin_port = inet_sk(sk)->inet_sport;
55891 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55895 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
55898 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
55900 + struct sockaddr_in sin;
55901 + const struct inet_sock *inet = inet_sk(sk);
55903 + sin.sin_addr.s_addr = inet->inet_daddr;
55904 + sin.sin_port = inet->inet_dport;
55906 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55911 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
55913 + struct sockaddr_in sin;
55915 + if (unlikely(skb->len < sizeof (struct udphdr)))
55916 + return 0; // skip this packet
55918 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
55919 + sin.sin_port = udp_hdr(skb)->source;
55921 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55923 diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
55924 new file mode 100644
55925 index 0000000..25f54ef
55927 +++ b/grsecurity/gracl_learn.c
55929 +#include <linux/kernel.h>
55930 +#include <linux/mm.h>
55931 +#include <linux/sched.h>
55932 +#include <linux/poll.h>
55933 +#include <linux/string.h>
55934 +#include <linux/file.h>
55935 +#include <linux/types.h>
55936 +#include <linux/vmalloc.h>
55937 +#include <linux/grinternal.h>
55939 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
55940 + size_t count, loff_t *ppos);
55941 +extern int gr_acl_is_enabled(void);
55943 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
55944 +static int gr_learn_attached;
55946 +/* use a 512k buffer */
55947 +#define LEARN_BUFFER_SIZE (512 * 1024)
55949 +static DEFINE_SPINLOCK(gr_learn_lock);
55950 +static DEFINE_MUTEX(gr_learn_user_mutex);
55952 +/* we need to maintain two buffers, so that the kernel context of grlearn
55953 + uses a semaphore around the userspace copying, and the other kernel contexts
55954 + use a spinlock when copying into the buffer, since they cannot sleep
55956 +static char *learn_buffer;
55957 +static char *learn_buffer_user;
55958 +static int learn_buffer_len;
55959 +static int learn_buffer_user_len;
55962 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
55964 + DECLARE_WAITQUEUE(wait, current);
55965 + ssize_t retval = 0;
55967 + add_wait_queue(&learn_wait, &wait);
55968 + set_current_state(TASK_INTERRUPTIBLE);
55970 + mutex_lock(&gr_learn_user_mutex);
55971 + spin_lock(&gr_learn_lock);
55972 + if (learn_buffer_len)
55974 + spin_unlock(&gr_learn_lock);
55975 + mutex_unlock(&gr_learn_user_mutex);
55976 + if (file->f_flags & O_NONBLOCK) {
55977 + retval = -EAGAIN;
55980 + if (signal_pending(current)) {
55981 + retval = -ERESTARTSYS;
55988 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
55989 + learn_buffer_user_len = learn_buffer_len;
55990 + retval = learn_buffer_len;
55991 + learn_buffer_len = 0;
55993 + spin_unlock(&gr_learn_lock);
55995 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
55996 + retval = -EFAULT;
55998 + mutex_unlock(&gr_learn_user_mutex);
56000 + set_current_state(TASK_RUNNING);
56001 + remove_wait_queue(&learn_wait, &wait);
56005 +static unsigned int
56006 +poll_learn(struct file * file, poll_table * wait)
56008 + poll_wait(file, &learn_wait, wait);
56010 + if (learn_buffer_len)
56011 + return (POLLIN | POLLRDNORM);
56017 +gr_clear_learn_entries(void)
56021 + mutex_lock(&gr_learn_user_mutex);
56022 + spin_lock(&gr_learn_lock);
56023 + tmp = learn_buffer;
56024 + learn_buffer = NULL;
56025 + spin_unlock(&gr_learn_lock);
56028 + if (learn_buffer_user != NULL) {
56029 + vfree(learn_buffer_user);
56030 + learn_buffer_user = NULL;
56032 + learn_buffer_len = 0;
56033 + mutex_unlock(&gr_learn_user_mutex);
56039 +gr_add_learn_entry(const char *fmt, ...)
56042 + unsigned int len;
56044 + if (!gr_learn_attached)
56047 + spin_lock(&gr_learn_lock);
56049 + /* leave a gap at the end so we know when it's "full" but don't have to
56050 + compute the exact length of the string we're trying to append
56052 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56053 + spin_unlock(&gr_learn_lock);
56054 + wake_up_interruptible(&learn_wait);
56057 + if (learn_buffer == NULL) {
56058 + spin_unlock(&gr_learn_lock);
56062 + va_start(args, fmt);
56063 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56066 + learn_buffer_len += len + 1;
56068 + spin_unlock(&gr_learn_lock);
56069 + wake_up_interruptible(&learn_wait);
56075 +open_learn(struct inode *inode, struct file *file)
56077 + if (file->f_mode & FMODE_READ && gr_learn_attached)
56079 + if (file->f_mode & FMODE_READ) {
56081 + mutex_lock(&gr_learn_user_mutex);
56082 + if (learn_buffer == NULL)
56083 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56084 + if (learn_buffer_user == NULL)
56085 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56086 + if (learn_buffer == NULL) {
56087 + retval = -ENOMEM;
56090 + if (learn_buffer_user == NULL) {
56091 + retval = -ENOMEM;
56094 + learn_buffer_len = 0;
56095 + learn_buffer_user_len = 0;
56096 + gr_learn_attached = 1;
56098 + mutex_unlock(&gr_learn_user_mutex);
56105 +close_learn(struct inode *inode, struct file *file)
56107 + if (file->f_mode & FMODE_READ) {
56108 + char *tmp = NULL;
56109 + mutex_lock(&gr_learn_user_mutex);
56110 + spin_lock(&gr_learn_lock);
56111 + tmp = learn_buffer;
56112 + learn_buffer = NULL;
56113 + spin_unlock(&gr_learn_lock);
56116 + if (learn_buffer_user != NULL) {
56117 + vfree(learn_buffer_user);
56118 + learn_buffer_user = NULL;
56120 + learn_buffer_len = 0;
56121 + learn_buffer_user_len = 0;
56122 + gr_learn_attached = 0;
56123 + mutex_unlock(&gr_learn_user_mutex);
56129 +const struct file_operations grsec_fops = {
56130 + .read = read_learn,
56131 + .write = write_grsec_handler,
56132 + .open = open_learn,
56133 + .release = close_learn,
56134 + .poll = poll_learn,
56136 diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
56137 new file mode 100644
56138 index 0000000..39645c9
56140 +++ b/grsecurity/gracl_res.c
56142 +#include <linux/kernel.h>
56143 +#include <linux/sched.h>
56144 +#include <linux/gracl.h>
56145 +#include <linux/grinternal.h>
56147 +static const char *restab_log[] = {
56148 + [RLIMIT_CPU] = "RLIMIT_CPU",
56149 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56150 + [RLIMIT_DATA] = "RLIMIT_DATA",
56151 + [RLIMIT_STACK] = "RLIMIT_STACK",
56152 + [RLIMIT_CORE] = "RLIMIT_CORE",
56153 + [RLIMIT_RSS] = "RLIMIT_RSS",
56154 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
56155 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56156 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56157 + [RLIMIT_AS] = "RLIMIT_AS",
56158 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56159 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56160 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56161 + [RLIMIT_NICE] = "RLIMIT_NICE",
56162 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56163 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56164 + [GR_CRASH_RES] = "RLIMIT_CRASH"
56168 +gr_log_resource(const struct task_struct *task,
56169 + const int res, const unsigned long wanted, const int gt)
56171 + const struct cred *cred;
56172 + unsigned long rlim;
56174 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
56177 + // not yet supported resource
56178 + if (unlikely(!restab_log[res]))
56181 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56182 + rlim = task_rlimit_max(task, res);
56184 + rlim = task_rlimit(task, res);
56186 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56190 + cred = __task_cred(task);
56192 + if (res == RLIMIT_NPROC &&
56193 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56194 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56195 + goto out_rcu_unlock;
56196 + else if (res == RLIMIT_MEMLOCK &&
56197 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56198 + goto out_rcu_unlock;
56199 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56200 + goto out_rcu_unlock;
56201 + rcu_read_unlock();
56203 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56207 + rcu_read_unlock();
56210 diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
56211 new file mode 100644
56212 index 0000000..5556be3
56214 +++ b/grsecurity/gracl_segv.c
56216 +#include <linux/kernel.h>
56217 +#include <linux/mm.h>
56218 +#include <asm/uaccess.h>
56219 +#include <asm/errno.h>
56220 +#include <asm/mman.h>
56221 +#include <net/sock.h>
56222 +#include <linux/file.h>
56223 +#include <linux/fs.h>
56224 +#include <linux/net.h>
56225 +#include <linux/in.h>
56226 +#include <linux/slab.h>
56227 +#include <linux/types.h>
56228 +#include <linux/sched.h>
56229 +#include <linux/timer.h>
56230 +#include <linux/gracl.h>
56231 +#include <linux/grsecurity.h>
56232 +#include <linux/grinternal.h>
56234 +static struct crash_uid *uid_set;
56235 +static unsigned short uid_used;
56236 +static DEFINE_SPINLOCK(gr_uid_lock);
56237 +extern rwlock_t gr_inode_lock;
56238 +extern struct acl_subject_label *
56239 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56240 + struct acl_role_label *role);
56242 +#ifdef CONFIG_BTRFS_FS
56243 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56244 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56247 +static inline dev_t __get_dev(const struct dentry *dentry)
56249 +#ifdef CONFIG_BTRFS_FS
56250 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56251 + return get_btrfs_dev_from_inode(dentry->d_inode);
56254 + return dentry->d_inode->i_sb->s_dev;
56258 +gr_init_uidset(void)
56261 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56264 + return uid_set ? 1 : 0;
56268 +gr_free_uidset(void)
56277 +gr_find_uid(const uid_t uid)
56279 + struct crash_uid *tmp = uid_set;
56281 + int low = 0, high = uid_used - 1, mid;
56283 + while (high >= low) {
56284 + mid = (low + high) >> 1;
56285 + buid = tmp[mid].uid;
56297 +static __inline__ void
56298 +gr_insertsort(void)
56300 + unsigned short i, j;
56301 + struct crash_uid index;
56303 + for (i = 1; i < uid_used; i++) {
56304 + index = uid_set[i];
56306 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56307 + uid_set[j] = uid_set[j - 1];
56310 + uid_set[j] = index;
56316 +static __inline__ void
56317 +gr_insert_uid(const uid_t uid, const unsigned long expires)
56321 + if (uid_used == GR_UIDTABLE_MAX)
56324 + loc = gr_find_uid(uid);
56327 + uid_set[loc].expires = expires;
56331 + uid_set[uid_used].uid = uid;
56332 + uid_set[uid_used].expires = expires;
56341 +gr_remove_uid(const unsigned short loc)
56343 + unsigned short i;
56345 + for (i = loc + 1; i < uid_used; i++)
56346 + uid_set[i - 1] = uid_set[i];
56354 +gr_check_crash_uid(const uid_t uid)
56359 + if (unlikely(!gr_acl_is_enabled()))
56362 + spin_lock(&gr_uid_lock);
56363 + loc = gr_find_uid(uid);
56368 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
56369 + gr_remove_uid(loc);
56374 + spin_unlock(&gr_uid_lock);
56378 +static __inline__ int
56379 +proc_is_setxid(const struct cred *cred)
56381 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
56382 + cred->uid != cred->fsuid)
56384 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56385 + cred->gid != cred->fsgid)
56391 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
56394 +gr_handle_crash(struct task_struct *task, const int sig)
56396 + struct acl_subject_label *curr;
56397 + struct task_struct *tsk, *tsk2;
56398 + const struct cred *cred;
56399 + const struct cred *cred2;
56401 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56404 + if (unlikely(!gr_acl_is_enabled()))
56407 + curr = task->acl;
56409 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
56412 + if (time_before_eq(curr->expires, get_seconds())) {
56413 + curr->expires = 0;
56414 + curr->crashes = 0;
56419 + if (!curr->expires)
56420 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56422 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56423 + time_after(curr->expires, get_seconds())) {
56425 + cred = __task_cred(task);
56426 + if (cred->uid && proc_is_setxid(cred)) {
56427 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56428 + spin_lock(&gr_uid_lock);
56429 + gr_insert_uid(cred->uid, curr->expires);
56430 + spin_unlock(&gr_uid_lock);
56431 + curr->expires = 0;
56432 + curr->crashes = 0;
56433 + read_lock(&tasklist_lock);
56434 + do_each_thread(tsk2, tsk) {
56435 + cred2 = __task_cred(tsk);
56436 + if (tsk != task && cred2->uid == cred->uid)
56437 + gr_fake_force_sig(SIGKILL, tsk);
56438 + } while_each_thread(tsk2, tsk);
56439 + read_unlock(&tasklist_lock);
56441 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56442 + read_lock(&tasklist_lock);
56443 + read_lock(&grsec_exec_file_lock);
56444 + do_each_thread(tsk2, tsk) {
56445 + if (likely(tsk != task)) {
56446 + // if this thread has the same subject as the one that triggered
56447 + // RES_CRASH and it's the same binary, kill it
56448 + if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
56449 + gr_fake_force_sig(SIGKILL, tsk);
56451 + } while_each_thread(tsk2, tsk);
56452 + read_unlock(&grsec_exec_file_lock);
56453 + read_unlock(&tasklist_lock);
56455 + rcu_read_unlock();
56462 +gr_check_crash_exec(const struct file *filp)
56464 + struct acl_subject_label *curr;
56466 + if (unlikely(!gr_acl_is_enabled()))
56469 + read_lock(&gr_inode_lock);
56470 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56471 + __get_dev(filp->f_path.dentry),
56473 + read_unlock(&gr_inode_lock);
56475 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56476 + (!curr->crashes && !curr->expires))
56479 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56480 + time_after(curr->expires, get_seconds()))
56482 + else if (time_before_eq(curr->expires, get_seconds())) {
56483 + curr->crashes = 0;
56484 + curr->expires = 0;
56491 +gr_handle_alertkill(struct task_struct *task)
56493 + struct acl_subject_label *curracl;
56495 + struct task_struct *p, *p2;
56497 + if (unlikely(!gr_acl_is_enabled()))
56500 + curracl = task->acl;
56501 + curr_ip = task->signal->curr_ip;
56503 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56504 + read_lock(&tasklist_lock);
56505 + do_each_thread(p2, p) {
56506 + if (p->signal->curr_ip == curr_ip)
56507 + gr_fake_force_sig(SIGKILL, p);
56508 + } while_each_thread(p2, p);
56509 + read_unlock(&tasklist_lock);
56510 + } else if (curracl->mode & GR_KILLPROC)
56511 + gr_fake_force_sig(SIGKILL, task);
56515 diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
56516 new file mode 100644
56517 index 0000000..9d83a69
56519 +++ b/grsecurity/gracl_shm.c
56521 +#include <linux/kernel.h>
56522 +#include <linux/mm.h>
56523 +#include <linux/sched.h>
56524 +#include <linux/file.h>
56525 +#include <linux/ipc.h>
56526 +#include <linux/gracl.h>
56527 +#include <linux/grsecurity.h>
56528 +#include <linux/grinternal.h>
56531 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56532 + const time_t shm_createtime, const uid_t cuid, const int shmid)
56534 + struct task_struct *task;
56536 + if (!gr_acl_is_enabled())
56540 + read_lock(&tasklist_lock);
56542 + task = find_task_by_vpid(shm_cprid);
56544 + if (unlikely(!task))
56545 + task = find_task_by_vpid(shm_lapid);
56547 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56548 + (task->pid == shm_lapid)) &&
56549 + (task->acl->mode & GR_PROTSHM) &&
56550 + (task->acl != current->acl))) {
56551 + read_unlock(&tasklist_lock);
56552 + rcu_read_unlock();
56553 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56556 + read_unlock(&tasklist_lock);
56557 + rcu_read_unlock();
56561 diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
56562 new file mode 100644
56563 index 0000000..bc0be01
56565 +++ b/grsecurity/grsec_chdir.c
56567 +#include <linux/kernel.h>
56568 +#include <linux/sched.h>
56569 +#include <linux/fs.h>
56570 +#include <linux/file.h>
56571 +#include <linux/grsecurity.h>
56572 +#include <linux/grinternal.h>
56575 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56577 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56578 + if ((grsec_enable_chdir && grsec_enable_group &&
56579 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56580 + !grsec_enable_group)) {
56581 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56586 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
56587 new file mode 100644
56588 index 0000000..a2dc675
56590 +++ b/grsecurity/grsec_chroot.c
56592 +#include <linux/kernel.h>
56593 +#include <linux/module.h>
56594 +#include <linux/sched.h>
56595 +#include <linux/file.h>
56596 +#include <linux/fs.h>
56597 +#include <linux/mount.h>
56598 +#include <linux/types.h>
56599 +#include <linux/pid_namespace.h>
56600 +#include <linux/grsecurity.h>
56601 +#include <linux/grinternal.h>
56603 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
56605 +#ifdef CONFIG_GRKERNSEC
56606 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
56607 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
56608 + task->gr_is_chrooted = 1;
56610 + task->gr_is_chrooted = 0;
56612 + task->gr_chroot_dentry = path->dentry;
56617 +void gr_clear_chroot_entries(struct task_struct *task)
56619 +#ifdef CONFIG_GRKERNSEC
56620 + task->gr_is_chrooted = 0;
56621 + task->gr_chroot_dentry = NULL;
56627 +gr_handle_chroot_unix(const pid_t pid)
56629 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
56630 + struct task_struct *p;
56632 + if (unlikely(!grsec_enable_chroot_unix))
56635 + if (likely(!proc_is_chrooted(current)))
56639 + read_lock(&tasklist_lock);
56640 + p = find_task_by_vpid_unrestricted(pid);
56641 + if (unlikely(p && !have_same_root(current, p))) {
56642 + read_unlock(&tasklist_lock);
56643 + rcu_read_unlock();
56644 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
56647 + read_unlock(&tasklist_lock);
56648 + rcu_read_unlock();
56654 +gr_handle_chroot_nice(void)
56656 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56657 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
56658 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
56666 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
56668 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56669 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
56670 + && proc_is_chrooted(current)) {
56671 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
56679 +gr_handle_chroot_rawio(const struct inode *inode)
56681 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56682 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
56683 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
56690 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
56692 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56693 + struct task_struct *p;
56695 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
56698 + read_lock(&tasklist_lock);
56699 + do_each_pid_task(pid, type, p) {
56700 + if (!have_same_root(current, p)) {
56704 + } while_each_pid_task(pid, type, p);
56706 + read_unlock(&tasklist_lock);
56713 +gr_pid_is_chrooted(struct task_struct *p)
56715 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56716 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
56719 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
56720 + !have_same_root(current, p)) {
56727 +EXPORT_SYMBOL(gr_pid_is_chrooted);
56729 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
56730 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
56732 + struct path path, currentroot;
56735 + path.dentry = (struct dentry *)u_dentry;
56736 + path.mnt = (struct vfsmount *)u_mnt;
56737 + get_fs_root(current->fs, ¤troot);
56738 + if (path_is_under(&path, ¤troot))
56740 + path_put(¤troot);
56747 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
56749 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
56750 + if (!grsec_enable_chroot_fchdir)
56753 + if (!proc_is_chrooted(current))
56755 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
56756 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
56764 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56765 + const time_t shm_createtime)
56767 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
56768 + struct task_struct *p;
56769 + time_t starttime;
56771 + if (unlikely(!grsec_enable_chroot_shmat))
56774 + if (likely(!proc_is_chrooted(current)))
56778 + read_lock(&tasklist_lock);
56780 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
56781 + starttime = p->start_time.tv_sec;
56782 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
56783 + if (have_same_root(current, p)) {
56786 + read_unlock(&tasklist_lock);
56787 + rcu_read_unlock();
56788 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56792 + /* creator exited, pid reuse, fall through to next check */
56794 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
56795 + if (unlikely(!have_same_root(current, p))) {
56796 + read_unlock(&tasklist_lock);
56797 + rcu_read_unlock();
56798 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56804 + read_unlock(&tasklist_lock);
56805 + rcu_read_unlock();
56811 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
56813 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
56814 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
56815 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
56821 +gr_handle_chroot_mknod(const struct dentry *dentry,
56822 + const struct vfsmount *mnt, const int mode)
56824 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
56825 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
56826 + proc_is_chrooted(current)) {
56827 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
56835 +gr_handle_chroot_mount(const struct dentry *dentry,
56836 + const struct vfsmount *mnt, const char *dev_name)
56838 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
56839 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
56840 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
56848 +gr_handle_chroot_pivot(void)
56850 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
56851 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
56852 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
56860 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
56862 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
56863 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
56864 + !gr_is_outside_chroot(dentry, mnt)) {
56865 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
56872 +extern const char *captab_log[];
56873 +extern int captab_log_entries;
56876 +gr_chroot_is_capable(const int cap)
56878 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56879 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56880 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56881 + if (cap_raised(chroot_caps, cap)) {
56882 + const struct cred *creds = current_cred();
56883 + if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
56884 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
56894 +gr_chroot_is_capable_nolog(const int cap)
56896 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56897 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56898 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56899 + if (cap_raised(chroot_caps, cap)) {
56908 +gr_handle_chroot_sysctl(const int op)
56910 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
56911 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
56912 + proc_is_chrooted(current))
56919 +gr_handle_chroot_chdir(struct path *path)
56921 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
56922 + if (grsec_enable_chroot_chdir)
56923 + set_fs_pwd(current->fs, path);
56929 +gr_handle_chroot_chmod(const struct dentry *dentry,
56930 + const struct vfsmount *mnt, const int mode)
56932 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
56933 + /* allow chmod +s on directories, but not files */
56934 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
56935 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
56936 + proc_is_chrooted(current)) {
56937 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
56943 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
56944 new file mode 100644
56945 index 0000000..d81a586
56947 +++ b/grsecurity/grsec_disabled.c
56949 +#include <linux/kernel.h>
56950 +#include <linux/module.h>
56951 +#include <linux/sched.h>
56952 +#include <linux/file.h>
56953 +#include <linux/fs.h>
56954 +#include <linux/kdev_t.h>
56955 +#include <linux/net.h>
56956 +#include <linux/in.h>
56957 +#include <linux/ip.h>
56958 +#include <linux/skbuff.h>
56959 +#include <linux/sysctl.h>
56961 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
56963 +pax_set_initial_flags(struct linux_binprm *bprm)
56969 +#ifdef CONFIG_SYSCTL
56971 +gr_handle_sysctl(const struct ctl_table * table, const int op)
56977 +#ifdef CONFIG_TASKSTATS
56978 +int gr_is_taskstats_denied(int pid)
56985 +gr_acl_is_enabled(void)
56991 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
56997 +gr_handle_rawio(const struct inode *inode)
57003 +gr_acl_handle_psacct(struct task_struct *task, const long code)
57009 +gr_handle_ptrace(struct task_struct *task, const long request)
57015 +gr_handle_proc_ptrace(struct task_struct *task)
57021 +gr_learn_resource(const struct task_struct *task,
57022 + const int res, const unsigned long wanted, const int gt)
57028 +gr_set_acls(const int type)
57034 +gr_check_hidden_task(const struct task_struct *tsk)
57040 +gr_check_protected_task(const struct task_struct *task)
57046 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57052 +gr_copy_label(struct task_struct *tsk)
57058 +gr_set_pax_flags(struct task_struct *task)
57064 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57065 + const int unsafe_share)
57071 +gr_handle_delete(const ino_t ino, const dev_t dev)
57077 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57083 +gr_handle_crash(struct task_struct *task, const int sig)
57089 +gr_check_crash_exec(const struct file *filp)
57095 +gr_check_crash_uid(const uid_t uid)
57101 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57102 + struct dentry *old_dentry,
57103 + struct dentry *new_dentry,
57104 + struct vfsmount *mnt, const __u8 replace)
57110 +gr_search_socket(const int family, const int type, const int protocol)
57116 +gr_search_connectbind(const int mode, const struct socket *sock,
57117 + const struct sockaddr_in *addr)
57123 +gr_handle_alertkill(struct task_struct *task)
57129 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57135 +gr_acl_handle_hidden_file(const struct dentry * dentry,
57136 + const struct vfsmount * mnt)
57142 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57149 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57155 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57161 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57162 + unsigned int *vm_flags)
57168 +gr_acl_handle_truncate(const struct dentry * dentry,
57169 + const struct vfsmount * mnt)
57175 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57181 +gr_acl_handle_access(const struct dentry * dentry,
57182 + const struct vfsmount * mnt, const int fmode)
57188 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57195 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57202 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57208 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57214 +grsecurity_init(void)
57220 +gr_acl_handle_mknod(const struct dentry * new_dentry,
57221 + const struct dentry * parent_dentry,
57222 + const struct vfsmount * parent_mnt,
57229 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
57230 + const struct dentry * parent_dentry,
57231 + const struct vfsmount * parent_mnt)
57237 +gr_acl_handle_symlink(const struct dentry * new_dentry,
57238 + const struct dentry * parent_dentry,
57239 + const struct vfsmount * parent_mnt, const char *from)
57245 +gr_acl_handle_link(const struct dentry * new_dentry,
57246 + const struct dentry * parent_dentry,
57247 + const struct vfsmount * parent_mnt,
57248 + const struct dentry * old_dentry,
57249 + const struct vfsmount * old_mnt, const char *to)
57255 +gr_acl_handle_rename(const struct dentry *new_dentry,
57256 + const struct dentry *parent_dentry,
57257 + const struct vfsmount *parent_mnt,
57258 + const struct dentry *old_dentry,
57259 + const struct inode *old_parent_inode,
57260 + const struct vfsmount *old_mnt, const char *newname)
57266 +gr_acl_handle_filldir(const struct file *file, const char *name,
57267 + const int namelen, const ino_t ino)
57273 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57274 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57280 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57286 +gr_search_accept(const struct socket *sock)
57292 +gr_search_listen(const struct socket *sock)
57298 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57304 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57310 +gr_acl_handle_creat(const struct dentry * dentry,
57311 + const struct dentry * p_dentry,
57312 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
57319 +gr_acl_handle_exit(void)
57325 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57331 +gr_set_role_label(const uid_t uid, const gid_t gid)
57337 +gr_acl_handle_procpidmem(const struct task_struct *task)
57343 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57349 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57355 +gr_set_kernel_label(struct task_struct *task)
57361 +gr_check_user_change(int real, int effective, int fs)
57367 +gr_check_group_change(int real, int effective, int fs)
57372 +int gr_acl_enable_at_secure(void)
57377 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57379 + return dentry->d_inode->i_sb->s_dev;
57382 +EXPORT_SYMBOL(gr_learn_resource);
57383 +EXPORT_SYMBOL(gr_set_kernel_label);
57384 +#ifdef CONFIG_SECURITY
57385 +EXPORT_SYMBOL(gr_check_user_change);
57386 +EXPORT_SYMBOL(gr_check_group_change);
57388 diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
57389 new file mode 100644
57390 index 0000000..2b05ada
57392 +++ b/grsecurity/grsec_exec.c
57394 +#include <linux/kernel.h>
57395 +#include <linux/sched.h>
57396 +#include <linux/file.h>
57397 +#include <linux/binfmts.h>
57398 +#include <linux/fs.h>
57399 +#include <linux/types.h>
57400 +#include <linux/grdefs.h>
57401 +#include <linux/grsecurity.h>
57402 +#include <linux/grinternal.h>
57403 +#include <linux/capability.h>
57404 +#include <linux/module.h>
57406 +#include <asm/uaccess.h>
57408 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57409 +static char gr_exec_arg_buf[132];
57410 +static DEFINE_MUTEX(gr_exec_arg_mutex);
57413 +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
57416 +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
57418 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57419 + char *grarg = gr_exec_arg_buf;
57420 + unsigned int i, x, execlen = 0;
57423 + if (!((grsec_enable_execlog && grsec_enable_group &&
57424 + in_group_p(grsec_audit_gid))
57425 + || (grsec_enable_execlog && !grsec_enable_group)))
57428 + mutex_lock(&gr_exec_arg_mutex);
57429 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
57431 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
57432 + const char __user *p;
57433 + unsigned int len;
57435 + p = get_user_arg_ptr(argv, i);
57439 + len = strnlen_user(p, 128 - execlen);
57440 + if (len > 128 - execlen)
57441 + len = 128 - execlen;
57442 + else if (len > 0)
57444 + if (copy_from_user(grarg + execlen, p, len))
57447 + /* rewrite unprintable characters */
57448 + for (x = 0; x < len; x++) {
57449 + c = *(grarg + execlen + x);
57450 + if (c < 32 || c > 126)
57451 + *(grarg + execlen + x) = ' ';
57455 + *(grarg + execlen) = ' ';
57456 + *(grarg + execlen + 1) = '\0';
57461 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57462 + bprm->file->f_path.mnt, grarg);
57463 + mutex_unlock(&gr_exec_arg_mutex);
57468 +#ifdef CONFIG_GRKERNSEC
57469 +extern int gr_acl_is_capable(const int cap);
57470 +extern int gr_acl_is_capable_nolog(const int cap);
57471 +extern int gr_chroot_is_capable(const int cap);
57472 +extern int gr_chroot_is_capable_nolog(const int cap);
57475 +const char *captab_log[] = {
57477 + "CAP_DAC_OVERRIDE",
57478 + "CAP_DAC_READ_SEARCH",
57485 + "CAP_LINUX_IMMUTABLE",
57486 + "CAP_NET_BIND_SERVICE",
57487 + "CAP_NET_BROADCAST",
57492 + "CAP_SYS_MODULE",
57494 + "CAP_SYS_CHROOT",
57495 + "CAP_SYS_PTRACE",
57500 + "CAP_SYS_RESOURCE",
57502 + "CAP_SYS_TTY_CONFIG",
57505 + "CAP_AUDIT_WRITE",
57506 + "CAP_AUDIT_CONTROL",
57508 + "CAP_MAC_OVERRIDE",
57514 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
57516 +int gr_is_capable(const int cap)
57518 +#ifdef CONFIG_GRKERNSEC
57519 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
57527 +int gr_is_capable_nolog(const int cap)
57529 +#ifdef CONFIG_GRKERNSEC
57530 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
57538 +EXPORT_SYMBOL(gr_is_capable);
57539 +EXPORT_SYMBOL(gr_is_capable_nolog);
57540 diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
57541 new file mode 100644
57542 index 0000000..d3ee748
57544 +++ b/grsecurity/grsec_fifo.c
57546 +#include <linux/kernel.h>
57547 +#include <linux/sched.h>
57548 +#include <linux/fs.h>
57549 +#include <linux/file.h>
57550 +#include <linux/grinternal.h>
57553 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57554 + const struct dentry *dir, const int flag, const int acc_mode)
57556 +#ifdef CONFIG_GRKERNSEC_FIFO
57557 + const struct cred *cred = current_cred();
57559 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57560 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57561 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57562 + (cred->fsuid != dentry->d_inode->i_uid)) {
57563 + if (!inode_permission(dentry->d_inode, acc_mode))
57564 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57570 diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
57571 new file mode 100644
57572 index 0000000..8ca18bf
57574 +++ b/grsecurity/grsec_fork.c
57576 +#include <linux/kernel.h>
57577 +#include <linux/sched.h>
57578 +#include <linux/grsecurity.h>
57579 +#include <linux/grinternal.h>
57580 +#include <linux/errno.h>
57583 +gr_log_forkfail(const int retval)
57585 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
57586 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
57587 + switch (retval) {
57589 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
57592 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
57599 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
57600 new file mode 100644
57601 index 0000000..cb8e5a1
57603 +++ b/grsecurity/grsec_init.c
57605 +#include <linux/kernel.h>
57606 +#include <linux/sched.h>
57607 +#include <linux/mm.h>
57608 +#include <linux/gracl.h>
57609 +#include <linux/slab.h>
57610 +#include <linux/vmalloc.h>
57611 +#include <linux/percpu.h>
57612 +#include <linux/module.h>
57614 +int grsec_enable_setxid;
57615 +int grsec_enable_brute;
57616 +int grsec_enable_link;
57617 +int grsec_enable_dmesg;
57618 +int grsec_enable_harden_ptrace;
57619 +int grsec_enable_fifo;
57620 +int grsec_enable_execlog;
57621 +int grsec_enable_signal;
57622 +int grsec_enable_forkfail;
57623 +int grsec_enable_audit_ptrace;
57624 +int grsec_enable_time;
57625 +int grsec_enable_audit_textrel;
57626 +int grsec_enable_group;
57627 +int grsec_audit_gid;
57628 +int grsec_enable_chdir;
57629 +int grsec_enable_mount;
57630 +int grsec_enable_rofs;
57631 +int grsec_enable_chroot_findtask;
57632 +int grsec_enable_chroot_mount;
57633 +int grsec_enable_chroot_shmat;
57634 +int grsec_enable_chroot_fchdir;
57635 +int grsec_enable_chroot_double;
57636 +int grsec_enable_chroot_pivot;
57637 +int grsec_enable_chroot_chdir;
57638 +int grsec_enable_chroot_chmod;
57639 +int grsec_enable_chroot_mknod;
57640 +int grsec_enable_chroot_nice;
57641 +int grsec_enable_chroot_execlog;
57642 +int grsec_enable_chroot_caps;
57643 +int grsec_enable_chroot_sysctl;
57644 +int grsec_enable_chroot_unix;
57645 +int grsec_enable_tpe;
57646 +int grsec_tpe_gid;
57647 +int grsec_enable_blackhole;
57648 +#ifdef CONFIG_IPV6_MODULE
57649 +EXPORT_SYMBOL(grsec_enable_blackhole);
57651 +int grsec_lastack_retries;
57652 +int grsec_enable_tpe_all;
57653 +int grsec_enable_tpe_invert;
57654 +int grsec_enable_socket_all;
57655 +int grsec_socket_all_gid;
57656 +int grsec_enable_socket_client;
57657 +int grsec_socket_client_gid;
57658 +int grsec_enable_socket_server;
57659 +int grsec_socket_server_gid;
57660 +int grsec_resource_logging;
57661 +int grsec_disable_privio;
57662 +int grsec_enable_log_rwxmaps;
57665 +DEFINE_SPINLOCK(grsec_alert_lock);
57666 +unsigned long grsec_alert_wtime = 0;
57667 +unsigned long grsec_alert_fyet = 0;
57669 +DEFINE_SPINLOCK(grsec_audit_lock);
57671 +DEFINE_RWLOCK(grsec_exec_file_lock);
57673 +char *gr_shared_page[4];
57675 +char *gr_alert_log_fmt;
57676 +char *gr_audit_log_fmt;
57677 +char *gr_alert_log_buf;
57678 +char *gr_audit_log_buf;
57680 +extern struct gr_arg *gr_usermode;
57681 +extern unsigned char *gr_system_salt;
57682 +extern unsigned char *gr_system_sum;
57685 +grsecurity_init(void)
57688 + /* create the per-cpu shared pages */
57691 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
57694 + for (j = 0; j < 4; j++) {
57695 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
57696 + if (gr_shared_page[j] == NULL) {
57697 + panic("Unable to allocate grsecurity shared page");
57702 + /* allocate log buffers */
57703 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
57704 + if (!gr_alert_log_fmt) {
57705 + panic("Unable to allocate grsecurity alert log format buffer");
57708 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
57709 + if (!gr_audit_log_fmt) {
57710 + panic("Unable to allocate grsecurity audit log format buffer");
57713 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57714 + if (!gr_alert_log_buf) {
57715 + panic("Unable to allocate grsecurity alert log buffer");
57718 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57719 + if (!gr_audit_log_buf) {
57720 + panic("Unable to allocate grsecurity audit log buffer");
57724 + /* allocate memory for authentication structure */
57725 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
57726 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
57727 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
57729 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
57730 + panic("Unable to allocate grsecurity authentication structure");
57735 +#ifdef CONFIG_GRKERNSEC_IO
57736 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
57737 + grsec_disable_privio = 1;
57738 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57739 + grsec_disable_privio = 1;
57741 + grsec_disable_privio = 0;
57745 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
57746 + /* for backward compatibility, tpe_invert always defaults to on if
57747 + enabled in the kernel
57749 + grsec_enable_tpe_invert = 1;
57752 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57753 +#ifndef CONFIG_GRKERNSEC_SYSCTL
57757 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
57758 + grsec_enable_audit_textrel = 1;
57760 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57761 + grsec_enable_log_rwxmaps = 1;
57763 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
57764 + grsec_enable_group = 1;
57765 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
57767 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57768 + grsec_enable_chdir = 1;
57770 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
57771 + grsec_enable_harden_ptrace = 1;
57773 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
57774 + grsec_enable_mount = 1;
57776 +#ifdef CONFIG_GRKERNSEC_LINK
57777 + grsec_enable_link = 1;
57779 +#ifdef CONFIG_GRKERNSEC_BRUTE
57780 + grsec_enable_brute = 1;
57782 +#ifdef CONFIG_GRKERNSEC_DMESG
57783 + grsec_enable_dmesg = 1;
57785 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
57786 + grsec_enable_blackhole = 1;
57787 + grsec_lastack_retries = 4;
57789 +#ifdef CONFIG_GRKERNSEC_FIFO
57790 + grsec_enable_fifo = 1;
57792 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57793 + grsec_enable_execlog = 1;
57795 +#ifdef CONFIG_GRKERNSEC_SETXID
57796 + grsec_enable_setxid = 1;
57798 +#ifdef CONFIG_GRKERNSEC_SIGNAL
57799 + grsec_enable_signal = 1;
57801 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
57802 + grsec_enable_forkfail = 1;
57804 +#ifdef CONFIG_GRKERNSEC_TIME
57805 + grsec_enable_time = 1;
57807 +#ifdef CONFIG_GRKERNSEC_RESLOG
57808 + grsec_resource_logging = 1;
57810 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57811 + grsec_enable_chroot_findtask = 1;
57813 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57814 + grsec_enable_chroot_unix = 1;
57816 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57817 + grsec_enable_chroot_mount = 1;
57819 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57820 + grsec_enable_chroot_fchdir = 1;
57822 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57823 + grsec_enable_chroot_shmat = 1;
57825 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
57826 + grsec_enable_audit_ptrace = 1;
57828 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57829 + grsec_enable_chroot_double = 1;
57831 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57832 + grsec_enable_chroot_pivot = 1;
57834 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57835 + grsec_enable_chroot_chdir = 1;
57837 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57838 + grsec_enable_chroot_chmod = 1;
57840 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57841 + grsec_enable_chroot_mknod = 1;
57843 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57844 + grsec_enable_chroot_nice = 1;
57846 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57847 + grsec_enable_chroot_execlog = 1;
57849 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57850 + grsec_enable_chroot_caps = 1;
57852 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57853 + grsec_enable_chroot_sysctl = 1;
57855 +#ifdef CONFIG_GRKERNSEC_TPE
57856 + grsec_enable_tpe = 1;
57857 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
57858 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
57859 + grsec_enable_tpe_all = 1;
57862 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57863 + grsec_enable_socket_all = 1;
57864 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
57866 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57867 + grsec_enable_socket_client = 1;
57868 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
57870 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57871 + grsec_enable_socket_server = 1;
57872 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
57878 diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
57879 new file mode 100644
57880 index 0000000..3efe141
57882 +++ b/grsecurity/grsec_link.c
57884 +#include <linux/kernel.h>
57885 +#include <linux/sched.h>
57886 +#include <linux/fs.h>
57887 +#include <linux/file.h>
57888 +#include <linux/grinternal.h>
57891 +gr_handle_follow_link(const struct inode *parent,
57892 + const struct inode *inode,
57893 + const struct dentry *dentry, const struct vfsmount *mnt)
57895 +#ifdef CONFIG_GRKERNSEC_LINK
57896 + const struct cred *cred = current_cred();
57898 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
57899 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
57900 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
57901 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
57909 +gr_handle_hardlink(const struct dentry *dentry,
57910 + const struct vfsmount *mnt,
57911 + struct inode *inode, const int mode, const char *to)
57913 +#ifdef CONFIG_GRKERNSEC_LINK
57914 + const struct cred *cred = current_cred();
57916 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
57917 + (!S_ISREG(mode) || (mode & S_ISUID) ||
57918 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
57919 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
57920 + !capable(CAP_FOWNER) && cred->uid) {
57921 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
57927 diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
57928 new file mode 100644
57929 index 0000000..a45d2e9
57931 +++ b/grsecurity/grsec_log.c
57933 +#include <linux/kernel.h>
57934 +#include <linux/sched.h>
57935 +#include <linux/file.h>
57936 +#include <linux/tty.h>
57937 +#include <linux/fs.h>
57938 +#include <linux/grinternal.h>
57940 +#ifdef CONFIG_TREE_PREEMPT_RCU
57941 +#define DISABLE_PREEMPT() preempt_disable()
57942 +#define ENABLE_PREEMPT() preempt_enable()
57944 +#define DISABLE_PREEMPT()
57945 +#define ENABLE_PREEMPT()
57948 +#define BEGIN_LOCKS(x) \
57949 + DISABLE_PREEMPT(); \
57950 + rcu_read_lock(); \
57951 + read_lock(&tasklist_lock); \
57952 + read_lock(&grsec_exec_file_lock); \
57953 + if (x != GR_DO_AUDIT) \
57954 + spin_lock(&grsec_alert_lock); \
57956 + spin_lock(&grsec_audit_lock)
57958 +#define END_LOCKS(x) \
57959 + if (x != GR_DO_AUDIT) \
57960 + spin_unlock(&grsec_alert_lock); \
57962 + spin_unlock(&grsec_audit_lock); \
57963 + read_unlock(&grsec_exec_file_lock); \
57964 + read_unlock(&tasklist_lock); \
57965 + rcu_read_unlock(); \
57966 + ENABLE_PREEMPT(); \
57967 + if (x == GR_DONT_AUDIT) \
57968 + gr_handle_alertkill(current)
57975 +extern char *gr_alert_log_fmt;
57976 +extern char *gr_audit_log_fmt;
57977 +extern char *gr_alert_log_buf;
57978 +extern char *gr_audit_log_buf;
57980 +static int gr_log_start(int audit)
57982 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
57983 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
57984 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57985 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
57986 + unsigned long curr_secs = get_seconds();
57988 + if (audit == GR_DO_AUDIT)
57991 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
57992 + grsec_alert_wtime = curr_secs;
57993 + grsec_alert_fyet = 0;
57994 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
57995 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
57996 + grsec_alert_fyet++;
57997 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
57998 + grsec_alert_wtime = curr_secs;
57999 + grsec_alert_fyet++;
58000 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58003 + else return FLOODING;
58007 + memset(buf, 0, PAGE_SIZE);
58008 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
58009 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58010 + snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58011 + } else if (current->signal->curr_ip) {
58012 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58013 + snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip);
58014 + } else if (gr_acl_is_enabled()) {
58015 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58016 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58018 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
58019 + strcpy(buf, fmt);
58022 + return NO_FLOODING;
58025 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58026 + __attribute__ ((format (printf, 2, 0)));
58028 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58030 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58031 + unsigned int len = strlen(buf);
58033 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58038 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58039 + __attribute__ ((format (printf, 2, 3)));
58041 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58043 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58044 + unsigned int len = strlen(buf);
58047 + va_start(ap, msg);
58048 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58054 +static void gr_log_end(int audit, int append_default)
58056 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58058 + if (append_default) {
58059 + unsigned int len = strlen(buf);
58060 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58063 + printk("%s\n", buf);
58068 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58071 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58072 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58073 + void *voidptr = NULL;
58074 + int num1 = 0, num2 = 0;
58075 + unsigned long ulong1 = 0, ulong2 = 0;
58076 + struct dentry *dentry = NULL;
58077 + struct vfsmount *mnt = NULL;
58078 + struct file *file = NULL;
58079 + struct task_struct *task = NULL;
58080 + const struct cred *cred, *pcred;
58083 + BEGIN_LOCKS(audit);
58084 + logtype = gr_log_start(audit);
58085 + if (logtype == FLOODING) {
58086 + END_LOCKS(audit);
58089 + va_start(ap, argtypes);
58090 + switch (argtypes) {
58091 + case GR_TTYSNIFF:
58092 + task = va_arg(ap, struct task_struct *);
58093 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58095 + case GR_SYSCTL_HIDDEN:
58096 + str1 = va_arg(ap, char *);
58097 + gr_log_middle_varargs(audit, msg, result, str1);
58100 + dentry = va_arg(ap, struct dentry *);
58101 + mnt = va_arg(ap, struct vfsmount *);
58102 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58104 + case GR_RBAC_STR:
58105 + dentry = va_arg(ap, struct dentry *);
58106 + mnt = va_arg(ap, struct vfsmount *);
58107 + str1 = va_arg(ap, char *);
58108 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58110 + case GR_STR_RBAC:
58111 + str1 = va_arg(ap, char *);
58112 + dentry = va_arg(ap, struct dentry *);
58113 + mnt = va_arg(ap, struct vfsmount *);
58114 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58116 + case GR_RBAC_MODE2:
58117 + dentry = va_arg(ap, struct dentry *);
58118 + mnt = va_arg(ap, struct vfsmount *);
58119 + str1 = va_arg(ap, char *);
58120 + str2 = va_arg(ap, char *);
58121 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58123 + case GR_RBAC_MODE3:
58124 + dentry = va_arg(ap, struct dentry *);
58125 + mnt = va_arg(ap, struct vfsmount *);
58126 + str1 = va_arg(ap, char *);
58127 + str2 = va_arg(ap, char *);
58128 + str3 = va_arg(ap, char *);
58129 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58131 + case GR_FILENAME:
58132 + dentry = va_arg(ap, struct dentry *);
58133 + mnt = va_arg(ap, struct vfsmount *);
58134 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58136 + case GR_STR_FILENAME:
58137 + str1 = va_arg(ap, char *);
58138 + dentry = va_arg(ap, struct dentry *);
58139 + mnt = va_arg(ap, struct vfsmount *);
58140 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58142 + case GR_FILENAME_STR:
58143 + dentry = va_arg(ap, struct dentry *);
58144 + mnt = va_arg(ap, struct vfsmount *);
58145 + str1 = va_arg(ap, char *);
58146 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58148 + case GR_FILENAME_TWO_INT:
58149 + dentry = va_arg(ap, struct dentry *);
58150 + mnt = va_arg(ap, struct vfsmount *);
58151 + num1 = va_arg(ap, int);
58152 + num2 = va_arg(ap, int);
58153 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58155 + case GR_FILENAME_TWO_INT_STR:
58156 + dentry = va_arg(ap, struct dentry *);
58157 + mnt = va_arg(ap, struct vfsmount *);
58158 + num1 = va_arg(ap, int);
58159 + num2 = va_arg(ap, int);
58160 + str1 = va_arg(ap, char *);
58161 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58164 + file = va_arg(ap, struct file *);
58165 + ulong1 = va_arg(ap, unsigned long);
58166 + ulong2 = va_arg(ap, unsigned long);
58167 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58170 + task = va_arg(ap, struct task_struct *);
58171 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58173 + case GR_RESOURCE:
58174 + task = va_arg(ap, struct task_struct *);
58175 + cred = __task_cred(task);
58176 + pcred = __task_cred(task->real_parent);
58177 + ulong1 = va_arg(ap, unsigned long);
58178 + str1 = va_arg(ap, char *);
58179 + ulong2 = va_arg(ap, unsigned long);
58180 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58183 + task = va_arg(ap, struct task_struct *);
58184 + cred = __task_cred(task);
58185 + pcred = __task_cred(task->real_parent);
58186 + str1 = va_arg(ap, char *);
58187 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58190 + str1 = va_arg(ap, char *);
58191 + voidptr = va_arg(ap, void *);
58192 + gr_log_middle_varargs(audit, msg, str1, voidptr);
58195 + task = va_arg(ap, struct task_struct *);
58196 + cred = __task_cred(task);
58197 + pcred = __task_cred(task->real_parent);
58198 + num1 = va_arg(ap, int);
58199 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58202 + task = va_arg(ap, struct task_struct *);
58203 + cred = __task_cred(task);
58204 + pcred = __task_cred(task->real_parent);
58205 + ulong1 = va_arg(ap, unsigned long);
58206 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58209 + task = va_arg(ap, struct task_struct *);
58210 + cred = __task_cred(task);
58211 + pcred = __task_cred(task->real_parent);
58212 + ulong1 = va_arg(ap, unsigned long);
58213 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58216 + file = va_arg(ap, struct file *);
58217 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58221 + unsigned int wday, cday;
58225 + char cur_tty[64] = { 0 };
58226 + char parent_tty[64] = { 0 };
58228 + task = va_arg(ap, struct task_struct *);
58229 + wday = va_arg(ap, unsigned int);
58230 + cday = va_arg(ap, unsigned int);
58231 + whr = va_arg(ap, int);
58232 + chr = va_arg(ap, int);
58233 + wmin = va_arg(ap, int);
58234 + cmin = va_arg(ap, int);
58235 + wsec = va_arg(ap, int);
58236 + csec = va_arg(ap, int);
58237 + ulong1 = va_arg(ap, unsigned long);
58238 + cred = __task_cred(task);
58239 + pcred = __task_cred(task->real_parent);
58241 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58245 + gr_log_middle(audit, msg, ap);
58248 + // these don't need DEFAULTSECARGS printed on the end
58249 + if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
58250 + gr_log_end(audit, 0);
58252 + gr_log_end(audit, 1);
58253 + END_LOCKS(audit);
58255 diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
58256 new file mode 100644
58257 index 0000000..6c0416b
58259 +++ b/grsecurity/grsec_mem.c
58261 +#include <linux/kernel.h>
58262 +#include <linux/sched.h>
58263 +#include <linux/mm.h>
58264 +#include <linux/mman.h>
58265 +#include <linux/grinternal.h>
58268 +gr_handle_ioperm(void)
58270 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58275 +gr_handle_iopl(void)
58277 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58282 +gr_handle_mem_readwrite(u64 from, u64 to)
58284 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58289 +gr_handle_vm86(void)
58291 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58294 diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
58295 new file mode 100644
58296 index 0000000..2131422
58298 +++ b/grsecurity/grsec_mount.c
58300 +#include <linux/kernel.h>
58301 +#include <linux/sched.h>
58302 +#include <linux/mount.h>
58303 +#include <linux/grsecurity.h>
58304 +#include <linux/grinternal.h>
58307 +gr_log_remount(const char *devname, const int retval)
58309 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58310 + if (grsec_enable_mount && (retval >= 0))
58311 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58317 +gr_log_unmount(const char *devname, const int retval)
58319 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58320 + if (grsec_enable_mount && (retval >= 0))
58321 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58327 +gr_log_mount(const char *from, const char *to, const int retval)
58329 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58330 + if (grsec_enable_mount && (retval >= 0))
58331 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58337 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58339 +#ifdef CONFIG_GRKERNSEC_ROFS
58340 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58341 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58350 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58352 +#ifdef CONFIG_GRKERNSEC_ROFS
58353 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58354 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58355 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58362 diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
58363 new file mode 100644
58364 index 0000000..a3b12a0
58366 +++ b/grsecurity/grsec_pax.c
58368 +#include <linux/kernel.h>
58369 +#include <linux/sched.h>
58370 +#include <linux/mm.h>
58371 +#include <linux/file.h>
58372 +#include <linux/grinternal.h>
58373 +#include <linux/grsecurity.h>
58376 +gr_log_textrel(struct vm_area_struct * vma)
58378 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58379 + if (grsec_enable_audit_textrel)
58380 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58386 +gr_log_rwxmmap(struct file *file)
58388 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58389 + if (grsec_enable_log_rwxmaps)
58390 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58396 +gr_log_rwxmprotect(struct file *file)
58398 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58399 + if (grsec_enable_log_rwxmaps)
58400 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58404 diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
58405 new file mode 100644
58406 index 0000000..472c1d6
58408 +++ b/grsecurity/grsec_ptrace.c
58410 +#include <linux/kernel.h>
58411 +#include <linux/sched.h>
58412 +#include <linux/grinternal.h>
58413 +#include <linux/grsecurity.h>
58416 +gr_audit_ptrace(struct task_struct *task)
58418 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58419 + if (grsec_enable_audit_ptrace)
58420 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58424 diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
58425 new file mode 100644
58426 index 0000000..cf090b3
58428 +++ b/grsecurity/grsec_sig.c
58430 +#include <linux/kernel.h>
58431 +#include <linux/sched.h>
58432 +#include <linux/delay.h>
58433 +#include <linux/grsecurity.h>
58434 +#include <linux/grinternal.h>
58435 +#include <linux/hardirq.h>
58437 +char *signames[] = {
58438 + [SIGSEGV] = "Segmentation fault",
58439 + [SIGILL] = "Illegal instruction",
58440 + [SIGABRT] = "Abort",
58441 + [SIGBUS] = "Invalid alignment/Bus error"
58445 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58447 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58448 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58449 + (sig == SIGABRT) || (sig == SIGBUS))) {
58450 + if (t->pid == current->pid) {
58451 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58453 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58461 +gr_handle_signal(const struct task_struct *p, const int sig)
58463 +#ifdef CONFIG_GRKERNSEC
58464 + if (current->pid > 1 && gr_check_protected_task(p)) {
58465 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58467 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58474 +#ifdef CONFIG_GRKERNSEC
58475 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58477 +int gr_fake_force_sig(int sig, struct task_struct *t)
58479 + unsigned long int flags;
58480 + int ret, blocked, ignored;
58481 + struct k_sigaction *action;
58483 + spin_lock_irqsave(&t->sighand->siglock, flags);
58484 + action = &t->sighand->action[sig-1];
58485 + ignored = action->sa.sa_handler == SIG_IGN;
58486 + blocked = sigismember(&t->blocked, sig);
58487 + if (blocked || ignored) {
58488 + action->sa.sa_handler = SIG_DFL;
58490 + sigdelset(&t->blocked, sig);
58491 + recalc_sigpending_and_wake(t);
58494 + if (action->sa.sa_handler == SIG_DFL)
58495 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
58496 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58498 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
58504 +#ifdef CONFIG_GRKERNSEC_BRUTE
58505 +#define GR_USER_BAN_TIME (15 * 60)
58507 +static int __get_dumpable(unsigned long mm_flags)
58511 + ret = mm_flags & MMF_DUMPABLE_MASK;
58512 + return (ret >= 2) ? 2 : ret;
58516 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58518 +#ifdef CONFIG_GRKERNSEC_BRUTE
58521 + if (!grsec_enable_brute)
58525 + read_lock(&tasklist_lock);
58526 + read_lock(&grsec_exec_file_lock);
58527 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58528 + p->real_parent->brute = 1;
58530 + const struct cred *cred = __task_cred(p), *cred2;
58531 + struct task_struct *tsk, *tsk2;
58533 + if (!__get_dumpable(mm_flags) && cred->uid) {
58534 + struct user_struct *user;
58538 + /* this is put upon execution past expiration */
58539 + user = find_user(uid);
58540 + if (user == NULL)
58542 + user->banned = 1;
58543 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58544 + if (user->ban_expires == ~0UL)
58545 + user->ban_expires--;
58547 + do_each_thread(tsk2, tsk) {
58548 + cred2 = __task_cred(tsk);
58549 + if (tsk != p && cred2->uid == uid)
58550 + gr_fake_force_sig(SIGKILL, tsk);
58551 + } while_each_thread(tsk2, tsk);
58555 + read_unlock(&grsec_exec_file_lock);
58556 + read_unlock(&tasklist_lock);
58557 + rcu_read_unlock();
58560 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58566 +void gr_handle_brute_check(void)
58568 +#ifdef CONFIG_GRKERNSEC_BRUTE
58569 + if (current->brute)
58570 + msleep(30 * 1000);
58575 +void gr_handle_kernel_exploit(void)
58577 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58578 + const struct cred *cred;
58579 + struct task_struct *tsk, *tsk2;
58580 + struct user_struct *user;
58583 + if (in_irq() || in_serving_softirq() || in_nmi())
58584 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58586 + uid = current_uid();
58589 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
58591 + /* kill all the processes of this user, hold a reference
58592 + to their creds struct, and prevent them from creating
58593 + another process until system reset
58595 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58596 + /* we intentionally leak this ref */
58597 + user = get_uid(current->cred->user);
58599 + user->banned = 1;
58600 + user->ban_expires = ~0UL;
58603 + read_lock(&tasklist_lock);
58604 + do_each_thread(tsk2, tsk) {
58605 + cred = __task_cred(tsk);
58606 + if (cred->uid == uid)
58607 + gr_fake_force_sig(SIGKILL, tsk);
58608 + } while_each_thread(tsk2, tsk);
58609 + read_unlock(&tasklist_lock);
58614 +int __gr_process_user_ban(struct user_struct *user)
58616 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58617 + if (unlikely(user->banned)) {
58618 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
58619 + user->banned = 0;
58620 + user->ban_expires = 0;
58629 +int gr_process_user_ban(void)
58631 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58632 + return __gr_process_user_ban(current->cred->user);
58636 diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
58637 new file mode 100644
58638 index 0000000..4030d57
58640 +++ b/grsecurity/grsec_sock.c
58642 +#include <linux/kernel.h>
58643 +#include <linux/module.h>
58644 +#include <linux/sched.h>
58645 +#include <linux/file.h>
58646 +#include <linux/net.h>
58647 +#include <linux/in.h>
58648 +#include <linux/ip.h>
58649 +#include <net/sock.h>
58650 +#include <net/inet_sock.h>
58651 +#include <linux/grsecurity.h>
58652 +#include <linux/grinternal.h>
58653 +#include <linux/gracl.h>
58655 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
58656 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
58658 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
58659 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
58661 +#ifdef CONFIG_UNIX_MODULE
58662 +EXPORT_SYMBOL(gr_acl_handle_unix);
58663 +EXPORT_SYMBOL(gr_acl_handle_mknod);
58664 +EXPORT_SYMBOL(gr_handle_chroot_unix);
58665 +EXPORT_SYMBOL(gr_handle_create);
58668 +#ifdef CONFIG_GRKERNSEC
58669 +#define gr_conn_table_size 32749
58670 +struct conn_table_entry {
58671 + struct conn_table_entry *next;
58672 + struct signal_struct *sig;
58675 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
58676 +DEFINE_SPINLOCK(gr_conn_table_lock);
58678 +extern const char * gr_socktype_to_name(unsigned char type);
58679 +extern const char * gr_proto_to_name(unsigned char proto);
58680 +extern const char * gr_sockfamily_to_name(unsigned char family);
58682 +static __inline__ int
58683 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
58685 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
58688 +static __inline__ int
58689 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
58690 + __u16 sport, __u16 dport)
58692 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
58693 + sig->gr_sport == sport && sig->gr_dport == dport))
58699 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
58701 + struct conn_table_entry **match;
58702 + unsigned int index;
58704 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58705 + sig->gr_sport, sig->gr_dport,
58706 + gr_conn_table_size);
58708 + newent->sig = sig;
58710 + match = &gr_conn_table[index];
58711 + newent->next = *match;
58717 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
58719 + struct conn_table_entry *match, *last = NULL;
58720 + unsigned int index;
58722 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58723 + sig->gr_sport, sig->gr_dport,
58724 + gr_conn_table_size);
58726 + match = gr_conn_table[index];
58727 + while (match && !conn_match(match->sig,
58728 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
58729 + sig->gr_dport)) {
58731 + match = match->next;
58736 + last->next = match->next;
58738 + gr_conn_table[index] = NULL;
58745 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
58746 + __u16 sport, __u16 dport)
58748 + struct conn_table_entry *match;
58749 + unsigned int index;
58751 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
58753 + match = gr_conn_table[index];
58754 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
58755 + match = match->next;
58758 + return match->sig;
58765 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
58767 +#ifdef CONFIG_GRKERNSEC
58768 + struct signal_struct *sig = task->signal;
58769 + struct conn_table_entry *newent;
58771 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
58772 + if (newent == NULL)
58774 + /* no bh lock needed since we are called with bh disabled */
58775 + spin_lock(&gr_conn_table_lock);
58776 + gr_del_task_from_ip_table_nolock(sig);
58777 + sig->gr_saddr = inet->inet_rcv_saddr;
58778 + sig->gr_daddr = inet->inet_daddr;
58779 + sig->gr_sport = inet->inet_sport;
58780 + sig->gr_dport = inet->inet_dport;
58781 + gr_add_to_task_ip_table_nolock(sig, newent);
58782 + spin_unlock(&gr_conn_table_lock);
58787 +void gr_del_task_from_ip_table(struct task_struct *task)
58789 +#ifdef CONFIG_GRKERNSEC
58790 + spin_lock_bh(&gr_conn_table_lock);
58791 + gr_del_task_from_ip_table_nolock(task->signal);
58792 + spin_unlock_bh(&gr_conn_table_lock);
58798 +gr_attach_curr_ip(const struct sock *sk)
58800 +#ifdef CONFIG_GRKERNSEC
58801 + struct signal_struct *p, *set;
58802 + const struct inet_sock *inet = inet_sk(sk);
58804 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
58807 + set = current->signal;
58809 + spin_lock_bh(&gr_conn_table_lock);
58810 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
58811 + inet->inet_dport, inet->inet_sport);
58812 + if (unlikely(p != NULL)) {
58813 + set->curr_ip = p->curr_ip;
58814 + set->used_accept = 1;
58815 + gr_del_task_from_ip_table_nolock(p);
58816 + spin_unlock_bh(&gr_conn_table_lock);
58819 + spin_unlock_bh(&gr_conn_table_lock);
58821 + set->curr_ip = inet->inet_daddr;
58822 + set->used_accept = 1;
58828 +gr_handle_sock_all(const int family, const int type, const int protocol)
58830 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58831 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
58832 + (family != AF_UNIX)) {
58833 + if (family == AF_INET)
58834 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
58836 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
58844 +gr_handle_sock_server(const struct sockaddr *sck)
58846 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58847 + if (grsec_enable_socket_server &&
58848 + in_group_p(grsec_socket_server_gid) &&
58849 + sck && (sck->sa_family != AF_UNIX) &&
58850 + (sck->sa_family != AF_LOCAL)) {
58851 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58859 +gr_handle_sock_server_other(const struct sock *sck)
58861 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58862 + if (grsec_enable_socket_server &&
58863 + in_group_p(grsec_socket_server_gid) &&
58864 + sck && (sck->sk_family != AF_UNIX) &&
58865 + (sck->sk_family != AF_LOCAL)) {
58866 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58874 +gr_handle_sock_client(const struct sockaddr *sck)
58876 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58877 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
58878 + sck && (sck->sa_family != AF_UNIX) &&
58879 + (sck->sa_family != AF_LOCAL)) {
58880 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
58886 diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
58887 new file mode 100644
58888 index 0000000..bceef2f
58890 +++ b/grsecurity/grsec_sysctl.c
58892 +#include <linux/kernel.h>
58893 +#include <linux/sched.h>
58894 +#include <linux/sysctl.h>
58895 +#include <linux/grsecurity.h>
58896 +#include <linux/grinternal.h>
58899 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
58901 +#ifdef CONFIG_GRKERNSEC_SYSCTL
58902 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
58903 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
58910 +#ifdef CONFIG_GRKERNSEC_ROFS
58911 +static int __maybe_unused one = 1;
58914 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
58915 +struct ctl_table grsecurity_table[] = {
58916 +#ifdef CONFIG_GRKERNSEC_SYSCTL
58917 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
58918 +#ifdef CONFIG_GRKERNSEC_IO
58920 + .procname = "disable_priv_io",
58921 + .data = &grsec_disable_privio,
58922 + .maxlen = sizeof(int),
58924 + .proc_handler = &proc_dointvec,
58928 +#ifdef CONFIG_GRKERNSEC_LINK
58930 + .procname = "linking_restrictions",
58931 + .data = &grsec_enable_link,
58932 + .maxlen = sizeof(int),
58934 + .proc_handler = &proc_dointvec,
58937 +#ifdef CONFIG_GRKERNSEC_BRUTE
58939 + .procname = "deter_bruteforce",
58940 + .data = &grsec_enable_brute,
58941 + .maxlen = sizeof(int),
58943 + .proc_handler = &proc_dointvec,
58946 +#ifdef CONFIG_GRKERNSEC_FIFO
58948 + .procname = "fifo_restrictions",
58949 + .data = &grsec_enable_fifo,
58950 + .maxlen = sizeof(int),
58952 + .proc_handler = &proc_dointvec,
58955 +#ifdef CONFIG_GRKERNSEC_SETXID
58957 + .procname = "consistent_setxid",
58958 + .data = &grsec_enable_setxid,
58959 + .maxlen = sizeof(int),
58961 + .proc_handler = &proc_dointvec,
58964 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58966 + .procname = "ip_blackhole",
58967 + .data = &grsec_enable_blackhole,
58968 + .maxlen = sizeof(int),
58970 + .proc_handler = &proc_dointvec,
58973 + .procname = "lastack_retries",
58974 + .data = &grsec_lastack_retries,
58975 + .maxlen = sizeof(int),
58977 + .proc_handler = &proc_dointvec,
58980 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58982 + .procname = "exec_logging",
58983 + .data = &grsec_enable_execlog,
58984 + .maxlen = sizeof(int),
58986 + .proc_handler = &proc_dointvec,
58989 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58991 + .procname = "rwxmap_logging",
58992 + .data = &grsec_enable_log_rwxmaps,
58993 + .maxlen = sizeof(int),
58995 + .proc_handler = &proc_dointvec,
58998 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59000 + .procname = "signal_logging",
59001 + .data = &grsec_enable_signal,
59002 + .maxlen = sizeof(int),
59004 + .proc_handler = &proc_dointvec,
59007 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
59009 + .procname = "forkfail_logging",
59010 + .data = &grsec_enable_forkfail,
59011 + .maxlen = sizeof(int),
59013 + .proc_handler = &proc_dointvec,
59016 +#ifdef CONFIG_GRKERNSEC_TIME
59018 + .procname = "timechange_logging",
59019 + .data = &grsec_enable_time,
59020 + .maxlen = sizeof(int),
59022 + .proc_handler = &proc_dointvec,
59025 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59027 + .procname = "chroot_deny_shmat",
59028 + .data = &grsec_enable_chroot_shmat,
59029 + .maxlen = sizeof(int),
59031 + .proc_handler = &proc_dointvec,
59034 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59036 + .procname = "chroot_deny_unix",
59037 + .data = &grsec_enable_chroot_unix,
59038 + .maxlen = sizeof(int),
59040 + .proc_handler = &proc_dointvec,
59043 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59045 + .procname = "chroot_deny_mount",
59046 + .data = &grsec_enable_chroot_mount,
59047 + .maxlen = sizeof(int),
59049 + .proc_handler = &proc_dointvec,
59052 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59054 + .procname = "chroot_deny_fchdir",
59055 + .data = &grsec_enable_chroot_fchdir,
59056 + .maxlen = sizeof(int),
59058 + .proc_handler = &proc_dointvec,
59061 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59063 + .procname = "chroot_deny_chroot",
59064 + .data = &grsec_enable_chroot_double,
59065 + .maxlen = sizeof(int),
59067 + .proc_handler = &proc_dointvec,
59070 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59072 + .procname = "chroot_deny_pivot",
59073 + .data = &grsec_enable_chroot_pivot,
59074 + .maxlen = sizeof(int),
59076 + .proc_handler = &proc_dointvec,
59079 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59081 + .procname = "chroot_enforce_chdir",
59082 + .data = &grsec_enable_chroot_chdir,
59083 + .maxlen = sizeof(int),
59085 + .proc_handler = &proc_dointvec,
59088 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59090 + .procname = "chroot_deny_chmod",
59091 + .data = &grsec_enable_chroot_chmod,
59092 + .maxlen = sizeof(int),
59094 + .proc_handler = &proc_dointvec,
59097 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59099 + .procname = "chroot_deny_mknod",
59100 + .data = &grsec_enable_chroot_mknod,
59101 + .maxlen = sizeof(int),
59103 + .proc_handler = &proc_dointvec,
59106 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59108 + .procname = "chroot_restrict_nice",
59109 + .data = &grsec_enable_chroot_nice,
59110 + .maxlen = sizeof(int),
59112 + .proc_handler = &proc_dointvec,
59115 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59117 + .procname = "chroot_execlog",
59118 + .data = &grsec_enable_chroot_execlog,
59119 + .maxlen = sizeof(int),
59121 + .proc_handler = &proc_dointvec,
59124 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59126 + .procname = "chroot_caps",
59127 + .data = &grsec_enable_chroot_caps,
59128 + .maxlen = sizeof(int),
59130 + .proc_handler = &proc_dointvec,
59133 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59135 + .procname = "chroot_deny_sysctl",
59136 + .data = &grsec_enable_chroot_sysctl,
59137 + .maxlen = sizeof(int),
59139 + .proc_handler = &proc_dointvec,
59142 +#ifdef CONFIG_GRKERNSEC_TPE
59144 + .procname = "tpe",
59145 + .data = &grsec_enable_tpe,
59146 + .maxlen = sizeof(int),
59148 + .proc_handler = &proc_dointvec,
59151 + .procname = "tpe_gid",
59152 + .data = &grsec_tpe_gid,
59153 + .maxlen = sizeof(int),
59155 + .proc_handler = &proc_dointvec,
59158 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59160 + .procname = "tpe_invert",
59161 + .data = &grsec_enable_tpe_invert,
59162 + .maxlen = sizeof(int),
59164 + .proc_handler = &proc_dointvec,
59167 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59169 + .procname = "tpe_restrict_all",
59170 + .data = &grsec_enable_tpe_all,
59171 + .maxlen = sizeof(int),
59173 + .proc_handler = &proc_dointvec,
59176 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59178 + .procname = "socket_all",
59179 + .data = &grsec_enable_socket_all,
59180 + .maxlen = sizeof(int),
59182 + .proc_handler = &proc_dointvec,
59185 + .procname = "socket_all_gid",
59186 + .data = &grsec_socket_all_gid,
59187 + .maxlen = sizeof(int),
59189 + .proc_handler = &proc_dointvec,
59192 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59194 + .procname = "socket_client",
59195 + .data = &grsec_enable_socket_client,
59196 + .maxlen = sizeof(int),
59198 + .proc_handler = &proc_dointvec,
59201 + .procname = "socket_client_gid",
59202 + .data = &grsec_socket_client_gid,
59203 + .maxlen = sizeof(int),
59205 + .proc_handler = &proc_dointvec,
59208 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59210 + .procname = "socket_server",
59211 + .data = &grsec_enable_socket_server,
59212 + .maxlen = sizeof(int),
59214 + .proc_handler = &proc_dointvec,
59217 + .procname = "socket_server_gid",
59218 + .data = &grsec_socket_server_gid,
59219 + .maxlen = sizeof(int),
59221 + .proc_handler = &proc_dointvec,
59224 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59226 + .procname = "audit_group",
59227 + .data = &grsec_enable_group,
59228 + .maxlen = sizeof(int),
59230 + .proc_handler = &proc_dointvec,
59233 + .procname = "audit_gid",
59234 + .data = &grsec_audit_gid,
59235 + .maxlen = sizeof(int),
59237 + .proc_handler = &proc_dointvec,
59240 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59242 + .procname = "audit_chdir",
59243 + .data = &grsec_enable_chdir,
59244 + .maxlen = sizeof(int),
59246 + .proc_handler = &proc_dointvec,
59249 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59251 + .procname = "audit_mount",
59252 + .data = &grsec_enable_mount,
59253 + .maxlen = sizeof(int),
59255 + .proc_handler = &proc_dointvec,
59258 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59260 + .procname = "audit_textrel",
59261 + .data = &grsec_enable_audit_textrel,
59262 + .maxlen = sizeof(int),
59264 + .proc_handler = &proc_dointvec,
59267 +#ifdef CONFIG_GRKERNSEC_DMESG
59269 + .procname = "dmesg",
59270 + .data = &grsec_enable_dmesg,
59271 + .maxlen = sizeof(int),
59273 + .proc_handler = &proc_dointvec,
59276 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59278 + .procname = "chroot_findtask",
59279 + .data = &grsec_enable_chroot_findtask,
59280 + .maxlen = sizeof(int),
59282 + .proc_handler = &proc_dointvec,
59285 +#ifdef CONFIG_GRKERNSEC_RESLOG
59287 + .procname = "resource_logging",
59288 + .data = &grsec_resource_logging,
59289 + .maxlen = sizeof(int),
59291 + .proc_handler = &proc_dointvec,
59294 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59296 + .procname = "audit_ptrace",
59297 + .data = &grsec_enable_audit_ptrace,
59298 + .maxlen = sizeof(int),
59300 + .proc_handler = &proc_dointvec,
59303 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59305 + .procname = "harden_ptrace",
59306 + .data = &grsec_enable_harden_ptrace,
59307 + .maxlen = sizeof(int),
59309 + .proc_handler = &proc_dointvec,
59313 + .procname = "grsec_lock",
59314 + .data = &grsec_lock,
59315 + .maxlen = sizeof(int),
59317 + .proc_handler = &proc_dointvec,
59320 +#ifdef CONFIG_GRKERNSEC_ROFS
59322 + .procname = "romount_protect",
59323 + .data = &grsec_enable_rofs,
59324 + .maxlen = sizeof(int),
59326 + .proc_handler = &proc_dointvec_minmax,
59334 diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
59335 new file mode 100644
59336 index 0000000..0dc13c3
59338 +++ b/grsecurity/grsec_time.c
59340 +#include <linux/kernel.h>
59341 +#include <linux/sched.h>
59342 +#include <linux/grinternal.h>
59343 +#include <linux/module.h>
59346 +gr_log_timechange(void)
59348 +#ifdef CONFIG_GRKERNSEC_TIME
59349 + if (grsec_enable_time)
59350 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59355 +EXPORT_SYMBOL(gr_log_timechange);
59356 diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
59357 new file mode 100644
59358 index 0000000..4a78774
59360 +++ b/grsecurity/grsec_tpe.c
59362 +#include <linux/kernel.h>
59363 +#include <linux/sched.h>
59364 +#include <linux/file.h>
59365 +#include <linux/fs.h>
59366 +#include <linux/grinternal.h>
59368 +extern int gr_acl_tpe_check(void);
59371 +gr_tpe_allow(const struct file *file)
59373 +#ifdef CONFIG_GRKERNSEC
59374 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59375 + const struct cred *cred = current_cred();
59377 + if (cred->uid && ((grsec_enable_tpe &&
59378 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59379 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59380 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59382 + in_group_p(grsec_tpe_gid)
59384 + ) || gr_acl_tpe_check()) &&
59385 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59386 + (inode->i_mode & S_IWOTH))))) {
59387 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59390 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59391 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59392 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59393 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59394 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59401 diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
59402 new file mode 100644
59403 index 0000000..9f7b1ac
59405 +++ b/grsecurity/grsum.c
59407 +#include <linux/err.h>
59408 +#include <linux/kernel.h>
59409 +#include <linux/sched.h>
59410 +#include <linux/mm.h>
59411 +#include <linux/scatterlist.h>
59412 +#include <linux/crypto.h>
59413 +#include <linux/gracl.h>
59416 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59417 +#error "crypto and sha256 must be built into the kernel"
59421 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59424 + struct crypto_hash *tfm;
59425 + struct hash_desc desc;
59426 + struct scatterlist sg;
59427 + unsigned char temp_sum[GR_SHA_LEN];
59428 + volatile int retval = 0;
59429 + volatile int dummy = 0;
59432 + sg_init_table(&sg, 1);
59434 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59435 + if (IS_ERR(tfm)) {
59436 + /* should never happen, since sha256 should be built in */
59443 + crypto_hash_init(&desc);
59446 + sg_set_buf(&sg, p, GR_SALT_LEN);
59447 + crypto_hash_update(&desc, &sg, sg.length);
59450 + sg_set_buf(&sg, p, strlen(p));
59452 + crypto_hash_update(&desc, &sg, sg.length);
59454 + crypto_hash_final(&desc, temp_sum);
59456 + memset(entry->pw, 0, GR_PW_LEN);
59458 + for (i = 0; i < GR_SHA_LEN; i++)
59459 + if (sum[i] != temp_sum[i])
59462 + dummy = 1; // waste a cycle
59464 + crypto_free_hash(tfm);
59468 diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
59469 index 6cd5b64..f620d2d 100644
59470 --- a/include/acpi/acpi_bus.h
59471 +++ b/include/acpi/acpi_bus.h
59472 @@ -107,7 +107,7 @@ struct acpi_device_ops {
59474 acpi_op_unbind unbind;
59475 acpi_op_notify notify;
59479 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
59481 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
59482 index b7babf0..71e4e74 100644
59483 --- a/include/asm-generic/atomic-long.h
59484 +++ b/include/asm-generic/atomic-long.h
59487 typedef atomic64_t atomic_long_t;
59489 +#ifdef CONFIG_PAX_REFCOUNT
59490 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
59492 +typedef atomic64_t atomic_long_unchecked_t;
59495 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
59497 static inline long atomic_long_read(atomic_long_t *l)
59498 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59499 return (long)atomic64_read(v);
59502 +#ifdef CONFIG_PAX_REFCOUNT
59503 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59505 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59507 + return (long)atomic64_read_unchecked(v);
59511 static inline void atomic_long_set(atomic_long_t *l, long i)
59513 atomic64_t *v = (atomic64_t *)l;
59514 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59515 atomic64_set(v, i);
59518 +#ifdef CONFIG_PAX_REFCOUNT
59519 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59521 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59523 + atomic64_set_unchecked(v, i);
59527 static inline void atomic_long_inc(atomic_long_t *l)
59529 atomic64_t *v = (atomic64_t *)l;
59530 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59534 +#ifdef CONFIG_PAX_REFCOUNT
59535 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59537 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59539 + atomic64_inc_unchecked(v);
59543 static inline void atomic_long_dec(atomic_long_t *l)
59545 atomic64_t *v = (atomic64_t *)l;
59546 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59550 +#ifdef CONFIG_PAX_REFCOUNT
59551 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59553 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59555 + atomic64_dec_unchecked(v);
59559 static inline void atomic_long_add(long i, atomic_long_t *l)
59561 atomic64_t *v = (atomic64_t *)l;
59562 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59563 atomic64_add(i, v);
59566 +#ifdef CONFIG_PAX_REFCOUNT
59567 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59569 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59571 + atomic64_add_unchecked(i, v);
59575 static inline void atomic_long_sub(long i, atomic_long_t *l)
59577 atomic64_t *v = (atomic64_t *)l;
59578 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59579 atomic64_sub(i, v);
59582 +#ifdef CONFIG_PAX_REFCOUNT
59583 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59585 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59587 + atomic64_sub_unchecked(i, v);
59591 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59593 atomic64_t *v = (atomic64_t *)l;
59594 @@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59595 return (long)atomic64_inc_return(v);
59598 +#ifdef CONFIG_PAX_REFCOUNT
59599 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59601 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59603 + return (long)atomic64_inc_return_unchecked(v);
59607 static inline long atomic_long_dec_return(atomic_long_t *l)
59609 atomic64_t *v = (atomic64_t *)l;
59610 @@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59612 typedef atomic_t atomic_long_t;
59614 +#ifdef CONFIG_PAX_REFCOUNT
59615 +typedef atomic_unchecked_t atomic_long_unchecked_t;
59617 +typedef atomic_t atomic_long_unchecked_t;
59620 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
59621 static inline long atomic_long_read(atomic_long_t *l)
59623 @@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
59624 return (long)atomic_read(v);
59627 +#ifdef CONFIG_PAX_REFCOUNT
59628 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59630 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59632 + return (long)atomic_read_unchecked(v);
59636 static inline void atomic_long_set(atomic_long_t *l, long i)
59638 atomic_t *v = (atomic_t *)l;
59639 @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
59643 +#ifdef CONFIG_PAX_REFCOUNT
59644 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59646 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59648 + atomic_set_unchecked(v, i);
59652 static inline void atomic_long_inc(atomic_long_t *l)
59654 atomic_t *v = (atomic_t *)l;
59655 @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
59659 +#ifdef CONFIG_PAX_REFCOUNT
59660 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59662 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59664 + atomic_inc_unchecked(v);
59668 static inline void atomic_long_dec(atomic_long_t *l)
59670 atomic_t *v = (atomic_t *)l;
59671 @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
59675 +#ifdef CONFIG_PAX_REFCOUNT
59676 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59678 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59680 + atomic_dec_unchecked(v);
59684 static inline void atomic_long_add(long i, atomic_long_t *l)
59686 atomic_t *v = (atomic_t *)l;
59687 @@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
59691 +#ifdef CONFIG_PAX_REFCOUNT
59692 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59694 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59696 + atomic_add_unchecked(i, v);
59700 static inline void atomic_long_sub(long i, atomic_long_t *l)
59702 atomic_t *v = (atomic_t *)l;
59703 @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
59707 +#ifdef CONFIG_PAX_REFCOUNT
59708 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
59710 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59712 + atomic_sub_unchecked(i, v);
59716 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
59718 atomic_t *v = (atomic_t *)l;
59719 @@ -232,6 +361,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
59720 return (long)atomic_inc_return(v);
59723 +#ifdef CONFIG_PAX_REFCOUNT
59724 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59726 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59728 + return (long)atomic_inc_return_unchecked(v);
59732 static inline long atomic_long_dec_return(atomic_long_t *l)
59734 atomic_t *v = (atomic_t *)l;
59735 @@ -255,4 +393,49 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
59737 #endif /* BITS_PER_LONG == 64 */
59739 +#ifdef CONFIG_PAX_REFCOUNT
59740 +static inline void pax_refcount_needs_these_functions(void)
59742 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
59743 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
59744 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
59745 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
59746 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
59747 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
59748 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
59749 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
59750 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
59751 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
59752 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
59754 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
59755 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
59756 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
59757 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
59758 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
59759 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
59760 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
59763 +#define atomic_read_unchecked(v) atomic_read(v)
59764 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
59765 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
59766 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
59767 +#define atomic_inc_unchecked(v) atomic_inc(v)
59768 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
59769 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
59770 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
59771 +#define atomic_dec_unchecked(v) atomic_dec(v)
59772 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
59773 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
59775 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
59776 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
59777 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
59778 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
59779 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
59780 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
59781 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
59784 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
59785 diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
59786 index b18ce4f..2ee2843 100644
59787 --- a/include/asm-generic/atomic64.h
59788 +++ b/include/asm-generic/atomic64.h
59789 @@ -16,6 +16,8 @@ typedef struct {
59793 +typedef atomic64_t atomic64_unchecked_t;
59795 #define ATOMIC64_INIT(i) { (i) }
59797 extern long long atomic64_read(const atomic64_t *v);
59798 @@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
59799 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
59800 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
59802 +#define atomic64_read_unchecked(v) atomic64_read(v)
59803 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
59804 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
59805 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
59806 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
59807 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
59808 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
59809 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
59810 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
59812 #endif /* _ASM_GENERIC_ATOMIC64_H */
59813 diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
59814 index 1bfcfe5..e04c5c9 100644
59815 --- a/include/asm-generic/cache.h
59816 +++ b/include/asm-generic/cache.h
59818 * cache lines need to provide their own cache.h.
59821 -#define L1_CACHE_SHIFT 5
59822 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
59823 +#define L1_CACHE_SHIFT 5UL
59824 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
59826 #endif /* __ASM_GENERIC_CACHE_H */
59827 diff --git a/include/asm-generic/int-l64.h b/include/asm-generic/int-l64.h
59828 index 1ca3efc..e3dc852 100644
59829 --- a/include/asm-generic/int-l64.h
59830 +++ b/include/asm-generic/int-l64.h
59831 @@ -46,6 +46,8 @@ typedef unsigned int u32;
59832 typedef signed long s64;
59833 typedef unsigned long u64;
59835 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
59838 #define U8_C(x) x ## U
59840 diff --git a/include/asm-generic/int-ll64.h b/include/asm-generic/int-ll64.h
59841 index f394147..b6152b9 100644
59842 --- a/include/asm-generic/int-ll64.h
59843 +++ b/include/asm-generic/int-ll64.h
59844 @@ -51,6 +51,8 @@ typedef unsigned int u32;
59845 typedef signed long long s64;
59846 typedef unsigned long long u64;
59848 +typedef unsigned long long intoverflow_t;
59851 #define U8_C(x) x ## U
59853 diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
59854 index 0232ccb..13d9165 100644
59855 --- a/include/asm-generic/kmap_types.h
59856 +++ b/include/asm-generic/kmap_types.h
59857 @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
59859 KMAP_D(18) KM_NMI_PTE,
59861 +KMAP_D(20) KM_CLEARPAGE,
59863 * Remember to update debug_kmap_atomic() when adding new kmap types!
59865 -KMAP_D(20) KM_TYPE_NR
59866 +KMAP_D(21) KM_TYPE_NR
59870 diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
59871 index 725612b..9cc513a 100644
59872 --- a/include/asm-generic/pgtable-nopmd.h
59873 +++ b/include/asm-generic/pgtable-nopmd.h
59875 #ifndef _PGTABLE_NOPMD_H
59876 #define _PGTABLE_NOPMD_H
59878 -#ifndef __ASSEMBLY__
59880 #include <asm-generic/pgtable-nopud.h>
59884 #define __PAGETABLE_PMD_FOLDED
59886 +#define PMD_SHIFT PUD_SHIFT
59887 +#define PTRS_PER_PMD 1
59888 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
59889 +#define PMD_MASK (~(PMD_SIZE-1))
59891 +#ifndef __ASSEMBLY__
59896 * Having the pmd type consist of a pud gets the size right, and allows
59897 * us to conceptually access the pud entry that this pmd is folded into
59898 @@ -16,11 +21,6 @@ struct mm_struct;
59900 typedef struct { pud_t pud; } pmd_t;
59902 -#define PMD_SHIFT PUD_SHIFT
59903 -#define PTRS_PER_PMD 1
59904 -#define PMD_SIZE (1UL << PMD_SHIFT)
59905 -#define PMD_MASK (~(PMD_SIZE-1))
59908 * The "pud_xxx()" functions here are trivial for a folded two-level
59909 * setup: the pmd is never bad, and a pmd always exists (as it's folded
59910 diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
59911 index 810431d..ccc3638 100644
59912 --- a/include/asm-generic/pgtable-nopud.h
59913 +++ b/include/asm-generic/pgtable-nopud.h
59915 #ifndef _PGTABLE_NOPUD_H
59916 #define _PGTABLE_NOPUD_H
59918 -#ifndef __ASSEMBLY__
59920 #define __PAGETABLE_PUD_FOLDED
59922 +#define PUD_SHIFT PGDIR_SHIFT
59923 +#define PTRS_PER_PUD 1
59924 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
59925 +#define PUD_MASK (~(PUD_SIZE-1))
59927 +#ifndef __ASSEMBLY__
59930 * Having the pud type consist of a pgd gets the size right, and allows
59931 * us to conceptually access the pgd entry that this pud is folded into
59934 typedef struct { pgd_t pgd; } pud_t;
59936 -#define PUD_SHIFT PGDIR_SHIFT
59937 -#define PTRS_PER_PUD 1
59938 -#define PUD_SIZE (1UL << PUD_SHIFT)
59939 -#define PUD_MASK (~(PUD_SIZE-1))
59942 * The "pgd_xxx()" functions here are trivial for a folded two-level
59943 * setup: the pud is never bad, and a pud always exists (as it's folded
59944 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
59945 index 76bff2b..c7a14e2 100644
59946 --- a/include/asm-generic/pgtable.h
59947 +++ b/include/asm-generic/pgtable.h
59948 @@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
59949 #endif /* __HAVE_ARCH_PMD_WRITE */
59952 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
59953 +static inline unsigned long pax_open_kernel(void) { return 0; }
59956 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
59957 +static inline unsigned long pax_close_kernel(void) { return 0; }
59960 #endif /* !__ASSEMBLY__ */
59962 #endif /* _ASM_GENERIC_PGTABLE_H */
59963 diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
59964 index db22d13..1f2e3e1 100644
59965 --- a/include/asm-generic/vmlinux.lds.h
59966 +++ b/include/asm-generic/vmlinux.lds.h
59967 @@ -217,6 +217,7 @@
59968 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
59969 VMLINUX_SYMBOL(__start_rodata) = .; \
59970 *(.rodata) *(.rodata.*) \
59971 + *(.data..read_only) \
59972 *(__vermagic) /* Kernel version magic */ \
59974 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
59975 @@ -723,17 +724,18 @@
59976 * section in the linker script will go there too. @phdr should have
59979 - * Note that this macros defines __per_cpu_load as an absolute symbol.
59980 + * Note that this macros defines per_cpu_load as an absolute symbol.
59981 * If there is no need to put the percpu section at a predetermined
59982 * address, use PERCPU_SECTION.
59984 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
59985 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
59986 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
59987 + per_cpu_load = .; \
59988 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
59990 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
59991 PERCPU_INPUT(cacheline) \
59993 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
59994 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
59997 * PERCPU_SECTION - define output section for percpu area, simple version
59998 diff --git a/include/drm/drmP.h b/include/drm/drmP.h
59999 index 9b7c2bb..76b7d1e 100644
60000 --- a/include/drm/drmP.h
60001 +++ b/include/drm/drmP.h
60003 #include <linux/workqueue.h>
60004 #include <linux/poll.h>
60005 #include <asm/pgalloc.h>
60006 +#include <asm/local.h>
60009 #include <linux/idr.h>
60010 @@ -1035,7 +1036,7 @@ struct drm_device {
60012 /** \name Usage Counters */
60014 - int open_count; /**< Outstanding files open */
60015 + local_t open_count; /**< Outstanding files open */
60016 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
60017 atomic_t vma_count; /**< Outstanding vma areas open */
60018 int buf_use; /**< Buffers in use -- cannot alloc */
60019 @@ -1046,7 +1047,7 @@ struct drm_device {
60021 unsigned long counters;
60022 enum drm_stat_type types[15];
60023 - atomic_t counts[15];
60024 + atomic_unchecked_t counts[15];
60027 struct list_head filelist;
60028 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
60029 index 73b0712..0b7ef2f 100644
60030 --- a/include/drm/drm_crtc_helper.h
60031 +++ b/include/drm/drm_crtc_helper.h
60032 @@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
60034 /* disable crtc when not in use - more explicit than dpms off */
60035 void (*disable)(struct drm_crtc *crtc);
60039 struct drm_encoder_helper_funcs {
60040 void (*dpms)(struct drm_encoder *encoder, int mode);
60041 @@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
60042 struct drm_connector *connector);
60043 /* disable encoder when not in use - more explicit than dpms off */
60044 void (*disable)(struct drm_encoder *encoder);
60048 struct drm_connector_helper_funcs {
60049 int (*get_modes)(struct drm_connector *connector);
60050 diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
60051 index 26c1f78..6722682 100644
60052 --- a/include/drm/ttm/ttm_memory.h
60053 +++ b/include/drm/ttm/ttm_memory.h
60056 struct ttm_mem_shrink {
60057 int (*do_shrink) (struct ttm_mem_shrink *);
60062 * struct ttm_mem_global - Global memory accounting structure.
60063 diff --git a/include/linux/a.out.h b/include/linux/a.out.h
60064 index e86dfca..40cc55f 100644
60065 --- a/include/linux/a.out.h
60066 +++ b/include/linux/a.out.h
60067 @@ -39,6 +39,14 @@ enum machine_type {
60068 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
60071 +/* Constants for the N_FLAGS field */
60072 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60073 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
60074 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
60075 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
60076 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60077 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60079 #if !defined (N_MAGIC)
60080 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
60082 diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
60083 index 49a83ca..df96b54 100644
60084 --- a/include/linux/atmdev.h
60085 +++ b/include/linux/atmdev.h
60086 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
60089 struct k_atm_aal_stats {
60090 -#define __HANDLE_ITEM(i) atomic_t i
60091 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
60093 #undef __HANDLE_ITEM
60095 diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
60096 index fd88a39..f4d0bad 100644
60097 --- a/include/linux/binfmts.h
60098 +++ b/include/linux/binfmts.h
60099 @@ -88,6 +88,7 @@ struct linux_binfmt {
60100 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
60101 int (*load_shlib)(struct file *);
60102 int (*core_dump)(struct coredump_params *cprm);
60103 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
60104 unsigned long min_coredump; /* minimal dump size */
60107 diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
60108 index 7fbaa91..5e6a460 100644
60109 --- a/include/linux/blkdev.h
60110 +++ b/include/linux/blkdev.h
60111 @@ -1321,7 +1321,7 @@ struct block_device_operations {
60112 /* this callback is with swap_lock and sometimes page table lock held */
60113 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
60114 struct module *owner;
60118 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60120 diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
60121 index 8e9e4bc..88bd457 100644
60122 --- a/include/linux/blktrace_api.h
60123 +++ b/include/linux/blktrace_api.h
60124 @@ -162,7 +162,7 @@ struct blk_trace {
60125 struct dentry *dir;
60126 struct dentry *dropped_file;
60127 struct dentry *msg_file;
60128 - atomic_t dropped;
60129 + atomic_unchecked_t dropped;
60132 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60133 diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
60134 index 83195fb..0b0f77d 100644
60135 --- a/include/linux/byteorder/little_endian.h
60136 +++ b/include/linux/byteorder/little_endian.h
60137 @@ -42,51 +42,51 @@
60139 static inline __le64 __cpu_to_le64p(const __u64 *p)
60141 - return (__force __le64)*p;
60142 + return (__force const __le64)*p;
60144 static inline __u64 __le64_to_cpup(const __le64 *p)
60146 - return (__force __u64)*p;
60147 + return (__force const __u64)*p;
60149 static inline __le32 __cpu_to_le32p(const __u32 *p)
60151 - return (__force __le32)*p;
60152 + return (__force const __le32)*p;
60154 static inline __u32 __le32_to_cpup(const __le32 *p)
60156 - return (__force __u32)*p;
60157 + return (__force const __u32)*p;
60159 static inline __le16 __cpu_to_le16p(const __u16 *p)
60161 - return (__force __le16)*p;
60162 + return (__force const __le16)*p;
60164 static inline __u16 __le16_to_cpup(const __le16 *p)
60166 - return (__force __u16)*p;
60167 + return (__force const __u16)*p;
60169 static inline __be64 __cpu_to_be64p(const __u64 *p)
60171 - return (__force __be64)__swab64p(p);
60172 + return (__force const __be64)__swab64p(p);
60174 static inline __u64 __be64_to_cpup(const __be64 *p)
60176 - return __swab64p((__u64 *)p);
60177 + return __swab64p((const __u64 *)p);
60179 static inline __be32 __cpu_to_be32p(const __u32 *p)
60181 - return (__force __be32)__swab32p(p);
60182 + return (__force const __be32)__swab32p(p);
60184 static inline __u32 __be32_to_cpup(const __be32 *p)
60186 - return __swab32p((__u32 *)p);
60187 + return __swab32p((const __u32 *)p);
60189 static inline __be16 __cpu_to_be16p(const __u16 *p)
60191 - return (__force __be16)__swab16p(p);
60192 + return (__force const __be16)__swab16p(p);
60194 static inline __u16 __be16_to_cpup(const __be16 *p)
60196 - return __swab16p((__u16 *)p);
60197 + return __swab16p((const __u16 *)p);
60199 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60200 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60201 diff --git a/include/linux/cache.h b/include/linux/cache.h
60202 index 4c57065..4307975 100644
60203 --- a/include/linux/cache.h
60204 +++ b/include/linux/cache.h
60206 #define __read_mostly
60209 +#ifndef __read_only
60210 +#define __read_only __read_mostly
60213 #ifndef ____cacheline_aligned
60214 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60216 diff --git a/include/linux/capability.h b/include/linux/capability.h
60217 index c421123..e343179 100644
60218 --- a/include/linux/capability.h
60219 +++ b/include/linux/capability.h
60220 @@ -547,6 +547,9 @@ extern bool capable(int cap);
60221 extern bool ns_capable(struct user_namespace *ns, int cap);
60222 extern bool task_ns_capable(struct task_struct *t, int cap);
60223 extern bool nsown_capable(int cap);
60224 +extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
60225 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
60226 +extern bool capable_nolog(int cap);
60228 /* audit system wants to get cap info from files as well */
60229 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
60230 diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
60231 index 04ffb2e..6799180 100644
60232 --- a/include/linux/cleancache.h
60233 +++ b/include/linux/cleancache.h
60234 @@ -31,7 +31,7 @@ struct cleancache_ops {
60235 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
60236 void (*flush_inode)(int, struct cleancache_filekey);
60237 void (*flush_fs)(int);
60241 extern struct cleancache_ops
60242 cleancache_register_ops(struct cleancache_ops *ops);
60243 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
60244 index dfadc96..c0e70c1 100644
60245 --- a/include/linux/compiler-gcc4.h
60246 +++ b/include/linux/compiler-gcc4.h
60250 #if __GNUC_MINOR__ >= 5
60252 +#ifdef CONSTIFY_PLUGIN
60253 +#define __no_const __attribute__((no_const))
60254 +#define __do_const __attribute__((do_const))
60258 * Mark a position in code as unreachable. This can be used to
60259 * suppress control flow warnings after asm blocks that transfer
60261 #define __noclone __attribute__((__noclone__))
60265 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60266 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60267 +#define __bos0(ptr) __bos((ptr), 0)
60268 +#define __bos1(ptr) __bos((ptr), 1)
60271 #if __GNUC_MINOR__ > 0
60272 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
60273 index 320d6c9..8573a1c 100644
60274 --- a/include/linux/compiler.h
60275 +++ b/include/linux/compiler.h
60279 # define __user __attribute__((noderef, address_space(1)))
60280 +# define __force_user __force __user
60281 # define __kernel __attribute__((address_space(0)))
60282 +# define __force_kernel __force __kernel
60283 # define __safe __attribute__((safe))
60284 # define __force __attribute__((force))
60285 # define __nocast __attribute__((nocast))
60286 # define __iomem __attribute__((noderef, address_space(2)))
60287 +# define __force_iomem __force __iomem
60288 # define __acquires(x) __attribute__((context(x,0,1)))
60289 # define __releases(x) __attribute__((context(x,1,0)))
60290 # define __acquire(x) __context__(x,1)
60291 # define __release(x) __context__(x,-1)
60292 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
60293 # define __percpu __attribute__((noderef, address_space(3)))
60294 +# define __force_percpu __force __percpu
60295 #ifdef CONFIG_SPARSE_RCU_POINTER
60296 # define __rcu __attribute__((noderef, address_space(4)))
60297 +# define __force_rcu __force __rcu
60300 +# define __force_rcu
60302 extern void __chk_user_ptr(const volatile void __user *);
60303 extern void __chk_io_ptr(const volatile void __iomem *);
60304 +#elif defined(CHECKER_PLUGIN)
60306 +//# define __force_user
60307 +//# define __kernel
60308 +//# define __force_kernel
60313 +# define __force_iomem
60314 +# define __chk_user_ptr(x) (void)0
60315 +# define __chk_io_ptr(x) (void)0
60316 +# define __builtin_warning(x, y...) (1)
60317 +# define __acquires(x)
60318 +# define __releases(x)
60319 +# define __acquire(x) (void)0
60320 +# define __release(x) (void)0
60321 +# define __cond_lock(x,c) (c)
60323 +# define __force_percpu
60325 +# define __force_rcu
60328 +# define __force_user
60330 +# define __force_kernel
60335 +# define __force_iomem
60336 # define __chk_user_ptr(x) (void)0
60337 # define __chk_io_ptr(x) (void)0
60338 # define __builtin_warning(x, y...) (1)
60339 @@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
60340 # define __release(x) (void)0
60341 # define __cond_lock(x,c) (c)
60343 +# define __force_percpu
60345 +# define __force_rcu
60349 @@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60350 # define __attribute_const__ /* unimplemented */
60353 +#ifndef __no_const
60354 +# define __no_const
60357 +#ifndef __do_const
60358 +# define __do_const
60362 * Tell gcc if a function is cold. The compiler will assume any path
60363 * directly leading to the call is unlikely.
60364 @@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60368 +#ifndef __alloc_size
60369 +#define __alloc_size(...)
60373 +#define __bos(ptr, arg)
60377 +#define __bos0(ptr)
60381 +#define __bos1(ptr)
60384 /* Simple shorthand for a section definition */
60386 # define __section(S) __attribute__ ((__section__(#S)))
60387 @@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60388 * use is to mediate communication between process-level code and irq/NMI
60389 * handlers, all running on the same CPU.
60391 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
60392 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
60393 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
60395 #endif /* __LINUX_COMPILER_H */
60396 diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
60397 index e9eaec5..bfeb9bb 100644
60398 --- a/include/linux/cpuset.h
60399 +++ b/include/linux/cpuset.h
60400 @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void)
60404 - --ACCESS_ONCE(current->mems_allowed_change_disable);
60405 + --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
60408 static inline void set_mems_allowed(nodemask_t nodemask)
60409 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
60410 index e5e468e..f079672 100644
60411 --- a/include/linux/crypto.h
60412 +++ b/include/linux/crypto.h
60413 @@ -361,7 +361,7 @@ struct cipher_tfm {
60414 const u8 *key, unsigned int keylen);
60415 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60416 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60421 int (*init)(struct hash_desc *desc);
60422 @@ -382,13 +382,13 @@ struct compress_tfm {
60423 int (*cot_decompress)(struct crypto_tfm *tfm,
60424 const u8 *src, unsigned int slen,
60425 u8 *dst, unsigned int *dlen);
60430 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
60431 unsigned int dlen);
60432 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
60436 #define crt_ablkcipher crt_u.ablkcipher
60437 #define crt_aead crt_u.aead
60438 diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
60439 index 7925bf0..d5143d2 100644
60440 --- a/include/linux/decompress/mm.h
60441 +++ b/include/linux/decompress/mm.h
60442 @@ -77,7 +77,7 @@ static void free(void *where)
60443 * warnings when not needed (indeed large_malloc / large_free are not
60444 * needed by inflate */
60446 -#define malloc(a) kmalloc(a, GFP_KERNEL)
60447 +#define malloc(a) kmalloc((a), GFP_KERNEL)
60448 #define free(a) kfree(a)
60450 #define large_malloc(a) vmalloc(a)
60451 diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
60452 index 347fdc3..cd01657 100644
60453 --- a/include/linux/dma-mapping.h
60454 +++ b/include/linux/dma-mapping.h
60455 @@ -42,7 +42,7 @@ struct dma_map_ops {
60456 int (*dma_supported)(struct device *dev, u64 mask);
60457 int (*set_dma_mask)(struct device *dev, u64 mask);
60462 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
60464 diff --git a/include/linux/efi.h b/include/linux/efi.h
60465 index 2362a0b..cfaf8fcc 100644
60466 --- a/include/linux/efi.h
60467 +++ b/include/linux/efi.h
60468 @@ -446,7 +446,7 @@ struct efivar_operations {
60469 efi_get_variable_t *get_variable;
60470 efi_get_next_variable_t *get_next_variable;
60471 efi_set_variable_t *set_variable;
60477 diff --git a/include/linux/elf.h b/include/linux/elf.h
60478 index 110821c..cb14c08 100644
60479 --- a/include/linux/elf.h
60480 +++ b/include/linux/elf.h
60481 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
60482 #define PT_GNU_EH_FRAME 0x6474e550
60484 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
60485 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
60487 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
60489 +/* Constants for the e_flags field */
60490 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60491 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
60492 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
60493 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
60494 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60495 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60498 * Extended Numbering
60499 @@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
60500 #define DT_DEBUG 21
60501 #define DT_TEXTREL 22
60502 #define DT_JMPREL 23
60503 +#define DT_FLAGS 30
60504 + #define DF_TEXTREL 0x00000004
60505 #define DT_ENCODING 32
60506 #define OLD_DT_LOOS 0x60000000
60507 #define DT_LOOS 0x6000000d
60508 @@ -252,6 +265,19 @@ typedef struct elf64_hdr {
60512 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
60513 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
60514 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
60515 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
60516 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
60517 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
60518 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
60519 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
60520 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
60521 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
60522 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
60523 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
60525 typedef struct elf32_phdr{
60527 Elf32_Off p_offset;
60528 @@ -344,6 +370,8 @@ typedef struct elf64_shdr {
60534 #define ELFMAG0 0x7f /* EI_MAG */
60535 #define ELFMAG1 'E'
60536 #define ELFMAG2 'L'
60537 @@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
60538 #define elf_note elf32_note
60539 #define elf_addr_t Elf32_Off
60540 #define Elf_Half Elf32_Half
60541 +#define elf_dyn Elf32_Dyn
60545 @@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
60546 #define elf_note elf64_note
60547 #define elf_addr_t Elf64_Off
60548 #define Elf_Half Elf64_Half
60549 +#define elf_dyn Elf64_Dyn
60553 diff --git a/include/linux/filter.h b/include/linux/filter.h
60554 index 741956f..f02f482 100644
60555 --- a/include/linux/filter.h
60556 +++ b/include/linux/filter.h
60557 @@ -134,6 +134,7 @@ struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
60561 +struct bpf_jit_work;
60565 @@ -141,6 +142,9 @@ struct sk_filter
60566 unsigned int len; /* Number of filter blocks */
60567 unsigned int (*bpf_func)(const struct sk_buff *skb,
60568 const struct sock_filter *filter);
60569 +#ifdef CONFIG_BPF_JIT
60570 + struct bpf_jit_work *work;
60572 struct rcu_head rcu;
60573 struct sock_filter insns[0];
60575 diff --git a/include/linux/firewire.h b/include/linux/firewire.h
60576 index 84ccf8e..2e9b14c 100644
60577 --- a/include/linux/firewire.h
60578 +++ b/include/linux/firewire.h
60579 @@ -428,7 +428,7 @@ struct fw_iso_context {
60581 fw_iso_callback_t sc;
60582 fw_iso_mc_callback_t mc;
60584 + } __no_const callback;
60585 void *callback_data;
60588 diff --git a/include/linux/fs.h b/include/linux/fs.h
60589 index cf7bc25..0d2babf 100644
60590 --- a/include/linux/fs.h
60591 +++ b/include/linux/fs.h
60592 @@ -1588,7 +1588,8 @@ struct file_operations {
60593 int (*setlease)(struct file *, long, struct file_lock **);
60594 long (*fallocate)(struct file *file, int mode, loff_t offset,
60598 +typedef struct file_operations __no_const file_operations_no_const;
60600 struct inode_operations {
60601 struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
60602 diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
60603 index 003dc0f..3c4ea97 100644
60604 --- a/include/linux/fs_struct.h
60605 +++ b/include/linux/fs_struct.h
60607 #include <linux/seqlock.h>
60615 diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
60616 index af095b5..cf1220c 100644
60617 --- a/include/linux/fscache-cache.h
60618 +++ b/include/linux/fscache-cache.h
60619 @@ -102,7 +102,7 @@ struct fscache_operation {
60620 fscache_operation_release_t release;
60623 -extern atomic_t fscache_op_debug_id;
60624 +extern atomic_unchecked_t fscache_op_debug_id;
60625 extern void fscache_op_work_func(struct work_struct *work);
60627 extern void fscache_enqueue_operation(struct fscache_operation *);
60628 @@ -122,7 +122,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
60630 INIT_WORK(&op->work, fscache_op_work_func);
60631 atomic_set(&op->usage, 1);
60632 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
60633 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
60634 op->processor = processor;
60635 op->release = release;
60636 INIT_LIST_HEAD(&op->pend_link);
60637 diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
60638 index 2a53f10..0187fdf 100644
60639 --- a/include/linux/fsnotify.h
60640 +++ b/include/linux/fsnotify.h
60641 @@ -314,7 +314,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
60643 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
60645 - return kstrdup(name, GFP_KERNEL);
60646 + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
60650 diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
60651 index 96efa67..1261547 100644
60652 --- a/include/linux/ftrace_event.h
60653 +++ b/include/linux/ftrace_event.h
60654 @@ -97,7 +97,7 @@ struct trace_event_functions {
60655 trace_print_func raw;
60656 trace_print_func hex;
60657 trace_print_func binary;
60661 struct trace_event {
60662 struct hlist_node node;
60663 @@ -252,7 +252,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
60664 extern int trace_add_event_call(struct ftrace_event_call *call);
60665 extern void trace_remove_event_call(struct ftrace_event_call *call);
60667 -#define is_signed_type(type) (((type)(-1)) < 0)
60668 +#define is_signed_type(type) (((type)(-1)) < (type)1)
60670 int trace_set_clr_event(const char *system, const char *event, int set);
60672 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
60673 index 02fa469..a15f279 100644
60674 --- a/include/linux/genhd.h
60675 +++ b/include/linux/genhd.h
60676 @@ -184,7 +184,7 @@ struct gendisk {
60677 struct kobject *slave_dir;
60679 struct timer_rand_state *random;
60680 - atomic_t sync_io; /* RAID */
60681 + atomic_unchecked_t sync_io; /* RAID */
60682 struct disk_events *ev;
60683 #ifdef CONFIG_BLK_DEV_INTEGRITY
60684 struct blk_integrity *integrity;
60685 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
60686 new file mode 100644
60687 index 0000000..0dc3943
60689 +++ b/include/linux/gracl.h
60694 +#include <linux/grdefs.h>
60695 +#include <linux/resource.h>
60696 +#include <linux/capability.h>
60697 +#include <linux/dcache.h>
60698 +#include <asm/resource.h>
60700 +/* Major status information */
60702 +#define GR_VERSION "grsecurity 2.2.2"
60703 +#define GRSECURITY_VERSION 0x2202
60714 + GR_SPROLEPAM = 8,
60717 +/* Password setup definitions
60718 + * kernel/grhash.c */
60721 + GR_SALT_LEN = 16,
60726 + GR_SPROLE_LEN = 64,
60735 +#define GR_NLIMITS 32
60737 +/* Begin Data Structures */
60739 +struct sprole_pw {
60740 + unsigned char *rolename;
60741 + unsigned char salt[GR_SALT_LEN];
60742 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
60745 +struct name_entry {
60752 + struct name_entry *prev;
60753 + struct name_entry *next;
60756 +struct inodev_entry {
60757 + struct name_entry *nentry;
60758 + struct inodev_entry *prev;
60759 + struct inodev_entry *next;
60762 +struct acl_role_db {
60763 + struct acl_role_label **r_hash;
60767 +struct inodev_db {
60768 + struct inodev_entry **i_hash;
60773 + struct name_entry **n_hash;
60777 +struct crash_uid {
60779 + unsigned long expires;
60782 +struct gr_hash_struct {
60784 + void **nametable;
60786 + __u32 table_size;
60791 +/* Userspace Grsecurity ACL data structures */
60793 +struct acl_subject_label {
60798 + kernel_cap_t cap_mask;
60799 + kernel_cap_t cap_lower;
60800 + kernel_cap_t cap_invert_audit;
60802 + struct rlimit res[GR_NLIMITS];
60805 + __u8 user_trans_type;
60806 + __u8 group_trans_type;
60807 + uid_t *user_transitions;
60808 + gid_t *group_transitions;
60809 + __u16 user_trans_num;
60810 + __u16 group_trans_num;
60812 + __u32 sock_families[2];
60813 + __u32 ip_proto[8];
60815 + struct acl_ip_label **ips;
60817 + __u32 inaddr_any_override;
60820 + unsigned long expires;
60822 + struct acl_subject_label *parent_subject;
60823 + struct gr_hash_struct *hash;
60824 + struct acl_subject_label *prev;
60825 + struct acl_subject_label *next;
60827 + struct acl_object_label **obj_hash;
60828 + __u32 obj_hash_size;
60832 +struct role_allowed_ip {
60836 + struct role_allowed_ip *prev;
60837 + struct role_allowed_ip *next;
60840 +struct role_transition {
60843 + struct role_transition *prev;
60844 + struct role_transition *next;
60847 +struct acl_role_label {
60852 + __u16 auth_attempts;
60853 + unsigned long expires;
60855 + struct acl_subject_label *root_label;
60856 + struct gr_hash_struct *hash;
60858 + struct acl_role_label *prev;
60859 + struct acl_role_label *next;
60861 + struct role_transition *transitions;
60862 + struct role_allowed_ip *allowed_ips;
60863 + uid_t *domain_children;
60864 + __u16 domain_child_num;
60866 + struct acl_subject_label **subj_hash;
60867 + __u32 subj_hash_size;
60870 +struct user_acl_role_db {
60871 + struct acl_role_label **r_table;
60872 + __u32 num_pointers; /* Number of allocations to track */
60873 + __u32 num_roles; /* Number of roles */
60874 + __u32 num_domain_children; /* Number of domain children */
60875 + __u32 num_subjects; /* Number of subjects */
60876 + __u32 num_objects; /* Number of objects */
60879 +struct acl_object_label {
60885 + struct acl_subject_label *nested;
60886 + struct acl_object_label *globbed;
60888 + /* next two structures not used */
60890 + struct acl_object_label *prev;
60891 + struct acl_object_label *next;
60894 +struct acl_ip_label {
60903 + /* next two structures not used */
60905 + struct acl_ip_label *prev;
60906 + struct acl_ip_label *next;
60910 + struct user_acl_role_db role_db;
60911 + unsigned char pw[GR_PW_LEN];
60912 + unsigned char salt[GR_SALT_LEN];
60913 + unsigned char sum[GR_SHA_LEN];
60914 + unsigned char sp_role[GR_SPROLE_LEN];
60915 + struct sprole_pw *sprole_pws;
60916 + dev_t segv_device;
60917 + ino_t segv_inode;
60919 + __u16 num_sprole_pws;
60923 +struct gr_arg_wrapper {
60924 + struct gr_arg *arg;
60929 +struct subject_map {
60930 + struct acl_subject_label *user;
60931 + struct acl_subject_label *kernel;
60932 + struct subject_map *prev;
60933 + struct subject_map *next;
60936 +struct acl_subj_map_db {
60937 + struct subject_map **s_hash;
60941 +/* End Data Structures Section */
60943 +/* Hash functions generated by empirical testing by Brad Spengler
60944 + Makes good use of the low bits of the inode. Generally 0-1 times
60945 + in loop for successful match. 0-3 for unsuccessful match.
60946 + Shift/add algorithm with modulus of table size and an XOR*/
60948 +static __inline__ unsigned int
60949 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
60951 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
60954 + static __inline__ unsigned int
60955 +shash(const struct acl_subject_label *userp, const unsigned int sz)
60957 + return ((const unsigned long)userp % sz);
60960 +static __inline__ unsigned int
60961 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
60963 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
60966 +static __inline__ unsigned int
60967 +nhash(const char *name, const __u16 len, const unsigned int sz)
60969 + return full_name_hash((const unsigned char *)name, len) % sz;
60972 +#define FOR_EACH_ROLE_START(role) \
60973 + role = role_list; \
60976 +#define FOR_EACH_ROLE_END(role) \
60977 + role = role->prev; \
60980 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
60983 + while (iter < role->subj_hash_size) { \
60984 + if (subj == NULL) \
60985 + subj = role->subj_hash[iter]; \
60986 + if (subj == NULL) { \
60991 +#define FOR_EACH_SUBJECT_END(subj,iter) \
60992 + subj = subj->next; \
60993 + if (subj == NULL) \
60998 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
60999 + subj = role->hash->first; \
61000 + while (subj != NULL) {
61002 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
61003 + subj = subj->next; \
61008 diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
61009 new file mode 100644
61010 index 0000000..323ecf2
61012 +++ b/include/linux/gralloc.h
61014 +#ifndef __GRALLOC_H
61015 +#define __GRALLOC_H
61017 +void acl_free_all(void);
61018 +int acl_alloc_stack_init(unsigned long size);
61019 +void *acl_alloc(unsigned long len);
61020 +void *acl_alloc_num(unsigned long num, unsigned long len);
61023 diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
61024 new file mode 100644
61025 index 0000000..b30e9bc
61027 +++ b/include/linux/grdefs.h
61032 +/* Begin grsecurity status declarations */
61036 + GR_STATUS_INIT = 0x00 // disabled state
61039 +/* Begin ACL declarations */
61044 + GR_ROLE_USER = 0x0001,
61045 + GR_ROLE_GROUP = 0x0002,
61046 + GR_ROLE_DEFAULT = 0x0004,
61047 + GR_ROLE_SPECIAL = 0x0008,
61048 + GR_ROLE_AUTH = 0x0010,
61049 + GR_ROLE_NOPW = 0x0020,
61050 + GR_ROLE_GOD = 0x0040,
61051 + GR_ROLE_LEARN = 0x0080,
61052 + GR_ROLE_TPE = 0x0100,
61053 + GR_ROLE_DOMAIN = 0x0200,
61054 + GR_ROLE_PAM = 0x0400,
61055 + GR_ROLE_PERSIST = 0x0800
61058 +/* ACL Subject and Object mode flags */
61060 + GR_DELETED = 0x80000000
61063 +/* ACL Object-only mode flags */
61065 + GR_READ = 0x00000001,
61066 + GR_APPEND = 0x00000002,
61067 + GR_WRITE = 0x00000004,
61068 + GR_EXEC = 0x00000008,
61069 + GR_FIND = 0x00000010,
61070 + GR_INHERIT = 0x00000020,
61071 + GR_SETID = 0x00000040,
61072 + GR_CREATE = 0x00000080,
61073 + GR_DELETE = 0x00000100,
61074 + GR_LINK = 0x00000200,
61075 + GR_AUDIT_READ = 0x00000400,
61076 + GR_AUDIT_APPEND = 0x00000800,
61077 + GR_AUDIT_WRITE = 0x00001000,
61078 + GR_AUDIT_EXEC = 0x00002000,
61079 + GR_AUDIT_FIND = 0x00004000,
61080 + GR_AUDIT_INHERIT= 0x00008000,
61081 + GR_AUDIT_SETID = 0x00010000,
61082 + GR_AUDIT_CREATE = 0x00020000,
61083 + GR_AUDIT_DELETE = 0x00040000,
61084 + GR_AUDIT_LINK = 0x00080000,
61085 + GR_PTRACERD = 0x00100000,
61086 + GR_NOPTRACE = 0x00200000,
61087 + GR_SUPPRESS = 0x00400000,
61088 + GR_NOLEARN = 0x00800000,
61089 + GR_INIT_TRANSFER= 0x01000000
61092 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61093 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61094 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61096 +/* ACL subject-only mode flags */
61098 + GR_KILL = 0x00000001,
61099 + GR_VIEW = 0x00000002,
61100 + GR_PROTECTED = 0x00000004,
61101 + GR_LEARN = 0x00000008,
61102 + GR_OVERRIDE = 0x00000010,
61103 + /* just a placeholder, this mode is only used in userspace */
61104 + GR_DUMMY = 0x00000020,
61105 + GR_PROTSHM = 0x00000040,
61106 + GR_KILLPROC = 0x00000080,
61107 + GR_KILLIPPROC = 0x00000100,
61108 + /* just a placeholder, this mode is only used in userspace */
61109 + GR_NOTROJAN = 0x00000200,
61110 + GR_PROTPROCFD = 0x00000400,
61111 + GR_PROCACCT = 0x00000800,
61112 + GR_RELAXPTRACE = 0x00001000,
61113 + GR_NESTED = 0x00002000,
61114 + GR_INHERITLEARN = 0x00004000,
61115 + GR_PROCFIND = 0x00008000,
61116 + GR_POVERRIDE = 0x00010000,
61117 + GR_KERNELAUTH = 0x00020000,
61118 + GR_ATSECURE = 0x00040000,
61119 + GR_SHMEXEC = 0x00080000
61123 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61124 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61125 + GR_PAX_ENABLE_MPROTECT = 0x0004,
61126 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
61127 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61128 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61129 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61130 + GR_PAX_DISABLE_MPROTECT = 0x0400,
61131 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
61132 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61136 + GR_ID_USER = 0x01,
61137 + GR_ID_GROUP = 0x02,
61141 + GR_ID_ALLOW = 0x01,
61142 + GR_ID_DENY = 0x02,
61145 +#define GR_CRASH_RES 31
61146 +#define GR_UIDTABLE_MAX 500
61148 +/* begin resource learning section */
61150 + GR_RLIM_CPU_BUMP = 60,
61151 + GR_RLIM_FSIZE_BUMP = 50000,
61152 + GR_RLIM_DATA_BUMP = 10000,
61153 + GR_RLIM_STACK_BUMP = 1000,
61154 + GR_RLIM_CORE_BUMP = 10000,
61155 + GR_RLIM_RSS_BUMP = 500000,
61156 + GR_RLIM_NPROC_BUMP = 1,
61157 + GR_RLIM_NOFILE_BUMP = 5,
61158 + GR_RLIM_MEMLOCK_BUMP = 50000,
61159 + GR_RLIM_AS_BUMP = 500000,
61160 + GR_RLIM_LOCKS_BUMP = 2,
61161 + GR_RLIM_SIGPENDING_BUMP = 5,
61162 + GR_RLIM_MSGQUEUE_BUMP = 10000,
61163 + GR_RLIM_NICE_BUMP = 1,
61164 + GR_RLIM_RTPRIO_BUMP = 1,
61165 + GR_RLIM_RTTIME_BUMP = 1000000
61169 diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
61170 new file mode 100644
61171 index 0000000..60cda84
61173 +++ b/include/linux/grinternal.h
61175 +#ifndef __GRINTERNAL_H
61176 +#define __GRINTERNAL_H
61178 +#ifdef CONFIG_GRKERNSEC
61180 +#include <linux/fs.h>
61181 +#include <linux/mnt_namespace.h>
61182 +#include <linux/nsproxy.h>
61183 +#include <linux/gracl.h>
61184 +#include <linux/grdefs.h>
61185 +#include <linux/grmsg.h>
61187 +void gr_add_learn_entry(const char *fmt, ...)
61188 + __attribute__ ((format (printf, 1, 2)));
61189 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61190 + const struct vfsmount *mnt);
61191 +__u32 gr_check_create(const struct dentry *new_dentry,
61192 + const struct dentry *parent,
61193 + const struct vfsmount *mnt, const __u32 mode);
61194 +int gr_check_protected_task(const struct task_struct *task);
61195 +__u32 to_gr_audit(const __u32 reqmode);
61196 +int gr_set_acls(const int type);
61197 +int gr_apply_subject_to_task(struct task_struct *task);
61198 +int gr_acl_is_enabled(void);
61199 +char gr_roletype_to_char(void);
61201 +void gr_handle_alertkill(struct task_struct *task);
61202 +char *gr_to_filename(const struct dentry *dentry,
61203 + const struct vfsmount *mnt);
61204 +char *gr_to_filename1(const struct dentry *dentry,
61205 + const struct vfsmount *mnt);
61206 +char *gr_to_filename2(const struct dentry *dentry,
61207 + const struct vfsmount *mnt);
61208 +char *gr_to_filename3(const struct dentry *dentry,
61209 + const struct vfsmount *mnt);
61211 +extern int grsec_enable_harden_ptrace;
61212 +extern int grsec_enable_link;
61213 +extern int grsec_enable_fifo;
61214 +extern int grsec_enable_execve;
61215 +extern int grsec_enable_shm;
61216 +extern int grsec_enable_execlog;
61217 +extern int grsec_enable_signal;
61218 +extern int grsec_enable_audit_ptrace;
61219 +extern int grsec_enable_forkfail;
61220 +extern int grsec_enable_time;
61221 +extern int grsec_enable_rofs;
61222 +extern int grsec_enable_chroot_shmat;
61223 +extern int grsec_enable_chroot_mount;
61224 +extern int grsec_enable_chroot_double;
61225 +extern int grsec_enable_chroot_pivot;
61226 +extern int grsec_enable_chroot_chdir;
61227 +extern int grsec_enable_chroot_chmod;
61228 +extern int grsec_enable_chroot_mknod;
61229 +extern int grsec_enable_chroot_fchdir;
61230 +extern int grsec_enable_chroot_nice;
61231 +extern int grsec_enable_chroot_execlog;
61232 +extern int grsec_enable_chroot_caps;
61233 +extern int grsec_enable_chroot_sysctl;
61234 +extern int grsec_enable_chroot_unix;
61235 +extern int grsec_enable_tpe;
61236 +extern int grsec_tpe_gid;
61237 +extern int grsec_enable_tpe_all;
61238 +extern int grsec_enable_tpe_invert;
61239 +extern int grsec_enable_socket_all;
61240 +extern int grsec_socket_all_gid;
61241 +extern int grsec_enable_socket_client;
61242 +extern int grsec_socket_client_gid;
61243 +extern int grsec_enable_socket_server;
61244 +extern int grsec_socket_server_gid;
61245 +extern int grsec_audit_gid;
61246 +extern int grsec_enable_group;
61247 +extern int grsec_enable_audit_textrel;
61248 +extern int grsec_enable_log_rwxmaps;
61249 +extern int grsec_enable_mount;
61250 +extern int grsec_enable_chdir;
61251 +extern int grsec_resource_logging;
61252 +extern int grsec_enable_blackhole;
61253 +extern int grsec_lastack_retries;
61254 +extern int grsec_enable_brute;
61255 +extern int grsec_lock;
61257 +extern spinlock_t grsec_alert_lock;
61258 +extern unsigned long grsec_alert_wtime;
61259 +extern unsigned long grsec_alert_fyet;
61261 +extern spinlock_t grsec_audit_lock;
61263 +extern rwlock_t grsec_exec_file_lock;
61265 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
61266 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
61267 + (tsk)->exec_file->f_vfsmnt) : "/")
61269 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
61270 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
61271 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61273 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
61274 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
61275 + (tsk)->exec_file->f_vfsmnt) : "/")
61277 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
61278 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
61279 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61281 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
61283 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
61285 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
61286 + (task)->pid, (cred)->uid, \
61287 + (cred)->euid, (cred)->gid, (cred)->egid, \
61288 + gr_parent_task_fullpath(task), \
61289 + (task)->real_parent->comm, (task)->real_parent->pid, \
61290 + (pcred)->uid, (pcred)->euid, \
61291 + (pcred)->gid, (pcred)->egid
61293 +#define GR_CHROOT_CAPS {{ \
61294 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
61295 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
61296 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
61297 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
61298 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
61299 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
61300 + CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
61302 +#define security_learn(normal_msg,args...) \
61304 + read_lock(&grsec_exec_file_lock); \
61305 + gr_add_learn_entry(normal_msg "\n", ## args); \
61306 + read_unlock(&grsec_exec_file_lock); \
61312 + /* used for non-audit messages that we shouldn't kill the task on */
61313 + GR_DONT_AUDIT_GOOD
61324 + GR_SYSCTL_HIDDEN,
61327 + GR_ONE_INT_TWO_STR,
61334 + GR_FIVE_INT_TWO_STR,
61340 + GR_FILENAME_TWO_INT,
61341 + GR_FILENAME_TWO_INT_STR,
61354 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
61355 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
61356 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
61357 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
61358 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
61359 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
61360 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
61361 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
61362 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
61363 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
61364 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
61365 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
61366 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
61367 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
61368 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
61369 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
61370 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
61371 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
61372 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
61373 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
61374 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
61375 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
61376 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
61377 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
61378 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
61379 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
61380 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
61381 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
61382 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
61383 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
61384 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
61385 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
61386 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
61387 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
61388 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
61390 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
61395 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
61396 new file mode 100644
61397 index 0000000..9d5fd4a
61399 +++ b/include/linux/grmsg.h
61401 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
61402 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
61403 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
61404 +#define GR_STOPMOD_MSG "denied modification of module state by "
61405 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
61406 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
61407 +#define GR_IOPERM_MSG "denied use of ioperm() by "
61408 +#define GR_IOPL_MSG "denied use of iopl() by "
61409 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
61410 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
61411 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
61412 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
61413 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
61414 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
61415 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
61416 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
61417 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
61418 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
61419 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
61420 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
61421 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
61422 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
61423 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
61424 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
61425 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
61426 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
61427 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
61428 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
61429 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
61430 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
61431 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
61432 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
61433 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
61434 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
61435 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
61436 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
61437 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
61438 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
61439 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
61440 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
61441 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
61442 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
61443 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
61444 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
61445 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
61446 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
61447 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
61448 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
61449 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
61450 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
61451 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
61452 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
61453 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
61454 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
61455 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
61456 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
61457 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
61458 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
61459 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
61460 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
61461 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
61462 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
61463 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
61464 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
61465 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
61466 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
61467 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
61468 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
61469 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
61470 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
61471 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
61472 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
61473 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
61474 +#define GR_NICE_CHROOT_MSG "denied priority change by "
61475 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
61476 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
61477 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
61478 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
61479 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
61480 +#define GR_TIME_MSG "time set by "
61481 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
61482 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
61483 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
61484 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
61485 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
61486 +#define GR_BIND_MSG "denied bind() by "
61487 +#define GR_CONNECT_MSG "denied connect() by "
61488 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
61489 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
61490 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
61491 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
61492 +#define GR_CAP_ACL_MSG "use of %s denied for "
61493 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
61494 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
61495 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
61496 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
61497 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
61498 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
61499 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
61500 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
61501 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
61502 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
61503 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
61504 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
61505 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
61506 +#define GR_VM86_MSG "denied use of vm86 by "
61507 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
61508 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
61509 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
61510 new file mode 100644
61511 index 0000000..4620f36
61513 +++ b/include/linux/grsecurity.h
61515 +#ifndef GR_SECURITY_H
61516 +#define GR_SECURITY_H
61517 +#include <linux/fs.h>
61518 +#include <linux/fs_struct.h>
61519 +#include <linux/binfmts.h>
61520 +#include <linux/gracl.h>
61522 +/* notify of brain-dead configs */
61523 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
61524 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
61526 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
61527 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
61529 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61530 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61532 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61533 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61535 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
61536 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
61538 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
61539 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
61542 +#include <linux/compat.h>
61544 +struct user_arg_ptr {
61545 +#ifdef CONFIG_COMPAT
61549 + const char __user *const __user *native;
61550 +#ifdef CONFIG_COMPAT
61551 + compat_uptr_t __user *compat;
61556 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
61557 +void gr_handle_brute_check(void);
61558 +void gr_handle_kernel_exploit(void);
61559 +int gr_process_user_ban(void);
61561 +char gr_roletype_to_char(void);
61563 +int gr_acl_enable_at_secure(void);
61565 +int gr_check_user_change(int real, int effective, int fs);
61566 +int gr_check_group_change(int real, int effective, int fs);
61568 +void gr_del_task_from_ip_table(struct task_struct *p);
61570 +int gr_pid_is_chrooted(struct task_struct *p);
61571 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
61572 +int gr_handle_chroot_nice(void);
61573 +int gr_handle_chroot_sysctl(const int op);
61574 +int gr_handle_chroot_setpriority(struct task_struct *p,
61575 + const int niceval);
61576 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
61577 +int gr_handle_chroot_chroot(const struct dentry *dentry,
61578 + const struct vfsmount *mnt);
61579 +void gr_handle_chroot_chdir(struct path *path);
61580 +int gr_handle_chroot_chmod(const struct dentry *dentry,
61581 + const struct vfsmount *mnt, const int mode);
61582 +int gr_handle_chroot_mknod(const struct dentry *dentry,
61583 + const struct vfsmount *mnt, const int mode);
61584 +int gr_handle_chroot_mount(const struct dentry *dentry,
61585 + const struct vfsmount *mnt,
61586 + const char *dev_name);
61587 +int gr_handle_chroot_pivot(void);
61588 +int gr_handle_chroot_unix(const pid_t pid);
61590 +int gr_handle_rawio(const struct inode *inode);
61592 +void gr_handle_ioperm(void);
61593 +void gr_handle_iopl(void);
61595 +int gr_tpe_allow(const struct file *file);
61597 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
61598 +void gr_clear_chroot_entries(struct task_struct *task);
61600 +void gr_log_forkfail(const int retval);
61601 +void gr_log_timechange(void);
61602 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
61603 +void gr_log_chdir(const struct dentry *dentry,
61604 + const struct vfsmount *mnt);
61605 +void gr_log_chroot_exec(const struct dentry *dentry,
61606 + const struct vfsmount *mnt);
61607 +void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
61608 +void gr_log_remount(const char *devname, const int retval);
61609 +void gr_log_unmount(const char *devname, const int retval);
61610 +void gr_log_mount(const char *from, const char *to, const int retval);
61611 +void gr_log_textrel(struct vm_area_struct *vma);
61612 +void gr_log_rwxmmap(struct file *file);
61613 +void gr_log_rwxmprotect(struct file *file);
61615 +int gr_handle_follow_link(const struct inode *parent,
61616 + const struct inode *inode,
61617 + const struct dentry *dentry,
61618 + const struct vfsmount *mnt);
61619 +int gr_handle_fifo(const struct dentry *dentry,
61620 + const struct vfsmount *mnt,
61621 + const struct dentry *dir, const int flag,
61622 + const int acc_mode);
61623 +int gr_handle_hardlink(const struct dentry *dentry,
61624 + const struct vfsmount *mnt,
61625 + struct inode *inode,
61626 + const int mode, const char *to);
61628 +int gr_is_capable(const int cap);
61629 +int gr_is_capable_nolog(const int cap);
61630 +void gr_learn_resource(const struct task_struct *task, const int limit,
61631 + const unsigned long wanted, const int gt);
61632 +void gr_copy_label(struct task_struct *tsk);
61633 +void gr_handle_crash(struct task_struct *task, const int sig);
61634 +int gr_handle_signal(const struct task_struct *p, const int sig);
61635 +int gr_check_crash_uid(const uid_t uid);
61636 +int gr_check_protected_task(const struct task_struct *task);
61637 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
61638 +int gr_acl_handle_mmap(const struct file *file,
61639 + const unsigned long prot);
61640 +int gr_acl_handle_mprotect(const struct file *file,
61641 + const unsigned long prot);
61642 +int gr_check_hidden_task(const struct task_struct *tsk);
61643 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
61644 + const struct vfsmount *mnt);
61645 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
61646 + const struct vfsmount *mnt);
61647 +__u32 gr_acl_handle_access(const struct dentry *dentry,
61648 + const struct vfsmount *mnt, const int fmode);
61649 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
61650 + const struct vfsmount *mnt, mode_t mode);
61651 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
61652 + const struct vfsmount *mnt, mode_t mode);
61653 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
61654 + const struct vfsmount *mnt);
61655 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
61656 + const struct vfsmount *mnt);
61657 +int gr_handle_ptrace(struct task_struct *task, const long request);
61658 +int gr_handle_proc_ptrace(struct task_struct *task);
61659 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
61660 + const struct vfsmount *mnt);
61661 +int gr_check_crash_exec(const struct file *filp);
61662 +int gr_acl_is_enabled(void);
61663 +void gr_set_kernel_label(struct task_struct *task);
61664 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
61665 + const gid_t gid);
61666 +int gr_set_proc_label(const struct dentry *dentry,
61667 + const struct vfsmount *mnt,
61668 + const int unsafe_share);
61669 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
61670 + const struct vfsmount *mnt);
61671 +__u32 gr_acl_handle_open(const struct dentry *dentry,
61672 + const struct vfsmount *mnt, int acc_mode);
61673 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
61674 + const struct dentry *p_dentry,
61675 + const struct vfsmount *p_mnt,
61676 + int open_flags, int acc_mode, const int imode);
61677 +void gr_handle_create(const struct dentry *dentry,
61678 + const struct vfsmount *mnt);
61679 +void gr_handle_proc_create(const struct dentry *dentry,
61680 + const struct inode *inode);
61681 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
61682 + const struct dentry *parent_dentry,
61683 + const struct vfsmount *parent_mnt,
61685 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
61686 + const struct dentry *parent_dentry,
61687 + const struct vfsmount *parent_mnt);
61688 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
61689 + const struct vfsmount *mnt);
61690 +void gr_handle_delete(const ino_t ino, const dev_t dev);
61691 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
61692 + const struct vfsmount *mnt);
61693 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
61694 + const struct dentry *parent_dentry,
61695 + const struct vfsmount *parent_mnt,
61696 + const char *from);
61697 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
61698 + const struct dentry *parent_dentry,
61699 + const struct vfsmount *parent_mnt,
61700 + const struct dentry *old_dentry,
61701 + const struct vfsmount *old_mnt, const char *to);
61702 +int gr_acl_handle_rename(struct dentry *new_dentry,
61703 + struct dentry *parent_dentry,
61704 + const struct vfsmount *parent_mnt,
61705 + struct dentry *old_dentry,
61706 + struct inode *old_parent_inode,
61707 + struct vfsmount *old_mnt, const char *newname);
61708 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
61709 + struct dentry *old_dentry,
61710 + struct dentry *new_dentry,
61711 + struct vfsmount *mnt, const __u8 replace);
61712 +__u32 gr_check_link(const struct dentry *new_dentry,
61713 + const struct dentry *parent_dentry,
61714 + const struct vfsmount *parent_mnt,
61715 + const struct dentry *old_dentry,
61716 + const struct vfsmount *old_mnt);
61717 +int gr_acl_handle_filldir(const struct file *file, const char *name,
61718 + const unsigned int namelen, const ino_t ino);
61720 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
61721 + const struct vfsmount *mnt);
61722 +void gr_acl_handle_exit(void);
61723 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
61724 +int gr_acl_handle_procpidmem(const struct task_struct *task);
61725 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
61726 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
61727 +void gr_audit_ptrace(struct task_struct *task);
61728 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
61730 +#ifdef CONFIG_GRKERNSEC
61731 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
61732 +void gr_handle_vm86(void);
61733 +void gr_handle_mem_readwrite(u64 from, u64 to);
61735 +extern int grsec_enable_dmesg;
61736 +extern int grsec_disable_privio;
61737 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
61738 +extern int grsec_enable_chroot_findtask;
61740 +#ifdef CONFIG_GRKERNSEC_SETXID
61741 +extern int grsec_enable_setxid;
61746 diff --git a/include/linux/grsock.h b/include/linux/grsock.h
61747 new file mode 100644
61748 index 0000000..e7ffaaf
61750 +++ b/include/linux/grsock.h
61752 +#ifndef __GRSOCK_H
61753 +#define __GRSOCK_H
61755 +extern void gr_attach_curr_ip(const struct sock *sk);
61756 +extern int gr_handle_sock_all(const int family, const int type,
61757 + const int protocol);
61758 +extern int gr_handle_sock_server(const struct sockaddr *sck);
61759 +extern int gr_handle_sock_server_other(const struct sock *sck);
61760 +extern int gr_handle_sock_client(const struct sockaddr *sck);
61761 +extern int gr_search_connect(struct socket * sock,
61762 + struct sockaddr_in * addr);
61763 +extern int gr_search_bind(struct socket * sock,
61764 + struct sockaddr_in * addr);
61765 +extern int gr_search_listen(struct socket * sock);
61766 +extern int gr_search_accept(struct socket * sock);
61767 +extern int gr_search_socket(const int domain, const int type,
61768 + const int protocol);
61771 diff --git a/include/linux/hid.h b/include/linux/hid.h
61772 index 9cf8e7a..5ec94d0 100644
61773 --- a/include/linux/hid.h
61774 +++ b/include/linux/hid.h
61775 @@ -676,7 +676,7 @@ struct hid_ll_driver {
61776 unsigned int code, int value);
61778 int (*parse)(struct hid_device *hdev);
61782 #define PM_HINT_FULLON 1<<5
61783 #define PM_HINT_NORMAL 1<<1
61784 diff --git a/include/linux/highmem.h b/include/linux/highmem.h
61785 index 3a93f73..b19d0b3 100644
61786 --- a/include/linux/highmem.h
61787 +++ b/include/linux/highmem.h
61788 @@ -185,6 +185,18 @@ static inline void clear_highpage(struct page *page)
61789 kunmap_atomic(kaddr, KM_USER0);
61792 +static inline void sanitize_highpage(struct page *page)
61795 + unsigned long flags;
61797 + local_irq_save(flags);
61798 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
61799 + clear_page(kaddr);
61800 + kunmap_atomic(kaddr, KM_CLEARPAGE);
61801 + local_irq_restore(flags);
61804 static inline void zero_user_segments(struct page *page,
61805 unsigned start1, unsigned end1,
61806 unsigned start2, unsigned end2)
61807 diff --git a/include/linux/i2c.h b/include/linux/i2c.h
61808 index a6c652e..1f5878f 100644
61809 --- a/include/linux/i2c.h
61810 +++ b/include/linux/i2c.h
61811 @@ -346,6 +346,7 @@ struct i2c_algorithm {
61812 /* To determine what the adapter supports */
61813 u32 (*functionality) (struct i2c_adapter *);
61815 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
61818 * i2c_adapter is the structure used to identify a physical i2c bus along
61819 diff --git a/include/linux/i2o.h b/include/linux/i2o.h
61820 index a6deef4..c56a7f2 100644
61821 --- a/include/linux/i2o.h
61822 +++ b/include/linux/i2o.h
61823 @@ -564,7 +564,7 @@ struct i2o_controller {
61824 struct i2o_device *exec; /* Executive */
61825 #if BITS_PER_LONG == 64
61826 spinlock_t context_list_lock; /* lock for context_list */
61827 - atomic_t context_list_counter; /* needed for unique contexts */
61828 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
61829 struct list_head context_list; /* list of context id's
61832 diff --git a/include/linux/init.h b/include/linux/init.h
61833 index 9146f39..885354d 100644
61834 --- a/include/linux/init.h
61835 +++ b/include/linux/init.h
61836 @@ -293,13 +293,13 @@ void __init parse_early_options(char *cmdline);
61838 /* Each module must use one module_init(). */
61839 #define module_init(initfn) \
61840 - static inline initcall_t __inittest(void) \
61841 + static inline __used initcall_t __inittest(void) \
61842 { return initfn; } \
61843 int init_module(void) __attribute__((alias(#initfn)));
61845 /* This is only required if you want to be unloadable. */
61846 #define module_exit(exitfn) \
61847 - static inline exitcall_t __exittest(void) \
61848 + static inline __used exitcall_t __exittest(void) \
61849 { return exitfn; } \
61850 void cleanup_module(void) __attribute__((alias(#exitfn)));
61852 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
61853 index d14e058..4162929 100644
61854 --- a/include/linux/init_task.h
61855 +++ b/include/linux/init_task.h
61856 @@ -126,6 +126,12 @@ extern struct cred init_cred;
61857 # define INIT_PERF_EVENTS(tsk)
61861 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
61863 +#define INIT_TASK_THREAD_INFO
61867 * INIT_TASK is used to set up the first task table, touch at
61868 * your own risk!. Base=0, limit=0x1fffff (=2MB)
61869 @@ -164,6 +170,7 @@ extern struct cred init_cred;
61870 RCU_INIT_POINTER(.cred, &init_cred), \
61871 .comm = "swapper", \
61872 .thread = INIT_THREAD, \
61873 + INIT_TASK_THREAD_INFO \
61875 .files = &init_files, \
61876 .signal = &init_signals, \
61877 diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
61878 index 9310c69..6ebb244 100644
61879 --- a/include/linux/intel-iommu.h
61880 +++ b/include/linux/intel-iommu.h
61881 @@ -296,7 +296,7 @@ struct iommu_flush {
61883 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
61884 unsigned int size_order, u64 type);
61890 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
61891 index f51a81b..adfcb44 100644
61892 --- a/include/linux/interrupt.h
61893 +++ b/include/linux/interrupt.h
61894 @@ -425,7 +425,7 @@ enum
61895 /* map softirq index to softirq name. update 'softirq_to_name' in
61896 * kernel/softirq.c when adding a new softirq.
61898 -extern char *softirq_to_name[NR_SOFTIRQS];
61899 +extern const char * const softirq_to_name[NR_SOFTIRQS];
61901 /* softirq mask and active fields moved to irq_cpustat_t in
61902 * asm/hardirq.h to get better cache usage. KAO
61903 @@ -433,12 +433,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
61905 struct softirq_action
61907 - void (*action)(struct softirq_action *);
61908 + void (*action)(void);
61911 asmlinkage void do_softirq(void);
61912 asmlinkage void __do_softirq(void);
61913 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
61914 +extern void open_softirq(int nr, void (*action)(void));
61915 extern void softirq_init(void);
61916 static inline void __raise_softirq_irqoff(unsigned int nr)
61918 diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
61919 index 0df513b..fe901a2 100644
61920 --- a/include/linux/kallsyms.h
61921 +++ b/include/linux/kallsyms.h
61926 -#ifdef CONFIG_KALLSYMS
61927 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
61928 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
61929 /* Lookup the address for a symbol. Returns 0 if not found. */
61930 unsigned long kallsyms_lookup_name(const char *name);
61932 @@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
61933 /* Stupid that this does nothing, but I didn't create this mess. */
61934 #define __print_symbol(fmt, addr)
61935 #endif /*CONFIG_KALLSYMS*/
61936 +#else /* when included by kallsyms.c, vsnprintf.c, or
61937 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
61938 +extern void __print_symbol(const char *fmt, unsigned long address);
61939 +extern int sprint_backtrace(char *buffer, unsigned long address);
61940 +extern int sprint_symbol(char *buffer, unsigned long address);
61941 +const char *kallsyms_lookup(unsigned long addr,
61942 + unsigned long *symbolsize,
61943 + unsigned long *offset,
61944 + char **modname, char *namebuf);
61947 /* This macro allows us to keep printk typechecking */
61948 static void __check_printsym_format(const char *fmt, ...)
61949 diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
61950 index fa39183..40160be 100644
61951 --- a/include/linux/kgdb.h
61952 +++ b/include/linux/kgdb.h
61953 @@ -53,7 +53,7 @@ extern int kgdb_connected;
61954 extern int kgdb_io_module_registered;
61956 extern atomic_t kgdb_setting_breakpoint;
61957 -extern atomic_t kgdb_cpu_doing_single_step;
61958 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
61960 extern struct task_struct *kgdb_usethread;
61961 extern struct task_struct *kgdb_contthread;
61962 @@ -251,7 +251,7 @@ struct kgdb_arch {
61963 void (*disable_hw_break)(struct pt_regs *regs);
61964 void (*remove_all_hw_break)(void);
61965 void (*correct_hw_break)(void);
61970 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
61971 @@ -276,7 +276,7 @@ struct kgdb_io {
61972 void (*pre_exception) (void);
61973 void (*post_exception) (void);
61978 extern struct kgdb_arch arch_kgdb_ops;
61980 diff --git a/include/linux/kmod.h b/include/linux/kmod.h
61981 index 0da38cf..d23f05f 100644
61982 --- a/include/linux/kmod.h
61983 +++ b/include/linux/kmod.h
61984 @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
61985 * usually useless though. */
61986 extern int __request_module(bool wait, const char *name, ...) \
61987 __attribute__((format(printf, 2, 3)));
61988 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
61989 + __attribute__((format(printf, 3, 4)));
61990 #define request_module(mod...) __request_module(true, mod)
61991 #define request_module_nowait(mod...) __request_module(false, mod)
61992 #define try_then_request_module(x, mod...) \
61993 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
61994 index eabb21a..3f030f4 100644
61995 --- a/include/linux/kvm_host.h
61996 +++ b/include/linux/kvm_host.h
61997 @@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
61998 void vcpu_load(struct kvm_vcpu *vcpu);
61999 void vcpu_put(struct kvm_vcpu *vcpu);
62001 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62002 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62003 struct module *module);
62004 void kvm_exit(void);
62006 @@ -454,7 +454,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
62007 struct kvm_guest_debug *dbg);
62008 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
62010 -int kvm_arch_init(void *opaque);
62011 +int kvm_arch_init(const void *opaque);
62012 void kvm_arch_exit(void);
62014 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
62015 diff --git a/include/linux/libata.h b/include/linux/libata.h
62016 index efd6f98..5f5fd37 100644
62017 --- a/include/linux/libata.h
62018 +++ b/include/linux/libata.h
62019 @@ -909,7 +909,7 @@ struct ata_port_operations {
62020 * fields must be pointers.
62022 const struct ata_port_operations *inherits;
62026 struct ata_port_info {
62027 unsigned long flags;
62028 diff --git a/include/linux/mca.h b/include/linux/mca.h
62029 index 3797270..7765ede 100644
62030 --- a/include/linux/mca.h
62031 +++ b/include/linux/mca.h
62032 @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
62034 void * (*mca_transform_memory)(struct mca_device *,
62040 u64 default_dma_mask;
62041 diff --git a/include/linux/memory.h b/include/linux/memory.h
62042 index 935699b..11042cc 100644
62043 --- a/include/linux/memory.h
62044 +++ b/include/linux/memory.h
62045 @@ -144,7 +144,7 @@ struct memory_accessor {
62047 ssize_t (*write)(struct memory_accessor *, const char *buf,
62048 off_t offset, size_t count);
62053 * Kernel text modification mutex, used for code patching. Users of this lock
62054 diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
62055 index 896b5e4..1159ad0 100644
62056 --- a/include/linux/mfd/abx500.h
62057 +++ b/include/linux/mfd/abx500.h
62058 @@ -234,6 +234,7 @@ struct abx500_ops {
62059 int (*event_registers_startup_state_get) (struct device *, u8 *);
62060 int (*startup_irq_enabled) (struct device *, unsigned int);
62062 +typedef struct abx500_ops __no_const abx500_ops_no_const;
62064 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
62065 void abx500_remove_ops(struct device *dev);
62066 diff --git a/include/linux/mm.h b/include/linux/mm.h
62067 index fedc5f0..7cedb6d 100644
62068 --- a/include/linux/mm.h
62069 +++ b/include/linux/mm.h
62070 @@ -114,7 +114,14 @@ extern unsigned int kobjsize(const void *objp);
62072 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
62073 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
62075 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
62076 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62077 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62079 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62082 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62083 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62085 @@ -1011,34 +1018,6 @@ int set_page_dirty(struct page *page);
62086 int set_page_dirty_lock(struct page *page);
62087 int clear_page_dirty_for_io(struct page *page);
62089 -/* Is the vma a continuation of the stack vma above it? */
62090 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
62092 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62095 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
62096 - unsigned long addr)
62098 - return (vma->vm_flags & VM_GROWSDOWN) &&
62099 - (vma->vm_start == addr) &&
62100 - !vma_growsdown(vma->vm_prev, addr);
62103 -/* Is the vma a continuation of the stack vma below it? */
62104 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
62106 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
62109 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
62110 - unsigned long addr)
62112 - return (vma->vm_flags & VM_GROWSUP) &&
62113 - (vma->vm_end == addr) &&
62114 - !vma_growsup(vma->vm_next, addr);
62117 extern unsigned long move_page_tables(struct vm_area_struct *vma,
62118 unsigned long old_addr, struct vm_area_struct *new_vma,
62119 unsigned long new_addr, unsigned long len);
62120 @@ -1133,6 +1112,15 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
62125 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
62127 +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
62129 + return __pgprot(0);
62133 int vma_wants_writenotify(struct vm_area_struct *vma);
62135 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
62136 @@ -1417,6 +1405,7 @@ out:
62139 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62140 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62142 extern unsigned long do_brk(unsigned long, unsigned long);
62144 @@ -1474,6 +1463,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
62145 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
62146 struct vm_area_struct **pprev);
62148 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
62149 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
62150 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
62152 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
62153 NULL if none. Assume start_addr < end_addr. */
62154 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
62155 @@ -1490,15 +1483,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
62156 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
62160 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
62162 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
62164 - return __pgprot(0);
62168 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
62169 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
62170 unsigned long pfn, unsigned long size, pgprot_t);
62171 @@ -1612,7 +1596,7 @@ extern int unpoison_memory(unsigned long pfn);
62172 extern int sysctl_memory_failure_early_kill;
62173 extern int sysctl_memory_failure_recovery;
62174 extern void shake_page(struct page *p, int access);
62175 -extern atomic_long_t mce_bad_pages;
62176 +extern atomic_long_unchecked_t mce_bad_pages;
62177 extern int soft_offline_page(struct page *page, int flags);
62179 extern void dump_page(struct page *page);
62180 @@ -1626,5 +1610,11 @@ extern void copy_user_huge_page(struct page *dst, struct page *src,
62181 unsigned int pages_per_huge_page);
62182 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
62184 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
62185 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
62187 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
62190 #endif /* __KERNEL__ */
62191 #endif /* _LINUX_MM_H */
62192 diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
62193 index 10a2f62..c8fa287 100644
62194 --- a/include/linux/mm_types.h
62195 +++ b/include/linux/mm_types.h
62196 @@ -230,6 +230,8 @@ struct vm_area_struct {
62198 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
62201 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
62204 struct core_thread {
62205 @@ -362,6 +364,24 @@ struct mm_struct {
62206 #ifdef CONFIG_CPUMASK_OFFSTACK
62207 struct cpumask cpumask_allocation;
62210 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62211 + unsigned long pax_flags;
62214 +#ifdef CONFIG_PAX_DLRESOLVE
62215 + unsigned long call_dl_resolve;
62218 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
62219 + unsigned long call_syscall;
62222 +#ifdef CONFIG_PAX_ASLR
62223 + unsigned long delta_mmap; /* randomized offset */
62224 + unsigned long delta_stack; /* randomized offset */
62229 static inline void mm_init_cpumask(struct mm_struct *mm)
62230 diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
62231 index 1d1b1e1..2a13c78 100644
62232 --- a/include/linux/mmu_notifier.h
62233 +++ b/include/linux/mmu_notifier.h
62234 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
62236 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
62240 struct vm_area_struct *___vma = __vma; \
62241 unsigned long ___address = __address; \
62242 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
62243 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
62244 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
62249 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
62250 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
62251 index be1ac8d..26868ce 100644
62252 --- a/include/linux/mmzone.h
62253 +++ b/include/linux/mmzone.h
62254 @@ -356,7 +356,7 @@ struct zone {
62255 unsigned long flags; /* zone flags, see below */
62257 /* Zone statistics */
62258 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62259 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62262 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
62263 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
62264 index ae28e93..1ac2233 100644
62265 --- a/include/linux/mod_devicetable.h
62266 +++ b/include/linux/mod_devicetable.h
62268 typedef unsigned long kernel_ulong_t;
62271 -#define PCI_ANY_ID (~0)
62272 +#define PCI_ANY_ID ((__u16)~0)
62274 struct pci_device_id {
62275 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
62276 @@ -131,7 +131,7 @@ struct usb_device_id {
62277 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
62278 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
62280 -#define HID_ANY_ID (~0)
62281 +#define HID_ANY_ID (~0U)
62283 struct hid_device_id {
62285 diff --git a/include/linux/module.h b/include/linux/module.h
62286 index 1c30087..fc2a442 100644
62287 --- a/include/linux/module.h
62288 +++ b/include/linux/module.h
62290 #include <linux/kobject.h>
62291 #include <linux/moduleparam.h>
62292 #include <linux/tracepoint.h>
62293 +#include <linux/fs.h>
62295 #include <linux/percpu.h>
62296 #include <asm/module.h>
62297 @@ -327,19 +328,16 @@ struct module
62300 /* If this is non-NULL, vfree after init() returns */
62301 - void *module_init;
62302 + void *module_init_rx, *module_init_rw;
62304 /* Here is the actual code + data, vfree'd on unload. */
62305 - void *module_core;
62306 + void *module_core_rx, *module_core_rw;
62308 /* Here are the sizes of the init and core sections */
62309 - unsigned int init_size, core_size;
62310 + unsigned int init_size_rw, core_size_rw;
62312 /* The size of the executable code in each section. */
62313 - unsigned int init_text_size, core_text_size;
62315 - /* Size of RO sections of the module (text+rodata) */
62316 - unsigned int init_ro_size, core_ro_size;
62317 + unsigned int init_size_rx, core_size_rx;
62319 /* Arch-specific module values */
62320 struct mod_arch_specific arch;
62321 @@ -395,6 +393,10 @@ struct module
62322 #ifdef CONFIG_EVENT_TRACING
62323 struct ftrace_event_call **trace_events;
62324 unsigned int num_trace_events;
62325 + struct file_operations trace_id;
62326 + struct file_operations trace_enable;
62327 + struct file_operations trace_format;
62328 + struct file_operations trace_filter;
62330 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
62331 unsigned int num_ftrace_callsites;
62332 @@ -445,16 +447,46 @@ bool is_module_address(unsigned long addr);
62333 bool is_module_percpu_address(unsigned long addr);
62334 bool is_module_text_address(unsigned long addr);
62336 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
62339 +#ifdef CONFIG_PAX_KERNEXEC
62340 + if (ktla_ktva(addr) >= (unsigned long)start &&
62341 + ktla_ktva(addr) < (unsigned long)start + size)
62345 + return ((void *)addr >= start && (void *)addr < start + size);
62348 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
62350 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
62353 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
62355 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
62358 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
62360 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
62363 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
62365 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
62368 static inline int within_module_core(unsigned long addr, struct module *mod)
62370 - return (unsigned long)mod->module_core <= addr &&
62371 - addr < (unsigned long)mod->module_core + mod->core_size;
62372 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
62375 static inline int within_module_init(unsigned long addr, struct module *mod)
62377 - return (unsigned long)mod->module_init <= addr &&
62378 - addr < (unsigned long)mod->module_init + mod->init_size;
62379 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
62382 /* Search for module by name: must hold module_mutex. */
62383 diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
62384 index b2be02e..6a9fdb1 100644
62385 --- a/include/linux/moduleloader.h
62386 +++ b/include/linux/moduleloader.h
62387 @@ -25,9 +25,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
62388 sections. Returns NULL on failure. */
62389 void *module_alloc(unsigned long size);
62391 +#ifdef CONFIG_PAX_KERNEXEC
62392 +void *module_alloc_exec(unsigned long size);
62394 +#define module_alloc_exec(x) module_alloc(x)
62397 /* Free memory returned from module_alloc. */
62398 void module_free(struct module *mod, void *module_region);
62400 +#ifdef CONFIG_PAX_KERNEXEC
62401 +void module_free_exec(struct module *mod, void *module_region);
62403 +#define module_free_exec(x, y) module_free((x), (y))
62406 /* Apply the given relocation to the (simplified) ELF. Return -error
62408 int apply_relocate(Elf_Shdr *sechdrs,
62409 diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
62410 index ddaae98..3c70938 100644
62411 --- a/include/linux/moduleparam.h
62412 +++ b/include/linux/moduleparam.h
62413 @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock(void)
62414 * @len is usually just sizeof(string).
62416 #define module_param_string(name, string, len, perm) \
62417 - static const struct kparam_string __param_string_##name \
62418 + static const struct kparam_string __param_string_##name __used \
62419 = { len, string }; \
62420 __module_param_call(MODULE_PARAM_PREFIX, name, \
62421 ¶m_ops_string, \
62422 @@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
62423 * module_param_named() for why this might be necessary.
62425 #define module_param_array_named(name, array, type, nump, perm) \
62426 - static const struct kparam_array __param_arr_##name \
62427 + static const struct kparam_array __param_arr_##name __used \
62428 = { .max = ARRAY_SIZE(array), .num = nump, \
62429 .ops = ¶m_ops_##type, \
62430 .elemsize = sizeof(array[0]), .elem = array }; \
62431 diff --git a/include/linux/namei.h b/include/linux/namei.h
62432 index ffc0213..2c1f2cb 100644
62433 --- a/include/linux/namei.h
62434 +++ b/include/linux/namei.h
62435 @@ -24,7 +24,7 @@ struct nameidata {
62439 - char *saved_names[MAX_NESTED_LINKS + 1];
62440 + const char *saved_names[MAX_NESTED_LINKS + 1];
62444 @@ -94,12 +94,12 @@ extern int follow_up(struct path *);
62445 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
62446 extern void unlock_rename(struct dentry *, struct dentry *);
62448 -static inline void nd_set_link(struct nameidata *nd, char *path)
62449 +static inline void nd_set_link(struct nameidata *nd, const char *path)
62451 nd->saved_names[nd->depth] = path;
62454 -static inline char *nd_get_link(struct nameidata *nd)
62455 +static inline const char *nd_get_link(const struct nameidata *nd)
62457 return nd->saved_names[nd->depth];
62459 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
62460 index ddee79b..67af106 100644
62461 --- a/include/linux/netdevice.h
62462 +++ b/include/linux/netdevice.h
62463 @@ -944,6 +944,7 @@ struct net_device_ops {
62464 int (*ndo_set_features)(struct net_device *dev,
62467 +typedef struct net_device_ops __no_const net_device_ops_no_const;
62470 * The DEVICE structure.
62471 diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
62472 new file mode 100644
62473 index 0000000..33f4af8
62475 +++ b/include/linux/netfilter/xt_gradm.h
62477 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
62478 +#define _LINUX_NETFILTER_XT_GRADM_H 1
62480 +struct xt_gradm_mtinfo {
62486 diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
62487 index c65a18a..0c05f3a 100644
62488 --- a/include/linux/of_pdt.h
62489 +++ b/include/linux/of_pdt.h
62490 @@ -32,7 +32,7 @@ struct of_pdt_ops {
62492 /* return 0 on success; fill in 'len' with number of bytes in path */
62493 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
62497 extern void *prom_early_alloc(unsigned long size);
62499 diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
62500 index 49c8727..34d2ae1 100644
62501 --- a/include/linux/oprofile.h
62502 +++ b/include/linux/oprofile.h
62503 @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
62504 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
62505 char const * name, ulong * val);
62507 -/** Create a file for read-only access to an atomic_t. */
62508 +/** Create a file for read-only access to an atomic_unchecked_t. */
62509 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
62510 - char const * name, atomic_t * val);
62511 + char const * name, atomic_unchecked_t * val);
62513 /** create a directory */
62514 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
62515 diff --git a/include/linux/padata.h b/include/linux/padata.h
62516 index 4633b2f..988bc08 100644
62517 --- a/include/linux/padata.h
62518 +++ b/include/linux/padata.h
62519 @@ -129,7 +129,7 @@ struct parallel_data {
62520 struct padata_instance *pinst;
62521 struct padata_parallel_queue __percpu *pqueue;
62522 struct padata_serial_queue __percpu *squeue;
62524 + atomic_unchecked_t seq_nr;
62525 atomic_t reorder_objects;
62527 unsigned int max_seq_nr;
62528 diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
62529 index c816075..cd28c4d 100644
62530 --- a/include/linux/perf_event.h
62531 +++ b/include/linux/perf_event.h
62532 @@ -745,8 +745,8 @@ struct perf_event {
62534 enum perf_event_active_state state;
62535 unsigned int attach_state;
62537 - atomic64_t child_count;
62538 + local64_t count; /* PaX: fix it one day */
62539 + atomic64_unchecked_t child_count;
62542 * These are the total time in nanoseconds that the event
62543 @@ -797,8 +797,8 @@ struct perf_event {
62544 * These accumulate total time (in nanoseconds) that children
62545 * events have been enabled and running, respectively.
62547 - atomic64_t child_total_time_enabled;
62548 - atomic64_t child_total_time_running;
62549 + atomic64_unchecked_t child_total_time_enabled;
62550 + atomic64_unchecked_t child_total_time_running;
62553 * Protect attach/detach and child_list:
62554 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
62555 index 77257c9..51d473a 100644
62556 --- a/include/linux/pipe_fs_i.h
62557 +++ b/include/linux/pipe_fs_i.h
62558 @@ -46,9 +46,9 @@ struct pipe_buffer {
62559 struct pipe_inode_info {
62560 wait_queue_head_t wait;
62561 unsigned int nrbufs, curbuf, buffers;
62562 - unsigned int readers;
62563 - unsigned int writers;
62564 - unsigned int waiting_writers;
62565 + atomic_t readers;
62566 + atomic_t writers;
62567 + atomic_t waiting_writers;
62568 unsigned int r_counter;
62569 unsigned int w_counter;
62570 struct page *tmp_page;
62571 diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
62572 index daac05d..c6802ce 100644
62573 --- a/include/linux/pm_runtime.h
62574 +++ b/include/linux/pm_runtime.h
62575 @@ -99,7 +99,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
62577 static inline void pm_runtime_mark_last_busy(struct device *dev)
62579 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
62580 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
62583 #else /* !CONFIG_PM_RUNTIME */
62584 diff --git a/include/linux/poison.h b/include/linux/poison.h
62585 index 79159de..f1233a9 100644
62586 --- a/include/linux/poison.h
62587 +++ b/include/linux/poison.h
62589 * under normal circumstances, used to verify that nobody uses
62590 * non-initialized list entries.
62592 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
62593 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
62594 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
62595 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
62597 /********** include/linux/timer.h **********/
62599 diff --git a/include/linux/preempt.h b/include/linux/preempt.h
62600 index 58969b2..ead129b 100644
62601 --- a/include/linux/preempt.h
62602 +++ b/include/linux/preempt.h
62603 @@ -123,7 +123,7 @@ struct preempt_ops {
62604 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
62605 void (*sched_out)(struct preempt_notifier *notifier,
62606 struct task_struct *next);
62611 * preempt_notifier - key for installing preemption notifiers
62612 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
62613 index 643b96c..ef55a9c 100644
62614 --- a/include/linux/proc_fs.h
62615 +++ b/include/linux/proc_fs.h
62616 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
62617 return proc_create_data(name, mode, parent, proc_fops, NULL);
62620 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
62621 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
62623 +#ifdef CONFIG_GRKERNSEC_PROC_USER
62624 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
62625 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62626 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
62628 + return proc_create_data(name, mode, parent, proc_fops, NULL);
62633 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
62634 mode_t mode, struct proc_dir_entry *base,
62635 read_proc_t *read_proc, void * data)
62636 @@ -258,7 +271,7 @@ union proc_op {
62637 int (*proc_show)(struct seq_file *m,
62638 struct pid_namespace *ns, struct pid *pid,
62639 struct task_struct *task);
62643 struct ctl_table_header;
62645 diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
62646 index 800f113..af90cc8 100644
62647 --- a/include/linux/ptrace.h
62648 +++ b/include/linux/ptrace.h
62649 @@ -129,10 +129,10 @@ extern void __ptrace_unlink(struct task_struct *child);
62650 extern void exit_ptrace(struct task_struct *tracer);
62651 #define PTRACE_MODE_READ 1
62652 #define PTRACE_MODE_ATTACH 2
62653 -/* Returns 0 on success, -errno on denial. */
62654 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
62655 /* Returns true on success, false on denial. */
62656 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
62657 +/* Returns true on success, false on denial. */
62658 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
62660 static inline int ptrace_reparented(struct task_struct *child)
62662 diff --git a/include/linux/random.h b/include/linux/random.h
62663 index d13059f..2eaafaa 100644
62664 --- a/include/linux/random.h
62665 +++ b/include/linux/random.h
62666 @@ -69,12 +69,17 @@ void srandom32(u32 seed);
62668 u32 prandom32(struct rnd_state *);
62670 +static inline unsigned long pax_get_random_long(void)
62672 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
62676 * Handle minimum values for seeds
62678 static inline u32 __seed(u32 x, u32 m)
62680 - return (x < m) ? x + m : x;
62681 + return (x <= m) ? x + m + 1 : x;
62685 diff --git a/include/linux/reboot.h b/include/linux/reboot.h
62686 index e0879a7..a12f962 100644
62687 --- a/include/linux/reboot.h
62688 +++ b/include/linux/reboot.h
62689 @@ -52,9 +52,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
62690 * Architecture-specific implementations of sys_reboot commands.
62693 -extern void machine_restart(char *cmd);
62694 -extern void machine_halt(void);
62695 -extern void machine_power_off(void);
62696 +extern void machine_restart(char *cmd) __noreturn;
62697 +extern void machine_halt(void) __noreturn;
62698 +extern void machine_power_off(void) __noreturn;
62700 extern void machine_shutdown(void);
62702 @@ -65,9 +65,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
62705 extern void kernel_restart_prepare(char *cmd);
62706 -extern void kernel_restart(char *cmd);
62707 -extern void kernel_halt(void);
62708 -extern void kernel_power_off(void);
62709 +extern void kernel_restart(char *cmd) __noreturn;
62710 +extern void kernel_halt(void) __noreturn;
62711 +extern void kernel_power_off(void) __noreturn;
62713 extern int C_A_D; /* for sysctl */
62714 void ctrl_alt_del(void);
62715 @@ -81,7 +81,7 @@ extern int orderly_poweroff(bool force);
62716 * Emergency restart, callable from an interrupt handler.
62719 -extern void emergency_restart(void);
62720 +extern void emergency_restart(void) __noreturn;
62721 #include <asm/emergency-restart.h>
62724 diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
62725 index 96d465f..b084e05 100644
62726 --- a/include/linux/reiserfs_fs.h
62727 +++ b/include/linux/reiserfs_fs.h
62728 @@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
62729 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
62731 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
62732 -#define get_generation(s) atomic_read (&fs_generation(s))
62733 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
62734 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
62735 #define __fs_changed(gen,s) (gen != get_generation (s))
62736 #define fs_changed(gen,s) \
62737 diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
62738 index 52c83b6..18ed7eb 100644
62739 --- a/include/linux/reiserfs_fs_sb.h
62740 +++ b/include/linux/reiserfs_fs_sb.h
62741 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
62742 /* Comment? -Hans */
62743 wait_queue_head_t s_wait;
62744 /* To be obsoleted soon by per buffer seals.. -Hans */
62745 - atomic_t s_generation_counter; // increased by one every time the
62746 + atomic_unchecked_t s_generation_counter; // increased by one every time the
62747 // tree gets re-balanced
62748 unsigned long s_properties; /* File system properties. Currently holds
62749 on-disk FS format */
62750 diff --git a/include/linux/relay.h b/include/linux/relay.h
62751 index 14a86bc..17d0700 100644
62752 --- a/include/linux/relay.h
62753 +++ b/include/linux/relay.h
62754 @@ -159,7 +159,7 @@ struct rchan_callbacks
62755 * The callback should return 0 if successful, negative if not.
62757 int (*remove_buf_file)(struct dentry *dentry);
62762 * CONFIG_RELAY kernel API, kernel/relay.c
62763 diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
62764 index c6c6084..5bf1212 100644
62765 --- a/include/linux/rfkill.h
62766 +++ b/include/linux/rfkill.h
62767 @@ -147,6 +147,7 @@ struct rfkill_ops {
62768 void (*query)(struct rfkill *rfkill, void *data);
62769 int (*set_block)(void *data, bool blocked);
62771 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
62773 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
62775 diff --git a/include/linux/rmap.h b/include/linux/rmap.h
62776 index 2148b12..519b820 100644
62777 --- a/include/linux/rmap.h
62778 +++ b/include/linux/rmap.h
62779 @@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma)
62780 void anon_vma_init(void); /* create anon_vma_cachep */
62781 int anon_vma_prepare(struct vm_area_struct *);
62782 void unlink_anon_vmas(struct vm_area_struct *);
62783 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
62784 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
62785 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
62786 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
62787 void __anon_vma_link(struct vm_area_struct *);
62789 static inline void anon_vma_merge(struct vm_area_struct *vma,
62790 diff --git a/include/linux/sched.h b/include/linux/sched.h
62791 index 41d0237..5a64056 100644
62792 --- a/include/linux/sched.h
62793 +++ b/include/linux/sched.h
62794 @@ -100,6 +100,7 @@ struct bio_list;
62796 struct perf_event_context;
62798 +struct linux_binprm;
62801 * List of flags we want to share for kernel threads,
62802 @@ -380,10 +381,13 @@ struct user_namespace;
62803 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
62805 extern int sysctl_max_map_count;
62806 +extern unsigned long sysctl_heap_stack_gap;
62808 #include <linux/aio.h>
62811 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
62812 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
62813 extern void arch_pick_mmap_layout(struct mm_struct *mm);
62814 extern unsigned long
62815 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
62816 @@ -629,6 +633,17 @@ struct signal_struct {
62817 #ifdef CONFIG_TASKSTATS
62818 struct taskstats *stats;
62821 +#ifdef CONFIG_GRKERNSEC
62828 + u8 used_accept:1;
62831 #ifdef CONFIG_AUDIT
62832 unsigned audit_tty;
62833 struct tty_audit_buf *tty_audit_buf;
62834 @@ -710,6 +725,11 @@ struct user_struct {
62835 struct key *session_keyring; /* UID's default session keyring */
62838 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
62839 + unsigned int banned;
62840 + unsigned long ban_expires;
62843 /* Hash table maintenance information */
62844 struct hlist_node uidhash_node;
62846 @@ -1340,8 +1360,8 @@ struct task_struct {
62847 struct list_head thread_group;
62849 struct completion *vfork_done; /* for vfork() */
62850 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
62851 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62852 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
62853 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62855 cputime_t utime, stime, utimescaled, stimescaled;
62857 @@ -1357,13 +1377,6 @@ struct task_struct {
62858 struct task_cputime cputime_expires;
62859 struct list_head cpu_timers[3];
62861 -/* process credentials */
62862 - const struct cred __rcu *real_cred; /* objective and real subjective task
62863 - * credentials (COW) */
62864 - const struct cred __rcu *cred; /* effective (overridable) subjective task
62865 - * credentials (COW) */
62866 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62868 char comm[TASK_COMM_LEN]; /* executable name excluding path
62869 - access with [gs]et_task_comm (which lock
62870 it with task_lock())
62871 @@ -1380,8 +1393,16 @@ struct task_struct {
62873 /* CPU-specific state of this task */
62874 struct thread_struct thread;
62875 +/* thread_info moved to task_struct */
62877 + struct thread_info tinfo;
62879 /* filesystem information */
62880 struct fs_struct *fs;
62882 + const struct cred __rcu *cred; /* effective (overridable) subjective task
62883 + * credentials (COW) */
62885 /* open file information */
62886 struct files_struct *files;
62888 @@ -1428,6 +1449,11 @@ struct task_struct {
62889 struct rt_mutex_waiter *pi_blocked_on;
62892 +/* process credentials */
62893 + const struct cred __rcu *real_cred; /* objective and real subjective task
62894 + * credentials (COW) */
62895 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62897 #ifdef CONFIG_DEBUG_MUTEXES
62898 /* mutex deadlock detection */
62899 struct mutex_waiter *blocked_on;
62900 @@ -1537,6 +1563,21 @@ struct task_struct {
62901 unsigned long default_timer_slack_ns;
62903 struct list_head *scm_work_list;
62905 +#ifdef CONFIG_GRKERNSEC
62907 + struct dentry *gr_chroot_dentry;
62908 + struct acl_subject_label *acl;
62909 + struct acl_role_label *role;
62910 + struct file *exec_file;
62912 + /* is this the task that authenticated to the special role */
62916 + u8 gr_is_chrooted;
62919 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
62920 /* Index of current stored address in ret_stack */
62921 int curr_ret_stack;
62922 @@ -1571,6 +1612,57 @@ struct task_struct {
62926 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
62927 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
62928 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
62929 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
62930 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
62931 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
62933 +#ifdef CONFIG_PAX_SOFTMODE
62934 +extern int pax_softmode;
62937 +extern int pax_check_flags(unsigned long *);
62939 +/* if tsk != current then task_lock must be held on it */
62940 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62941 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
62943 + if (likely(tsk->mm))
62944 + return tsk->mm->pax_flags;
62949 +/* if tsk != current then task_lock must be held on it */
62950 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
62952 + if (likely(tsk->mm)) {
62953 + tsk->mm->pax_flags = flags;
62960 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
62961 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
62962 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
62963 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
62966 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
62967 +extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
62968 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
62969 +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
62971 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
62972 +extern void pax_track_stack(void);
62974 +static inline void pax_track_stack(void) {}
62977 /* Future-safe accessor for struct task_struct's cpus_allowed. */
62978 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
62980 @@ -2074,7 +2166,9 @@ void yield(void);
62981 extern struct exec_domain default_exec_domain;
62983 union thread_union {
62984 +#ifndef CONFIG_X86
62985 struct thread_info thread_info;
62987 unsigned long stack[THREAD_SIZE/sizeof(long)];
62990 @@ -2107,6 +2201,7 @@ extern struct pid_namespace init_pid_ns;
62993 extern struct task_struct *find_task_by_vpid(pid_t nr);
62994 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
62995 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
62996 struct pid_namespace *ns);
62998 @@ -2243,7 +2338,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
62999 extern void exit_itimers(struct signal_struct *);
63000 extern void flush_itimer_signals(void);
63002 -extern NORET_TYPE void do_group_exit(int);
63003 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
63005 extern void daemonize(const char *, ...);
63006 extern int allow_signal(int);
63007 @@ -2408,13 +2503,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
63011 -static inline int object_is_on_stack(void *obj)
63012 +static inline int object_starts_on_stack(void *obj)
63014 - void *stack = task_stack_page(current);
63015 + const void *stack = task_stack_page(current);
63017 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
63020 +#ifdef CONFIG_PAX_USERCOPY
63021 +extern int object_is_on_stack(const void *obj, unsigned long len);
63024 extern void thread_info_cache_init(void);
63026 #ifdef CONFIG_DEBUG_STACK_USAGE
63027 diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
63028 index 899fbb4..1cb4138 100644
63029 --- a/include/linux/screen_info.h
63030 +++ b/include/linux/screen_info.h
63031 @@ -43,7 +43,8 @@ struct screen_info {
63032 __u16 pages; /* 0x32 */
63033 __u16 vesa_attributes; /* 0x34 */
63034 __u32 capabilities; /* 0x36 */
63035 - __u8 _reserved[6]; /* 0x3a */
63036 + __u16 vesapm_size; /* 0x3a */
63037 + __u8 _reserved[4]; /* 0x3c */
63038 } __attribute__((packed));
63040 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
63041 diff --git a/include/linux/security.h b/include/linux/security.h
63042 index ebd2a53..2d949ae 100644
63043 --- a/include/linux/security.h
63044 +++ b/include/linux/security.h
63046 #include <linux/key.h>
63047 #include <linux/xfrm.h>
63048 #include <linux/slab.h>
63049 +#include <linux/grsecurity.h>
63050 #include <net/flow.h>
63052 /* Maximum number of letters for an LSM name string */
63053 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
63054 index be720cd..a0e1b94 100644
63055 --- a/include/linux/seq_file.h
63056 +++ b/include/linux/seq_file.h
63057 @@ -33,6 +33,7 @@ struct seq_operations {
63058 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
63059 int (*show) (struct seq_file *m, void *v);
63061 +typedef struct seq_operations __no_const seq_operations_no_const;
63065 diff --git a/include/linux/shm.h b/include/linux/shm.h
63066 index 92808b8..c28cac4 100644
63067 --- a/include/linux/shm.h
63068 +++ b/include/linux/shm.h
63069 @@ -98,6 +98,10 @@ struct shmid_kernel /* private to the kernel */
63071 /* The task created the shm object. NULL if the task is dead. */
63072 struct task_struct *shm_creator;
63073 +#ifdef CONFIG_GRKERNSEC
63074 + time_t shm_createtime;
63079 /* shm_mode upper byte flags */
63080 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
63081 index 0f96646..cfb757a 100644
63082 --- a/include/linux/skbuff.h
63083 +++ b/include/linux/skbuff.h
63084 @@ -610,7 +610,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
63086 static inline int skb_queue_empty(const struct sk_buff_head *list)
63088 - return list->next == (struct sk_buff *)list;
63089 + return list->next == (const struct sk_buff *)list;
63093 @@ -623,7 +623,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
63094 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63095 const struct sk_buff *skb)
63097 - return skb->next == (struct sk_buff *)list;
63098 + return skb->next == (const struct sk_buff *)list;
63102 @@ -636,7 +636,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63103 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
63104 const struct sk_buff *skb)
63106 - return skb->prev == (struct sk_buff *)list;
63107 + return skb->prev == (const struct sk_buff *)list;
63111 @@ -1458,7 +1458,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
63112 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
63114 #ifndef NET_SKB_PAD
63115 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
63116 +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
63119 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
63120 diff --git a/include/linux/slab.h b/include/linux/slab.h
63121 index 573c809..e84c132 100644
63122 --- a/include/linux/slab.h
63123 +++ b/include/linux/slab.h
63124 @@ -11,12 +11,20 @@
63126 #include <linux/gfp.h>
63127 #include <linux/types.h>
63128 +#include <linux/err.h>
63131 * Flags to pass to kmem_cache_create().
63132 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
63134 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
63136 +#ifdef CONFIG_PAX_USERCOPY
63137 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
63139 +#define SLAB_USERCOPY 0x00000000UL
63142 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
63143 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
63144 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
63145 @@ -87,10 +95,13 @@
63146 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
63147 * Both make kfree a no-op.
63149 -#define ZERO_SIZE_PTR ((void *)16)
63150 +#define ZERO_SIZE_PTR \
63152 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
63153 + (void *)(-MAX_ERRNO-1L); \
63156 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
63157 - (unsigned long)ZERO_SIZE_PTR)
63158 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
63161 * struct kmem_cache related prototypes
63162 @@ -161,6 +172,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
63163 void kfree(const void *);
63164 void kzfree(const void *);
63165 size_t ksize(const void *);
63166 +void check_object_size(const void *ptr, unsigned long n, bool to);
63169 * Allocator specific definitions. These are mainly used to establish optimized
63170 @@ -353,4 +365,59 @@ static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
63172 void __init kmem_cache_init_late(void);
63174 +#define kmalloc(x, y) \
63176 + void *___retval; \
63177 + intoverflow_t ___x = (intoverflow_t)x; \
63178 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
63179 + ___retval = NULL; \
63181 + ___retval = kmalloc((size_t)___x, (y)); \
63185 +#define kmalloc_node(x, y, z) \
63187 + void *___retval; \
63188 + intoverflow_t ___x = (intoverflow_t)x; \
63189 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
63190 + ___retval = NULL; \
63192 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
63196 +#define kzalloc(x, y) \
63198 + void *___retval; \
63199 + intoverflow_t ___x = (intoverflow_t)x; \
63200 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
63201 + ___retval = NULL; \
63203 + ___retval = kzalloc((size_t)___x, (y)); \
63207 +#define __krealloc(x, y, z) \
63209 + void *___retval; \
63210 + intoverflow_t ___y = (intoverflow_t)y; \
63211 + if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
63212 + ___retval = NULL; \
63214 + ___retval = __krealloc((x), (size_t)___y, (z)); \
63218 +#define krealloc(x, y, z) \
63220 + void *___retval; \
63221 + intoverflow_t ___y = (intoverflow_t)y; \
63222 + if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
63223 + ___retval = NULL; \
63225 + ___retval = krealloc((x), (size_t)___y, (z)); \
63229 #endif /* _LINUX_SLAB_H */
63230 diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
63231 index d00e0ba..1b3bf7b 100644
63232 --- a/include/linux/slab_def.h
63233 +++ b/include/linux/slab_def.h
63234 @@ -68,10 +68,10 @@ struct kmem_cache {
63235 unsigned long node_allocs;
63236 unsigned long node_frees;
63237 unsigned long node_overflow;
63238 - atomic_t allochit;
63239 - atomic_t allocmiss;
63240 - atomic_t freehit;
63241 - atomic_t freemiss;
63242 + atomic_unchecked_t allochit;
63243 + atomic_unchecked_t allocmiss;
63244 + atomic_unchecked_t freehit;
63245 + atomic_unchecked_t freemiss;
63248 * If debugging is enabled, then the allocator can add additional
63249 diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
63250 index f58d641..c56bf9c 100644
63251 --- a/include/linux/slub_def.h
63252 +++ b/include/linux/slub_def.h
63253 @@ -85,7 +85,7 @@ struct kmem_cache {
63254 struct kmem_cache_order_objects max;
63255 struct kmem_cache_order_objects min;
63256 gfp_t allocflags; /* gfp flags to use on each alloc */
63257 - int refcount; /* Refcount for slab cache destroy */
63258 + atomic_t refcount; /* Refcount for slab cache destroy */
63259 void (*ctor)(void *);
63260 int inuse; /* Offset to metadata */
63261 int align; /* Alignment */
63262 @@ -211,7 +211,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
63265 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
63266 -void *__kmalloc(size_t size, gfp_t flags);
63267 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
63269 static __always_inline void *
63270 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
63271 diff --git a/include/linux/sonet.h b/include/linux/sonet.h
63272 index de8832d..0147b46 100644
63273 --- a/include/linux/sonet.h
63274 +++ b/include/linux/sonet.h
63275 @@ -61,7 +61,7 @@ struct sonet_stats {
63276 #include <linux/atomic.h>
63278 struct k_sonet_stats {
63279 -#define __HANDLE_ITEM(i) atomic_t i
63280 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
63282 #undef __HANDLE_ITEM
63284 diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
63285 index db7bcaf..1aca77e 100644
63286 --- a/include/linux/sunrpc/clnt.h
63287 +++ b/include/linux/sunrpc/clnt.h
63288 @@ -169,9 +169,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
63290 switch (sap->sa_family) {
63292 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
63293 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
63295 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
63296 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
63300 @@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
63301 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
63302 const struct sockaddr *src)
63304 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
63305 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
63306 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
63308 dsin->sin_family = ssin->sin_family;
63309 @@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
63310 if (sa->sa_family != AF_INET6)
63313 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
63314 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
63317 #endif /* __KERNEL__ */
63318 diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
63319 index e775689..9e206d9 100644
63320 --- a/include/linux/sunrpc/sched.h
63321 +++ b/include/linux/sunrpc/sched.h
63322 @@ -105,6 +105,7 @@ struct rpc_call_ops {
63323 void (*rpc_call_done)(struct rpc_task *, void *);
63324 void (*rpc_release)(void *);
63326 +typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
63328 struct rpc_task_setup {
63329 struct rpc_task *task;
63330 diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
63331 index c14fe86..393245e 100644
63332 --- a/include/linux/sunrpc/svc_rdma.h
63333 +++ b/include/linux/sunrpc/svc_rdma.h
63334 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
63335 extern unsigned int svcrdma_max_requests;
63336 extern unsigned int svcrdma_max_req_size;
63338 -extern atomic_t rdma_stat_recv;
63339 -extern atomic_t rdma_stat_read;
63340 -extern atomic_t rdma_stat_write;
63341 -extern atomic_t rdma_stat_sq_starve;
63342 -extern atomic_t rdma_stat_rq_starve;
63343 -extern atomic_t rdma_stat_rq_poll;
63344 -extern atomic_t rdma_stat_rq_prod;
63345 -extern atomic_t rdma_stat_sq_poll;
63346 -extern atomic_t rdma_stat_sq_prod;
63347 +extern atomic_unchecked_t rdma_stat_recv;
63348 +extern atomic_unchecked_t rdma_stat_read;
63349 +extern atomic_unchecked_t rdma_stat_write;
63350 +extern atomic_unchecked_t rdma_stat_sq_starve;
63351 +extern atomic_unchecked_t rdma_stat_rq_starve;
63352 +extern atomic_unchecked_t rdma_stat_rq_poll;
63353 +extern atomic_unchecked_t rdma_stat_rq_prod;
63354 +extern atomic_unchecked_t rdma_stat_sq_poll;
63355 +extern atomic_unchecked_t rdma_stat_sq_prod;
63357 #define RPCRDMA_VERSION 1
63359 diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
63360 index 11684d9..0d245eb 100644
63361 --- a/include/linux/sysctl.h
63362 +++ b/include/linux/sysctl.h
63363 @@ -155,7 +155,11 @@ enum
63364 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
63368 +#ifdef CONFIG_PAX_SOFTMODE
63370 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
63374 /* CTL_VM names: */
63376 @@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
63378 extern int proc_dostring(struct ctl_table *, int,
63379 void __user *, size_t *, loff_t *);
63380 +extern int proc_dostring_modpriv(struct ctl_table *, int,
63381 + void __user *, size_t *, loff_t *);
63382 extern int proc_dointvec(struct ctl_table *, int,
63383 void __user *, size_t *, loff_t *);
63384 extern int proc_dointvec_minmax(struct ctl_table *, int,
63385 diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
63386 index ff7dc08..893e1bd 100644
63387 --- a/include/linux/tty_ldisc.h
63388 +++ b/include/linux/tty_ldisc.h
63389 @@ -148,7 +148,7 @@ struct tty_ldisc_ops {
63391 struct module *owner;
63394 + atomic_t refcount;
63398 diff --git a/include/linux/types.h b/include/linux/types.h
63399 index 176da8c..e45e473 100644
63400 --- a/include/linux/types.h
63401 +++ b/include/linux/types.h
63402 @@ -213,10 +213,26 @@ typedef struct {
63406 +#ifdef CONFIG_PAX_REFCOUNT
63409 +} atomic_unchecked_t;
63411 +typedef atomic_t atomic_unchecked_t;
63414 #ifdef CONFIG_64BIT
63419 +#ifdef CONFIG_PAX_REFCOUNT
63422 +} atomic64_unchecked_t;
63424 +typedef atomic64_t atomic64_unchecked_t;
63429 diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
63430 index 5ca0951..ab496a5 100644
63431 --- a/include/linux/uaccess.h
63432 +++ b/include/linux/uaccess.h
63433 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
63435 mm_segment_t old_fs = get_fs(); \
63437 - set_fs(KERNEL_DS); \
63438 pagefault_disable(); \
63439 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
63440 - pagefault_enable(); \
63441 + set_fs(KERNEL_DS); \
63442 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
63444 + pagefault_enable(); \
63448 diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
63449 index 99c1b4d..bb94261 100644
63450 --- a/include/linux/unaligned/access_ok.h
63451 +++ b/include/linux/unaligned/access_ok.h
63454 static inline u16 get_unaligned_le16(const void *p)
63456 - return le16_to_cpup((__le16 *)p);
63457 + return le16_to_cpup((const __le16 *)p);
63460 static inline u32 get_unaligned_le32(const void *p)
63462 - return le32_to_cpup((__le32 *)p);
63463 + return le32_to_cpup((const __le32 *)p);
63466 static inline u64 get_unaligned_le64(const void *p)
63468 - return le64_to_cpup((__le64 *)p);
63469 + return le64_to_cpup((const __le64 *)p);
63472 static inline u16 get_unaligned_be16(const void *p)
63474 - return be16_to_cpup((__be16 *)p);
63475 + return be16_to_cpup((const __be16 *)p);
63478 static inline u32 get_unaligned_be32(const void *p)
63480 - return be32_to_cpup((__be32 *)p);
63481 + return be32_to_cpup((const __be32 *)p);
63484 static inline u64 get_unaligned_be64(const void *p)
63486 - return be64_to_cpup((__be64 *)p);
63487 + return be64_to_cpup((const __be64 *)p);
63490 static inline void put_unaligned_le16(u16 val, void *p)
63491 diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
63492 index cf97b5b..40ebc87 100644
63493 --- a/include/linux/vermagic.h
63494 +++ b/include/linux/vermagic.h
63496 #define MODULE_ARCH_VERMAGIC ""
63499 +#ifdef CONFIG_PAX_REFCOUNT
63500 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
63502 +#define MODULE_PAX_REFCOUNT ""
63505 +#ifdef CONSTIFY_PLUGIN
63506 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
63508 +#define MODULE_CONSTIFY_PLUGIN ""
63511 +#ifdef STACKLEAK_PLUGIN
63512 +#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
63514 +#define MODULE_STACKLEAK_PLUGIN ""
63517 +#ifdef CONFIG_GRKERNSEC
63518 +#define MODULE_GRSEC "GRSEC "
63520 +#define MODULE_GRSEC ""
63523 #define VERMAGIC_STRING \
63525 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
63526 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
63527 - MODULE_ARCH_VERMAGIC
63528 + MODULE_ARCH_VERMAGIC \
63529 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
63532 diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
63533 index 687fb11..b342358 100644
63534 --- a/include/linux/vmalloc.h
63535 +++ b/include/linux/vmalloc.h
63536 @@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
63537 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
63538 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
63539 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
63541 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
63542 +#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
63545 /* bits [20..32] reserved for arch specific ioremap internals */
63548 @@ -156,4 +161,103 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
63552 +#define vmalloc(x) \
63554 + void *___retval; \
63555 + intoverflow_t ___x = (intoverflow_t)x; \
63556 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
63557 + ___retval = NULL; \
63559 + ___retval = vmalloc((unsigned long)___x); \
63563 +#define vzalloc(x) \
63565 + void *___retval; \
63566 + intoverflow_t ___x = (intoverflow_t)x; \
63567 + if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
63568 + ___retval = NULL; \
63570 + ___retval = vzalloc((unsigned long)___x); \
63574 +#define __vmalloc(x, y, z) \
63576 + void *___retval; \
63577 + intoverflow_t ___x = (intoverflow_t)x; \
63578 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
63579 + ___retval = NULL; \
63581 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
63585 +#define vmalloc_user(x) \
63587 + void *___retval; \
63588 + intoverflow_t ___x = (intoverflow_t)x; \
63589 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
63590 + ___retval = NULL; \
63592 + ___retval = vmalloc_user((unsigned long)___x); \
63596 +#define vmalloc_exec(x) \
63598 + void *___retval; \
63599 + intoverflow_t ___x = (intoverflow_t)x; \
63600 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
63601 + ___retval = NULL; \
63603 + ___retval = vmalloc_exec((unsigned long)___x); \
63607 +#define vmalloc_node(x, y) \
63609 + void *___retval; \
63610 + intoverflow_t ___x = (intoverflow_t)x; \
63611 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
63612 + ___retval = NULL; \
63614 + ___retval = vmalloc_node((unsigned long)___x, (y));\
63618 +#define vzalloc_node(x, y) \
63620 + void *___retval; \
63621 + intoverflow_t ___x = (intoverflow_t)x; \
63622 + if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
63623 + ___retval = NULL; \
63625 + ___retval = vzalloc_node((unsigned long)___x, (y));\
63629 +#define vmalloc_32(x) \
63631 + void *___retval; \
63632 + intoverflow_t ___x = (intoverflow_t)x; \
63633 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
63634 + ___retval = NULL; \
63636 + ___retval = vmalloc_32((unsigned long)___x); \
63640 +#define vmalloc_32_user(x) \
63642 +void *___retval; \
63643 + intoverflow_t ___x = (intoverflow_t)x; \
63644 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
63645 + ___retval = NULL; \
63647 + ___retval = vmalloc_32_user((unsigned long)___x);\
63651 #endif /* _LINUX_VMALLOC_H */
63652 diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
63653 index 65efb92..137adbb 100644
63654 --- a/include/linux/vmstat.h
63655 +++ b/include/linux/vmstat.h
63656 @@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(int cpu)
63658 * Zone based page accounting with per cpu differentials.
63660 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63661 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63663 static inline void zone_page_state_add(long x, struct zone *zone,
63664 enum zone_stat_item item)
63666 - atomic_long_add(x, &zone->vm_stat[item]);
63667 - atomic_long_add(x, &vm_stat[item]);
63668 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
63669 + atomic_long_add_unchecked(x, &vm_stat[item]);
63672 static inline unsigned long global_page_state(enum zone_stat_item item)
63674 - long x = atomic_long_read(&vm_stat[item]);
63675 + long x = atomic_long_read_unchecked(&vm_stat[item]);
63679 @@ -109,7 +109,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
63680 static inline unsigned long zone_page_state(struct zone *zone,
63681 enum zone_stat_item item)
63683 - long x = atomic_long_read(&zone->vm_stat[item]);
63684 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63688 @@ -126,7 +126,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
63689 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
63690 enum zone_stat_item item)
63692 - long x = atomic_long_read(&zone->vm_stat[item]);
63693 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63697 @@ -221,8 +221,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
63699 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
63701 - atomic_long_inc(&zone->vm_stat[item]);
63702 - atomic_long_inc(&vm_stat[item]);
63703 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
63704 + atomic_long_inc_unchecked(&vm_stat[item]);
63707 static inline void __inc_zone_page_state(struct page *page,
63708 @@ -233,8 +233,8 @@ static inline void __inc_zone_page_state(struct page *page,
63710 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
63712 - atomic_long_dec(&zone->vm_stat[item]);
63713 - atomic_long_dec(&vm_stat[item]);
63714 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
63715 + atomic_long_dec_unchecked(&vm_stat[item]);
63718 static inline void __dec_zone_page_state(struct page *page,
63719 diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
63720 index 4aeff96..b378cdc 100644
63721 --- a/include/media/saa7146_vv.h
63722 +++ b/include/media/saa7146_vv.h
63723 @@ -163,7 +163,7 @@ struct saa7146_ext_vv
63724 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
63726 /* the extension can override this */
63727 - struct v4l2_ioctl_ops ops;
63728 + v4l2_ioctl_ops_no_const ops;
63729 /* pointer to the saa7146 core ops */
63730 const struct v4l2_ioctl_ops *core_ops;
63732 diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
63733 index c7c40f1..4f01585 100644
63734 --- a/include/media/v4l2-dev.h
63735 +++ b/include/media/v4l2-dev.h
63736 @@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local);
63739 struct v4l2_file_operations {
63740 - struct module *owner;
63741 + struct module * const owner;
63742 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
63743 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
63744 unsigned int (*poll) (struct file *, struct poll_table_struct *);
63745 @@ -68,6 +68,7 @@ struct v4l2_file_operations {
63746 int (*open) (struct file *);
63747 int (*release) (struct file *);
63749 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
63752 * Newer version of video_device, handled by videodev2.c
63753 diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
63754 index dd9f1e7..8c4dd86 100644
63755 --- a/include/media/v4l2-ioctl.h
63756 +++ b/include/media/v4l2-ioctl.h
63757 @@ -272,7 +272,7 @@ struct v4l2_ioctl_ops {
63758 long (*vidioc_default) (struct file *file, void *fh,
63759 bool valid_prio, int cmd, void *arg);
63762 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
63764 /* v4l debugging and diagnostics */
63766 diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
63767 index c5dedd8..a93b07b 100644
63768 --- a/include/net/caif/caif_hsi.h
63769 +++ b/include/net/caif/caif_hsi.h
63770 @@ -94,7 +94,7 @@ struct cfhsi_drv {
63771 void (*rx_done_cb) (struct cfhsi_drv *drv);
63772 void (*wake_up_cb) (struct cfhsi_drv *drv);
63773 void (*wake_down_cb) (struct cfhsi_drv *drv);
63777 /* Structure implemented by HSI device. */
63779 diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
63780 index 9e5425b..8136ffc 100644
63781 --- a/include/net/caif/cfctrl.h
63782 +++ b/include/net/caif/cfctrl.h
63783 @@ -52,7 +52,7 @@ struct cfctrl_rsp {
63784 void (*radioset_rsp)(void);
63785 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
63786 struct cflayer *client_layer);
63790 /* Link Setup Parameters for CAIF-Links. */
63791 struct cfctrl_link_param {
63792 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
63794 struct cfsrvl serv;
63795 struct cfctrl_rsp res;
63796 - atomic_t req_seq_no;
63797 - atomic_t rsp_seq_no;
63798 + atomic_unchecked_t req_seq_no;
63799 + atomic_unchecked_t rsp_seq_no;
63800 struct list_head list;
63801 /* Protects from simultaneous access to first_req list */
63802 spinlock_t info_list_lock;
63803 diff --git a/include/net/flow.h b/include/net/flow.h
63804 index a094477..bc91db1 100644
63805 --- a/include/net/flow.h
63806 +++ b/include/net/flow.h
63807 @@ -207,6 +207,6 @@ extern struct flow_cache_object *flow_cache_lookup(
63808 u8 dir, flow_resolve_t resolver, void *ctx);
63810 extern void flow_cache_flush(void);
63811 -extern atomic_t flow_cache_genid;
63812 +extern atomic_unchecked_t flow_cache_genid;
63815 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
63816 index e9ff3fc..9d3e5c7 100644
63817 --- a/include/net/inetpeer.h
63818 +++ b/include/net/inetpeer.h
63819 @@ -48,8 +48,8 @@ struct inet_peer {
63823 - atomic_t rid; /* Frag reception counter */
63824 - atomic_t ip_id_count; /* IP ID for the next packet */
63825 + atomic_unchecked_t rid; /* Frag reception counter */
63826 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
63828 __u32 tcp_ts_stamp;
63830 @@ -113,11 +113,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
63832 inet_peer_refcheck(p);
63834 - old = atomic_read(&p->ip_id_count);
63835 + old = atomic_read_unchecked(&p->ip_id_count);
63839 - } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
63840 + } while (atomic_cmpxchg_unchecked(&p->ip_id_count, old, new) != old);
63844 diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
63845 index 10422ef..662570f 100644
63846 --- a/include/net/ip_fib.h
63847 +++ b/include/net/ip_fib.h
63848 @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
63850 #define FIB_RES_SADDR(net, res) \
63851 ((FIB_RES_NH(res).nh_saddr_genid == \
63852 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
63853 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
63854 FIB_RES_NH(res).nh_saddr : \
63855 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
63856 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
63857 diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
63858 index 8fa4430..05dd772 100644
63859 --- a/include/net/ip_vs.h
63860 +++ b/include/net/ip_vs.h
63861 @@ -509,7 +509,7 @@ struct ip_vs_conn {
63862 struct ip_vs_conn *control; /* Master control connection */
63863 atomic_t n_control; /* Number of controlled ones */
63864 struct ip_vs_dest *dest; /* real server */
63865 - atomic_t in_pkts; /* incoming packet counter */
63866 + atomic_unchecked_t in_pkts; /* incoming packet counter */
63868 /* packet transmitter for different forwarding methods. If it
63869 mangles the packet, it must return NF_DROP or better NF_STOLEN,
63870 @@ -647,7 +647,7 @@ struct ip_vs_dest {
63871 __be16 port; /* port number of the server */
63872 union nf_inet_addr addr; /* IP address of the server */
63873 volatile unsigned flags; /* dest status flags */
63874 - atomic_t conn_flags; /* flags to copy to conn */
63875 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
63876 atomic_t weight; /* server weight */
63878 atomic_t refcnt; /* reference counter */
63879 diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
63880 index 69b610a..fe3962c 100644
63881 --- a/include/net/irda/ircomm_core.h
63882 +++ b/include/net/irda/ircomm_core.h
63883 @@ -51,7 +51,7 @@ typedef struct {
63884 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
63885 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
63886 struct ircomm_info *);
63888 +} __no_const call_t;
63891 irda_queue_t queue;
63892 diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
63893 index 59ba38bc..d515662 100644
63894 --- a/include/net/irda/ircomm_tty.h
63895 +++ b/include/net/irda/ircomm_tty.h
63897 #include <linux/termios.h>
63898 #include <linux/timer.h>
63899 #include <linux/tty.h> /* struct tty_struct */
63900 +#include <asm/local.h>
63902 #include <net/irda/irias_object.h>
63903 #include <net/irda/ircomm_core.h>
63904 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
63905 unsigned short close_delay;
63906 unsigned short closing_wait; /* time to wait before closing */
63909 - int blocked_open; /* # of blocked opens */
63910 + local_t open_count;
63911 + local_t blocked_open; /* # of blocked opens */
63913 /* Protect concurent access to :
63914 * o self->open_count
63915 diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
63916 index f82a1e8..82d81e8 100644
63917 --- a/include/net/iucv/af_iucv.h
63918 +++ b/include/net/iucv/af_iucv.h
63919 @@ -87,7 +87,7 @@ struct iucv_sock {
63920 struct iucv_sock_list {
63921 struct hlist_head head;
63923 - atomic_t autobind_name;
63924 + atomic_unchecked_t autobind_name;
63927 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
63928 diff --git a/include/net/lapb.h b/include/net/lapb.h
63929 index 96cb5dd..25e8d4f 100644
63930 --- a/include/net/lapb.h
63931 +++ b/include/net/lapb.h
63932 @@ -95,7 +95,7 @@ struct lapb_cb {
63933 struct sk_buff_head write_queue;
63934 struct sk_buff_head ack_queue;
63935 unsigned char window;
63936 - struct lapb_register_struct callbacks;
63937 + struct lapb_register_struct *callbacks;
63939 /* FRMR control information */
63940 struct lapb_frame frmr_data;
63941 diff --git a/include/net/neighbour.h b/include/net/neighbour.h
63942 index 2720884..3aa5c25 100644
63943 --- a/include/net/neighbour.h
63944 +++ b/include/net/neighbour.h
63945 @@ -122,7 +122,7 @@ struct neigh_ops {
63946 void (*error_report)(struct neighbour *, struct sk_buff *);
63947 int (*output)(struct neighbour *, struct sk_buff *);
63948 int (*connected_output)(struct neighbour *, struct sk_buff *);
63952 struct pneigh_entry {
63953 struct pneigh_entry *next;
63954 diff --git a/include/net/netlink.h b/include/net/netlink.h
63955 index 98c1854..d4add7b 100644
63956 --- a/include/net/netlink.h
63957 +++ b/include/net/netlink.h
63958 @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
63959 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
63962 - skb_trim(skb, (unsigned char *) mark - skb->data);
63963 + skb_trim(skb, (const unsigned char *) mark - skb->data);
63967 diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
63968 index d786b4f..4c3dd41 100644
63969 --- a/include/net/netns/ipv4.h
63970 +++ b/include/net/netns/ipv4.h
63971 @@ -56,8 +56,8 @@ struct netns_ipv4 {
63973 unsigned int sysctl_ping_group_range[2];
63975 - atomic_t rt_genid;
63976 - atomic_t dev_addr_genid;
63977 + atomic_unchecked_t rt_genid;
63978 + atomic_unchecked_t dev_addr_genid;
63980 #ifdef CONFIG_IP_MROUTE
63981 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
63982 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
63983 index 6a72a58..e6a127d 100644
63984 --- a/include/net/sctp/sctp.h
63985 +++ b/include/net/sctp/sctp.h
63986 @@ -318,9 +318,9 @@ do { \
63988 #else /* SCTP_DEBUG */
63990 -#define SCTP_DEBUG_PRINTK(whatever...)
63991 -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
63992 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
63993 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
63994 +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
63995 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
63996 #define SCTP_ENABLE_DEBUG
63997 #define SCTP_DISABLE_DEBUG
63998 #define SCTP_ASSERT(expr, str, func)
63999 diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
64000 index f7d9c3f..ec86952 100644
64001 --- a/include/net/sctp/structs.h
64002 +++ b/include/net/sctp/structs.h
64003 @@ -241,6 +241,9 @@ extern struct sctp_globals {
64004 * bits is an indicator of when to send and window update SACK.
64006 int rwnd_update_shift;
64008 + /* Threshold for autoclose timeout, in seconds. */
64009 + unsigned long max_autoclose;
64012 #define sctp_rto_initial (sctp_globals.rto_initial)
64013 @@ -281,6 +284,7 @@ extern struct sctp_globals {
64014 #define sctp_auth_enable (sctp_globals.auth_enable)
64015 #define sctp_checksum_disable (sctp_globals.checksum_disable)
64016 #define sctp_rwnd_upd_shift (sctp_globals.rwnd_update_shift)
64017 +#define sctp_max_autoclose (sctp_globals.max_autoclose)
64019 /* SCTP Socket type: UDP or TCP style. */
64021 diff --git a/include/net/sock.h b/include/net/sock.h
64022 index 8e4062f..77b041e 100644
64023 --- a/include/net/sock.h
64024 +++ b/include/net/sock.h
64025 @@ -278,7 +278,7 @@ struct sock {
64029 - atomic_t sk_drops;
64030 + atomic_unchecked_t sk_drops;
64033 struct sk_filter __rcu *sk_filter;
64034 @@ -1391,7 +1391,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
64037 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
64038 - char __user *from, char *to,
64039 + char __user *from, unsigned char *to,
64040 int copy, int offset)
64042 if (skb->ip_summed == CHECKSUM_NONE) {
64043 diff --git a/include/net/tcp.h b/include/net/tcp.h
64044 index acc620a..f4d99c6 100644
64045 --- a/include/net/tcp.h
64046 +++ b/include/net/tcp.h
64047 @@ -1401,8 +1401,8 @@ enum tcp_seq_states {
64048 struct tcp_seq_afinfo {
64050 sa_family_t family;
64051 - struct file_operations seq_fops;
64052 - struct seq_operations seq_ops;
64053 + file_operations_no_const seq_fops;
64054 + seq_operations_no_const seq_ops;
64057 struct tcp_iter_state {
64058 diff --git a/include/net/udp.h b/include/net/udp.h
64059 index 67ea6fc..e42aee8 100644
64060 --- a/include/net/udp.h
64061 +++ b/include/net/udp.h
64062 @@ -234,8 +234,8 @@ struct udp_seq_afinfo {
64064 sa_family_t family;
64065 struct udp_table *udp_table;
64066 - struct file_operations seq_fops;
64067 - struct seq_operations seq_ops;
64068 + file_operations_no_const seq_fops;
64069 + seq_operations_no_const seq_ops;
64072 struct udp_iter_state {
64073 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
64074 index b203e14..1df3991 100644
64075 --- a/include/net/xfrm.h
64076 +++ b/include/net/xfrm.h
64077 @@ -505,7 +505,7 @@ struct xfrm_policy {
64078 struct timer_list timer;
64080 struct flow_cache_object flo;
64082 + atomic_unchecked_t genid;
64085 struct xfrm_mark mark;
64086 diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
64087 index 2d0191c..a55797d 100644
64088 --- a/include/rdma/iw_cm.h
64089 +++ b/include/rdma/iw_cm.h
64090 @@ -120,7 +120,7 @@ struct iw_cm_verbs {
64093 int (*destroy_listen)(struct iw_cm_id *cm_id);
64098 * iw_create_cm_id - Create an IW CM identifier.
64099 diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
64100 index 7d96829..4ba78d3 100644
64101 --- a/include/scsi/libfc.h
64102 +++ b/include/scsi/libfc.h
64103 @@ -758,6 +758,7 @@ struct libfc_function_template {
64105 void (*disc_stop_final) (struct fc_lport *);
64107 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
64110 * struct fc_disc - Discovery context
64111 @@ -861,7 +862,7 @@ struct fc_lport {
64112 struct fc_vport *vport;
64114 /* Operational Information */
64115 - struct libfc_function_template tt;
64116 + libfc_function_template_no_const tt;
64119 enum fc_lport_state state;
64120 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
64121 index d371c3c..e228a8c 100644
64122 --- a/include/scsi/scsi_device.h
64123 +++ b/include/scsi/scsi_device.h
64124 @@ -161,9 +161,9 @@ struct scsi_device {
64125 unsigned int max_device_blocked; /* what device_blocked counts down from */
64126 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
64128 - atomic_t iorequest_cnt;
64129 - atomic_t iodone_cnt;
64130 - atomic_t ioerr_cnt;
64131 + atomic_unchecked_t iorequest_cnt;
64132 + atomic_unchecked_t iodone_cnt;
64133 + atomic_unchecked_t ioerr_cnt;
64135 struct device sdev_gendev,
64137 diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
64138 index 2a65167..91e01f8 100644
64139 --- a/include/scsi/scsi_transport_fc.h
64140 +++ b/include/scsi/scsi_transport_fc.h
64141 @@ -711,7 +711,7 @@ struct fc_function_template {
64142 unsigned long show_host_system_hostname:1;
64144 unsigned long disable_target_scan:1;
64150 diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
64151 index 030b87c..98a6954 100644
64152 --- a/include/sound/ak4xxx-adda.h
64153 +++ b/include/sound/ak4xxx-adda.h
64154 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
64155 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
64156 unsigned char val);
64157 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
64161 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
64163 diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
64164 index 8c05e47..2b5df97 100644
64165 --- a/include/sound/hwdep.h
64166 +++ b/include/sound/hwdep.h
64167 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
64168 struct snd_hwdep_dsp_status *status);
64169 int (*dsp_load)(struct snd_hwdep *hw,
64170 struct snd_hwdep_dsp_image *image);
64175 struct snd_card *card;
64176 diff --git a/include/sound/info.h b/include/sound/info.h
64177 index 4e94cf1..76748b1 100644
64178 --- a/include/sound/info.h
64179 +++ b/include/sound/info.h
64180 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
64181 struct snd_info_buffer *buffer);
64182 void (*write)(struct snd_info_entry *entry,
64183 struct snd_info_buffer *buffer);
64187 struct snd_info_entry_ops {
64188 int (*open)(struct snd_info_entry *entry,
64189 diff --git a/include/sound/pcm.h b/include/sound/pcm.h
64190 index 57e71fa..a2c7534 100644
64191 --- a/include/sound/pcm.h
64192 +++ b/include/sound/pcm.h
64193 @@ -81,6 +81,7 @@ struct snd_pcm_ops {
64194 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
64195 int (*ack)(struct snd_pcm_substream *substream);
64197 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
64201 diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
64202 index af1b49e..a5d55a5 100644
64203 --- a/include/sound/sb16_csp.h
64204 +++ b/include/sound/sb16_csp.h
64205 @@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
64206 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
64207 int (*csp_stop) (struct snd_sb_csp * p);
64208 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
64214 diff --git a/include/sound/soc.h b/include/sound/soc.h
64215 index aa19f5a..a5b8208 100644
64216 --- a/include/sound/soc.h
64217 +++ b/include/sound/soc.h
64218 @@ -676,7 +676,7 @@ struct snd_soc_platform_driver {
64219 /* platform IO - used for platform DAPM */
64220 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
64221 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
64225 struct snd_soc_platform {
64227 diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
64228 index 444cd6b..3327cc5 100644
64229 --- a/include/sound/ymfpci.h
64230 +++ b/include/sound/ymfpci.h
64231 @@ -358,7 +358,7 @@ struct snd_ymfpci {
64232 spinlock_t reg_lock;
64233 spinlock_t voice_lock;
64234 wait_queue_head_t interrupt_sleep;
64235 - atomic_t interrupt_sleep_count;
64236 + atomic_unchecked_t interrupt_sleep_count;
64237 struct snd_info_entry *proc_entry;
64238 const struct firmware *dsp_microcode;
64239 const struct firmware *controller_microcode;
64240 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
64241 index 2704065..e10f3ef 100644
64242 --- a/include/target/target_core_base.h
64243 +++ b/include/target/target_core_base.h
64244 @@ -356,7 +356,7 @@ struct t10_reservation_ops {
64245 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
64246 int (*t10_pr_register)(struct se_cmd *);
64247 int (*t10_pr_clear)(struct se_cmd *);
64251 struct t10_reservation {
64252 /* Reservation effects all target ports */
64253 @@ -496,8 +496,8 @@ struct se_cmd {
64254 atomic_t t_task_cdbs_left;
64255 atomic_t t_task_cdbs_ex_left;
64256 atomic_t t_task_cdbs_timeout_left;
64257 - atomic_t t_task_cdbs_sent;
64258 - atomic_t t_transport_aborted;
64259 + atomic_unchecked_t t_task_cdbs_sent;
64260 + atomic_unchecked_t t_transport_aborted;
64261 atomic_t t_transport_active;
64262 atomic_t t_transport_complete;
64263 atomic_t t_transport_queue_active;
64264 @@ -744,7 +744,7 @@ struct se_device {
64265 atomic_t active_cmds;
64266 atomic_t simple_cmds;
64267 atomic_t depth_left;
64268 - atomic_t dev_ordered_id;
64269 + atomic_unchecked_t dev_ordered_id;
64270 atomic_t dev_tur_active;
64271 atomic_t execute_tasks;
64272 atomic_t dev_status_thr_count;
64273 diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
64274 index 1c09820..7f5ec79 100644
64275 --- a/include/trace/events/irq.h
64276 +++ b/include/trace/events/irq.h
64277 @@ -36,7 +36,7 @@ struct softirq_action;
64279 TRACE_EVENT(irq_handler_entry,
64281 - TP_PROTO(int irq, struct irqaction *action),
64282 + TP_PROTO(int irq, const struct irqaction *action),
64284 TP_ARGS(irq, action),
64286 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
64288 TRACE_EVENT(irq_handler_exit,
64290 - TP_PROTO(int irq, struct irqaction *action, int ret),
64291 + TP_PROTO(int irq, const struct irqaction *action, int ret),
64293 TP_ARGS(irq, action, ret),
64295 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
64296 index 69d485a..dd0bee7 100644
64297 --- a/include/video/udlfb.h
64298 +++ b/include/video/udlfb.h
64299 @@ -51,10 +51,10 @@ struct dlfb_data {
64301 u32 pseudo_palette[256];
64302 /* blit-only rendering path metrics, exposed through sysfs */
64303 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64304 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
64305 - atomic_t bytes_sent; /* to usb, after compression including overhead */
64306 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
64307 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
64308 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
64309 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
64310 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
64313 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
64314 diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
64315 index 0993a22..32ba2fe 100644
64316 --- a/include/video/uvesafb.h
64317 +++ b/include/video/uvesafb.h
64318 @@ -177,6 +177,7 @@ struct uvesafb_par {
64319 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
64320 u8 pmi_setpal; /* PMI for palette changes */
64321 u16 *pmi_base; /* protected mode interface location */
64322 + u8 *pmi_code; /* protected mode code location */
64325 u8 *vbe_state_orig; /*
64326 diff --git a/init/Kconfig b/init/Kconfig
64327 index d627783..693a9f3 100644
64330 @@ -1202,7 +1202,7 @@ config SLUB_DEBUG
64333 bool "Disable heap randomization"
64337 Randomizing heap placement makes heap exploits harder, but it
64338 also breaks ancient binaries (including anything libc5 based).
64339 diff --git a/init/do_mounts.c b/init/do_mounts.c
64340 index c0851a8..4f8977d 100644
64341 --- a/init/do_mounts.c
64342 +++ b/init/do_mounts.c
64343 @@ -287,11 +287,11 @@ static void __init get_fs_names(char *page)
64345 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
64347 - int err = sys_mount(name, "/root", fs, flags, data);
64348 + int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
64352 - sys_chdir((const char __user __force *)"/root");
64353 + sys_chdir((const char __force_user*)"/root");
64354 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
64356 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
64357 @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...)
64358 va_start(args, fmt);
64359 vsprintf(buf, fmt, args);
64361 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
64362 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
64364 sys_ioctl(fd, FDEJECT, 0);
64367 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
64368 - fd = sys_open("/dev/console", O_RDWR, 0);
64369 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
64371 sys_ioctl(fd, TCGETS, (long)&termios);
64372 termios.c_lflag &= ~ICANON;
64373 sys_ioctl(fd, TCSETSF, (long)&termios);
64374 - sys_read(fd, &c, 1);
64375 + sys_read(fd, (char __user *)&c, 1);
64376 termios.c_lflag |= ICANON;
64377 sys_ioctl(fd, TCSETSF, (long)&termios);
64379 @@ -488,6 +488,6 @@ void __init prepare_namespace(void)
64382 devtmpfs_mount("dev");
64383 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
64384 - sys_chroot((const char __user __force *)".");
64385 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64386 + sys_chroot((const char __force_user *)".");
64388 diff --git a/init/do_mounts.h b/init/do_mounts.h
64389 index f5b978a..69dbfe8 100644
64390 --- a/init/do_mounts.h
64391 +++ b/init/do_mounts.h
64392 @@ -15,15 +15,15 @@ extern int root_mountflags;
64394 static inline int create_dev(char *name, dev_t dev)
64396 - sys_unlink(name);
64397 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
64398 + sys_unlink((char __force_user *)name);
64399 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
64402 #if BITS_PER_LONG == 32
64403 static inline u32 bstat(char *name)
64405 struct stat64 stat;
64406 - if (sys_stat64(name, &stat) != 0)
64407 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
64409 if (!S_ISBLK(stat.st_mode))
64411 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
64412 static inline u32 bstat(char *name)
64415 - if (sys_newstat(name, &stat) != 0)
64416 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
64418 if (!S_ISBLK(stat.st_mode))
64420 diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
64421 index 3098a38..253064e 100644
64422 --- a/init/do_mounts_initrd.c
64423 +++ b/init/do_mounts_initrd.c
64424 @@ -44,13 +44,13 @@ static void __init handle_initrd(void)
64425 create_dev("/dev/root.old", Root_RAM0);
64426 /* mount initrd on rootfs' /root */
64427 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
64428 - sys_mkdir("/old", 0700);
64429 - root_fd = sys_open("/", 0, 0);
64430 - old_fd = sys_open("/old", 0, 0);
64431 + sys_mkdir((const char __force_user *)"/old", 0700);
64432 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
64433 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
64434 /* move initrd over / and chdir/chroot in initrd root */
64435 - sys_chdir("/root");
64436 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
64438 + sys_chdir((const char __force_user *)"/root");
64439 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
64440 + sys_chroot((const char __force_user *)".");
64443 * In case that a resume from disk is carried out by linuxrc or one of
64444 @@ -67,15 +67,15 @@ static void __init handle_initrd(void)
64446 /* move initrd to rootfs' /old */
64447 sys_fchdir(old_fd);
64448 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
64449 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
64450 /* switch root and cwd back to / of rootfs */
64451 sys_fchdir(root_fd);
64453 + sys_chroot((const char __force_user *)".");
64455 sys_close(root_fd);
64457 if (new_decode_dev(real_root_dev) == Root_RAM0) {
64458 - sys_chdir("/old");
64459 + sys_chdir((const char __force_user *)"/old");
64463 @@ -83,17 +83,17 @@ static void __init handle_initrd(void)
64466 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
64467 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
64468 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
64472 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
64473 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
64474 if (error == -ENOENT)
64475 printk("/initrd does not exist. Ignored.\n");
64477 printk("failed\n");
64478 printk(KERN_NOTICE "Unmounting old root\n");
64479 - sys_umount("/old", MNT_DETACH);
64480 + sys_umount((char __force_user *)"/old", MNT_DETACH);
64481 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
64484 @@ -116,11 +116,11 @@ int __init initrd_load(void)
64485 * mounted in the normal path.
64487 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
64488 - sys_unlink("/initrd.image");
64489 + sys_unlink((const char __force_user *)"/initrd.image");
64494 - sys_unlink("/initrd.image");
64495 + sys_unlink((const char __force_user *)"/initrd.image");
64498 diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
64499 index 32c4799..c27ee74 100644
64500 --- a/init/do_mounts_md.c
64501 +++ b/init/do_mounts_md.c
64502 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
64503 partitioned ? "_d" : "", minor,
64504 md_setup_args[ent].device_names);
64506 - fd = sys_open(name, 0, 0);
64507 + fd = sys_open((char __force_user *)name, 0, 0);
64509 printk(KERN_ERR "md: open failed - cannot start "
64510 "array %s\n", name);
64511 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
64515 - fd = sys_open(name, 0, 0);
64516 + fd = sys_open((char __force_user *)name, 0, 0);
64517 sys_ioctl(fd, BLKRRPART, 0);
64520 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
64522 wait_for_device_probe();
64524 - fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
64525 + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
64527 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
64529 diff --git a/init/initramfs.c b/init/initramfs.c
64530 index 2531811..040d4d4 100644
64531 --- a/init/initramfs.c
64532 +++ b/init/initramfs.c
64533 @@ -74,7 +74,7 @@ static void __init free_hash(void)
64537 -static long __init do_utime(char __user *filename, time_t mtime)
64538 +static long __init do_utime(__force char __user *filename, time_t mtime)
64540 struct timespec t[2];
64542 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
64543 struct dir_entry *de, *tmp;
64544 list_for_each_entry_safe(de, tmp, &dir_list, list) {
64545 list_del(&de->list);
64546 - do_utime(de->name, de->mtime);
64547 + do_utime((char __force_user *)de->name, de->mtime);
64551 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
64553 char *old = find_link(major, minor, ino, mode, collected);
64555 - return (sys_link(old, collected) < 0) ? -1 : 1;
64556 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
64560 @@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
64564 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
64565 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
64566 if (S_ISDIR(st.st_mode))
64568 + sys_rmdir((char __force_user *)path);
64570 - sys_unlink(path);
64571 + sys_unlink((char __force_user *)path);
64575 @@ -305,7 +305,7 @@ static int __init do_name(void)
64576 int openflags = O_WRONLY|O_CREAT;
64578 openflags |= O_TRUNC;
64579 - wfd = sys_open(collected, openflags, mode);
64580 + wfd = sys_open((char __force_user *)collected, openflags, mode);
64583 sys_fchown(wfd, uid, gid);
64584 @@ -317,17 +317,17 @@ static int __init do_name(void)
64587 } else if (S_ISDIR(mode)) {
64588 - sys_mkdir(collected, mode);
64589 - sys_chown(collected, uid, gid);
64590 - sys_chmod(collected, mode);
64591 + sys_mkdir((char __force_user *)collected, mode);
64592 + sys_chown((char __force_user *)collected, uid, gid);
64593 + sys_chmod((char __force_user *)collected, mode);
64594 dir_add(collected, mtime);
64595 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
64596 S_ISFIFO(mode) || S_ISSOCK(mode)) {
64597 if (maybe_link() == 0) {
64598 - sys_mknod(collected, mode, rdev);
64599 - sys_chown(collected, uid, gid);
64600 - sys_chmod(collected, mode);
64601 - do_utime(collected, mtime);
64602 + sys_mknod((char __force_user *)collected, mode, rdev);
64603 + sys_chown((char __force_user *)collected, uid, gid);
64604 + sys_chmod((char __force_user *)collected, mode);
64605 + do_utime((char __force_user *)collected, mtime);
64609 @@ -336,15 +336,15 @@ static int __init do_name(void)
64610 static int __init do_copy(void)
64612 if (count >= body_len) {
64613 - sys_write(wfd, victim, body_len);
64614 + sys_write(wfd, (char __force_user *)victim, body_len);
64616 - do_utime(vcollected, mtime);
64617 + do_utime((char __force_user *)vcollected, mtime);
64623 - sys_write(wfd, victim, count);
64624 + sys_write(wfd, (char __force_user *)victim, count);
64628 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
64630 collected[N_ALIGN(name_len) + body_len] = '\0';
64631 clean_path(collected, 0);
64632 - sys_symlink(collected + N_ALIGN(name_len), collected);
64633 - sys_lchown(collected, uid, gid);
64634 - do_utime(collected, mtime);
64635 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
64636 + sys_lchown((char __force_user *)collected, uid, gid);
64637 + do_utime((char __force_user *)collected, mtime);
64639 next_state = Reset;
64641 diff --git a/init/main.c b/init/main.c
64642 index 03b408d..5777f59 100644
64645 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
64646 extern void tc_init(void);
64649 +extern void grsecurity_init(void);
64652 * Debug helper: via this flag we know that we are in 'early bootup code'
64653 * where only the boot processor is running with IRQ disabled. This means
64654 @@ -149,6 +151,49 @@ static int __init set_reset_devices(char *str)
64656 __setup("reset_devices", set_reset_devices);
64658 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
64659 +extern char pax_enter_kernel_user[];
64660 +extern char pax_exit_kernel_user[];
64661 +extern pgdval_t clone_pgd_mask;
64664 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
64665 +static int __init setup_pax_nouderef(char *str)
64667 +#ifdef CONFIG_X86_32
64668 + unsigned int cpu;
64669 + struct desc_struct *gdt;
64671 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
64672 + gdt = get_cpu_gdt_table(cpu);
64673 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
64674 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
64675 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
64676 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
64678 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
64680 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
64681 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
64682 + clone_pgd_mask = ~(pgdval_t)0UL;
64687 +early_param("pax_nouderef", setup_pax_nouderef);
64690 +#ifdef CONFIG_PAX_SOFTMODE
64693 +static int __init setup_pax_softmode(char *str)
64695 + get_option(&str, &pax_softmode);
64698 +__setup("pax_softmode=", setup_pax_softmode);
64701 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
64702 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
64703 static const char *panic_later, *panic_param;
64704 @@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
64706 int count = preempt_count();
64708 + const char *msg1 = "", *msg2 = "";
64710 if (initcall_debug)
64711 ret = do_one_initcall_debug(fn);
64712 @@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
64713 sprintf(msgbuf, "error code %d ", ret);
64715 if (preempt_count() != count) {
64716 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
64717 + msg1 = " preemption imbalance";
64718 preempt_count() = count;
64720 if (irqs_disabled()) {
64721 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
64722 + msg2 = " disabled interrupts";
64723 local_irq_enable();
64726 - printk("initcall %pF returned with %s\n", fn, msgbuf);
64727 + if (msgbuf[0] || *msg1 || *msg2) {
64728 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
64732 @@ -817,7 +863,7 @@ static int __init kernel_init(void * unused)
64735 /* Open the /dev/console on the rootfs, this should never fail */
64736 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
64737 + if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
64738 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
64741 @@ -830,11 +876,13 @@ static int __init kernel_init(void * unused)
64742 if (!ramdisk_execute_command)
64743 ramdisk_execute_command = "/init";
64745 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
64746 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
64747 ramdisk_execute_command = NULL;
64748 prepare_namespace();
64751 + grsecurity_init();
64754 * Ok, we have completed the initial bootup, and
64755 * we're essentially up and running. Get rid of the
64756 diff --git a/ipc/mqueue.c b/ipc/mqueue.c
64757 index ed049ea..6442f7f 100644
64760 @@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
64761 mq_bytes = (mq_msg_tblsz +
64762 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
64764 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
64765 spin_lock(&mq_lock);
64766 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
64767 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
64768 diff --git a/ipc/msg.c b/ipc/msg.c
64769 index 7385de2..a8180e0 100644
64772 @@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
64773 return security_msg_queue_associate(msq, msgflg);
64776 +static struct ipc_ops msg_ops = {
64777 + .getnew = newque,
64778 + .associate = msg_security,
64779 + .more_checks = NULL
64782 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
64784 struct ipc_namespace *ns;
64785 - struct ipc_ops msg_ops;
64786 struct ipc_params msg_params;
64788 ns = current->nsproxy->ipc_ns;
64790 - msg_ops.getnew = newque;
64791 - msg_ops.associate = msg_security;
64792 - msg_ops.more_checks = NULL;
64794 msg_params.key = key;
64795 msg_params.flg = msgflg;
64797 diff --git a/ipc/sem.c b/ipc/sem.c
64798 index c8e00f8..1135c4e 100644
64801 @@ -318,10 +318,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
64805 +static struct ipc_ops sem_ops = {
64806 + .getnew = newary,
64807 + .associate = sem_security,
64808 + .more_checks = sem_more_checks
64811 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64813 struct ipc_namespace *ns;
64814 - struct ipc_ops sem_ops;
64815 struct ipc_params sem_params;
64817 ns = current->nsproxy->ipc_ns;
64818 @@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64819 if (nsems < 0 || nsems > ns->sc_semmsl)
64822 - sem_ops.getnew = newary;
64823 - sem_ops.associate = sem_security;
64824 - sem_ops.more_checks = sem_more_checks;
64826 sem_params.key = key;
64827 sem_params.flg = semflg;
64828 sem_params.u.nsems = nsems;
64829 @@ -848,6 +849,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
64831 struct list_head tasks;
64833 + pax_track_stack();
64835 sma = sem_lock_check(ns, semid);
64837 return PTR_ERR(sma);
64838 @@ -1295,6 +1298,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
64839 struct ipc_namespace *ns;
64840 struct list_head tasks;
64842 + pax_track_stack();
64844 ns = current->nsproxy->ipc_ns;
64846 if (nsops < 1 || semid < 0)
64847 diff --git a/ipc/shm.c b/ipc/shm.c
64848 index 02ecf2c..c8f5627 100644
64851 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
64852 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
64855 +#ifdef CONFIG_GRKERNSEC
64856 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64857 + const time_t shm_createtime, const uid_t cuid,
64858 + const int shmid);
64859 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64860 + const time_t shm_createtime);
64863 void shm_init_ns(struct ipc_namespace *ns)
64865 ns->shm_ctlmax = SHMMAX;
64866 @@ -508,6 +516,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
64867 shp->shm_lprid = 0;
64868 shp->shm_atim = shp->shm_dtim = 0;
64869 shp->shm_ctim = get_seconds();
64870 +#ifdef CONFIG_GRKERNSEC
64872 + struct timespec timeval;
64873 + do_posix_clock_monotonic_gettime(&timeval);
64875 + shp->shm_createtime = timeval.tv_sec;
64878 shp->shm_segsz = size;
64879 shp->shm_nattch = 0;
64880 shp->shm_file = file;
64881 @@ -559,18 +575,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
64885 +static struct ipc_ops shm_ops = {
64886 + .getnew = newseg,
64887 + .associate = shm_security,
64888 + .more_checks = shm_more_checks
64891 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
64893 struct ipc_namespace *ns;
64894 - struct ipc_ops shm_ops;
64895 struct ipc_params shm_params;
64897 ns = current->nsproxy->ipc_ns;
64899 - shm_ops.getnew = newseg;
64900 - shm_ops.associate = shm_security;
64901 - shm_ops.more_checks = shm_more_checks;
64903 shm_params.key = key;
64904 shm_params.flg = shmflg;
64905 shm_params.u.size = size;
64906 @@ -870,8 +887,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
64910 - struct file *uninitialized_var(shm_file);
64912 lru_add_drain_all(); /* drain pagevecs to lru lists */
64914 shp = shm_lock_check(ns, shmid);
64915 @@ -1004,9 +1019,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
64919 +#ifdef CONFIG_GRKERNSEC
64920 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
64921 + shp->shm_perm.cuid, shmid) ||
64922 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
64928 path = shp->shm_file->f_path;
64931 +#ifdef CONFIG_GRKERNSEC
64932 + shp->shm_lapid = current->pid;
64934 size = i_size_read(path.dentry->d_inode);
64937 diff --git a/kernel/acct.c b/kernel/acct.c
64938 index fa7eb3d..7faf116 100644
64939 --- a/kernel/acct.c
64940 +++ b/kernel/acct.c
64941 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
64943 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
64944 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
64945 - file->f_op->write(file, (char *)&ac,
64946 + file->f_op->write(file, (char __force_user *)&ac,
64947 sizeof(acct_t), &file->f_pos);
64948 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
64950 diff --git a/kernel/audit.c b/kernel/audit.c
64951 index 0a1355c..dca420f 100644
64952 --- a/kernel/audit.c
64953 +++ b/kernel/audit.c
64954 @@ -115,7 +115,7 @@ u32 audit_sig_sid = 0;
64955 3) suppressed due to audit_rate_limit
64956 4) suppressed due to audit_backlog_limit
64958 -static atomic_t audit_lost = ATOMIC_INIT(0);
64959 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
64961 /* The netlink socket. */
64962 static struct sock *audit_sock;
64963 @@ -237,7 +237,7 @@ void audit_log_lost(const char *message)
64967 - atomic_inc(&audit_lost);
64968 + atomic_inc_unchecked(&audit_lost);
64970 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
64972 @@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
64973 printk(KERN_WARNING
64974 "audit: audit_lost=%d audit_rate_limit=%d "
64975 "audit_backlog_limit=%d\n",
64976 - atomic_read(&audit_lost),
64977 + atomic_read_unchecked(&audit_lost),
64979 audit_backlog_limit);
64980 audit_panic(message);
64981 @@ -689,7 +689,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
64982 status_set.pid = audit_pid;
64983 status_set.rate_limit = audit_rate_limit;
64984 status_set.backlog_limit = audit_backlog_limit;
64985 - status_set.lost = atomic_read(&audit_lost);
64986 + status_set.lost = atomic_read_unchecked(&audit_lost);
64987 status_set.backlog = skb_queue_len(&audit_skb_queue);
64988 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
64989 &status_set, sizeof(status_set));
64990 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
64991 index ce4b054..8139ed7 100644
64992 --- a/kernel/auditsc.c
64993 +++ b/kernel/auditsc.c
64994 @@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
64997 /* global counter which is incremented every time something logs in */
64998 -static atomic_t session_id = ATOMIC_INIT(0);
64999 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
65002 * audit_set_loginuid - set a task's audit_context loginuid
65003 @@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
65005 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
65007 - unsigned int sessionid = atomic_inc_return(&session_id);
65008 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
65009 struct audit_context *context = task->audit_context;
65011 if (context && context->in_syscall) {
65012 diff --git a/kernel/capability.c b/kernel/capability.c
65013 index 283c529..36ac81e 100644
65014 --- a/kernel/capability.c
65015 +++ b/kernel/capability.c
65016 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
65017 * before modification is attempted and the application
65020 + if (tocopy > ARRAY_SIZE(kdata))
65023 if (copy_to_user(dataptr, kdata, tocopy
65024 * sizeof(struct __user_cap_data_struct))) {
65026 @@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
65030 - if (security_capable(ns, current_cred(), cap) == 0) {
65031 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
65032 current->flags |= PF_SUPERPRIV;
65035 @@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *ns, int cap)
65037 EXPORT_SYMBOL(ns_capable);
65039 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
65041 + if (unlikely(!cap_valid(cap))) {
65042 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
65046 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
65047 + current->flags |= PF_SUPERPRIV;
65052 +EXPORT_SYMBOL(ns_capable_nolog);
65054 +bool capable_nolog(int cap)
65056 + return ns_capable_nolog(&init_user_ns, cap);
65058 +EXPORT_SYMBOL(capable_nolog);
65061 * task_ns_capable - Determine whether current task has a superior
65062 * capability targeted at a specific task's user namespace.
65063 @@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct *t, int cap)
65065 EXPORT_SYMBOL(task_ns_capable);
65067 +bool task_ns_capable_nolog(struct task_struct *t, int cap)
65069 + return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
65071 +EXPORT_SYMBOL(task_ns_capable_nolog);
65074 * nsown_capable - Check superior capability to one's own user_ns
65075 * @cap: The capability in question
65076 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
65077 index 1d2b6ce..87bf267 100644
65078 --- a/kernel/cgroup.c
65079 +++ b/kernel/cgroup.c
65080 @@ -595,6 +595,8 @@ static struct css_set *find_css_set(
65081 struct hlist_head *hhead;
65082 struct cg_cgroup_link *link;
65084 + pax_track_stack();
65086 /* First see if we already have a cgroup group that matches
65087 * the desired set */
65088 read_lock(&css_set_lock);
65089 diff --git a/kernel/compat.c b/kernel/compat.c
65090 index e2435ee..8e82199 100644
65091 --- a/kernel/compat.c
65092 +++ b/kernel/compat.c
65095 #include <linux/linkage.h>
65096 #include <linux/compat.h>
65097 +#include <linux/module.h>
65098 #include <linux/errno.h>
65099 #include <linux/time.h>
65100 #include <linux/signal.h>
65101 @@ -167,7 +168,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
65102 mm_segment_t oldfs;
65105 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
65106 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
65109 ret = hrtimer_nanosleep_restart(restart);
65110 @@ -199,7 +200,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
65113 ret = hrtimer_nanosleep(&tu,
65114 - rmtp ? (struct timespec __user *)&rmt : NULL,
65115 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
65116 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
65119 @@ -308,7 +309,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
65120 mm_segment_t old_fs = get_fs();
65123 - ret = sys_sigpending((old_sigset_t __user *) &s);
65124 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
65127 ret = put_user(s, set);
65128 @@ -331,8 +332,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
65131 ret = sys_sigprocmask(how,
65132 - set ? (old_sigset_t __user *) &s : NULL,
65133 - oset ? (old_sigset_t __user *) &s : NULL);
65134 + set ? (old_sigset_t __force_user *) &s : NULL,
65135 + oset ? (old_sigset_t __force_user *) &s : NULL);
65139 @@ -369,7 +370,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
65140 mm_segment_t old_fs = get_fs();
65143 - ret = sys_old_getrlimit(resource, &r);
65144 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
65148 @@ -441,7 +442,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
65149 mm_segment_t old_fs = get_fs();
65152 - ret = sys_getrusage(who, (struct rusage __user *) &r);
65153 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
65157 @@ -468,8 +469,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
65158 set_fs (KERNEL_DS);
65159 ret = sys_wait4(pid,
65161 - (unsigned int __user *) &status : NULL),
65162 - options, (struct rusage __user *) &r);
65163 + (unsigned int __force_user *) &status : NULL),
65164 + options, (struct rusage __force_user *) &r);
65168 @@ -494,8 +495,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
65169 memset(&info, 0, sizeof(info));
65172 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
65173 - uru ? (struct rusage __user *)&ru : NULL);
65174 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
65175 + uru ? (struct rusage __force_user *)&ru : NULL);
65178 if ((ret < 0) || (info.si_signo == 0))
65179 @@ -625,8 +626,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
65182 err = sys_timer_settime(timer_id, flags,
65183 - (struct itimerspec __user *) &newts,
65184 - (struct itimerspec __user *) &oldts);
65185 + (struct itimerspec __force_user *) &newts,
65186 + (struct itimerspec __force_user *) &oldts);
65188 if (!err && old && put_compat_itimerspec(old, &oldts))
65190 @@ -643,7 +644,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
65193 err = sys_timer_gettime(timer_id,
65194 - (struct itimerspec __user *) &ts);
65195 + (struct itimerspec __force_user *) &ts);
65197 if (!err && put_compat_itimerspec(setting, &ts))
65199 @@ -662,7 +663,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
65202 err = sys_clock_settime(which_clock,
65203 - (struct timespec __user *) &ts);
65204 + (struct timespec __force_user *) &ts);
65208 @@ -677,7 +678,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
65211 err = sys_clock_gettime(which_clock,
65212 - (struct timespec __user *) &ts);
65213 + (struct timespec __force_user *) &ts);
65215 if (!err && put_compat_timespec(&ts, tp))
65217 @@ -697,7 +698,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
65221 - ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
65222 + ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
65225 err = compat_put_timex(utp, &txc);
65226 @@ -717,7 +718,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
65229 err = sys_clock_getres(which_clock,
65230 - (struct timespec __user *) &ts);
65231 + (struct timespec __force_user *) &ts);
65233 if (!err && tp && put_compat_timespec(&ts, tp))
65235 @@ -729,9 +730,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
65237 mm_segment_t oldfs;
65238 struct timespec tu;
65239 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
65240 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
65242 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
65243 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
65246 err = clock_nanosleep_restart(restart);
65247 @@ -763,8 +764,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
65250 err = sys_clock_nanosleep(which_clock, flags,
65251 - (struct timespec __user *) &in,
65252 - (struct timespec __user *) &out);
65253 + (struct timespec __force_user *) &in,
65254 + (struct timespec __force_user *) &out);
65257 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
65258 diff --git a/kernel/configs.c b/kernel/configs.c
65259 index 42e8fa0..9e7406b 100644
65260 --- a/kernel/configs.c
65261 +++ b/kernel/configs.c
65262 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
65263 struct proc_dir_entry *entry;
65265 /* create the current config file */
65266 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
65267 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
65268 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
65269 + &ikconfig_file_ops);
65270 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65271 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
65272 + &ikconfig_file_ops);
65275 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
65276 &ikconfig_file_ops);
65282 diff --git a/kernel/cred.c b/kernel/cred.c
65283 index 8ef31f5..d7d50d8 100644
65284 --- a/kernel/cred.c
65285 +++ b/kernel/cred.c
65286 @@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
65288 void __put_cred(struct cred *cred)
65290 + pax_track_stack();
65292 kdebug("__put_cred(%p{%d,%d})", cred,
65293 atomic_read(&cred->usage),
65294 read_cred_subscribers(cred));
65295 @@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
65299 + pax_track_stack();
65301 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
65302 atomic_read(&tsk->cred->usage),
65303 read_cred_subscribers(tsk->cred));
65304 @@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct task_struct *task)
65306 const struct cred *cred;
65308 + pax_track_stack();
65313 @@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
65317 + pax_track_stack();
65319 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
65322 @@ -281,12 +289,14 @@ error:
65324 * Call commit_creds() or abort_creds() to clean up.
65326 -struct cred *prepare_creds(void)
65328 +static struct cred *__prepare_creds(struct task_struct *task)
65330 - struct task_struct *task = current;
65331 const struct cred *old;
65334 + pax_track_stack();
65336 validate_process_creds();
65338 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65339 @@ -322,6 +332,11 @@ error:
65344 +struct cred *prepare_creds(void)
65346 + return __prepare_creds(current);
65348 EXPORT_SYMBOL(prepare_creds);
65351 @@ -333,6 +348,8 @@ struct cred *prepare_exec_creds(void)
65352 struct thread_group_cred *tgcred = NULL;
65355 + pax_track_stack();
65358 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
65360 @@ -385,6 +402,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
65364 + pax_track_stack();
65368 !p->cred->thread_keyring &&
65369 @@ -470,11 +489,12 @@ error_put:
65370 * Always returns 0 thus allowing this function to be tail-called at the end
65371 * of, say, sys_setgid().
65373 -int commit_creds(struct cred *new)
65374 +static int __commit_creds(struct task_struct *task, struct cred *new)
65376 - struct task_struct *task = current;
65377 const struct cred *old = task->real_cred;
65379 + pax_track_stack();
65381 kdebug("commit_creds(%p{%d,%d})", new,
65382 atomic_read(&new->usage),
65383 read_cred_subscribers(new));
65384 @@ -489,6 +509,8 @@ int commit_creds(struct cred *new)
65386 get_cred(new); /* we will require a ref for the subj creds too */
65388 + gr_set_role_label(task, new->uid, new->gid);
65390 /* dumpability changes */
65391 if (old->euid != new->euid ||
65392 old->egid != new->egid ||
65393 @@ -538,6 +560,64 @@ int commit_creds(struct cred *new)
65398 +int commit_creds(struct cred *new)
65400 +#ifdef CONFIG_GRKERNSEC_SETXID
65401 + struct task_struct *t;
65402 + struct cred *ncred;
65403 + const struct cred *old;
65405 + if (grsec_enable_setxid && !current_is_single_threaded() &&
65406 + !current_uid() && new->uid) {
65408 + read_lock(&tasklist_lock);
65409 + for (t = next_thread(current); t != current;
65410 + t = next_thread(t)) {
65411 + old = __task_cred(t);
65414 + ncred = __prepare_creds(t);
65418 + ncred->uid = new->uid;
65419 + ncred->euid = new->euid;
65420 + ncred->suid = new->suid;
65421 + ncred->fsuid = new->fsuid;
65423 + ncred->gid = new->gid;
65424 + ncred->egid = new->egid;
65425 + ncred->sgid = new->sgid;
65426 + ncred->fsgid = new->fsgid;
65428 + if (set_groups(ncred, new->group_info) < 0) {
65429 + abort_creds(ncred);
65433 + ncred->securebits = new->securebits;
65434 + ncred->cap_inheritable = new->cap_inheritable;
65435 + ncred->cap_permitted = new->cap_permitted;
65436 + ncred->cap_effective = new->cap_effective;
65437 + ncred->cap_bset = new->cap_bset;
65439 + __commit_creds(t, ncred);
65441 + read_unlock(&tasklist_lock);
65442 + rcu_read_unlock();
65445 + return __commit_creds(current, new);
65446 +#ifdef CONFIG_GRKERNSEC_SETXID
65448 + read_unlock(&tasklist_lock);
65449 + rcu_read_unlock();
65450 + abort_creds(new);
65451 + do_group_exit(SIGKILL);
65455 EXPORT_SYMBOL(commit_creds);
65458 @@ -549,6 +629,8 @@ EXPORT_SYMBOL(commit_creds);
65460 void abort_creds(struct cred *new)
65462 + pax_track_stack();
65464 kdebug("abort_creds(%p{%d,%d})", new,
65465 atomic_read(&new->usage),
65466 read_cred_subscribers(new));
65467 @@ -572,6 +654,8 @@ const struct cred *override_creds(const struct cred *new)
65469 const struct cred *old = current->cred;
65471 + pax_track_stack();
65473 kdebug("override_creds(%p{%d,%d})", new,
65474 atomic_read(&new->usage),
65475 read_cred_subscribers(new));
65476 @@ -601,6 +685,8 @@ void revert_creds(const struct cred *old)
65478 const struct cred *override = current->cred;
65480 + pax_track_stack();
65482 kdebug("revert_creds(%p{%d,%d})", old,
65483 atomic_read(&old->usage),
65484 read_cred_subscribers(old));
65485 @@ -647,6 +733,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
65486 const struct cred *old;
65489 + pax_track_stack();
65491 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65494 @@ -701,6 +789,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
65496 int set_security_override(struct cred *new, u32 secid)
65498 + pax_track_stack();
65500 return security_kernel_act_as(new, secid);
65502 EXPORT_SYMBOL(set_security_override);
65503 @@ -720,6 +810,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
65507 + pax_track_stack();
65509 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
65512 diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
65513 index 0d7c087..01b8cef 100644
65514 --- a/kernel/debug/debug_core.c
65515 +++ b/kernel/debug/debug_core.c
65516 @@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
65518 static atomic_t masters_in_kgdb;
65519 static atomic_t slaves_in_kgdb;
65520 -static atomic_t kgdb_break_tasklet_var;
65521 +static atomic_unchecked_t kgdb_break_tasklet_var;
65522 atomic_t kgdb_setting_breakpoint;
65524 struct task_struct *kgdb_usethread;
65525 @@ -129,7 +129,7 @@ int kgdb_single_step;
65526 static pid_t kgdb_sstep_pid;
65528 /* to keep track of the CPU which is doing the single stepping*/
65529 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65530 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65533 * If you are debugging a problem where roundup (the collection of
65534 @@ -542,7 +542,7 @@ return_normal:
65535 * kernel will only try for the value of sstep_tries before
65536 * giving up and continuing on.
65538 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
65539 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
65540 (kgdb_info[cpu].task &&
65541 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
65542 atomic_set(&kgdb_active, -1);
65543 @@ -636,8 +636,8 @@ cpu_master_loop:
65547 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
65548 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
65549 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
65550 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
65551 if (kgdb_info[sstep_cpu].task)
65552 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
65554 @@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(void)
65555 static void kgdb_tasklet_bpt(unsigned long ing)
65558 - atomic_set(&kgdb_break_tasklet_var, 0);
65559 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
65562 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
65564 void kgdb_schedule_breakpoint(void)
65566 - if (atomic_read(&kgdb_break_tasklet_var) ||
65567 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
65568 atomic_read(&kgdb_active) != -1 ||
65569 atomic_read(&kgdb_setting_breakpoint))
65571 - atomic_inc(&kgdb_break_tasklet_var);
65572 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
65573 tasklet_schedule(&kgdb_tasklet_breakpoint);
65575 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
65576 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
65577 index 63786e7..0780cac 100644
65578 --- a/kernel/debug/kdb/kdb_main.c
65579 +++ b/kernel/debug/kdb/kdb_main.c
65580 @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const char **argv)
65581 list_for_each_entry(mod, kdb_modules, list) {
65583 kdb_printf("%-20s%8u 0x%p ", mod->name,
65584 - mod->core_size, (void *)mod);
65585 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
65586 #ifdef CONFIG_MODULE_UNLOAD
65587 kdb_printf("%4d ", module_refcount(mod));
65589 @@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const char **argv)
65590 kdb_printf(" (Loading)");
65592 kdb_printf(" (Live)");
65593 - kdb_printf(" 0x%p", mod->module_core);
65594 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
65596 #ifdef CONFIG_MODULE_UNLOAD
65598 diff --git a/kernel/events/core.c b/kernel/events/core.c
65599 index 0f85778..0d43716 100644
65600 --- a/kernel/events/core.c
65601 +++ b/kernel/events/core.c
65602 @@ -172,7 +172,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
65606 -static atomic64_t perf_event_id;
65607 +static atomic64_unchecked_t perf_event_id;
65609 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
65610 enum event_type_t event_type);
65611 @@ -2535,7 +2535,7 @@ static void __perf_event_read(void *info)
65613 static inline u64 perf_event_count(struct perf_event *event)
65615 - return local64_read(&event->count) + atomic64_read(&event->child_count);
65616 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
65619 static u64 perf_event_read(struct perf_event *event)
65620 @@ -3060,9 +3060,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
65621 mutex_lock(&event->child_mutex);
65622 total += perf_event_read(event);
65623 *enabled += event->total_time_enabled +
65624 - atomic64_read(&event->child_total_time_enabled);
65625 + atomic64_read_unchecked(&event->child_total_time_enabled);
65626 *running += event->total_time_running +
65627 - atomic64_read(&event->child_total_time_running);
65628 + atomic64_read_unchecked(&event->child_total_time_running);
65630 list_for_each_entry(child, &event->child_list, child_list) {
65631 total += perf_event_read(child);
65632 @@ -3448,10 +3448,10 @@ void perf_event_update_userpage(struct perf_event *event)
65633 userpg->offset -= local64_read(&event->hw.prev_count);
65635 userpg->time_enabled = enabled +
65636 - atomic64_read(&event->child_total_time_enabled);
65637 + atomic64_read_unchecked(&event->child_total_time_enabled);
65639 userpg->time_running = running +
65640 - atomic64_read(&event->child_total_time_running);
65641 + atomic64_read_unchecked(&event->child_total_time_running);
65645 @@ -3822,11 +3822,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
65646 values[n++] = perf_event_count(event);
65647 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
65648 values[n++] = enabled +
65649 - atomic64_read(&event->child_total_time_enabled);
65650 + atomic64_read_unchecked(&event->child_total_time_enabled);
65652 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
65653 values[n++] = running +
65654 - atomic64_read(&event->child_total_time_running);
65655 + atomic64_read_unchecked(&event->child_total_time_running);
65657 if (read_format & PERF_FORMAT_ID)
65658 values[n++] = primary_event_id(event);
65659 @@ -4477,12 +4477,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
65660 * need to add enough zero bytes after the string to handle
65661 * the 64bit alignment we do later.
65663 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
65664 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
65666 name = strncpy(tmp, "//enomem", sizeof(tmp));
65669 - name = d_path(&file->f_path, buf, PATH_MAX);
65670 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
65671 if (IS_ERR(name)) {
65672 name = strncpy(tmp, "//toolong", sizeof(tmp));
65674 @@ -5833,7 +5833,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
65675 event->parent = parent_event;
65677 event->ns = get_pid_ns(current->nsproxy->pid_ns);
65678 - event->id = atomic64_inc_return(&perf_event_id);
65679 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
65681 event->state = PERF_EVENT_STATE_INACTIVE;
65683 @@ -6355,10 +6355,10 @@ static void sync_child_event(struct perf_event *child_event,
65685 * Add back the child's count to the parent's count:
65687 - atomic64_add(child_val, &parent_event->child_count);
65688 - atomic64_add(child_event->total_time_enabled,
65689 + atomic64_add_unchecked(child_val, &parent_event->child_count);
65690 + atomic64_add_unchecked(child_event->total_time_enabled,
65691 &parent_event->child_total_time_enabled);
65692 - atomic64_add(child_event->total_time_running,
65693 + atomic64_add_unchecked(child_event->total_time_running,
65694 &parent_event->child_total_time_running);
65697 diff --git a/kernel/exit.c b/kernel/exit.c
65698 index 2913b35..4465c81 100644
65699 --- a/kernel/exit.c
65700 +++ b/kernel/exit.c
65702 #include <asm/pgtable.h>
65703 #include <asm/mmu_context.h>
65705 +#ifdef CONFIG_GRKERNSEC
65706 +extern rwlock_t grsec_exec_file_lock;
65709 static void exit_mm(struct task_struct * tsk);
65711 static void __unhash_process(struct task_struct *p, bool group_dead)
65712 @@ -168,6 +172,10 @@ void release_task(struct task_struct * p)
65713 struct task_struct *leader;
65717 + gr_del_task_from_ip_table(p);
65720 /* don't need to get the RCU readlock here - the process is dead and
65721 * can't be modifying its own credentials. But shut RCU-lockdep up */
65723 @@ -380,7 +388,7 @@ int allow_signal(int sig)
65724 * know it'll be handled, so that they don't get converted to
65725 * SIGKILL or just silently dropped.
65727 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
65728 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
65729 recalc_sigpending();
65730 spin_unlock_irq(¤t->sighand->siglock);
65732 @@ -416,6 +424,17 @@ void daemonize(const char *name, ...)
65733 vsnprintf(current->comm, sizeof(current->comm), name, args);
65736 +#ifdef CONFIG_GRKERNSEC
65737 + write_lock(&grsec_exec_file_lock);
65738 + if (current->exec_file) {
65739 + fput(current->exec_file);
65740 + current->exec_file = NULL;
65742 + write_unlock(&grsec_exec_file_lock);
65745 + gr_set_kernel_label(current);
65748 * If we were started as result of loading a module, close all of the
65749 * user space pages. We don't need them, and if we didn't close them
65750 @@ -895,6 +914,8 @@ NORET_TYPE void do_exit(long code)
65751 struct task_struct *tsk = current;
65756 profile_task_exit(tsk);
65758 WARN_ON(blk_needs_flush_plug(tsk));
65759 @@ -911,7 +932,6 @@ NORET_TYPE void do_exit(long code)
65760 * mm_release()->clear_child_tid() from writing to a user-controlled
65765 ptrace_event(PTRACE_EVENT_EXIT, code);
65767 @@ -973,6 +993,9 @@ NORET_TYPE void do_exit(long code)
65768 tsk->exit_code = code;
65769 taskstats_exit(tsk, group_dead);
65771 + gr_acl_handle_psacct(tsk, code);
65772 + gr_acl_handle_exit();
65777 diff --git a/kernel/fork.c b/kernel/fork.c
65778 index 8e6b6f4..9dccf00 100644
65779 --- a/kernel/fork.c
65780 +++ b/kernel/fork.c
65781 @@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
65782 *stackend = STACK_END_MAGIC; /* for overflow detection */
65784 #ifdef CONFIG_CC_STACKPROTECTOR
65785 - tsk->stack_canary = get_random_int();
65786 + tsk->stack_canary = pax_get_random_long();
65790 @@ -309,13 +309,77 @@ out:
65794 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
65796 + struct vm_area_struct *tmp;
65797 + unsigned long charge;
65798 + struct mempolicy *pol;
65799 + struct file *file;
65802 + if (mpnt->vm_flags & VM_ACCOUNT) {
65803 + unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65804 + if (security_vm_enough_memory(len))
65808 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65813 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
65814 + pol = mpol_dup(vma_policy(mpnt));
65816 + goto fail_nomem_policy;
65817 + vma_set_policy(tmp, pol);
65818 + if (anon_vma_fork(tmp, mpnt))
65819 + goto fail_nomem_anon_vma_fork;
65820 + tmp->vm_flags &= ~VM_LOCKED;
65821 + tmp->vm_next = tmp->vm_prev = NULL;
65822 + tmp->vm_mirror = NULL;
65823 + file = tmp->vm_file;
65825 + struct inode *inode = file->f_path.dentry->d_inode;
65826 + struct address_space *mapping = file->f_mapping;
65829 + if (tmp->vm_flags & VM_DENYWRITE)
65830 + atomic_dec(&inode->i_writecount);
65831 + mutex_lock(&mapping->i_mmap_mutex);
65832 + if (tmp->vm_flags & VM_SHARED)
65833 + mapping->i_mmap_writable++;
65834 + flush_dcache_mmap_lock(mapping);
65835 + /* insert tmp into the share list, just after mpnt */
65836 + vma_prio_tree_add(tmp, mpnt);
65837 + flush_dcache_mmap_unlock(mapping);
65838 + mutex_unlock(&mapping->i_mmap_mutex);
65842 + * Clear hugetlb-related page reserves for children. This only
65843 + * affects MAP_PRIVATE mappings. Faults generated by the child
65844 + * are not guaranteed to succeed, even if read-only
65846 + if (is_vm_hugetlb_page(tmp))
65847 + reset_vma_resv_huge_pages(tmp);
65851 +fail_nomem_anon_vma_fork:
65853 +fail_nomem_policy:
65854 + kmem_cache_free(vm_area_cachep, tmp);
65856 + vm_unacct_memory(charge);
65860 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65862 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
65863 struct rb_node **rb_link, *rb_parent;
65865 - unsigned long charge;
65866 - struct mempolicy *pol;
65868 down_write(&oldmm->mmap_sem);
65869 flush_cache_dup_mm(oldmm);
65870 @@ -327,8 +391,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65873 mm->mmap_cache = NULL;
65874 - mm->free_area_cache = oldmm->mmap_base;
65875 - mm->cached_hole_size = ~0UL;
65876 + mm->free_area_cache = oldmm->free_area_cache;
65877 + mm->cached_hole_size = oldmm->cached_hole_size;
65879 cpumask_clear(mm_cpumask(mm));
65880 mm->mm_rb = RB_ROOT;
65881 @@ -344,8 +408,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65884 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
65885 - struct file *file;
65887 if (mpnt->vm_flags & VM_DONTCOPY) {
65888 long pages = vma_pages(mpnt);
65889 mm->total_vm -= pages;
65890 @@ -353,53 +415,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65895 - if (mpnt->vm_flags & VM_ACCOUNT) {
65896 - unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
65897 - if (security_vm_enough_memory(len))
65900 + tmp = dup_vma(mm, mpnt);
65902 + retval = -ENOMEM;
65905 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
65909 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
65910 - pol = mpol_dup(vma_policy(mpnt));
65911 - retval = PTR_ERR(pol);
65913 - goto fail_nomem_policy;
65914 - vma_set_policy(tmp, pol);
65916 - if (anon_vma_fork(tmp, mpnt))
65917 - goto fail_nomem_anon_vma_fork;
65918 - tmp->vm_flags &= ~VM_LOCKED;
65919 - tmp->vm_next = tmp->vm_prev = NULL;
65920 - file = tmp->vm_file;
65922 - struct inode *inode = file->f_path.dentry->d_inode;
65923 - struct address_space *mapping = file->f_mapping;
65926 - if (tmp->vm_flags & VM_DENYWRITE)
65927 - atomic_dec(&inode->i_writecount);
65928 - mutex_lock(&mapping->i_mmap_mutex);
65929 - if (tmp->vm_flags & VM_SHARED)
65930 - mapping->i_mmap_writable++;
65931 - flush_dcache_mmap_lock(mapping);
65932 - /* insert tmp into the share list, just after mpnt */
65933 - vma_prio_tree_add(tmp, mpnt);
65934 - flush_dcache_mmap_unlock(mapping);
65935 - mutex_unlock(&mapping->i_mmap_mutex);
65939 - * Clear hugetlb-related page reserves for children. This only
65940 - * affects MAP_PRIVATE mappings. Faults generated by the child
65941 - * are not guaranteed to succeed, even if read-only
65943 - if (is_vm_hugetlb_page(tmp))
65944 - reset_vma_resv_huge_pages(tmp);
65947 * Link in the new vma and copy the page table entries.
65948 @@ -422,6 +442,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
65953 +#ifdef CONFIG_PAX_SEGMEXEC
65954 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
65955 + struct vm_area_struct *mpnt_m;
65957 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
65958 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
65960 + if (!mpnt->vm_mirror)
65963 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
65964 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
65965 + mpnt->vm_mirror = mpnt_m;
65967 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
65968 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
65969 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
65970 + mpnt->vm_mirror->vm_mirror = mpnt;
65977 /* a new mm has just been created */
65978 arch_dup_mmap(oldmm, mm);
65980 @@ -430,14 +475,6 @@ out:
65981 flush_tlb_mm(oldmm);
65982 up_write(&oldmm->mmap_sem);
65984 -fail_nomem_anon_vma_fork:
65986 -fail_nomem_policy:
65987 - kmem_cache_free(vm_area_cachep, tmp);
65989 - retval = -ENOMEM;
65990 - vm_unacct_memory(charge);
65994 static inline int mm_alloc_pgd(struct mm_struct *mm)
65995 @@ -837,13 +874,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
65996 spin_unlock(&fs->lock);
66000 + atomic_inc(&fs->users);
66001 spin_unlock(&fs->lock);
66004 tsk->fs = copy_fs_struct(fs);
66007 + gr_set_chroot_entries(tsk, &tsk->fs->root);
66011 @@ -1105,6 +1143,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66012 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
66016 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
66018 if (atomic_read(&p->real_cred->user->processes) >=
66019 task_rlimit(p, RLIMIT_NPROC)) {
66020 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
66021 @@ -1264,6 +1305,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
66022 if (clone_flags & CLONE_THREAD)
66023 p->tgid = current->tgid;
66025 + gr_copy_label(p);
66027 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
66029 * Clear TID on mm_release()?
66030 @@ -1428,6 +1471,8 @@ bad_fork_cleanup_count:
66034 + gr_log_forkfail(retval);
66036 return ERR_PTR(retval);
66039 @@ -1528,6 +1573,8 @@ long do_fork(unsigned long clone_flags,
66040 if (clone_flags & CLONE_PARENT_SETTID)
66041 put_user(nr, parent_tidptr);
66043 + gr_handle_brute_check();
66045 if (clone_flags & CLONE_VFORK) {
66046 p->vfork_done = &vfork;
66047 init_completion(&vfork);
66048 @@ -1637,7 +1684,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
66051 /* don't need lock here; in the worst case we'll do useless copy */
66052 - if (fs->users == 1)
66053 + if (atomic_read(&fs->users) == 1)
66056 *new_fsp = copy_fs_struct(fs);
66057 @@ -1726,7 +1773,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
66059 spin_lock(&fs->lock);
66060 current->fs = new_fs;
66062 + gr_set_chroot_entries(current, ¤t->fs->root);
66063 + if (atomic_dec_return(&fs->users))
66067 diff --git a/kernel/futex.c b/kernel/futex.c
66068 index 11cbe05..c5dab58 100644
66069 --- a/kernel/futex.c
66070 +++ b/kernel/futex.c
66072 #include <linux/mount.h>
66073 #include <linux/pagemap.h>
66074 #include <linux/syscalls.h>
66075 +#include <linux/ptrace.h>
66076 #include <linux/signal.h>
66077 #include <linux/module.h>
66078 #include <linux/magic.h>
66079 @@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
66080 struct page *page, *page_head;
66083 +#ifdef CONFIG_PAX_SEGMEXEC
66084 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
66089 * The futex address must be "naturally" aligned.
66091 @@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
66092 struct futex_q q = futex_q_init;
66095 + pax_track_stack();
66100 @@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
66101 struct futex_q q = futex_q_init;
66104 + pax_track_stack();
66109 @@ -2447,6 +2457,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
66113 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66114 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
66117 pcred = __task_cred(p);
66118 /* If victim is in different user_ns, then uids are not
66119 comparable, so we must have CAP_SYS_PTRACE */
66120 @@ -2712,6 +2726,7 @@ static int __init futex_init(void)
66124 + mm_segment_t oldfs;
66127 * This will fail and we want it. Some arch implementations do
66128 @@ -2723,8 +2738,11 @@ static int __init futex_init(void)
66129 * implementation, the non-functional ones will return
66132 + oldfs = get_fs();
66134 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
66135 futex_cmpxchg_enabled = 1;
66138 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
66139 plist_head_init(&futex_queues[i].chain);
66140 diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
66141 index 5f9e689..582d46d 100644
66142 --- a/kernel/futex_compat.c
66143 +++ b/kernel/futex_compat.c
66145 #include <linux/compat.h>
66146 #include <linux/nsproxy.h>
66147 #include <linux/futex.h>
66148 +#include <linux/ptrace.h>
66150 #include <asm/uaccess.h>
66152 @@ -136,7 +137,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66154 struct compat_robust_list_head __user *head;
66156 - const struct cred *cred = current_cred(), *pcred;
66157 + const struct cred *cred = current_cred();
66158 + const struct cred *pcred;
66160 if (!futex_cmpxchg_enabled)
66162 @@ -152,6 +154,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
66166 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
66167 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
66170 pcred = __task_cred(p);
66171 /* If victim is in different user_ns, then uids are not
66172 comparable, so we must have CAP_SYS_PTRACE */
66173 diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
66174 index 9b22d03..6295b62 100644
66175 --- a/kernel/gcov/base.c
66176 +++ b/kernel/gcov/base.c
66177 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
66180 #ifdef CONFIG_MODULES
66181 -static inline int within(void *addr, void *start, unsigned long size)
66183 - return ((addr >= start) && (addr < start + size));
66186 /* Update list and generate events when modules are unloaded. */
66187 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66189 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
66191 /* Remove entries located in module from linked list. */
66192 for (info = gcov_info_head; info; info = info->next) {
66193 - if (within(info, mod->module_core, mod->core_size)) {
66194 + if (within_module_core_rw((unsigned long)info, mod)) {
66196 prev->next = info->next;
66198 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
66199 index 2043c08..ec81a69 100644
66200 --- a/kernel/hrtimer.c
66201 +++ b/kernel/hrtimer.c
66202 @@ -1393,7 +1393,7 @@ void hrtimer_peek_ahead_timers(void)
66203 local_irq_restore(flags);
66206 -static void run_hrtimer_softirq(struct softirq_action *h)
66207 +static void run_hrtimer_softirq(void)
66209 hrtimer_peek_ahead_timers();
66211 diff --git a/kernel/jump_label.c b/kernel/jump_label.c
66212 index e6f1f24..6c19597 100644
66213 --- a/kernel/jump_label.c
66214 +++ b/kernel/jump_label.c
66215 @@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
66217 size = (((unsigned long)stop - (unsigned long)start)
66218 / sizeof(struct jump_entry));
66219 + pax_open_kernel();
66220 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
66221 + pax_close_kernel();
66224 static void jump_label_update(struct jump_label_key *key, int enable);
66225 @@ -298,10 +300,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
66226 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
66227 struct jump_entry *iter;
66229 + pax_open_kernel();
66230 for (iter = iter_start; iter < iter_stop; iter++) {
66231 if (within_module_init(iter->code, mod))
66234 + pax_close_kernel();
66238 diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
66239 index 079f1d3..a407562 100644
66240 --- a/kernel/kallsyms.c
66241 +++ b/kernel/kallsyms.c
66243 * Changed the compression method from stem compression to "table lookup"
66244 * compression (see scripts/kallsyms.c for a more complete description)
66246 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66247 +#define __INCLUDED_BY_HIDESYM 1
66249 #include <linux/kallsyms.h>
66250 #include <linux/module.h>
66251 #include <linux/init.h>
66252 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
66254 static inline int is_kernel_inittext(unsigned long addr)
66256 + if (system_state != SYSTEM_BOOTING)
66259 if (addr >= (unsigned long)_sinittext
66260 && addr <= (unsigned long)_einittext)
66265 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66266 +#ifdef CONFIG_MODULES
66267 +static inline int is_module_text(unsigned long addr)
66269 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
66272 + addr = ktla_ktva(addr);
66273 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
66276 +static inline int is_module_text(unsigned long addr)
66283 static inline int is_kernel_text(unsigned long addr)
66285 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
66286 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
66288 static inline int is_kernel(unsigned long addr)
66291 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66292 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
66295 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
66297 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
66301 return in_gate_area_no_mm(addr);
66304 static int is_ksym_addr(unsigned long addr)
66307 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
66308 + if (is_module_text(addr))
66313 return is_kernel(addr);
66315 @@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
66317 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
66319 - iter->name[0] = '\0';
66320 iter->nameoff = get_symbol_offset(new_pos);
66321 iter->pos = new_pos;
66323 @@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, void *p)
66325 struct kallsym_iter *iter = m->private;
66327 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66328 + if (current_uid())
66332 /* Some debugging symbols have no name. Ignore them. */
66333 if (!iter->name[0])
66335 @@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
66336 struct kallsym_iter *iter;
66339 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
66340 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
66343 reset_iter(iter, 0);
66344 diff --git a/kernel/kexec.c b/kernel/kexec.c
66345 index 296fbc8..84cb857 100644
66346 --- a/kernel/kexec.c
66347 +++ b/kernel/kexec.c
66348 @@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
66349 unsigned long flags)
66351 struct compat_kexec_segment in;
66352 - struct kexec_segment out, __user *ksegments;
66353 + struct kexec_segment out;
66354 + struct kexec_segment __user *ksegments;
66355 unsigned long i, result;
66357 /* Don't allow clients that don't understand the native
66358 diff --git a/kernel/kmod.c b/kernel/kmod.c
66359 index a4bea97..7a1ae9a 100644
66360 --- a/kernel/kmod.c
66361 +++ b/kernel/kmod.c
66362 @@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
66363 * If module auto-loading support is disabled then this function
66364 * becomes a no-operation.
66366 -int __request_module(bool wait, const char *fmt, ...)
66367 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
66370 char module_name[MODULE_NAME_LEN];
66371 unsigned int max_modprobes;
66373 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
66374 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
66375 static char *envp[] = { "HOME=/",
66377 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
66378 @@ -88,9 +87,7 @@ int __request_module(bool wait, const char *fmt, ...)
66379 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
66380 static int kmod_loop_msg;
66382 - va_start(args, fmt);
66383 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
66385 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
66386 if (ret >= MODULE_NAME_LEN)
66387 return -ENAMETOOLONG;
66389 @@ -98,6 +95,20 @@ int __request_module(bool wait, const char *fmt, ...)
66393 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
66394 + if (!current_uid()) {
66395 + /* hack to workaround consolekit/udisks stupidity */
66396 + read_lock(&tasklist_lock);
66397 + if (!strcmp(current->comm, "mount") &&
66398 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
66399 + read_unlock(&tasklist_lock);
66400 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
66403 + read_unlock(&tasklist_lock);
66407 /* If modprobe needs a service that is in a module, we get a recursive
66408 * loop. Limit the number of running kmod threads to max_threads/2 or
66409 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
66410 @@ -133,6 +144,47 @@ int __request_module(bool wait, const char *fmt, ...)
66411 atomic_dec(&kmod_concurrent);
66415 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
66420 + va_start(args, fmt);
66421 + ret = ____request_module(wait, module_param, fmt, args);
66427 +int __request_module(bool wait, const char *fmt, ...)
66432 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
66433 + if (current_uid()) {
66434 + char module_param[MODULE_NAME_LEN];
66436 + memset(module_param, 0, sizeof(module_param));
66438 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
66440 + va_start(args, fmt);
66441 + ret = ____request_module(wait, module_param, fmt, args);
66448 + va_start(args, fmt);
66449 + ret = ____request_module(wait, NULL, fmt, args);
66455 EXPORT_SYMBOL(__request_module);
66456 #endif /* CONFIG_MODULES */
66458 @@ -222,7 +274,7 @@ static int wait_for_helper(void *data)
66460 * Thus the __user pointer cast is valid here.
66462 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
66463 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
66466 * If ret is 0, either ____call_usermodehelper failed and the
66467 diff --git a/kernel/kprobes.c b/kernel/kprobes.c
66468 index b30fd54..11821ec 100644
66469 --- a/kernel/kprobes.c
66470 +++ b/kernel/kprobes.c
66471 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
66472 * kernel image and loaded module images reside. This is required
66473 * so x86_64 can correctly handle the %rip-relative fixups.
66475 - kip->insns = module_alloc(PAGE_SIZE);
66476 + kip->insns = module_alloc_exec(PAGE_SIZE);
66480 @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
66482 if (!list_is_singular(&kip->list)) {
66483 list_del(&kip->list);
66484 - module_free(NULL, kip->insns);
66485 + module_free_exec(NULL, kip->insns);
66489 @@ -1949,7 +1949,7 @@ static int __init init_kprobes(void)
66492 unsigned long offset = 0, size = 0;
66493 - char *modname, namebuf[128];
66494 + char *modname, namebuf[KSYM_NAME_LEN];
66495 const char *symbol_name;
66497 struct kprobe_blackpoint *kb;
66498 @@ -2075,7 +2075,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
66499 const char *sym = NULL;
66500 unsigned int i = *(loff_t *) v;
66501 unsigned long offset = 0;
66502 - char *modname, namebuf[128];
66503 + char *modname, namebuf[KSYM_NAME_LEN];
66505 head = &kprobe_table[i];
66507 diff --git a/kernel/lockdep.c b/kernel/lockdep.c
66508 index 4479606..4036bea 100644
66509 --- a/kernel/lockdep.c
66510 +++ b/kernel/lockdep.c
66511 @@ -584,6 +584,10 @@ static int static_obj(void *obj)
66512 end = (unsigned long) &_end,
66513 addr = (unsigned long) obj;
66515 +#ifdef CONFIG_PAX_KERNEXEC
66516 + start = ktla_ktva(start);
66522 @@ -719,6 +723,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
66523 if (!static_obj(lock->key)) {
66525 printk("INFO: trying to register non-static key.\n");
66526 + printk("lock:%pS key:%pS.\n", lock, lock->key);
66527 printk("the code is fine but needs lockdep annotation.\n");
66528 printk("turning off the locking correctness validator.\n");
66530 @@ -2954,7 +2959,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
66534 - atomic_inc((atomic_t *)&class->ops);
66535 + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
66536 if (very_verbose(class)) {
66537 printk("\nacquire class [%p] %s", class->key, class->name);
66538 if (class->name_version > 1)
66539 diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
66540 index 71edd2f..e0542a5 100644
66541 --- a/kernel/lockdep_proc.c
66542 +++ b/kernel/lockdep_proc.c
66543 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
66545 static void print_name(struct seq_file *m, struct lock_class *class)
66548 + char str[KSYM_NAME_LEN];
66549 const char *name = class->name;
66552 diff --git a/kernel/module.c b/kernel/module.c
66553 index 04379f92..fba2faf 100644
66554 --- a/kernel/module.c
66555 +++ b/kernel/module.c
66557 #include <linux/jump_label.h>
66558 #include <linux/pfn.h>
66559 #include <linux/bsearch.h>
66560 +#include <linux/grsecurity.h>
66562 #define CREATE_TRACE_POINTS
66563 #include <trace/events/module.h>
66564 @@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
66566 /* Bounds of module allocation, for speeding __module_address.
66567 * Protected by module_mutex. */
66568 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
66569 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
66570 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
66572 int register_module_notifier(struct notifier_block * nb)
66574 @@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66577 list_for_each_entry_rcu(mod, &modules, list) {
66578 - struct symsearch arr[] = {
66579 + struct symsearch modarr[] = {
66580 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
66581 NOT_GPL_ONLY, false },
66582 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
66583 @@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
66587 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
66588 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
66592 @@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(struct module *mod)
66593 static int percpu_modalloc(struct module *mod,
66594 unsigned long size, unsigned long align)
66596 - if (align > PAGE_SIZE) {
66597 + if (align-1 >= PAGE_SIZE) {
66598 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
66599 mod->name, align, PAGE_SIZE);
66601 @@ -1183,7 +1185,7 @@ resolve_symbol_wait(struct module *mod,
66603 #ifdef CONFIG_SYSFS
66605 -#ifdef CONFIG_KALLSYMS
66606 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66607 static inline bool sect_empty(const Elf_Shdr *sect)
66609 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
66610 @@ -1649,21 +1651,21 @@ static void set_section_ro_nx(void *base,
66612 static void unset_module_core_ro_nx(struct module *mod)
66614 - set_page_attributes(mod->module_core + mod->core_text_size,
66615 - mod->module_core + mod->core_size,
66616 + set_page_attributes(mod->module_core_rw,
66617 + mod->module_core_rw + mod->core_size_rw,
66619 - set_page_attributes(mod->module_core,
66620 - mod->module_core + mod->core_ro_size,
66621 + set_page_attributes(mod->module_core_rx,
66622 + mod->module_core_rx + mod->core_size_rx,
66626 static void unset_module_init_ro_nx(struct module *mod)
66628 - set_page_attributes(mod->module_init + mod->init_text_size,
66629 - mod->module_init + mod->init_size,
66630 + set_page_attributes(mod->module_init_rw,
66631 + mod->module_init_rw + mod->init_size_rw,
66633 - set_page_attributes(mod->module_init,
66634 - mod->module_init + mod->init_ro_size,
66635 + set_page_attributes(mod->module_init_rx,
66636 + mod->module_init_rx + mod->init_size_rx,
66640 @@ -1674,14 +1676,14 @@ void set_all_modules_text_rw(void)
66642 mutex_lock(&module_mutex);
66643 list_for_each_entry_rcu(mod, &modules, list) {
66644 - if ((mod->module_core) && (mod->core_text_size)) {
66645 - set_page_attributes(mod->module_core,
66646 - mod->module_core + mod->core_text_size,
66647 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
66648 + set_page_attributes(mod->module_core_rx,
66649 + mod->module_core_rx + mod->core_size_rx,
66652 - if ((mod->module_init) && (mod->init_text_size)) {
66653 - set_page_attributes(mod->module_init,
66654 - mod->module_init + mod->init_text_size,
66655 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
66656 + set_page_attributes(mod->module_init_rx,
66657 + mod->module_init_rx + mod->init_size_rx,
66661 @@ -1695,14 +1697,14 @@ void set_all_modules_text_ro(void)
66663 mutex_lock(&module_mutex);
66664 list_for_each_entry_rcu(mod, &modules, list) {
66665 - if ((mod->module_core) && (mod->core_text_size)) {
66666 - set_page_attributes(mod->module_core,
66667 - mod->module_core + mod->core_text_size,
66668 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
66669 + set_page_attributes(mod->module_core_rx,
66670 + mod->module_core_rx + mod->core_size_rx,
66673 - if ((mod->module_init) && (mod->init_text_size)) {
66674 - set_page_attributes(mod->module_init,
66675 - mod->module_init + mod->init_text_size,
66676 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
66677 + set_page_attributes(mod->module_init_rx,
66678 + mod->module_init_rx + mod->init_size_rx,
66682 @@ -1748,16 +1750,19 @@ static void free_module(struct module *mod)
66684 /* This may be NULL, but that's OK */
66685 unset_module_init_ro_nx(mod);
66686 - module_free(mod, mod->module_init);
66687 + module_free(mod, mod->module_init_rw);
66688 + module_free_exec(mod, mod->module_init_rx);
66690 percpu_modfree(mod);
66692 /* Free lock-classes: */
66693 - lockdep_free_key_range(mod->module_core, mod->core_size);
66694 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
66695 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
66697 /* Finally, free the core (containing the module structure) */
66698 unset_module_core_ro_nx(mod);
66699 - module_free(mod, mod->module_core);
66700 + module_free_exec(mod, mod->module_core_rx);
66701 + module_free(mod, mod->module_core_rw);
66704 update_protections(current->mm);
66705 @@ -1826,10 +1831,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66708 const struct kernel_symbol *ksym;
66709 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
66710 + int is_fs_load = 0;
66711 + int register_filesystem_found = 0;
66714 + p = strstr(mod->args, "grsec_modharden_fs");
66716 + char *endptr = p + strlen("grsec_modharden_fs");
66717 + /* copy \0 as well */
66718 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
66723 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
66724 const char *name = info->strtab + sym[i].st_name;
66726 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
66727 + /* it's a real shame this will never get ripped and copied
66730 + if (is_fs_load && !strcmp(name, "register_filesystem"))
66731 + register_filesystem_found = 1;
66734 switch (sym[i].st_shndx) {
66736 /* We compiled with -fno-common. These are not
66737 @@ -1850,7 +1876,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66738 ksym = resolve_symbol_wait(mod, info, name);
66739 /* Ok if resolved. */
66740 if (ksym && !IS_ERR(ksym)) {
66741 + pax_open_kernel();
66742 sym[i].st_value = ksym->value;
66743 + pax_close_kernel();
66747 @@ -1869,11 +1897,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
66748 secbase = (unsigned long)mod_percpu(mod);
66750 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
66751 + pax_open_kernel();
66752 sym[i].st_value += secbase;
66753 + pax_close_kernel();
66758 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
66759 + if (is_fs_load && !register_filesystem_found) {
66760 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
66768 @@ -1977,22 +2014,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
66769 || s->sh_entsize != ~0UL
66770 || strstarts(sname, ".init"))
66772 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
66773 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66774 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
66776 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
66777 DEBUGP("\t%s\n", name);
66780 - case 0: /* executable */
66781 - mod->core_size = debug_align(mod->core_size);
66782 - mod->core_text_size = mod->core_size;
66784 - case 1: /* RO: text and ro-data */
66785 - mod->core_size = debug_align(mod->core_size);
66786 - mod->core_ro_size = mod->core_size;
66788 - case 3: /* whole core */
66789 - mod->core_size = debug_align(mod->core_size);
66794 DEBUGP("Init section allocation order:\n");
66795 @@ -2006,23 +2033,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
66796 || s->sh_entsize != ~0UL
66797 || !strstarts(sname, ".init"))
66799 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
66800 - | INIT_OFFSET_MASK);
66801 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66802 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
66804 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
66805 + s->sh_entsize |= INIT_OFFSET_MASK;
66806 DEBUGP("\t%s\n", sname);
66809 - case 0: /* executable */
66810 - mod->init_size = debug_align(mod->init_size);
66811 - mod->init_text_size = mod->init_size;
66813 - case 1: /* RO: text and ro-data */
66814 - mod->init_size = debug_align(mod->init_size);
66815 - mod->init_ro_size = mod->init_size;
66817 - case 3: /* whole init */
66818 - mod->init_size = debug_align(mod->init_size);
66824 @@ -2187,7 +2204,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66826 /* Put symbol section at end of init part of module. */
66827 symsect->sh_flags |= SHF_ALLOC;
66828 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
66829 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
66830 info->index.sym) | INIT_OFFSET_MASK;
66831 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
66833 @@ -2204,19 +2221,19 @@ static void layout_symtab(struct module *mod, struct load_info *info)
66836 /* Append room for core symbols at end of core part. */
66837 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
66838 - mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
66839 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
66840 + mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
66842 /* Put string table section at end of init part of module. */
66843 strsect->sh_flags |= SHF_ALLOC;
66844 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
66845 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
66846 info->index.str) | INIT_OFFSET_MASK;
66847 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
66849 /* Append room for core symbols' strings at end of core part. */
66850 - info->stroffs = mod->core_size;
66851 + info->stroffs = mod->core_size_rx;
66852 __set_bit(0, info->strmap);
66853 - mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
66854 + mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
66857 static void add_kallsyms(struct module *mod, const struct load_info *info)
66858 @@ -2232,11 +2249,13 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66859 /* Make sure we get permanent strtab: don't use info->strtab. */
66860 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
66862 + pax_open_kernel();
66864 /* Set types up while we still have access to sections. */
66865 for (i = 0; i < mod->num_symtab; i++)
66866 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
66868 - mod->core_symtab = dst = mod->module_core + info->symoffs;
66869 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
66872 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
66873 @@ -2249,10 +2268,12 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
66875 mod->core_num_syms = ndst;
66877 - mod->core_strtab = s = mod->module_core + info->stroffs;
66878 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
66879 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
66880 if (test_bit(i, info->strmap))
66881 *++s = mod->strtab[i];
66883 + pax_close_kernel();
66886 static inline void layout_symtab(struct module *mod, struct load_info *info)
66887 @@ -2286,17 +2307,33 @@ void * __weak module_alloc(unsigned long size)
66888 return size == 0 ? NULL : vmalloc_exec(size);
66891 -static void *module_alloc_update_bounds(unsigned long size)
66892 +static void *module_alloc_update_bounds_rw(unsigned long size)
66894 void *ret = module_alloc(size);
66897 mutex_lock(&module_mutex);
66898 /* Update module bounds. */
66899 - if ((unsigned long)ret < module_addr_min)
66900 - module_addr_min = (unsigned long)ret;
66901 - if ((unsigned long)ret + size > module_addr_max)
66902 - module_addr_max = (unsigned long)ret + size;
66903 + if ((unsigned long)ret < module_addr_min_rw)
66904 + module_addr_min_rw = (unsigned long)ret;
66905 + if ((unsigned long)ret + size > module_addr_max_rw)
66906 + module_addr_max_rw = (unsigned long)ret + size;
66907 + mutex_unlock(&module_mutex);
66912 +static void *module_alloc_update_bounds_rx(unsigned long size)
66914 + void *ret = module_alloc_exec(size);
66917 + mutex_lock(&module_mutex);
66918 + /* Update module bounds. */
66919 + if ((unsigned long)ret < module_addr_min_rx)
66920 + module_addr_min_rx = (unsigned long)ret;
66921 + if ((unsigned long)ret + size > module_addr_max_rx)
66922 + module_addr_max_rx = (unsigned long)ret + size;
66923 mutex_unlock(&module_mutex);
66926 @@ -2474,8 +2511,14 @@ static struct module *setup_load_info(struct load_info *info)
66927 static int check_modinfo(struct module *mod, struct load_info *info)
66929 const char *modmagic = get_modinfo(info, "vermagic");
66930 + const char *license = get_modinfo(info, "license");
66933 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
66934 + if (!license || !license_is_gpl_compatible(license))
66938 /* This is allowed: modprobe --force will invalidate it. */
66940 err = try_to_force_load(mod, "bad vermagic");
66941 @@ -2495,7 +2538,7 @@ static int check_modinfo(struct module *mod, struct load_info *info)
66944 /* Set up license info based on the info section */
66945 - set_license(mod, get_modinfo(info, "license"));
66946 + set_license(mod, license);
66950 @@ -2589,7 +2632,7 @@ static int move_module(struct module *mod, struct load_info *info)
66953 /* Do the allocs. */
66954 - ptr = module_alloc_update_bounds(mod->core_size);
66955 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
66957 * The pointer to this block is stored in the module structure
66958 * which is inside the block. Just mark it as not being a
66959 @@ -2599,23 +2642,50 @@ static int move_module(struct module *mod, struct load_info *info)
66963 - memset(ptr, 0, mod->core_size);
66964 - mod->module_core = ptr;
66965 + memset(ptr, 0, mod->core_size_rw);
66966 + mod->module_core_rw = ptr;
66968 - ptr = module_alloc_update_bounds(mod->init_size);
66969 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
66971 * The pointer to this block is stored in the module structure
66972 * which is inside the block. This block doesn't need to be
66973 * scanned as it contains data and code that will be freed
66974 * after the module is initialized.
66976 - kmemleak_ignore(ptr);
66977 - if (!ptr && mod->init_size) {
66978 - module_free(mod, mod->module_core);
66979 + kmemleak_not_leak(ptr);
66980 + if (!ptr && mod->init_size_rw) {
66981 + module_free(mod, mod->module_core_rw);
66984 - memset(ptr, 0, mod->init_size);
66985 - mod->module_init = ptr;
66986 + memset(ptr, 0, mod->init_size_rw);
66987 + mod->module_init_rw = ptr;
66989 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
66990 + kmemleak_not_leak(ptr);
66992 + module_free(mod, mod->module_init_rw);
66993 + module_free(mod, mod->module_core_rw);
66997 + pax_open_kernel();
66998 + memset(ptr, 0, mod->core_size_rx);
66999 + pax_close_kernel();
67000 + mod->module_core_rx = ptr;
67002 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
67003 + kmemleak_not_leak(ptr);
67004 + if (!ptr && mod->init_size_rx) {
67005 + module_free_exec(mod, mod->module_core_rx);
67006 + module_free(mod, mod->module_init_rw);
67007 + module_free(mod, mod->module_core_rw);
67011 + pax_open_kernel();
67012 + memset(ptr, 0, mod->init_size_rx);
67013 + pax_close_kernel();
67014 + mod->module_init_rx = ptr;
67016 /* Transfer each section which specifies SHF_ALLOC */
67017 DEBUGP("final section addresses:\n");
67018 @@ -2626,16 +2696,45 @@ static int move_module(struct module *mod, struct load_info *info)
67019 if (!(shdr->sh_flags & SHF_ALLOC))
67022 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
67023 - dest = mod->module_init
67024 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67026 - dest = mod->module_core + shdr->sh_entsize;
67027 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
67028 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67029 + dest = mod->module_init_rw
67030 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67032 + dest = mod->module_init_rx
67033 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
67035 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
67036 + dest = mod->module_core_rw + shdr->sh_entsize;
67038 + dest = mod->module_core_rx + shdr->sh_entsize;
67041 + if (shdr->sh_type != SHT_NOBITS) {
67043 +#ifdef CONFIG_PAX_KERNEXEC
67044 +#ifdef CONFIG_X86_64
67045 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
67046 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
67048 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
67049 + pax_open_kernel();
67050 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67051 + pax_close_kernel();
67055 - if (shdr->sh_type != SHT_NOBITS)
67056 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
67058 /* Update sh_addr to point to copy in image. */
67059 - shdr->sh_addr = (unsigned long)dest;
67061 +#ifdef CONFIG_PAX_KERNEXEC
67062 + if (shdr->sh_flags & SHF_EXECINSTR)
67063 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
67067 + shdr->sh_addr = (unsigned long)dest;
67068 DEBUGP("\t0x%lx %s\n",
67069 shdr->sh_addr, info->secstrings + shdr->sh_name);
67071 @@ -2686,12 +2785,12 @@ static void flush_module_icache(const struct module *mod)
67072 * Do it before processing of module parameters, so the module
67073 * can provide parameter accessor functions of its own.
67075 - if (mod->module_init)
67076 - flush_icache_range((unsigned long)mod->module_init,
67077 - (unsigned long)mod->module_init
67078 - + mod->init_size);
67079 - flush_icache_range((unsigned long)mod->module_core,
67080 - (unsigned long)mod->module_core + mod->core_size);
67081 + if (mod->module_init_rx)
67082 + flush_icache_range((unsigned long)mod->module_init_rx,
67083 + (unsigned long)mod->module_init_rx
67084 + + mod->init_size_rx);
67085 + flush_icache_range((unsigned long)mod->module_core_rx,
67086 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
67090 @@ -2771,8 +2870,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
67092 kfree(info->strmap);
67093 percpu_modfree(mod);
67094 - module_free(mod, mod->module_init);
67095 - module_free(mod, mod->module_core);
67096 + module_free_exec(mod, mod->module_init_rx);
67097 + module_free_exec(mod, mod->module_core_rx);
67098 + module_free(mod, mod->module_init_rw);
67099 + module_free(mod, mod->module_core_rw);
67102 int __weak module_finalize(const Elf_Ehdr *hdr,
67103 @@ -2836,9 +2937,38 @@ static struct module *load_module(void __user *umod,
67107 + /* Now copy in args */
67108 + mod->args = strndup_user(uargs, ~0UL >> 1);
67109 + if (IS_ERR(mod->args)) {
67110 + err = PTR_ERR(mod->args);
67111 + goto free_unload;
67114 /* Set up MODINFO_ATTR fields */
67115 setup_modinfo(mod, &info);
67117 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67121 + if (strstr(mod->args, "grsec_modharden_netdev")) {
67122 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
67124 + goto free_modinfo;
67125 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
67126 + p += strlen("grsec_modharden_normal");
67127 + p2 = strstr(p, "_");
67130 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
67134 + goto free_modinfo;
67139 /* Fix up syms, so that st_value is a pointer to location. */
67140 err = simplify_symbols(mod, &info);
67142 @@ -2854,13 +2984,6 @@ static struct module *load_module(void __user *umod,
67144 flush_module_icache(mod);
67146 - /* Now copy in args */
67147 - mod->args = strndup_user(uargs, ~0UL >> 1);
67148 - if (IS_ERR(mod->args)) {
67149 - err = PTR_ERR(mod->args);
67150 - goto free_arch_cleanup;
67153 /* Mark state as coming so strong_try_module_get() ignores us. */
67154 mod->state = MODULE_STATE_COMING;
67156 @@ -2920,11 +3043,10 @@ static struct module *load_module(void __user *umod,
67158 mutex_unlock(&module_mutex);
67159 synchronize_sched();
67160 - kfree(mod->args);
67161 - free_arch_cleanup:
67162 module_arch_cleanup(mod);
67165 + kfree(mod->args);
67167 module_unload_free(mod);
67169 @@ -2965,16 +3087,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67170 MODULE_STATE_COMING, mod);
67172 /* Set RO and NX regions for core */
67173 - set_section_ro_nx(mod->module_core,
67174 - mod->core_text_size,
67175 - mod->core_ro_size,
67177 + set_section_ro_nx(mod->module_core_rx,
67178 + mod->core_size_rx,
67179 + mod->core_size_rx,
67180 + mod->core_size_rx);
67182 /* Set RO and NX regions for init */
67183 - set_section_ro_nx(mod->module_init,
67184 - mod->init_text_size,
67185 - mod->init_ro_size,
67187 + set_section_ro_nx(mod->module_init_rx,
67188 + mod->init_size_rx,
67189 + mod->init_size_rx,
67190 + mod->init_size_rx);
67193 /* Start the module */
67194 @@ -3020,11 +3142,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
67195 mod->strtab = mod->core_strtab;
67197 unset_module_init_ro_nx(mod);
67198 - module_free(mod, mod->module_init);
67199 - mod->module_init = NULL;
67200 - mod->init_size = 0;
67201 - mod->init_ro_size = 0;
67202 - mod->init_text_size = 0;
67203 + module_free(mod, mod->module_init_rw);
67204 + module_free_exec(mod, mod->module_init_rx);
67205 + mod->module_init_rw = NULL;
67206 + mod->module_init_rx = NULL;
67207 + mod->init_size_rw = 0;
67208 + mod->init_size_rx = 0;
67209 mutex_unlock(&module_mutex);
67212 @@ -3055,10 +3178,16 @@ static const char *get_ksymbol(struct module *mod,
67213 unsigned long nextval;
67215 /* At worse, next value is at end of module */
67216 - if (within_module_init(addr, mod))
67217 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
67218 + if (within_module_init_rx(addr, mod))
67219 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
67220 + else if (within_module_init_rw(addr, mod))
67221 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
67222 + else if (within_module_core_rx(addr, mod))
67223 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
67224 + else if (within_module_core_rw(addr, mod))
67225 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
67227 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
67230 /* Scan for closest preceding symbol, and next symbol. (ELF
67231 starts real symbols at 1). */
67232 @@ -3304,7 +3433,7 @@ static int m_show(struct seq_file *m, void *p)
67235 seq_printf(m, "%s %u",
67236 - mod->name, mod->init_size + mod->core_size);
67237 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
67238 print_unload_info(m, mod);
67240 /* Informative for users. */
67241 @@ -3313,7 +3442,7 @@ static int m_show(struct seq_file *m, void *p)
67242 mod->state == MODULE_STATE_COMING ? "Loading":
67244 /* Used by oprofile and other similar tools. */
67245 - seq_printf(m, " 0x%pK", mod->module_core);
67246 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
67250 @@ -3349,7 +3478,17 @@ static const struct file_operations proc_modules_operations = {
67252 static int __init proc_modules_init(void)
67254 +#ifndef CONFIG_GRKERNSEC_HIDESYM
67255 +#ifdef CONFIG_GRKERNSEC_PROC_USER
67256 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67257 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
67258 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
67260 proc_create("modules", 0, NULL, &proc_modules_operations);
67263 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
67267 module_init(proc_modules_init);
67268 @@ -3408,12 +3547,12 @@ struct module *__module_address(unsigned long addr)
67270 struct module *mod;
67272 - if (addr < module_addr_min || addr > module_addr_max)
67273 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
67274 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
67277 list_for_each_entry_rcu(mod, &modules, list)
67278 - if (within_module_core(addr, mod)
67279 - || within_module_init(addr, mod))
67280 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
67284 @@ -3447,11 +3586,20 @@ bool is_module_text_address(unsigned long addr)
67286 struct module *__module_text_address(unsigned long addr)
67288 - struct module *mod = __module_address(addr);
67289 + struct module *mod;
67291 +#ifdef CONFIG_X86_32
67292 + addr = ktla_ktva(addr);
67295 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
67298 + mod = __module_address(addr);
67301 /* Make sure it's within the text section. */
67302 - if (!within(addr, mod->module_init, mod->init_text_size)
67303 - && !within(addr, mod->module_core, mod->core_text_size))
67304 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
67308 diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
67309 index 73da83a..fe46e99 100644
67310 --- a/kernel/mutex-debug.c
67311 +++ b/kernel/mutex-debug.c
67312 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
67315 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67316 - struct thread_info *ti)
67317 + struct task_struct *task)
67319 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
67321 /* Mark the current thread as blocked on the lock: */
67322 - ti->task->blocked_on = waiter;
67323 + task->blocked_on = waiter;
67326 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67327 - struct thread_info *ti)
67328 + struct task_struct *task)
67330 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
67331 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
67332 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
67333 - ti->task->blocked_on = NULL;
67334 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
67335 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
67336 + task->blocked_on = NULL;
67338 list_del_init(&waiter->list);
67339 waiter->task = NULL;
67340 diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
67341 index 0799fd3..d06ae3b 100644
67342 --- a/kernel/mutex-debug.h
67343 +++ b/kernel/mutex-debug.h
67344 @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
67345 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
67346 extern void debug_mutex_add_waiter(struct mutex *lock,
67347 struct mutex_waiter *waiter,
67348 - struct thread_info *ti);
67349 + struct task_struct *task);
67350 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
67351 - struct thread_info *ti);
67352 + struct task_struct *task);
67353 extern void debug_mutex_unlock(struct mutex *lock);
67354 extern void debug_mutex_init(struct mutex *lock, const char *name,
67355 struct lock_class_key *key);
67356 diff --git a/kernel/mutex.c b/kernel/mutex.c
67357 index d607ed5..58d0a52 100644
67358 --- a/kernel/mutex.c
67359 +++ b/kernel/mutex.c
67360 @@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67361 spin_lock_mutex(&lock->wait_lock, flags);
67363 debug_mutex_lock_common(lock, &waiter);
67364 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
67365 + debug_mutex_add_waiter(lock, &waiter, task);
67367 /* add waiting tasks to the end of the waitqueue (FIFO): */
67368 list_add_tail(&waiter.list, &lock->wait_list);
67369 @@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67370 * TASK_UNINTERRUPTIBLE case.)
67372 if (unlikely(signal_pending_state(state, task))) {
67373 - mutex_remove_waiter(lock, &waiter,
67374 - task_thread_info(task));
67375 + mutex_remove_waiter(lock, &waiter, task);
67376 mutex_release(&lock->dep_map, 1, ip);
67377 spin_unlock_mutex(&lock->wait_lock, flags);
67379 @@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
67381 lock_acquired(&lock->dep_map, ip);
67382 /* got the lock - rejoice! */
67383 - mutex_remove_waiter(lock, &waiter, current_thread_info());
67384 + mutex_remove_waiter(lock, &waiter, task);
67385 mutex_set_owner(lock);
67387 /* set it to 0 if there are no waiters left: */
67388 diff --git a/kernel/padata.c b/kernel/padata.c
67389 index b91941d..0871d60 100644
67390 --- a/kernel/padata.c
67391 +++ b/kernel/padata.c
67392 @@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_instance *pinst,
67394 padata->cb_cpu = cb_cpu;
67396 - if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
67397 - atomic_set(&pd->seq_nr, -1);
67398 + if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
67399 + atomic_set_unchecked(&pd->seq_nr, -1);
67401 - padata->seq_nr = atomic_inc_return(&pd->seq_nr);
67402 + padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
67404 target_cpu = padata_cpu_hash(padata);
67405 queue = per_cpu_ptr(pd->pqueue, target_cpu);
67406 @@ -444,7 +444,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
67407 padata_init_pqueues(pd);
67408 padata_init_squeues(pd);
67409 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
67410 - atomic_set(&pd->seq_nr, -1);
67411 + atomic_set_unchecked(&pd->seq_nr, -1);
67412 atomic_set(&pd->reorder_objects, 0);
67413 atomic_set(&pd->refcnt, 0);
67415 diff --git a/kernel/panic.c b/kernel/panic.c
67416 index d7bb697..9ef9f19 100644
67417 --- a/kernel/panic.c
67418 +++ b/kernel/panic.c
67419 @@ -371,7 +371,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
67422 printk(KERN_WARNING "------------[ cut here ]------------\n");
67423 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
67424 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
67425 board = dmi_get_system_info(DMI_PRODUCT_NAME);
67427 printk(KERN_WARNING "Hardware name: %s\n", board);
67428 @@ -426,7 +426,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
67430 void __stack_chk_fail(void)
67432 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
67434 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
67435 __builtin_return_address(0));
67437 EXPORT_SYMBOL(__stack_chk_fail);
67438 diff --git a/kernel/pid.c b/kernel/pid.c
67439 index e432057..a2b2ac5 100644
67443 #include <linux/rculist.h>
67444 #include <linux/bootmem.h>
67445 #include <linux/hash.h>
67446 +#include <linux/security.h>
67447 #include <linux/pid_namespace.h>
67448 #include <linux/init_task.h>
67449 #include <linux/syscalls.h>
67450 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
67452 int pid_max = PID_MAX_DEFAULT;
67454 -#define RESERVED_PIDS 300
67455 +#define RESERVED_PIDS 500
67457 int pid_max_min = RESERVED_PIDS + 1;
67458 int pid_max_max = PID_MAX_LIMIT;
67459 @@ -418,8 +419,15 @@ EXPORT_SYMBOL(pid_task);
67461 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
67463 + struct task_struct *task;
67465 rcu_lockdep_assert(rcu_read_lock_held());
67466 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67467 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67469 + if (gr_pid_is_chrooted(task))
67475 struct task_struct *find_task_by_vpid(pid_t vnr)
67476 @@ -427,6 +435,12 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
67477 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
67480 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
67482 + rcu_lockdep_assert(rcu_read_lock_held());
67483 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
67486 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
67489 diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
67490 index 640ded8..3dafb85 100644
67491 --- a/kernel/posix-cpu-timers.c
67492 +++ b/kernel/posix-cpu-timers.c
67494 #include <linux/posix-timers.h>
67495 #include <linux/errno.h>
67496 #include <linux/math64.h>
67497 +#include <linux/security.h>
67498 #include <asm/uaccess.h>
67499 #include <linux/kernel_stat.h>
67500 #include <trace/events/timer.h>
67501 @@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
67503 static __init int init_posix_cpu_timers(void)
67505 - struct k_clock process = {
67506 + static struct k_clock process = {
67507 .clock_getres = process_cpu_clock_getres,
67508 .clock_get = process_cpu_clock_get,
67509 .timer_create = process_cpu_timer_create,
67510 .nsleep = process_cpu_nsleep,
67511 .nsleep_restart = process_cpu_nsleep_restart,
67513 - struct k_clock thread = {
67514 + static struct k_clock thread = {
67515 .clock_getres = thread_cpu_clock_getres,
67516 .clock_get = thread_cpu_clock_get,
67517 .timer_create = thread_cpu_timer_create,
67518 diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
67519 index 4556182..9335419 100644
67520 --- a/kernel/posix-timers.c
67521 +++ b/kernel/posix-timers.c
67523 #include <linux/idr.h>
67524 #include <linux/posix-clock.h>
67525 #include <linux/posix-timers.h>
67526 +#include <linux/grsecurity.h>
67527 #include <linux/syscalls.h>
67528 #include <linux/wait.h>
67529 #include <linux/workqueue.h>
67530 @@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
67531 * which we beg off on and pass to do_sys_settimeofday().
67534 -static struct k_clock posix_clocks[MAX_CLOCKS];
67535 +static struct k_clock *posix_clocks[MAX_CLOCKS];
67538 * These ones are defined below.
67539 @@ -227,7 +228,7 @@ static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
67541 static __init int init_posix_timers(void)
67543 - struct k_clock clock_realtime = {
67544 + static struct k_clock clock_realtime = {
67545 .clock_getres = hrtimer_get_res,
67546 .clock_get = posix_clock_realtime_get,
67547 .clock_set = posix_clock_realtime_set,
67548 @@ -239,7 +240,7 @@ static __init int init_posix_timers(void)
67549 .timer_get = common_timer_get,
67550 .timer_del = common_timer_del,
67552 - struct k_clock clock_monotonic = {
67553 + static struct k_clock clock_monotonic = {
67554 .clock_getres = hrtimer_get_res,
67555 .clock_get = posix_ktime_get_ts,
67556 .nsleep = common_nsleep,
67557 @@ -249,19 +250,19 @@ static __init int init_posix_timers(void)
67558 .timer_get = common_timer_get,
67559 .timer_del = common_timer_del,
67561 - struct k_clock clock_monotonic_raw = {
67562 + static struct k_clock clock_monotonic_raw = {
67563 .clock_getres = hrtimer_get_res,
67564 .clock_get = posix_get_monotonic_raw,
67566 - struct k_clock clock_realtime_coarse = {
67567 + static struct k_clock clock_realtime_coarse = {
67568 .clock_getres = posix_get_coarse_res,
67569 .clock_get = posix_get_realtime_coarse,
67571 - struct k_clock clock_monotonic_coarse = {
67572 + static struct k_clock clock_monotonic_coarse = {
67573 .clock_getres = posix_get_coarse_res,
67574 .clock_get = posix_get_monotonic_coarse,
67576 - struct k_clock clock_boottime = {
67577 + static struct k_clock clock_boottime = {
67578 .clock_getres = hrtimer_get_res,
67579 .clock_get = posix_get_boottime,
67580 .nsleep = common_nsleep,
67581 @@ -272,6 +273,8 @@ static __init int init_posix_timers(void)
67582 .timer_del = common_timer_del,
67585 + pax_track_stack();
67587 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
67588 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
67589 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
67590 @@ -473,7 +476,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
67594 - posix_clocks[clock_id] = *new_clock;
67595 + posix_clocks[clock_id] = new_clock;
67597 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
67599 @@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
67600 return (id & CLOCKFD_MASK) == CLOCKFD ?
67601 &clock_posix_dynamic : &clock_posix_cpu;
67603 - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
67604 + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
67606 - return &posix_clocks[id];
67607 + return posix_clocks[id];
67610 static int common_timer_create(struct k_itimer *new_timer)
67611 @@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
67612 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
67615 + /* only the CLOCK_REALTIME clock can be set, all other clocks
67616 + have their clock_set fptr set to a nosettime dummy function
67617 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
67618 + call common_clock_set, which calls do_sys_settimeofday, which
67622 return kc->clock_set(which_clock, &new_tp);
67625 diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
67626 index d523593..68197a4 100644
67627 --- a/kernel/power/poweroff.c
67628 +++ b/kernel/power/poweroff.c
67629 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
67630 .enable_mask = SYSRQ_ENABLE_BOOT,
67633 -static int pm_sysrq_init(void)
67634 +static int __init pm_sysrq_init(void)
67636 register_sysrq_key('o', &sysrq_poweroff_op);
67638 diff --git a/kernel/power/process.c b/kernel/power/process.c
67639 index 0cf3a27..5481be4 100644
67640 --- a/kernel/power/process.c
67641 +++ b/kernel/power/process.c
67642 @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_only)
67643 u64 elapsed_csecs64;
67644 unsigned int elapsed_csecs;
67645 bool wakeup = false;
67646 + bool timedout = false;
67648 do_gettimeofday(&start);
67650 @@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_only)
67654 + if (time_after(jiffies, end_time))
67656 read_lock(&tasklist_lock);
67657 do_each_thread(g, p) {
67658 if (frozen(p) || !freezable(p))
67659 @@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_only)
67660 * try_to_stop() after schedule() in ptrace/signal
67661 * stop sees TIF_FREEZE.
67663 - if (!task_is_stopped_or_traced(p) &&
67664 - !freezer_should_skip(p))
67665 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
67668 + printk(KERN_ERR "Task refusing to freeze:\n");
67669 + sched_show_task(p);
67672 } while_each_thread(g, p);
67673 read_unlock(&tasklist_lock);
67675 @@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_only)
67679 - if (!todo || time_after(jiffies, end_time))
67680 + if (!todo || timedout)
67683 if (pm_wakeup_pending()) {
67684 diff --git a/kernel/printk.c b/kernel/printk.c
67685 index 28a40d8..2411bec 100644
67686 --- a/kernel/printk.c
67687 +++ b/kernel/printk.c
67688 @@ -313,6 +313,11 @@ static int check_syslog_permissions(int type, bool from_file)
67689 if (from_file && type != SYSLOG_ACTION_OPEN)
67692 +#ifdef CONFIG_GRKERNSEC_DMESG
67693 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
67697 if (syslog_action_restricted(type)) {
67698 if (capable(CAP_SYSLOG))
67700 diff --git a/kernel/profile.c b/kernel/profile.c
67701 index 961b389..c451353 100644
67702 --- a/kernel/profile.c
67703 +++ b/kernel/profile.c
67704 @@ -39,7 +39,7 @@ struct profile_hit {
67705 /* Oprofile timer tick hook */
67706 static int (*timer_hook)(struct pt_regs *) __read_mostly;
67708 -static atomic_t *prof_buffer;
67709 +static atomic_unchecked_t *prof_buffer;
67710 static unsigned long prof_len, prof_shift;
67712 int prof_on __read_mostly;
67713 @@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
67717 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67718 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67719 hits[i].hits = hits[i].pc = 0;
67722 @@ -342,9 +342,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67723 * Add the current hit(s) and flush the write-queue out
67724 * to the global buffer:
67726 - atomic_add(nr_hits, &prof_buffer[pc]);
67727 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
67728 for (i = 0; i < NR_PROFILE_HIT; ++i) {
67729 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67730 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67731 hits[i].pc = hits[i].hits = 0;
67734 @@ -419,7 +419,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
67737 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
67738 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67739 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67741 #endif /* !CONFIG_SMP */
67743 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
67745 buf++; p++; count--; read++;
67747 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
67748 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
67749 if (copy_to_user(buf, (void *)pnt, count))
67752 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
67755 profile_discard_flip_buffers();
67756 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
67757 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
67761 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
67762 index a70d2a5..cbd4b4f 100644
67763 --- a/kernel/ptrace.c
67764 +++ b/kernel/ptrace.c
67765 @@ -161,7 +161,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
67769 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67770 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
67771 + unsigned int log)
67773 const struct cred *cred = current_cred(), *tcred;
67775 @@ -187,7 +188,8 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67776 cred->gid == tcred->sgid &&
67777 cred->gid == tcred->gid))
67779 - if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
67780 + if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
67781 + (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
67785 @@ -196,7 +198,9 @@ ok:
67788 dumpable = get_dumpable(task->mm);
67789 - if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
67791 + ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
67792 + (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
67795 return security_ptrace_access_check(task, mode);
67796 @@ -206,7 +210,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
67800 - err = __ptrace_may_access(task, mode);
67801 + err = __ptrace_may_access(task, mode, 0);
67802 + task_unlock(task);
67806 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
67810 + err = __ptrace_may_access(task, mode, 1);
67814 @@ -251,7 +264,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67818 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
67819 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
67823 @@ -266,7 +279,7 @@ static int ptrace_attach(struct task_struct *task, long request,
67824 task->ptrace = PT_PTRACED;
67826 task->ptrace |= PT_SEIZED;
67827 - if (task_ns_capable(task, CAP_SYS_PTRACE))
67828 + if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
67829 task->ptrace |= PT_PTRACE_CAP;
67831 __ptrace_link(task, current);
67832 @@ -461,6 +474,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67836 + pax_track_stack();
67840 int this_len, retval;
67841 @@ -472,7 +487,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
67845 - if (copy_to_user(dst, buf, retval))
67846 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
67850 @@ -486,6 +501,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
67854 + pax_track_stack();
67858 int this_len, retval;
67859 @@ -669,10 +686,12 @@ int ptrace_request(struct task_struct *child, long request,
67860 bool seized = child->ptrace & PT_SEIZED;
67862 siginfo_t siginfo, *si;
67863 - void __user *datavp = (void __user *) data;
67864 + void __user *datavp = (__force void __user *) data;
67865 unsigned long __user *datalp = datavp;
67866 unsigned long flags;
67868 + pax_track_stack();
67871 case PTRACE_PEEKTEXT:
67872 case PTRACE_PEEKDATA:
67873 @@ -871,14 +890,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
67877 + if (gr_handle_ptrace(child, request)) {
67879 + goto out_put_task_struct;
67882 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67883 ret = ptrace_attach(child, request, data);
67885 * Some architectures need to do book-keeping after
67890 arch_ptrace_attach(child);
67891 + gr_audit_ptrace(child);
67893 goto out_put_task_struct;
67896 @@ -904,7 +930,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
67897 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
67898 if (copied != sizeof(tmp))
67900 - return put_user(tmp, (unsigned long __user *)data);
67901 + return put_user(tmp, (__force unsigned long __user *)data);
67904 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
67905 @@ -927,6 +953,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
67909 + pax_track_stack();
67912 case PTRACE_PEEKTEXT:
67913 case PTRACE_PEEKDATA:
67914 @@ -1014,14 +1042,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
67918 + if (gr_handle_ptrace(child, request)) {
67920 + goto out_put_task_struct;
67923 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
67924 ret = ptrace_attach(child, request, data);
67926 * Some architectures need to do book-keeping after
67931 arch_ptrace_attach(child);
67932 + gr_audit_ptrace(child);
67934 goto out_put_task_struct;
67937 diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
67938 index 98f51b1..30b950c 100644
67939 --- a/kernel/rcutorture.c
67940 +++ b/kernel/rcutorture.c
67941 @@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
67943 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
67945 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67946 -static atomic_t n_rcu_torture_alloc;
67947 -static atomic_t n_rcu_torture_alloc_fail;
67948 -static atomic_t n_rcu_torture_free;
67949 -static atomic_t n_rcu_torture_mberror;
67950 -static atomic_t n_rcu_torture_error;
67951 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67952 +static atomic_unchecked_t n_rcu_torture_alloc;
67953 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
67954 +static atomic_unchecked_t n_rcu_torture_free;
67955 +static atomic_unchecked_t n_rcu_torture_mberror;
67956 +static atomic_unchecked_t n_rcu_torture_error;
67957 static long n_rcu_torture_boost_ktrerror;
67958 static long n_rcu_torture_boost_rterror;
67959 static long n_rcu_torture_boost_failure;
67960 @@ -223,11 +223,11 @@ rcu_torture_alloc(void)
67962 spin_lock_bh(&rcu_torture_lock);
67963 if (list_empty(&rcu_torture_freelist)) {
67964 - atomic_inc(&n_rcu_torture_alloc_fail);
67965 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
67966 spin_unlock_bh(&rcu_torture_lock);
67969 - atomic_inc(&n_rcu_torture_alloc);
67970 + atomic_inc_unchecked(&n_rcu_torture_alloc);
67971 p = rcu_torture_freelist.next;
67973 spin_unlock_bh(&rcu_torture_lock);
67974 @@ -240,7 +240,7 @@ rcu_torture_alloc(void)
67976 rcu_torture_free(struct rcu_torture *p)
67978 - atomic_inc(&n_rcu_torture_free);
67979 + atomic_inc_unchecked(&n_rcu_torture_free);
67980 spin_lock_bh(&rcu_torture_lock);
67981 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
67982 spin_unlock_bh(&rcu_torture_lock);
67983 @@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
67984 i = rp->rtort_pipe_count;
67985 if (i > RCU_TORTURE_PIPE_LEN)
67986 i = RCU_TORTURE_PIPE_LEN;
67987 - atomic_inc(&rcu_torture_wcount[i]);
67988 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
67989 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67990 rp->rtort_mbtest = 0;
67991 rcu_torture_free(rp);
67992 @@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
67993 i = rp->rtort_pipe_count;
67994 if (i > RCU_TORTURE_PIPE_LEN)
67995 i = RCU_TORTURE_PIPE_LEN;
67996 - atomic_inc(&rcu_torture_wcount[i]);
67997 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
67998 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67999 rp->rtort_mbtest = 0;
68000 list_del(&rp->rtort_free);
68001 @@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
68002 i = old_rp->rtort_pipe_count;
68003 if (i > RCU_TORTURE_PIPE_LEN)
68004 i = RCU_TORTURE_PIPE_LEN;
68005 - atomic_inc(&rcu_torture_wcount[i]);
68006 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
68007 old_rp->rtort_pipe_count++;
68008 cur_ops->deferred_free(old_rp);
68010 @@ -950,7 +950,7 @@ static void rcu_torture_timer(unsigned long unused)
68013 if (p->rtort_mbtest == 0)
68014 - atomic_inc(&n_rcu_torture_mberror);
68015 + atomic_inc_unchecked(&n_rcu_torture_mberror);
68016 spin_lock(&rand_lock);
68017 cur_ops->read_delay(&rand);
68018 n_rcu_torture_timers++;
68019 @@ -1011,7 +1011,7 @@ rcu_torture_reader(void *arg)
68022 if (p->rtort_mbtest == 0)
68023 - atomic_inc(&n_rcu_torture_mberror);
68024 + atomic_inc_unchecked(&n_rcu_torture_mberror);
68025 cur_ops->read_delay(&rand);
68027 pipe_count = p->rtort_pipe_count;
68028 @@ -1070,16 +1070,16 @@ rcu_torture_printk(char *page)
68029 rcu_torture_current,
68030 rcu_torture_current_version,
68031 list_empty(&rcu_torture_freelist),
68032 - atomic_read(&n_rcu_torture_alloc),
68033 - atomic_read(&n_rcu_torture_alloc_fail),
68034 - atomic_read(&n_rcu_torture_free),
68035 - atomic_read(&n_rcu_torture_mberror),
68036 + atomic_read_unchecked(&n_rcu_torture_alloc),
68037 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
68038 + atomic_read_unchecked(&n_rcu_torture_free),
68039 + atomic_read_unchecked(&n_rcu_torture_mberror),
68040 n_rcu_torture_boost_ktrerror,
68041 n_rcu_torture_boost_rterror,
68042 n_rcu_torture_boost_failure,
68043 n_rcu_torture_boosts,
68044 n_rcu_torture_timers);
68045 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
68046 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
68047 n_rcu_torture_boost_ktrerror != 0 ||
68048 n_rcu_torture_boost_rterror != 0 ||
68049 n_rcu_torture_boost_failure != 0)
68050 @@ -1087,7 +1087,7 @@ rcu_torture_printk(char *page)
68051 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
68053 cnt += sprintf(&page[cnt], "!!! ");
68054 - atomic_inc(&n_rcu_torture_error);
68055 + atomic_inc_unchecked(&n_rcu_torture_error);
68058 cnt += sprintf(&page[cnt], "Reader Pipe: ");
68059 @@ -1101,7 +1101,7 @@ rcu_torture_printk(char *page)
68060 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
68061 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68062 cnt += sprintf(&page[cnt], " %d",
68063 - atomic_read(&rcu_torture_wcount[i]));
68064 + atomic_read_unchecked(&rcu_torture_wcount[i]));
68066 cnt += sprintf(&page[cnt], "\n");
68067 if (cur_ops->stats)
68068 @@ -1410,7 +1410,7 @@ rcu_torture_cleanup(void)
68070 if (cur_ops->cleanup)
68071 cur_ops->cleanup();
68072 - if (atomic_read(&n_rcu_torture_error))
68073 + if (atomic_read_unchecked(&n_rcu_torture_error))
68074 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
68076 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
68077 @@ -1474,17 +1474,17 @@ rcu_torture_init(void)
68079 rcu_torture_current = NULL;
68080 rcu_torture_current_version = 0;
68081 - atomic_set(&n_rcu_torture_alloc, 0);
68082 - atomic_set(&n_rcu_torture_alloc_fail, 0);
68083 - atomic_set(&n_rcu_torture_free, 0);
68084 - atomic_set(&n_rcu_torture_mberror, 0);
68085 - atomic_set(&n_rcu_torture_error, 0);
68086 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
68087 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
68088 + atomic_set_unchecked(&n_rcu_torture_free, 0);
68089 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
68090 + atomic_set_unchecked(&n_rcu_torture_error, 0);
68091 n_rcu_torture_boost_ktrerror = 0;
68092 n_rcu_torture_boost_rterror = 0;
68093 n_rcu_torture_boost_failure = 0;
68094 n_rcu_torture_boosts = 0;
68095 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
68096 - atomic_set(&rcu_torture_wcount[i], 0);
68097 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
68098 for_each_possible_cpu(cpu) {
68099 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
68100 per_cpu(rcu_torture_count, cpu)[i] = 0;
68101 diff --git a/kernel/rcutree.c b/kernel/rcutree.c
68102 index ba06207..85d8ba8 100644
68103 --- a/kernel/rcutree.c
68104 +++ b/kernel/rcutree.c
68105 @@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
68107 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68108 smp_mb__before_atomic_inc(); /* See above. */
68109 - atomic_inc(&rdtp->dynticks);
68110 + atomic_inc_unchecked(&rdtp->dynticks);
68111 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
68112 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68113 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68114 local_irq_restore(flags);
68116 /* If the interrupt queued a callback, get out of dyntick mode. */
68117 @@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
68120 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
68121 - atomic_inc(&rdtp->dynticks);
68122 + atomic_inc_unchecked(&rdtp->dynticks);
68123 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68124 smp_mb__after_atomic_inc(); /* See above. */
68125 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68126 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68127 local_irq_restore(flags);
68130 @@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
68131 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
68133 if (rdtp->dynticks_nmi_nesting == 0 &&
68134 - (atomic_read(&rdtp->dynticks) & 0x1))
68135 + (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
68137 rdtp->dynticks_nmi_nesting++;
68138 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
68139 - atomic_inc(&rdtp->dynticks);
68140 + atomic_inc_unchecked(&rdtp->dynticks);
68141 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
68142 smp_mb__after_atomic_inc(); /* See above. */
68143 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
68144 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
68148 @@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
68150 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
68151 smp_mb__before_atomic_inc(); /* See above. */
68152 - atomic_inc(&rdtp->dynticks);
68153 + atomic_inc_unchecked(&rdtp->dynticks);
68154 smp_mb__after_atomic_inc(); /* Force delay to next write. */
68155 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
68156 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
68160 @@ -469,7 +469,7 @@ void rcu_irq_exit(void)
68162 static int dyntick_save_progress_counter(struct rcu_data *rdp)
68164 - rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
68165 + rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68169 @@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
68170 unsigned long curr;
68171 unsigned long snap;
68173 - curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
68174 + curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
68175 snap = (unsigned long)rdp->dynticks_snap;
68178 @@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
68180 * Do softirq processing for the current CPU.
68182 -static void rcu_process_callbacks(struct softirq_action *unused)
68183 +static void rcu_process_callbacks(void)
68185 __rcu_process_callbacks(&rcu_sched_state,
68186 &__get_cpu_var(rcu_sched_data));
68187 diff --git a/kernel/rcutree.h b/kernel/rcutree.h
68188 index 01b2ccd..4f5d80a 100644
68189 --- a/kernel/rcutree.h
68190 +++ b/kernel/rcutree.h
68192 struct rcu_dynticks {
68193 int dynticks_nesting; /* Track irq/process nesting level. */
68194 int dynticks_nmi_nesting; /* Track NMI nesting level. */
68195 - atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
68196 + atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
68199 /* RCU's kthread states for tracing. */
68200 diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
68201 index 8aafbb8..2fca109 100644
68202 --- a/kernel/rcutree_plugin.h
68203 +++ b/kernel/rcutree_plugin.h
68204 @@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
68206 /* Clean up and exit. */
68207 smp_mb(); /* ensure expedited GP seen before counter increment. */
68208 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
68209 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
68211 mutex_unlock(&sync_rcu_preempt_exp_mutex);
68213 @@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expedited);
68215 #else /* #ifndef CONFIG_SMP */
68217 -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
68218 -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
68219 +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
68220 +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
68222 static int synchronize_sched_expedited_cpu_stop(void *data)
68224 @@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
68225 int firstsnap, s, snap, trycount = 0;
68227 /* Note that atomic_inc_return() implies full memory barrier. */
68228 - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
68229 + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
68233 @@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
68236 /* Check to see if someone else did our work for us. */
68237 - s = atomic_read(&sync_sched_expedited_done);
68238 + s = atomic_read_unchecked(&sync_sched_expedited_done);
68239 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
68240 smp_mb(); /* ensure test happens before caller kfree */
68242 @@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
68243 * grace period works for us.
68246 - snap = atomic_read(&sync_sched_expedited_started) - 1;
68247 + snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
68248 smp_mb(); /* ensure read is before try_stop_cpus(). */
68251 @@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
68252 * than we did beat us to the punch.
68255 - s = atomic_read(&sync_sched_expedited_done);
68256 + s = atomic_read_unchecked(&sync_sched_expedited_done);
68257 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
68258 smp_mb(); /* ensure test happens before caller kfree */
68261 - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
68262 + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
68266 @@ -1953,7 +1953,7 @@ int rcu_needs_cpu(int cpu)
68267 for_each_online_cpu(thatcpu) {
68268 if (thatcpu == cpu)
68270 - snap = atomic_add_return(0, &per_cpu(rcu_dynticks,
68271 + snap = atomic_add_return_unchecked(0, &per_cpu(rcu_dynticks,
68272 thatcpu).dynticks);
68273 smp_mb(); /* Order sampling of snap with end of grace period. */
68274 if ((snap & 0x1) != 0) {
68275 diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
68276 index 3b0c098..43ba2d8 100644
68277 --- a/kernel/rcutree_trace.c
68278 +++ b/kernel/rcutree_trace.c
68279 @@ -74,7 +74,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
68281 #ifdef CONFIG_NO_HZ
68282 seq_printf(m, " dt=%d/%d/%d df=%lu",
68283 - atomic_read(&rdp->dynticks->dynticks),
68284 + atomic_read_unchecked(&rdp->dynticks->dynticks),
68285 rdp->dynticks->dynticks_nesting,
68286 rdp->dynticks->dynticks_nmi_nesting,
68287 rdp->dynticks_fqs);
68288 @@ -148,7 +148,7 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
68290 #ifdef CONFIG_NO_HZ
68291 seq_printf(m, ",%d,%d,%d,%lu",
68292 - atomic_read(&rdp->dynticks->dynticks),
68293 + atomic_read_unchecked(&rdp->dynticks->dynticks),
68294 rdp->dynticks->dynticks_nesting,
68295 rdp->dynticks->dynticks_nmi_nesting,
68296 rdp->dynticks_fqs);
68297 diff --git a/kernel/relay.c b/kernel/relay.c
68298 index 859ea5a..096e2fe 100644
68299 --- a/kernel/relay.c
68300 +++ b/kernel/relay.c
68301 @@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
68305 + pax_track_stack();
68307 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
68309 if (splice_grow_spd(pipe, &spd))
68310 diff --git a/kernel/resource.c b/kernel/resource.c
68311 index c8dc249..f1e2359 100644
68312 --- a/kernel/resource.c
68313 +++ b/kernel/resource.c
68314 @@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = {
68316 static int __init ioresources_init(void)
68318 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
68319 +#ifdef CONFIG_GRKERNSEC_PROC_USER
68320 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
68321 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
68322 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68323 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
68324 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
68327 proc_create("ioports", 0, NULL, &proc_ioports_operations);
68328 proc_create("iomem", 0, NULL, &proc_iomem_operations);
68332 __initcall(ioresources_init);
68333 diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
68334 index 5c9ccd3..a35e22b 100644
68335 --- a/kernel/rtmutex-tester.c
68336 +++ b/kernel/rtmutex-tester.c
68338 #define MAX_RT_TEST_MUTEXES 8
68340 static spinlock_t rttest_lock;
68341 -static atomic_t rttest_event;
68342 +static atomic_unchecked_t rttest_event;
68344 struct test_thread_data {
68346 @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68348 case RTTEST_LOCKCONT:
68349 td->mutexes[td->opdata] = 1;
68350 - td->event = atomic_add_return(1, &rttest_event);
68351 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68355 @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68358 case RTTEST_RESETEVENT:
68359 - atomic_set(&rttest_event, 0);
68360 + atomic_set_unchecked(&rttest_event, 0);
68364 @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68367 td->mutexes[id] = 1;
68368 - td->event = atomic_add_return(1, &rttest_event);
68369 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68370 rt_mutex_lock(&mutexes[id]);
68371 - td->event = atomic_add_return(1, &rttest_event);
68372 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68373 td->mutexes[id] = 4;
68376 @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68379 td->mutexes[id] = 1;
68380 - td->event = atomic_add_return(1, &rttest_event);
68381 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68382 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
68383 - td->event = atomic_add_return(1, &rttest_event);
68384 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68385 td->mutexes[id] = ret ? 0 : 4;
68386 return ret ? -EINTR : 0;
68388 @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
68389 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
68392 - td->event = atomic_add_return(1, &rttest_event);
68393 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68394 rt_mutex_unlock(&mutexes[id]);
68395 - td->event = atomic_add_return(1, &rttest_event);
68396 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68397 td->mutexes[id] = 0;
68400 @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68403 td->mutexes[dat] = 2;
68404 - td->event = atomic_add_return(1, &rttest_event);
68405 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68409 @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68412 td->mutexes[dat] = 3;
68413 - td->event = atomic_add_return(1, &rttest_event);
68414 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68417 case RTTEST_LOCKNOWAIT:
68418 @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
68421 td->mutexes[dat] = 1;
68422 - td->event = atomic_add_return(1, &rttest_event);
68423 + td->event = atomic_add_return_unchecked(1, &rttest_event);
68427 diff --git a/kernel/sched.c b/kernel/sched.c
68428 index b50b0f0..1c6c591 100644
68429 --- a/kernel/sched.c
68430 +++ b/kernel/sched.c
68431 @@ -4264,6 +4264,8 @@ static void __sched __schedule(void)
68435 + pax_track_stack();
68439 cpu = smp_processor_id();
68440 @@ -4950,6 +4952,8 @@ int can_nice(const struct task_struct *p, const int nice)
68441 /* convert nice value [19,-20] to rlimit style value [1,40] */
68442 int nice_rlim = 20 - nice;
68444 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
68446 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
68447 capable(CAP_SYS_NICE));
68449 @@ -4983,7 +4987,8 @@ SYSCALL_DEFINE1(nice, int, increment)
68453 - if (increment < 0 && !can_nice(current, nice))
68454 + if (increment < 0 && (!can_nice(current, nice) ||
68455 + gr_handle_chroot_nice()))
68458 retval = security_task_setnice(current, nice);
68459 @@ -5127,6 +5132,7 @@ recheck:
68460 unsigned long rlim_rtprio =
68461 task_rlimit(p, RLIMIT_RTPRIO);
68463 + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
68464 /* can't set/change the rt policy */
68465 if (policy != p->policy && !rlim_rtprio)
68467 diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
68468 index 429242f..d7cca82 100644
68469 --- a/kernel/sched_autogroup.c
68470 +++ b/kernel/sched_autogroup.c
68473 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
68474 static struct autogroup autogroup_default;
68475 -static atomic_t autogroup_seq_nr;
68476 +static atomic_unchecked_t autogroup_seq_nr;
68478 static void __init autogroup_init(struct task_struct *init_task)
68480 @@ -78,7 +78,7 @@ static inline struct autogroup *autogroup_create(void)
68482 kref_init(&ag->kref);
68483 init_rwsem(&ag->lock);
68484 - ag->id = atomic_inc_return(&autogroup_seq_nr);
68485 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
68487 #ifdef CONFIG_RT_GROUP_SCHED
68489 diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
68490 index bc8ee99..b6f6492 100644
68491 --- a/kernel/sched_fair.c
68492 +++ b/kernel/sched_fair.c
68493 @@ -4062,7 +4062,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
68494 * run_rebalance_domains is triggered when needed from the scheduler tick.
68495 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
68497 -static void run_rebalance_domains(struct softirq_action *h)
68498 +static void run_rebalance_domains(void)
68500 int this_cpu = smp_processor_id();
68501 struct rq *this_rq = cpu_rq(this_cpu);
68502 diff --git a/kernel/signal.c b/kernel/signal.c
68503 index 291c970..304bd03 100644
68504 --- a/kernel/signal.c
68505 +++ b/kernel/signal.c
68506 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
68508 int print_fatal_signals __read_mostly;
68510 -static void __user *sig_handler(struct task_struct *t, int sig)
68511 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
68513 return t->sighand->action[sig - 1].sa.sa_handler;
68516 -static int sig_handler_ignored(void __user *handler, int sig)
68517 +static int sig_handler_ignored(__sighandler_t handler, int sig)
68519 /* Is it explicitly or implicitly ignored? */
68520 return handler == SIG_IGN ||
68521 @@ -60,7 +60,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
68522 static int sig_task_ignored(struct task_struct *t, int sig,
68523 int from_ancestor_ns)
68525 - void __user *handler;
68526 + __sighandler_t handler;
68528 handler = sig_handler(t, sig);
68530 @@ -364,6 +364,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
68531 atomic_inc(&user->sigpending);
68534 + if (!override_rlimit)
68535 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
68537 if (override_rlimit ||
68538 atomic_read(&user->sigpending) <=
68539 task_rlimit(t, RLIMIT_SIGPENDING)) {
68540 @@ -488,7 +491,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
68542 int unhandled_signal(struct task_struct *tsk, int sig)
68544 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
68545 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
68546 if (is_global_init(tsk))
68548 if (handler != SIG_IGN && handler != SIG_DFL)
68549 @@ -815,6 +818,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
68553 + /* allow glibc communication via tgkill to other threads in our
68555 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
68556 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
68557 + && gr_handle_signal(t, sig))
68560 return security_task_kill(t, info, sig, 0);
68563 @@ -1165,7 +1175,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68564 return send_signal(sig, info, p, 1);
68569 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68571 return send_signal(sig, info, t, 0);
68572 @@ -1202,6 +1212,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68573 unsigned long int flags;
68574 int ret, blocked, ignored;
68575 struct k_sigaction *action;
68576 + int is_unhandled = 0;
68578 spin_lock_irqsave(&t->sighand->siglock, flags);
68579 action = &t->sighand->action[sig-1];
68580 @@ -1216,9 +1227,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68582 if (action->sa.sa_handler == SIG_DFL)
68583 t->signal->flags &= ~SIGNAL_UNKILLABLE;
68584 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
68585 + is_unhandled = 1;
68586 ret = specific_send_sig_info(sig, info, t);
68587 spin_unlock_irqrestore(&t->sighand->siglock, flags);
68589 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
68590 + normal operation */
68591 + if (is_unhandled) {
68592 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
68593 + gr_handle_crash(t, sig);
68599 @@ -1285,8 +1305,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
68600 ret = check_kill_permission(sig, info, p);
68604 + if (!ret && sig) {
68605 ret = do_send_sig_info(sig, info, p, true);
68607 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
68612 @@ -1909,6 +1932,8 @@ static void ptrace_do_notify(int signr, int exit_code, int why)
68616 + pax_track_stack();
68618 memset(&info, 0, sizeof info);
68619 info.si_signo = signr;
68620 info.si_code = exit_code;
68621 @@ -2748,7 +2773,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
68622 int error = -ESRCH;
68625 - p = find_task_by_vpid(pid);
68626 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
68627 + /* allow glibc communication via tgkill to other threads in our
68629 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
68630 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
68631 + p = find_task_by_vpid_unrestricted(pid);
68634 + p = find_task_by_vpid(pid);
68635 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
68636 error = check_kill_permission(sig, info, p);
68638 diff --git a/kernel/smp.c b/kernel/smp.c
68639 index fb67dfa..f819e2e 100644
68642 @@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait)
68644 EXPORT_SYMBOL(smp_call_function);
68646 -void ipi_call_lock(void)
68647 +void ipi_call_lock(void) __acquires(call_function.lock)
68649 raw_spin_lock(&call_function.lock);
68652 -void ipi_call_unlock(void)
68653 +void ipi_call_unlock(void) __releases(call_function.lock)
68655 raw_spin_unlock(&call_function.lock);
68658 -void ipi_call_lock_irq(void)
68659 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
68661 raw_spin_lock_irq(&call_function.lock);
68664 -void ipi_call_unlock_irq(void)
68665 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
68667 raw_spin_unlock_irq(&call_function.lock);
68669 diff --git a/kernel/softirq.c b/kernel/softirq.c
68670 index fca82c3..1db9690 100644
68671 --- a/kernel/softirq.c
68672 +++ b/kernel/softirq.c
68673 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
68675 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
68677 -char *softirq_to_name[NR_SOFTIRQS] = {
68678 +const char * const softirq_to_name[NR_SOFTIRQS] = {
68679 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
68680 "TASKLET", "SCHED", "HRTIMER", "RCU"
68682 @@ -235,7 +235,7 @@ restart:
68683 kstat_incr_softirqs_this_cpu(vec_nr);
68685 trace_softirq_entry(vec_nr);
68688 trace_softirq_exit(vec_nr);
68689 if (unlikely(prev_count != preempt_count())) {
68690 printk(KERN_ERR "huh, entered softirq %u %s %p"
68691 @@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
68692 local_irq_restore(flags);
68695 -void open_softirq(int nr, void (*action)(struct softirq_action *))
68696 +void open_softirq(int nr, void (*action)(void))
68698 - softirq_vec[nr].action = action;
68699 + pax_open_kernel();
68700 + *(void **)&softirq_vec[nr].action = action;
68701 + pax_close_kernel();
68705 @@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
68707 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
68709 -static void tasklet_action(struct softirq_action *a)
68710 +static void tasklet_action(void)
68712 struct tasklet_struct *list;
68714 @@ -476,7 +478,7 @@ static void tasklet_action(struct softirq_action *a)
68718 -static void tasklet_hi_action(struct softirq_action *a)
68719 +static void tasklet_hi_action(void)
68721 struct tasklet_struct *list;
68723 diff --git a/kernel/sys.c b/kernel/sys.c
68724 index 1dbbe69..e96e1dd 100644
68727 @@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
68732 + if (gr_handle_chroot_setpriority(p, niceval)) {
68737 no_nice = security_task_setnice(p, niceval);
68740 @@ -571,6 +577,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
68744 + if (gr_check_group_change(new->gid, new->egid, -1))
68747 if (rgid != (gid_t) -1 ||
68748 (egid != (gid_t) -1 && egid != old->gid))
68749 new->sgid = new->egid;
68750 @@ -600,6 +609,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
68751 old = current_cred();
68755 + if (gr_check_group_change(gid, gid, gid))
68758 if (nsown_capable(CAP_SETGID))
68759 new->gid = new->egid = new->sgid = new->fsgid = gid;
68760 else if (gid == old->gid || gid == old->sgid)
68761 @@ -687,6 +700,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
68765 + if (gr_check_user_change(new->uid, new->euid, -1))
68768 if (new->uid != old->uid) {
68769 retval = set_user(new);
68771 @@ -731,6 +747,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
68772 old = current_cred();
68776 + if (gr_check_crash_uid(uid))
68778 + if (gr_check_user_change(uid, uid, uid))
68781 if (nsown_capable(CAP_SETUID)) {
68782 new->suid = new->uid = uid;
68783 if (uid != old->uid) {
68784 @@ -785,6 +807,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
68788 + if (gr_check_user_change(ruid, euid, -1))
68791 if (ruid != (uid_t) -1) {
68793 if (ruid != old->uid) {
68794 @@ -849,6 +874,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
68798 + if (gr_check_group_change(rgid, egid, -1))
68801 if (rgid != (gid_t) -1)
68803 if (egid != (gid_t) -1)
68804 @@ -895,6 +923,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68805 old = current_cred();
68806 old_fsuid = old->fsuid;
68808 + if (gr_check_user_change(-1, -1, uid))
68811 if (uid == old->uid || uid == old->euid ||
68812 uid == old->suid || uid == old->fsuid ||
68813 nsown_capable(CAP_SETUID)) {
68814 @@ -905,6 +936,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68822 @@ -931,12 +963,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
68823 if (gid == old->gid || gid == old->egid ||
68824 gid == old->sgid || gid == old->fsgid ||
68825 nsown_capable(CAP_SETGID)) {
68826 + if (gr_check_group_change(-1, -1, gid))
68829 if (gid != old_fsgid) {
68839 @@ -1188,7 +1224,10 @@ static int override_release(char __user *release, int len)
68841 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
68842 snprintf(buf, len, "2.6.%u%s", v, rest);
68843 - ret = copy_to_user(release, buf, len);
68844 + if (len > sizeof(buf))
68847 + ret = copy_to_user(release, buf, len);
68851 @@ -1242,19 +1281,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
68854 down_read(&uts_sem);
68855 - error = __copy_to_user(&name->sysname, &utsname()->sysname,
68856 + error = __copy_to_user(name->sysname, &utsname()->sysname,
68858 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
68859 - error |= __copy_to_user(&name->nodename, &utsname()->nodename,
68860 + error |= __copy_to_user(name->nodename, &utsname()->nodename,
68862 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
68863 - error |= __copy_to_user(&name->release, &utsname()->release,
68864 + error |= __copy_to_user(name->release, &utsname()->release,
68866 error |= __put_user(0, name->release + __OLD_UTS_LEN);
68867 - error |= __copy_to_user(&name->version, &utsname()->version,
68868 + error |= __copy_to_user(name->version, &utsname()->version,
68870 error |= __put_user(0, name->version + __OLD_UTS_LEN);
68871 - error |= __copy_to_user(&name->machine, &utsname()->machine,
68872 + error |= __copy_to_user(name->machine, &utsname()->machine,
68874 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
68876 @@ -1717,7 +1756,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
68877 error = get_dumpable(me->mm);
68879 case PR_SET_DUMPABLE:
68880 - if (arg2 < 0 || arg2 > 1) {
68885 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
68886 index 11d65b5..6957b37 100644
68887 --- a/kernel/sysctl.c
68888 +++ b/kernel/sysctl.c
68892 #if defined(CONFIG_SYSCTL)
68893 +#include <linux/grsecurity.h>
68894 +#include <linux/grinternal.h>
68896 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
68897 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
68899 +extern int gr_handle_chroot_sysctl(const int op);
68901 /* External variables not in a header file. */
68902 extern int sysctl_overcommit_memory;
68903 @@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
68907 +extern struct ctl_table grsecurity_table[];
68909 static struct ctl_table root_table[];
68910 static struct ctl_table_root sysctl_table_root;
68911 @@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
68912 int sysctl_legacy_va_layout;
68915 +#ifdef CONFIG_PAX_SOFTMODE
68916 +static ctl_table pax_table[] = {
68918 + .procname = "softmode",
68919 + .data = &pax_softmode,
68920 + .maxlen = sizeof(unsigned int),
68922 + .proc_handler = &proc_dointvec,
68929 /* The default sysctl tables: */
68931 static struct ctl_table root_table[] = {
68932 @@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
68935 static struct ctl_table kern_table[] = {
68936 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
68938 + .procname = "grsecurity",
68940 + .child = grsecurity_table,
68944 +#ifdef CONFIG_PAX_SOFTMODE
68946 + .procname = "pax",
68948 + .child = pax_table,
68953 .procname = "sched_child_runs_first",
68954 .data = &sysctl_sched_child_runs_first,
68955 @@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
68956 .data = &modprobe_path,
68957 .maxlen = KMOD_PATH_LEN,
68959 - .proc_handler = proc_dostring,
68960 + .proc_handler = proc_dostring_modpriv,
68963 .procname = "modules_disabled",
68964 @@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
68970 .procname = "kptr_restrict",
68971 .data = &kptr_restrict,
68972 .maxlen = sizeof(int),
68974 .proc_handler = proc_dmesg_restrict,
68975 +#ifdef CONFIG_GRKERNSEC_HIDESYM
68984 .procname = "ngroups_max",
68985 .data = &ngroups_max,
68986 @@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
68987 .proc_handler = proc_dointvec_minmax,
68991 + .procname = "heap_stack_gap",
68992 + .data = &sysctl_heap_stack_gap,
68993 + .maxlen = sizeof(sysctl_heap_stack_gap),
68995 + .proc_handler = proc_doulongvec_minmax,
68999 .procname = "nr_trim_pages",
69000 @@ -1709,6 +1758,17 @@ static int test_perm(int mode, int op)
69001 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
69006 + if (table->parent != NULL && table->parent->procname != NULL &&
69007 + table->procname != NULL &&
69008 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
69010 + if (gr_handle_chroot_sysctl(op))
69012 + error = gr_handle_sysctl(table, op);
69016 if (root->permissions)
69017 mode = root->permissions(root, current->nsproxy, table);
69018 @@ -2113,6 +2173,16 @@ int proc_dostring(struct ctl_table *table, int write,
69019 buffer, lenp, ppos);
69022 +int proc_dostring_modpriv(struct ctl_table *table, int write,
69023 + void __user *buffer, size_t *lenp, loff_t *ppos)
69025 + if (write && !capable(CAP_SYS_MODULE))
69028 + return _proc_do_string(table->data, table->maxlen, write,
69029 + buffer, lenp, ppos);
69032 static size_t proc_skip_spaces(char **buf)
69035 @@ -2218,6 +2288,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
69039 + if (len > sizeof(tmp))
69040 + len = sizeof(tmp);
69041 if (copy_to_user(*buf, tmp, len))
69044 @@ -2534,8 +2606,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
69047 val = convdiv * (*i) / convmul;
69050 err = proc_put_char(&buffer, &left, '\t');
69054 err = proc_put_long(&buffer, &left, val, false);
69057 @@ -2930,6 +3005,12 @@ int proc_dostring(struct ctl_table *table, int write,
69061 +int proc_dostring_modpriv(struct ctl_table *table, int write,
69062 + void __user *buffer, size_t *lenp, loff_t *ppos)
69067 int proc_dointvec(struct ctl_table *table, int write,
69068 void __user *buffer, size_t *lenp, loff_t *ppos)
69070 @@ -2986,6 +3067,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
69071 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
69072 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
69073 EXPORT_SYMBOL(proc_dostring);
69074 +EXPORT_SYMBOL(proc_dostring_modpriv);
69075 EXPORT_SYMBOL(proc_doulongvec_minmax);
69076 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
69077 EXPORT_SYMBOL(register_sysctl_table);
69078 diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
69079 index e8bffbe..82bf0a4 100644
69080 --- a/kernel/sysctl_binary.c
69081 +++ b/kernel/sysctl_binary.c
69082 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
69086 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69087 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69091 @@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *file,
69095 - result = vfs_write(file, buffer, str - buffer, &pos);
69096 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69100 @@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file *file,
69104 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
69105 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
69109 @@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file *file,
69113 - result = vfs_write(file, buffer, str - buffer, &pos);
69114 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
69118 @@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *file,
69122 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69123 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69127 @@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69131 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
69132 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
69136 @@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
69137 le16_to_cpu(dnaddr) & 0x3ff);
69140 - result = vfs_write(file, buf, len, &pos);
69141 + result = vfs_write(file, (const char __force_user *)buf, len, &pos);
69145 @@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
69149 - putname(pathname);
69150 + __putname(pathname);
69154 diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
69155 index 362da65..ab8ef8c 100644
69156 --- a/kernel/sysctl_check.c
69157 +++ b/kernel/sysctl_check.c
69158 @@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
69159 set_fail(&fail, table, "Directory with extra2");
69161 if ((table->proc_handler == proc_dostring) ||
69162 + (table->proc_handler == proc_dostring_modpriv) ||
69163 (table->proc_handler == proc_dointvec) ||
69164 (table->proc_handler == proc_dointvec_minmax) ||
69165 (table->proc_handler == proc_dointvec_jiffies) ||
69166 diff --git a/kernel/taskstats.c b/kernel/taskstats.c
69167 index e660464..c8b9e67 100644
69168 --- a/kernel/taskstats.c
69169 +++ b/kernel/taskstats.c
69171 #include <linux/cgroup.h>
69172 #include <linux/fs.h>
69173 #include <linux/file.h>
69174 +#include <linux/grsecurity.h>
69175 #include <net/genetlink.h>
69176 #include <linux/atomic.h>
69178 +extern int gr_is_taskstats_denied(int pid);
69181 * Maximum length of a cpumask that can be specified in
69182 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
69183 @@ -556,6 +559,9 @@ err:
69185 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
69187 + if (gr_is_taskstats_denied(current->pid))
69190 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
69191 return cmd_attr_register_cpumask(info);
69192 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
69193 diff --git a/kernel/time.c b/kernel/time.c
69194 index d776062..fa8d186 100644
69195 --- a/kernel/time.c
69196 +++ b/kernel/time.c
69197 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
69201 + /* we log in do_settimeofday called below, so don't log twice
69204 + gr_log_timechange();
69206 /* SMP safe, global irq locking makes it work. */
69208 update_vsyscall_tz();
69209 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
69210 index 8b70c76..923e9f5 100644
69211 --- a/kernel/time/alarmtimer.c
69212 +++ b/kernel/time/alarmtimer.c
69213 @@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
69217 - struct k_clock alarm_clock = {
69218 + static struct k_clock alarm_clock = {
69219 .clock_getres = alarm_clock_getres,
69220 .clock_get = alarm_clock_get,
69221 .timer_create = alarm_timer_create,
69222 diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
69223 index 7a90d02..6d8585a 100644
69224 --- a/kernel/time/tick-broadcast.c
69225 +++ b/kernel/time/tick-broadcast.c
69226 @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
69227 * then clear the broadcast bit.
69229 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
69230 - int cpu = smp_processor_id();
69231 + cpu = smp_processor_id();
69233 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
69234 tick_broadcast_clear_oneshot(cpu);
69235 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
69236 index 6f9798b..f8c4087 100644
69237 --- a/kernel/time/timekeeping.c
69238 +++ b/kernel/time/timekeeping.c
69240 #include <linux/init.h>
69241 #include <linux/mm.h>
69242 #include <linux/sched.h>
69243 +#include <linux/grsecurity.h>
69244 #include <linux/syscore_ops.h>
69245 #include <linux/clocksource.h>
69246 #include <linux/jiffies.h>
69247 @@ -365,6 +366,8 @@ int do_settimeofday(const struct timespec *tv)
69248 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
69251 + gr_log_timechange();
69253 write_seqlock_irqsave(&xtime_lock, flags);
69255 timekeeping_forward_now();
69256 diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
69257 index 3258455..f35227d 100644
69258 --- a/kernel/time/timer_list.c
69259 +++ b/kernel/time/timer_list.c
69260 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
69262 static void print_name_offset(struct seq_file *m, void *sym)
69264 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69265 + SEQ_printf(m, "<%p>", NULL);
69267 char symname[KSYM_NAME_LEN];
69269 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
69270 SEQ_printf(m, "<%pK>", sym);
69272 SEQ_printf(m, "%s", symname);
69277 @@ -112,7 +116,11 @@ next_one:
69279 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
69281 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69282 + SEQ_printf(m, " .base: %p\n", NULL);
69284 SEQ_printf(m, " .base: %pK\n", base);
69286 SEQ_printf(m, " .index: %d\n",
69288 SEQ_printf(m, " .resolution: %Lu nsecs\n",
69289 @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs(void)
69291 struct proc_dir_entry *pe;
69293 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
69294 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
69296 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
69301 diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
69302 index a5d0a3a..60c7948 100644
69303 --- a/kernel/time/timer_stats.c
69304 +++ b/kernel/time/timer_stats.c
69305 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
69306 static unsigned long nr_entries;
69307 static struct entry entries[MAX_ENTRIES];
69309 -static atomic_t overflow_count;
69310 +static atomic_unchecked_t overflow_count;
69313 * The entries are in a hash-table, for fast lookup:
69314 @@ -140,7 +140,7 @@ static void reset_entries(void)
69316 memset(entries, 0, sizeof(entries));
69317 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
69318 - atomic_set(&overflow_count, 0);
69319 + atomic_set_unchecked(&overflow_count, 0);
69322 static struct entry *alloc_entry(void)
69323 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69327 - atomic_inc(&overflow_count);
69328 + atomic_inc_unchecked(&overflow_count);
69331 raw_spin_unlock_irqrestore(lock, flags);
69332 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
69334 static void print_name_offset(struct seq_file *m, unsigned long addr)
69336 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69337 + seq_printf(m, "<%p>", NULL);
69339 char symname[KSYM_NAME_LEN];
69341 if (lookup_symbol_name(addr, symname) < 0)
69342 seq_printf(m, "<%p>", (void *)addr);
69344 seq_printf(m, "%s", symname);
69348 static int tstats_show(struct seq_file *m, void *v)
69349 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
69351 seq_puts(m, "Timer Stats Version: v0.2\n");
69352 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
69353 - if (atomic_read(&overflow_count))
69354 + if (atomic_read_unchecked(&overflow_count))
69355 seq_printf(m, "Overflow: %d entries\n",
69356 - atomic_read(&overflow_count));
69357 + atomic_read_unchecked(&overflow_count));
69359 for (i = 0; i < nr_entries; i++) {
69360 entry = entries + i;
69361 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
69363 struct proc_dir_entry *pe;
69365 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
69366 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
69368 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
69373 diff --git a/kernel/timer.c b/kernel/timer.c
69374 index 8cff361..0fb5cd8 100644
69375 --- a/kernel/timer.c
69376 +++ b/kernel/timer.c
69377 @@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
69379 * This function runs timers and the timer-tq in bottom half context.
69381 -static void run_timer_softirq(struct softirq_action *h)
69382 +static void run_timer_softirq(void)
69384 struct tvec_base *base = __this_cpu_read(tvec_bases);
69386 diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
69387 index 7c910a5..8b72104 100644
69388 --- a/kernel/trace/blktrace.c
69389 +++ b/kernel/trace/blktrace.c
69390 @@ -323,7 +323,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
69391 struct blk_trace *bt = filp->private_data;
69394 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
69395 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
69397 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
69399 @@ -388,7 +388,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
69402 bt = buf->chan->private_data;
69403 - atomic_inc(&bt->dropped);
69404 + atomic_inc_unchecked(&bt->dropped);
69408 @@ -489,7 +489,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
69412 - atomic_set(&bt->dropped, 0);
69413 + atomic_set_unchecked(&bt->dropped, 0);
69416 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
69417 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
69418 index 48d3762..3b61fce 100644
69419 --- a/kernel/trace/ftrace.c
69420 +++ b/kernel/trace/ftrace.c
69421 @@ -1584,12 +1584,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
69422 if (unlikely(ftrace_disabled))
69425 + ret = ftrace_arch_code_modify_prepare();
69426 + FTRACE_WARN_ON(ret);
69430 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
69431 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
69433 ftrace_bug(ret, ip);
69437 + return ret ? 0 : 1;
69441 @@ -2606,7 +2611,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
69444 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
69448 struct ftrace_func_probe *entry;
69449 struct ftrace_page *pg;
69450 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
69451 index 17a2d44..85907e2 100644
69452 --- a/kernel/trace/trace.c
69453 +++ b/kernel/trace/trace.c
69454 @@ -3451,6 +3451,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
69458 + pax_track_stack();
69460 if (splice_grow_spd(pipe, &spd))
69463 @@ -3926,6 +3928,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
69464 int entries, size, i;
69467 + pax_track_stack();
69469 if (splice_grow_spd(pipe, &spd))
69472 @@ -4093,10 +4097,9 @@ static const struct file_operations tracing_dyn_info_fops = {
69476 -static struct dentry *d_tracer;
69478 struct dentry *tracing_init_dentry(void)
69480 + static struct dentry *d_tracer;
69484 @@ -4116,10 +4119,9 @@ struct dentry *tracing_init_dentry(void)
69488 -static struct dentry *d_percpu;
69490 struct dentry *tracing_dentry_percpu(void)
69492 + static struct dentry *d_percpu;
69494 struct dentry *d_tracer;
69496 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
69497 index c212a7f..7b02394 100644
69498 --- a/kernel/trace/trace_events.c
69499 +++ b/kernel/trace/trace_events.c
69500 @@ -1299,10 +1299,6 @@ static LIST_HEAD(ftrace_module_file_list);
69501 struct ftrace_module_file_ops {
69502 struct list_head list;
69503 struct module *mod;
69504 - struct file_operations id;
69505 - struct file_operations enable;
69506 - struct file_operations format;
69507 - struct file_operations filter;
69510 static struct ftrace_module_file_ops *
69511 @@ -1323,17 +1319,12 @@ trace_create_file_ops(struct module *mod)
69513 file_ops->mod = mod;
69515 - file_ops->id = ftrace_event_id_fops;
69516 - file_ops->id.owner = mod;
69518 - file_ops->enable = ftrace_enable_fops;
69519 - file_ops->enable.owner = mod;
69521 - file_ops->filter = ftrace_event_filter_fops;
69522 - file_ops->filter.owner = mod;
69524 - file_ops->format = ftrace_event_format_fops;
69525 - file_ops->format.owner = mod;
69526 + pax_open_kernel();
69527 + *(void **)&mod->trace_id.owner = mod;
69528 + *(void **)&mod->trace_enable.owner = mod;
69529 + *(void **)&mod->trace_filter.owner = mod;
69530 + *(void **)&mod->trace_format.owner = mod;
69531 + pax_close_kernel();
69533 list_add(&file_ops->list, &ftrace_module_file_list);
69535 @@ -1357,8 +1348,8 @@ static void trace_module_add_events(struct module *mod)
69537 for_each_event(call, start, end) {
69538 __trace_add_event_call(*call, mod,
69539 - &file_ops->id, &file_ops->enable,
69540 - &file_ops->filter, &file_ops->format);
69541 + &mod->trace_id, &mod->trace_enable,
69542 + &mod->trace_filter, &mod->trace_format);
69546 diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
69547 index 00d527c..7c5b1a3 100644
69548 --- a/kernel/trace/trace_kprobe.c
69549 +++ b/kernel/trace/trace_kprobe.c
69550 @@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69552 int maxlen = get_rloc_len(*(u32 *)dest);
69553 u8 *dst = get_rloc_data(dest);
69555 + const u8 __user *src = (const u8 __force_user *)addr;
69556 mm_segment_t old_fs = get_fs();
69559 @@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69560 pagefault_disable();
69562 ret = __copy_from_user_inatomic(dst++, src++, 1);
69563 - while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
69564 + while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
69566 pagefault_enable();
69568 @@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
69569 ((u8 *)get_rloc_data(dest))[0] = '\0';
69570 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
69572 - *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
69573 + *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
69574 get_rloc_offs(*(u32 *)dest));
69576 /* Return the length of string -- including null terminal byte */
69577 @@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs,
69579 pagefault_disable();
69581 - ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
69582 + ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
69584 } while (c && ret == 0 && len < MAX_STRING_SIZE);
69585 pagefault_enable();
69586 diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
69587 index fd3c8aa..5f324a6 100644
69588 --- a/kernel/trace/trace_mmiotrace.c
69589 +++ b/kernel/trace/trace_mmiotrace.c
69590 @@ -24,7 +24,7 @@ struct header_iter {
69591 static struct trace_array *mmio_trace_array;
69592 static bool overrun_detected;
69593 static unsigned long prev_overruns;
69594 -static atomic_t dropped_count;
69595 +static atomic_unchecked_t dropped_count;
69597 static void mmio_reset_data(struct trace_array *tr)
69599 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
69601 static unsigned long count_overruns(struct trace_iterator *iter)
69603 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
69604 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
69605 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
69607 if (over > prev_overruns)
69608 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
69609 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
69610 sizeof(*entry), 0, pc);
69612 - atomic_inc(&dropped_count);
69613 + atomic_inc_unchecked(&dropped_count);
69616 entry = ring_buffer_event_data(event);
69617 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
69618 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
69619 sizeof(*entry), 0, pc);
69621 - atomic_inc(&dropped_count);
69622 + atomic_inc_unchecked(&dropped_count);
69625 entry = ring_buffer_event_data(event);
69626 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
69627 index 5199930..26c73a0 100644
69628 --- a/kernel/trace/trace_output.c
69629 +++ b/kernel/trace/trace_output.c
69630 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
69632 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
69634 - p = mangle_path(s->buffer + s->len, p, "\n");
69635 + p = mangle_path(s->buffer + s->len, p, "\n\\");
69637 s->len = p - s->buffer;
69639 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
69640 index 77575b3..6e623d1 100644
69641 --- a/kernel/trace/trace_stack.c
69642 +++ b/kernel/trace/trace_stack.c
69643 @@ -50,7 +50,7 @@ static inline void check_stack(void)
69646 /* we do not handle interrupt stacks yet */
69647 - if (!object_is_on_stack(&this_size))
69648 + if (!object_starts_on_stack(&this_size))
69651 local_irq_save(flags);
69652 diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
69653 index 209b379..7f76423 100644
69654 --- a/kernel/trace/trace_workqueue.c
69655 +++ b/kernel/trace/trace_workqueue.c
69656 @@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
69659 /* Can be inserted from interrupt or user context, need to be atomic */
69660 - atomic_t inserted;
69661 + atomic_unchecked_t inserted;
69663 * Don't need to be atomic, works are serialized in a single workqueue thread
69665 @@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
69666 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
69667 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
69668 if (node->pid == wq_thread->pid) {
69669 - atomic_inc(&node->inserted);
69670 + atomic_inc_unchecked(&node->inserted);
69674 @@ -210,7 +210,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
69675 tsk = get_pid_task(pid, PIDTYPE_PID);
69677 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
69678 - atomic_read(&cws->inserted), cws->executed,
69679 + atomic_read_unchecked(&cws->inserted), cws->executed,
69681 put_task_struct(tsk);
69683 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
69684 index c0cb9c4..f33aa89 100644
69685 --- a/lib/Kconfig.debug
69686 +++ b/lib/Kconfig.debug
69687 @@ -1091,6 +1091,7 @@ config LATENCYTOP
69688 depends on DEBUG_KERNEL
69689 depends on STACKTRACE_SUPPORT
69691 + depends on !GRKERNSEC_HIDESYM
69692 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
69694 select KALLSYMS_ALL
69695 diff --git a/lib/bitmap.c b/lib/bitmap.c
69696 index 2f4412e..a557e27 100644
69699 @@ -419,7 +419,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
69701 int c, old_c, totaldigits, ndigits, nchunks, nbits;
69703 - const char __user *ubuf = buf;
69704 + const char __user *ubuf = (const char __force_user *)buf;
69706 bitmap_zero(maskp, nmaskbits);
69708 @@ -504,7 +504,7 @@ int bitmap_parse_user(const char __user *ubuf,
69710 if (!access_ok(VERIFY_READ, ubuf, ulen))
69712 - return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
69713 + return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
69715 EXPORT_SYMBOL(bitmap_parse_user);
69717 @@ -594,7 +594,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
69720 int c, old_c, totaldigits;
69721 - const char __user *ubuf = buf;
69722 + const char __user *ubuf = (const char __force_user *)buf;
69723 int exp_digit, in_range;
69725 totaldigits = c = 0;
69726 @@ -694,7 +694,7 @@ int bitmap_parselist_user(const char __user *ubuf,
69728 if (!access_ok(VERIFY_READ, ubuf, ulen))
69730 - return __bitmap_parselist((const char *)ubuf,
69731 + return __bitmap_parselist((const char __force_kernel *)ubuf,
69732 ulen, 1, maskp, nmaskbits);
69734 EXPORT_SYMBOL(bitmap_parselist_user);
69735 diff --git a/lib/bug.c b/lib/bug.c
69736 index 1955209..cbbb2ad 100644
69739 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
69740 return BUG_TRAP_TYPE_NONE;
69742 bug = find_bug(bugaddr);
69744 + return BUG_TRAP_TYPE_NONE;
69748 diff --git a/lib/debugobjects.c b/lib/debugobjects.c
69749 index a78b7c6..2c73084 100644
69750 --- a/lib/debugobjects.c
69751 +++ b/lib/debugobjects.c
69752 @@ -284,7 +284,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
69756 - is_on_stack = object_is_on_stack(addr);
69757 + is_on_stack = object_starts_on_stack(addr);
69758 if (is_on_stack == onstack)
69761 diff --git a/lib/devres.c b/lib/devres.c
69762 index 7c0e953..f642b5c 100644
69765 @@ -80,7 +80,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
69766 void devm_iounmap(struct device *dev, void __iomem *addr)
69768 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
69770 + (void __force *)addr));
69773 EXPORT_SYMBOL(devm_iounmap);
69774 @@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
69776 ioport_unmap(addr);
69777 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
69778 - devm_ioport_map_match, (void *)addr));
69779 + devm_ioport_map_match, (void __force *)addr));
69781 EXPORT_SYMBOL(devm_ioport_unmap);
69783 diff --git a/lib/dma-debug.c b/lib/dma-debug.c
69784 index db07bfd..719b5ab 100644
69785 --- a/lib/dma-debug.c
69786 +++ b/lib/dma-debug.c
69787 @@ -870,7 +870,7 @@ out:
69789 static void check_for_stack(struct device *dev, void *addr)
69791 - if (object_is_on_stack(addr))
69792 + if (object_starts_on_stack(addr))
69793 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
69794 "stack [addr=%p]\n", addr);
69796 diff --git a/lib/extable.c b/lib/extable.c
69797 index 4cac81e..63e9b8f 100644
69798 --- a/lib/extable.c
69799 +++ b/lib/extable.c
69801 #include <linux/init.h>
69802 #include <linux/sort.h>
69803 #include <asm/uaccess.h>
69804 +#include <asm/pgtable.h>
69806 #ifndef ARCH_HAS_SORT_EXTABLE
69808 @@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const void *b)
69809 void sort_extable(struct exception_table_entry *start,
69810 struct exception_table_entry *finish)
69812 + pax_open_kernel();
69813 sort(start, finish - start, sizeof(struct exception_table_entry),
69815 + pax_close_kernel();
69818 #ifdef CONFIG_MODULES
69819 diff --git a/lib/inflate.c b/lib/inflate.c
69820 index 013a761..c28f3fc 100644
69821 --- a/lib/inflate.c
69822 +++ b/lib/inflate.c
69823 @@ -269,7 +269,7 @@ static void free(void *where)
69824 malloc_ptr = free_mem_ptr;
69827 -#define malloc(a) kmalloc(a, GFP_KERNEL)
69828 +#define malloc(a) kmalloc((a), GFP_KERNEL)
69829 #define free(a) kfree(a)
69832 diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
69833 index bd2bea9..6b3c95e 100644
69834 --- a/lib/is_single_threaded.c
69835 +++ b/lib/is_single_threaded.c
69836 @@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
69837 struct task_struct *p, *t;
69843 if (atomic_read(&task->signal->live) != 1)
69846 diff --git a/lib/kref.c b/lib/kref.c
69847 index 3efb882..8492f4c 100644
69850 @@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
69852 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
69854 - WARN_ON(release == NULL);
69855 + BUG_ON(release == NULL);
69856 WARN_ON(release == (void (*)(struct kref *))kfree);
69858 if (atomic_dec_and_test(&kref->refcount)) {
69859 diff --git a/lib/radix-tree.c b/lib/radix-tree.c
69860 index a2f9da5..3bcadb6 100644
69861 --- a/lib/radix-tree.c
69862 +++ b/lib/radix-tree.c
69863 @@ -80,7 +80,7 @@ struct radix_tree_preload {
69865 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
69867 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
69868 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
69870 static inline void *ptr_to_indirect(void *ptr)
69872 diff --git a/lib/vsprintf.c b/lib/vsprintf.c
69873 index d7222a9..2172edc 100644
69874 --- a/lib/vsprintf.c
69875 +++ b/lib/vsprintf.c
69877 * - scnprintf and vscnprintf
69880 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69881 +#define __INCLUDED_BY_HIDESYM 1
69883 #include <stdarg.h>
69884 #include <linux/module.h>
69885 #include <linux/types.h>
69886 @@ -432,7 +435,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
69887 char sym[KSYM_SYMBOL_LEN];
69889 sprint_backtrace(sym, value);
69890 - else if (ext != 'f' && ext != 's')
69891 + else if (ext != 'f' && ext != 's' && ext != 'a')
69892 sprint_symbol(sym, value);
69894 kallsyms_lookup(value, NULL, NULL, NULL, sym);
69895 @@ -796,7 +799,11 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
69896 return string(buf, end, uuid, spec);
69899 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69900 +int kptr_restrict __read_mostly = 2;
69902 int kptr_restrict __read_mostly;
69906 * Show a '%p' thing. A kernel extension is that the '%p' is followed
69907 @@ -810,6 +817,8 @@ int kptr_restrict __read_mostly;
69908 * - 'S' For symbolic direct pointers with offset
69909 * - 's' For symbolic direct pointers without offset
69910 * - 'B' For backtraced symbolic direct pointers with offset
69911 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
69912 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
69913 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
69914 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
69915 * - 'M' For a 6-byte MAC address, it prints the address in the
69916 @@ -854,12 +863,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69918 if (!ptr && *fmt != 'K') {
69920 - * Print (null) with the same width as a pointer so it makes
69921 + * Print (nil) with the same width as a pointer so it makes
69922 * tabular output look nice.
69924 if (spec.field_width == -1)
69925 spec.field_width = 2 * sizeof(void *);
69926 - return string(buf, end, "(null)", spec);
69927 + return string(buf, end, "(nil)", spec);
69931 @@ -869,6 +878,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
69935 +#ifdef CONFIG_GRKERNSEC_HIDESYM
69938 + return symbol_string(buf, end, ptr, spec, *fmt);
69943 return symbol_string(buf, end, ptr, spec, *fmt);
69945 @@ -1627,11 +1643,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69946 typeof(type) value; \
69947 if (sizeof(type) == 8) { \
69948 args = PTR_ALIGN(args, sizeof(u32)); \
69949 - *(u32 *)&value = *(u32 *)args; \
69950 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
69951 + *(u32 *)&value = *(const u32 *)args; \
69952 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
69954 args = PTR_ALIGN(args, sizeof(type)); \
69955 - value = *(typeof(type) *)args; \
69956 + value = *(const typeof(type) *)args; \
69958 args += sizeof(type); \
69960 @@ -1694,7 +1710,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
69961 case FORMAT_TYPE_STR: {
69962 const char *str_arg = args;
69963 args += strlen(str_arg) + 1;
69964 - str = string(str, end, (char *)str_arg, spec);
69965 + str = string(str, end, str_arg, spec);
69969 diff --git a/localversion-grsec b/localversion-grsec
69970 new file mode 100644
69971 index 0000000..7cd6065
69973 +++ b/localversion-grsec
69976 diff --git a/mm/Kconfig b/mm/Kconfig
69977 index f2f1ca1..0645f06 100644
69980 @@ -238,10 +238,10 @@ config KSM
69981 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
69983 config DEFAULT_MMAP_MIN_ADDR
69984 - int "Low address space to protect from user allocation"
69985 + int "Low address space to protect from user allocation"
69991 This is the portion of low virtual memory which should be protected
69992 from userspace allocation. Keeping a user from writing to low pages
69993 can help reduce the impact of kernel NULL pointer bugs.
69994 diff --git a/mm/filemap.c b/mm/filemap.c
69995 index 7771871..91bcdb4 100644
69998 @@ -1784,7 +1784,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
69999 struct address_space *mapping = file->f_mapping;
70001 if (!mapping->a_ops->readpage)
70004 file_accessed(file);
70005 vma->vm_ops = &generic_file_vm_ops;
70006 vma->vm_flags |= VM_CAN_NONLINEAR;
70007 @@ -2190,6 +2190,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
70008 *pos = i_size_read(inode);
70010 if (limit != RLIM_INFINITY) {
70011 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
70012 if (*pos >= limit) {
70013 send_sig(SIGXFSZ, current, 0);
70015 diff --git a/mm/fremap.c b/mm/fremap.c
70016 index b8e0e2d..076e171 100644
70019 @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
70021 vma = find_vma(mm, start);
70023 +#ifdef CONFIG_PAX_SEGMEXEC
70024 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
70029 * Make sure the vma is shared, that it supports prefaulting,
70030 * and that the remapped range is valid and fully within
70031 diff --git a/mm/highmem.c b/mm/highmem.c
70032 index 5ef672c..d7660f4 100644
70035 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
70036 * So no dangers, even with speculative execution.
70038 page = pte_page(pkmap_page_table[i]);
70039 + pax_open_kernel();
70040 pte_clear(&init_mm, (unsigned long)page_address(page),
70041 &pkmap_page_table[i]);
70043 + pax_close_kernel();
70044 set_page_address(page, NULL);
70047 @@ -186,9 +187,11 @@ start:
70050 vaddr = PKMAP_ADDR(last_pkmap_nr);
70052 + pax_open_kernel();
70053 set_pte_at(&init_mm, vaddr,
70054 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
70056 + pax_close_kernel();
70057 pkmap_count[last_pkmap_nr] = 1;
70058 set_page_address(page, (void *)vaddr);
70060 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
70061 index d819d93..468e18f 100644
70062 --- a/mm/huge_memory.c
70063 +++ b/mm/huge_memory.c
70064 @@ -702,7 +702,7 @@ out:
70065 * run pte_offset_map on the pmd, if an huge pmd could
70066 * materialize from under us from a different thread.
70068 - if (unlikely(__pte_alloc(mm, vma, pmd, address)))
70069 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70070 return VM_FAULT_OOM;
70071 /* if an huge pmd materialized from under us just retry later */
70072 if (unlikely(pmd_trans_huge(*pmd)))
70073 @@ -829,7 +829,7 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
70075 for (i = 0; i < HPAGE_PMD_NR; i++) {
70076 copy_user_highpage(pages[i], page + i,
70077 - haddr + PAGE_SHIFT*i, vma);
70078 + haddr + PAGE_SIZE*i, vma);
70079 __SetPageUptodate(pages[i]);
70082 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
70083 index 73f17c0..fef0140 100644
70086 @@ -2347,6 +2347,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
70090 +#ifdef CONFIG_PAX_SEGMEXEC
70091 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
70093 + struct mm_struct *mm = vma->vm_mm;
70094 + struct vm_area_struct *vma_m;
70095 + unsigned long address_m;
70098 + vma_m = pax_find_mirror_vma(vma);
70102 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70103 + address_m = address + SEGMEXEC_TASK_SIZE;
70104 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
70105 + get_page(page_m);
70106 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
70107 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
70112 * Hugetlb_cow() should be called with page lock of the original hugepage held.
70114 @@ -2450,6 +2471,11 @@ retry_avoidcopy:
70115 make_huge_pte(vma, new_page, 1));
70116 page_remove_rmap(old_page);
70117 hugepage_add_new_anon_rmap(new_page, vma, address);
70119 +#ifdef CONFIG_PAX_SEGMEXEC
70120 + pax_mirror_huge_pte(vma, address, new_page);
70123 /* Make the old page be freed below */
70124 new_page = old_page;
70125 mmu_notifier_invalidate_range_end(mm,
70126 @@ -2601,6 +2627,10 @@ retry:
70127 && (vma->vm_flags & VM_SHARED)));
70128 set_huge_pte_at(mm, address, ptep, new_pte);
70130 +#ifdef CONFIG_PAX_SEGMEXEC
70131 + pax_mirror_huge_pte(vma, address, page);
70134 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
70135 /* Optimization, do the COW without a second fault */
70136 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
70137 @@ -2630,6 +2660,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70138 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
70139 struct hstate *h = hstate_vma(vma);
70141 +#ifdef CONFIG_PAX_SEGMEXEC
70142 + struct vm_area_struct *vma_m;
70145 ptep = huge_pte_offset(mm, address);
70147 entry = huge_ptep_get(ptep);
70148 @@ -2641,6 +2675,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70149 VM_FAULT_SET_HINDEX(h - hstates);
70152 +#ifdef CONFIG_PAX_SEGMEXEC
70153 + vma_m = pax_find_mirror_vma(vma);
70155 + unsigned long address_m;
70157 + if (vma->vm_start > vma_m->vm_start) {
70158 + address_m = address;
70159 + address -= SEGMEXEC_TASK_SIZE;
70161 + h = hstate_vma(vma);
70163 + address_m = address + SEGMEXEC_TASK_SIZE;
70165 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
70166 + return VM_FAULT_OOM;
70167 + address_m &= HPAGE_MASK;
70168 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
70172 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
70174 return VM_FAULT_OOM;
70175 diff --git a/mm/internal.h b/mm/internal.h
70176 index 2189af4..f2ca332 100644
70177 --- a/mm/internal.h
70178 +++ b/mm/internal.h
70179 @@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
70180 * in mm/page_alloc.c
70182 extern void __free_pages_bootmem(struct page *page, unsigned int order);
70183 +extern void free_compound_page(struct page *page);
70184 extern void prep_compound_page(struct page *page, unsigned long order);
70185 #ifdef CONFIG_MEMORY_FAILURE
70186 extern bool is_free_buddy_page(struct page *page);
70187 diff --git a/mm/kmemleak.c b/mm/kmemleak.c
70188 index d6880f5..ed77913 100644
70189 --- a/mm/kmemleak.c
70190 +++ b/mm/kmemleak.c
70191 @@ -357,7 +357,7 @@ static void print_unreferenced(struct seq_file *seq,
70193 for (i = 0; i < object->trace_len; i++) {
70194 void *ptr = (void *)object->trace[i];
70195 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
70196 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
70200 diff --git a/mm/maccess.c b/mm/maccess.c
70201 index 4cee182..e00511d 100644
70204 @@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
70206 pagefault_disable();
70207 ret = __copy_from_user_inatomic(dst,
70208 - (__force const void __user *)src, size);
70209 + (const void __force_user *)src, size);
70210 pagefault_enable();
70213 @@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
70216 pagefault_disable();
70217 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
70218 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
70219 pagefault_enable();
70222 diff --git a/mm/madvise.c b/mm/madvise.c
70223 index 74bf193..feb6fd3 100644
70226 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
70228 unsigned long new_flags = vma->vm_flags;
70230 +#ifdef CONFIG_PAX_SEGMEXEC
70231 + struct vm_area_struct *vma_m;
70234 switch (behavior) {
70236 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
70237 @@ -110,6 +114,13 @@ success:
70239 * vm_flags is protected by the mmap_sem held in write mode.
70242 +#ifdef CONFIG_PAX_SEGMEXEC
70243 + vma_m = pax_find_mirror_vma(vma);
70245 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
70248 vma->vm_flags = new_flags;
70251 @@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70252 struct vm_area_struct ** prev,
70253 unsigned long start, unsigned long end)
70256 +#ifdef CONFIG_PAX_SEGMEXEC
70257 + struct vm_area_struct *vma_m;
70261 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
70263 @@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
70264 zap_page_range(vma, start, end - start, &details);
70266 zap_page_range(vma, start, end - start, NULL);
70268 +#ifdef CONFIG_PAX_SEGMEXEC
70269 + vma_m = pax_find_mirror_vma(vma);
70271 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
70272 + struct zap_details details = {
70273 + .nonlinear_vma = vma_m,
70274 + .last_index = ULONG_MAX,
70276 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
70278 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
70285 @@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
70289 +#ifdef CONFIG_PAX_SEGMEXEC
70290 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
70291 + if (end > SEGMEXEC_TASK_SIZE)
70296 + if (end > TASK_SIZE)
70302 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
70303 index 2b43ba0..fc09657 100644
70304 --- a/mm/memory-failure.c
70305 +++ b/mm/memory-failure.c
70306 @@ -60,7 +60,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
70308 int sysctl_memory_failure_recovery __read_mostly = 1;
70310 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70311 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70313 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
70315 @@ -201,7 +201,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
70316 si.si_signo = SIGBUS;
70318 si.si_code = BUS_MCEERR_AO;
70319 - si.si_addr = (void *)addr;
70320 + si.si_addr = (void __user *)addr;
70321 #ifdef __ARCH_SI_TRAPNO
70322 si.si_trapno = trapno;
70324 @@ -1009,7 +1009,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70327 nr_pages = 1 << compound_trans_order(hpage);
70328 - atomic_long_add(nr_pages, &mce_bad_pages);
70329 + atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
70332 * We need/can do nothing about count=0 pages.
70333 @@ -1039,7 +1039,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70334 if (!PageHWPoison(hpage)
70335 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
70336 || (p != hpage && TestSetPageHWPoison(hpage))) {
70337 - atomic_long_sub(nr_pages, &mce_bad_pages);
70338 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70341 set_page_hwpoison_huge_page(hpage);
70342 @@ -1097,7 +1097,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
70344 if (hwpoison_filter(p)) {
70345 if (TestClearPageHWPoison(p))
70346 - atomic_long_sub(nr_pages, &mce_bad_pages);
70347 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70348 unlock_page(hpage);
70351 @@ -1314,7 +1314,7 @@ int unpoison_memory(unsigned long pfn)
70354 if (TestClearPageHWPoison(p))
70355 - atomic_long_sub(nr_pages, &mce_bad_pages);
70356 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70357 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
70360 @@ -1328,7 +1328,7 @@ int unpoison_memory(unsigned long pfn)
70362 if (TestClearPageHWPoison(page)) {
70363 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
70364 - atomic_long_sub(nr_pages, &mce_bad_pages);
70365 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
70367 if (PageHuge(page))
70368 clear_page_hwpoison_huge_page(page);
70369 @@ -1441,7 +1441,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
70372 if (!PageHWPoison(hpage))
70373 - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
70374 + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
70375 set_page_hwpoison_huge_page(hpage);
70376 dequeue_hwpoisoned_huge_page(hpage);
70377 /* keep elevated page count for bad page */
70378 @@ -1572,7 +1572,7 @@ int soft_offline_page(struct page *page, int flags)
70382 - atomic_long_add(1, &mce_bad_pages);
70383 + atomic_long_add_unchecked(1, &mce_bad_pages);
70384 SetPageHWPoison(page);
70385 /* keep elevated page count for bad page */
70387 diff --git a/mm/memory.c b/mm/memory.c
70388 index b2b8731..6080174 100644
70391 @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
70394 pmd = pmd_offset(pud, start);
70396 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
70398 pmd_free_tlb(tlb, pmd, start);
70403 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70404 @@ -489,9 +493,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70405 if (end - 1 > ceiling - 1)
70408 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
70409 pud = pud_offset(pgd, start);
70411 pud_free_tlb(tlb, pud, start);
70417 @@ -1566,12 +1573,6 @@ no_page_table:
70421 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
70423 - return stack_guard_page_start(vma, addr) ||
70424 - stack_guard_page_end(vma, addr+PAGE_SIZE);
70428 * __get_user_pages() - pin user pages in memory
70429 * @tsk: task_struct of target task
70430 @@ -1644,10 +1645,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70431 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
70435 + while (nr_pages) {
70436 struct vm_area_struct *vma;
70438 - vma = find_extend_vma(mm, start);
70439 + vma = find_vma(mm, start);
70440 if (!vma && in_gate_area(mm, start)) {
70441 unsigned long pg = start & PAGE_MASK;
70443 @@ -1695,7 +1696,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70448 + if (!vma || start < vma->vm_start ||
70449 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
70450 !(vm_flags & vma->vm_flags))
70451 return i ? : -EFAULT;
70452 @@ -1722,11 +1723,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
70454 unsigned int fault_flags = 0;
70456 - /* For mlock, just skip the stack guard page. */
70457 - if (foll_flags & FOLL_MLOCK) {
70458 - if (stack_guard_page(vma, start))
70461 if (foll_flags & FOLL_WRITE)
70462 fault_flags |= FAULT_FLAG_WRITE;
70464 @@ -1800,7 +1796,7 @@ next_page:
70465 start += PAGE_SIZE;
70467 } while (nr_pages && start < vma->vm_end);
70468 - } while (nr_pages);
70472 EXPORT_SYMBOL(__get_user_pages);
70473 @@ -2007,6 +2003,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
70474 page_add_file_rmap(page);
70475 set_pte_at(mm, addr, pte, mk_pte(page, prot));
70477 +#ifdef CONFIG_PAX_SEGMEXEC
70478 + pax_mirror_file_pte(vma, addr, page, ptl);
70482 pte_unmap_unlock(pte, ptl);
70484 @@ -2041,10 +2041,22 @@ out:
70485 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
70489 +#ifdef CONFIG_PAX_SEGMEXEC
70490 + struct vm_area_struct *vma_m;
70493 if (addr < vma->vm_start || addr >= vma->vm_end)
70495 if (!page_count(page))
70498 +#ifdef CONFIG_PAX_SEGMEXEC
70499 + vma_m = pax_find_mirror_vma(vma);
70501 + vma_m->vm_flags |= VM_INSERTPAGE;
70504 vma->vm_flags |= VM_INSERTPAGE;
70505 return insert_page(vma, addr, page, vma->vm_page_prot);
70507 @@ -2130,6 +2142,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
70510 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
70511 + BUG_ON(vma->vm_mirror);
70513 if (addr < vma->vm_start || addr >= vma->vm_end)
70515 @@ -2445,6 +2458,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
70516 copy_user_highpage(dst, src, va, vma);
70519 +#ifdef CONFIG_PAX_SEGMEXEC
70520 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
70522 + struct mm_struct *mm = vma->vm_mm;
70524 + pte_t *pte, entry;
70526 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
70528 + if (!pte_present(entry)) {
70529 + if (!pte_none(entry)) {
70530 + BUG_ON(pte_file(entry));
70531 + free_swap_and_cache(pte_to_swp_entry(entry));
70532 + pte_clear_not_present_full(mm, address, pte, 0);
70535 + struct page *page;
70537 + flush_cache_page(vma, address, pte_pfn(entry));
70538 + entry = ptep_clear_flush(vma, address, pte);
70539 + BUG_ON(pte_dirty(entry));
70540 + page = vm_normal_page(vma, address, entry);
70542 + update_hiwater_rss(mm);
70543 + if (PageAnon(page))
70544 + dec_mm_counter_fast(mm, MM_ANONPAGES);
70546 + dec_mm_counter_fast(mm, MM_FILEPAGES);
70547 + page_remove_rmap(page);
70548 + page_cache_release(page);
70551 + pte_unmap_unlock(pte, ptl);
70554 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
70556 + * the ptl of the lower mapped page is held on entry and is not released on exit
70557 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
70559 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70561 + struct mm_struct *mm = vma->vm_mm;
70562 + unsigned long address_m;
70563 + spinlock_t *ptl_m;
70564 + struct vm_area_struct *vma_m;
70566 + pte_t *pte_m, entry_m;
70568 + BUG_ON(!page_m || !PageAnon(page_m));
70570 + vma_m = pax_find_mirror_vma(vma);
70574 + BUG_ON(!PageLocked(page_m));
70575 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70576 + address_m = address + SEGMEXEC_TASK_SIZE;
70577 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70578 + pte_m = pte_offset_map(pmd_m, address_m);
70579 + ptl_m = pte_lockptr(mm, pmd_m);
70580 + if (ptl != ptl_m) {
70581 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70582 + if (!pte_none(*pte_m))
70586 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70587 + page_cache_get(page_m);
70588 + page_add_anon_rmap(page_m, vma_m, address_m);
70589 + inc_mm_counter_fast(mm, MM_ANONPAGES);
70590 + set_pte_at(mm, address_m, pte_m, entry_m);
70591 + update_mmu_cache(vma_m, address_m, entry_m);
70593 + if (ptl != ptl_m)
70594 + spin_unlock(ptl_m);
70595 + pte_unmap(pte_m);
70596 + unlock_page(page_m);
70599 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70601 + struct mm_struct *mm = vma->vm_mm;
70602 + unsigned long address_m;
70603 + spinlock_t *ptl_m;
70604 + struct vm_area_struct *vma_m;
70606 + pte_t *pte_m, entry_m;
70608 + BUG_ON(!page_m || PageAnon(page_m));
70610 + vma_m = pax_find_mirror_vma(vma);
70614 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70615 + address_m = address + SEGMEXEC_TASK_SIZE;
70616 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70617 + pte_m = pte_offset_map(pmd_m, address_m);
70618 + ptl_m = pte_lockptr(mm, pmd_m);
70619 + if (ptl != ptl_m) {
70620 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70621 + if (!pte_none(*pte_m))
70625 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70626 + page_cache_get(page_m);
70627 + page_add_file_rmap(page_m);
70628 + inc_mm_counter_fast(mm, MM_FILEPAGES);
70629 + set_pte_at(mm, address_m, pte_m, entry_m);
70630 + update_mmu_cache(vma_m, address_m, entry_m);
70632 + if (ptl != ptl_m)
70633 + spin_unlock(ptl_m);
70634 + pte_unmap(pte_m);
70637 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
70639 + struct mm_struct *mm = vma->vm_mm;
70640 + unsigned long address_m;
70641 + spinlock_t *ptl_m;
70642 + struct vm_area_struct *vma_m;
70644 + pte_t *pte_m, entry_m;
70646 + vma_m = pax_find_mirror_vma(vma);
70650 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70651 + address_m = address + SEGMEXEC_TASK_SIZE;
70652 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70653 + pte_m = pte_offset_map(pmd_m, address_m);
70654 + ptl_m = pte_lockptr(mm, pmd_m);
70655 + if (ptl != ptl_m) {
70656 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70657 + if (!pte_none(*pte_m))
70661 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
70662 + set_pte_at(mm, address_m, pte_m, entry_m);
70664 + if (ptl != ptl_m)
70665 + spin_unlock(ptl_m);
70666 + pte_unmap(pte_m);
70669 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
70671 + struct page *page_m;
70674 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
70678 + page_m = vm_normal_page(vma, address, entry);
70680 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
70681 + else if (PageAnon(page_m)) {
70682 + if (pax_find_mirror_vma(vma)) {
70683 + pte_unmap_unlock(pte, ptl);
70684 + lock_page(page_m);
70685 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
70686 + if (pte_same(entry, *pte))
70687 + pax_mirror_anon_pte(vma, address, page_m, ptl);
70689 + unlock_page(page_m);
70692 + pax_mirror_file_pte(vma, address, page_m, ptl);
70695 + pte_unmap_unlock(pte, ptl);
70700 * This routine handles present pages, when users try to write
70701 * to a shared page. It is done by copying the page to a new address
70702 @@ -2656,6 +2849,12 @@ gotten:
70704 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70705 if (likely(pte_same(*page_table, orig_pte))) {
70707 +#ifdef CONFIG_PAX_SEGMEXEC
70708 + if (pax_find_mirror_vma(vma))
70709 + BUG_ON(!trylock_page(new_page));
70713 if (!PageAnon(old_page)) {
70714 dec_mm_counter_fast(mm, MM_FILEPAGES);
70715 @@ -2707,6 +2906,10 @@ gotten:
70716 page_remove_rmap(old_page);
70719 +#ifdef CONFIG_PAX_SEGMEXEC
70720 + pax_mirror_anon_pte(vma, address, new_page, ptl);
70723 /* Free the old page.. */
70724 new_page = old_page;
70725 ret |= VM_FAULT_WRITE;
70726 @@ -2986,6 +3189,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70728 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
70729 try_to_free_swap(page);
70731 +#ifdef CONFIG_PAX_SEGMEXEC
70732 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
70738 @@ -3009,6 +3217,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
70740 /* No need to invalidate - it was non-present before */
70741 update_mmu_cache(vma, address, page_table);
70743 +#ifdef CONFIG_PAX_SEGMEXEC
70744 + pax_mirror_anon_pte(vma, address, page, ptl);
70748 pte_unmap_unlock(page_table, ptl);
70750 @@ -3028,40 +3241,6 @@ out_release:
70754 - * This is like a special single-page "expand_{down|up}wards()",
70755 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
70756 - * doesn't hit another vma.
70758 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
70760 - address &= PAGE_MASK;
70761 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
70762 - struct vm_area_struct *prev = vma->vm_prev;
70765 - * Is there a mapping abutting this one below?
70767 - * That's only ok if it's the same stack mapping
70768 - * that has gotten split..
70770 - if (prev && prev->vm_end == address)
70771 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
70773 - expand_downwards(vma, address - PAGE_SIZE);
70775 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
70776 - struct vm_area_struct *next = vma->vm_next;
70778 - /* As VM_GROWSDOWN but s/below/above/ */
70779 - if (next && next->vm_start == address + PAGE_SIZE)
70780 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
70782 - expand_upwards(vma, address + PAGE_SIZE);
70788 * We enter with non-exclusive mmap_sem (to exclude vma changes,
70789 * but allow concurrent faults), and pte mapped but not yet locked.
70790 * We return with mmap_sem still held, but pte unmapped and unlocked.
70791 @@ -3070,27 +3249,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70792 unsigned long address, pte_t *page_table, pmd_t *pmd,
70793 unsigned int flags)
70795 - struct page *page;
70796 + struct page *page = NULL;
70800 - pte_unmap(page_table);
70802 - /* Check if we need to add a guard page to the stack */
70803 - if (check_stack_guard_page(vma, address) < 0)
70804 - return VM_FAULT_SIGBUS;
70806 - /* Use the zero-page for reads */
70807 if (!(flags & FAULT_FLAG_WRITE)) {
70808 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
70809 vma->vm_page_prot));
70810 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70811 + ptl = pte_lockptr(mm, pmd);
70813 if (!pte_none(*page_table))
70818 /* Allocate our own private page. */
70819 + pte_unmap(page_table);
70821 if (unlikely(anon_vma_prepare(vma)))
70823 page = alloc_zeroed_user_highpage_movable(vma, address);
70824 @@ -3109,6 +3284,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
70825 if (!pte_none(*page_table))
70828 +#ifdef CONFIG_PAX_SEGMEXEC
70829 + if (pax_find_mirror_vma(vma))
70830 + BUG_ON(!trylock_page(page));
70833 inc_mm_counter_fast(mm, MM_ANONPAGES);
70834 page_add_new_anon_rmap(page, vma, address);
70836 @@ -3116,6 +3296,12 @@ setpte:
70838 /* No need to invalidate - it was non-present before */
70839 update_mmu_cache(vma, address, page_table);
70841 +#ifdef CONFIG_PAX_SEGMEXEC
70843 + pax_mirror_anon_pte(vma, address, page, ptl);
70847 pte_unmap_unlock(page_table, ptl);
70849 @@ -3259,6 +3445,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70851 /* Only go through if we didn't race with anybody else... */
70852 if (likely(pte_same(*page_table, orig_pte))) {
70854 +#ifdef CONFIG_PAX_SEGMEXEC
70855 + if (anon && pax_find_mirror_vma(vma))
70856 + BUG_ON(!trylock_page(page));
70859 flush_icache_page(vma, page);
70860 entry = mk_pte(page, vma->vm_page_prot);
70861 if (flags & FAULT_FLAG_WRITE)
70862 @@ -3278,6 +3470,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70864 /* no need to invalidate: a not-present page won't be cached */
70865 update_mmu_cache(vma, address, page_table);
70867 +#ifdef CONFIG_PAX_SEGMEXEC
70869 + pax_mirror_anon_pte(vma, address, page, ptl);
70871 + pax_mirror_file_pte(vma, address, page, ptl);
70876 mem_cgroup_uncharge_page(cow_page);
70877 @@ -3431,6 +3631,12 @@ int handle_pte_fault(struct mm_struct *mm,
70878 if (flags & FAULT_FLAG_WRITE)
70879 flush_tlb_fix_spurious_fault(vma, address);
70882 +#ifdef CONFIG_PAX_SEGMEXEC
70883 + pax_mirror_pte(vma, address, pte, pmd, ptl);
70888 pte_unmap_unlock(pte, ptl);
70890 @@ -3447,6 +3653,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70894 +#ifdef CONFIG_PAX_SEGMEXEC
70895 + struct vm_area_struct *vma_m;
70898 __set_current_state(TASK_RUNNING);
70900 count_vm_event(PGFAULT);
70901 @@ -3458,6 +3668,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70902 if (unlikely(is_vm_hugetlb_page(vma)))
70903 return hugetlb_fault(mm, vma, address, flags);
70905 +#ifdef CONFIG_PAX_SEGMEXEC
70906 + vma_m = pax_find_mirror_vma(vma);
70908 + unsigned long address_m;
70913 + if (vma->vm_start > vma_m->vm_start) {
70914 + address_m = address;
70915 + address -= SEGMEXEC_TASK_SIZE;
70918 + address_m = address + SEGMEXEC_TASK_SIZE;
70920 + pgd_m = pgd_offset(mm, address_m);
70921 + pud_m = pud_alloc(mm, pgd_m, address_m);
70923 + return VM_FAULT_OOM;
70924 + pmd_m = pmd_alloc(mm, pud_m, address_m);
70926 + return VM_FAULT_OOM;
70927 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
70928 + return VM_FAULT_OOM;
70929 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
70933 pgd = pgd_offset(mm, address);
70934 pud = pud_alloc(mm, pgd, address);
70936 @@ -3487,7 +3725,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
70937 * run pte_offset_map on the pmd, if an huge pmd could
70938 * materialize from under us from a different thread.
70940 - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
70941 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
70942 return VM_FAULT_OOM;
70943 /* if an huge pmd materialized from under us just retry later */
70944 if (unlikely(pmd_trans_huge(*pmd)))
70945 @@ -3591,7 +3829,7 @@ static int __init gate_vma_init(void)
70946 gate_vma.vm_start = FIXADDR_USER_START;
70947 gate_vma.vm_end = FIXADDR_USER_END;
70948 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
70949 - gate_vma.vm_page_prot = __P101;
70950 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
70952 * Make sure the vDSO gets into every core dump.
70953 * Dumping its contents makes post-mortem fully interpretable later
70954 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
70955 index 9c51f9f..f2b1c49 100644
70956 --- a/mm/mempolicy.c
70957 +++ b/mm/mempolicy.c
70958 @@ -636,20 +636,33 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70959 struct vm_area_struct *prev;
70960 struct vm_area_struct *vma;
70963 unsigned long vmstart;
70964 unsigned long vmend;
70966 +#ifdef CONFIG_PAX_SEGMEXEC
70967 + struct vm_area_struct *vma_m;
70970 vma = find_vma_prev(mm, start, &prev);
70971 if (!vma || vma->vm_start > start)
70974 + if (start > vma->vm_start)
70977 for (; vma && vma->vm_start < end; prev = vma, vma = next) {
70978 next = vma->vm_next;
70979 vmstart = max(start, vma->vm_start);
70980 vmend = min(end, vma->vm_end);
70982 + if (mpol_equal(vma_policy(vma), new_pol))
70985 + pgoff = vma->vm_pgoff +
70986 + ((vmstart - vma->vm_start) >> PAGE_SHIFT);
70987 prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,
70988 - vma->anon_vma, vma->vm_file, vma->vm_pgoff,
70989 + vma->anon_vma, vma->vm_file, pgoff,
70993 @@ -669,6 +682,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
70994 err = policy_vma(vma, new_pol);
70998 +#ifdef CONFIG_PAX_SEGMEXEC
70999 + vma_m = pax_find_mirror_vma(vma);
71001 + err = policy_vma(vma_m, new_pol);
71010 @@ -1102,6 +1125,17 @@ static long do_mbind(unsigned long start, unsigned long len,
71015 +#ifdef CONFIG_PAX_SEGMEXEC
71016 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
71017 + if (end > SEGMEXEC_TASK_SIZE)
71022 + if (end > TASK_SIZE)
71028 @@ -1320,6 +1354,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71032 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71033 + if (mm != current->mm &&
71034 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71041 * Check if this process has the right to modify the specified
71042 * process. The right exists if the process has administrative
71043 @@ -1329,8 +1371,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
71045 tcred = __task_cred(task);
71046 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71047 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
71048 - !capable(CAP_SYS_NICE)) {
71049 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71053 diff --git a/mm/migrate.c b/mm/migrate.c
71054 index 14d0a6a..0360908 100644
71057 @@ -866,9 +866,9 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
71060 put_anon_vma(anon_vma);
71062 unlock_page(hpage);
71065 if (rc != -EAGAIN) {
71066 list_del(&hpage->lru);
71068 @@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
71069 unsigned long chunk_start;
71072 + pax_track_stack();
71074 task_nodes = cpuset_mems_allowed(task);
71077 @@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71081 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
71082 + if (mm != current->mm &&
71083 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
71090 * Check if this process has the right to modify the specified
71091 * process. The right exists if the process has administrative
71092 @@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
71094 tcred = __task_cred(task);
71095 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
71096 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
71097 - !capable(CAP_SYS_NICE)) {
71098 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
71102 diff --git a/mm/mlock.c b/mm/mlock.c
71103 index 048260c..57f4a4e 100644
71107 #include <linux/pagemap.h>
71108 #include <linux/mempolicy.h>
71109 #include <linux/syscalls.h>
71110 +#include <linux/security.h>
71111 #include <linux/sched.h>
71112 #include <linux/module.h>
71113 #include <linux/rmap.h>
71114 @@ -377,6 +378,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
71118 + if (end > TASK_SIZE)
71121 vma = find_vma_prev(current->mm, start, &prev);
71122 if (!vma || vma->vm_start > start)
71124 @@ -387,6 +391,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
71125 for (nstart = start ; ; ) {
71126 vm_flags_t newflags;
71128 +#ifdef CONFIG_PAX_SEGMEXEC
71129 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71133 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
71135 newflags = vma->vm_flags | VM_LOCKED;
71136 @@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
71137 lock_limit >>= PAGE_SHIFT;
71139 /* check against resource limits */
71140 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
71141 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
71142 error = do_mlock(start, len, 1);
71143 up_write(¤t->mm->mmap_sem);
71144 @@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
71145 static int do_mlockall(int flags)
71147 struct vm_area_struct * vma, * prev = NULL;
71148 - unsigned int def_flags = 0;
71150 if (flags & MCL_FUTURE)
71151 - def_flags = VM_LOCKED;
71152 - current->mm->def_flags = def_flags;
71153 + current->mm->def_flags |= VM_LOCKED;
71155 + current->mm->def_flags &= ~VM_LOCKED;
71156 if (flags == MCL_FUTURE)
71159 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
71160 vm_flags_t newflags;
71162 +#ifdef CONFIG_PAX_SEGMEXEC
71163 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
71167 + BUG_ON(vma->vm_end > TASK_SIZE);
71168 newflags = vma->vm_flags | VM_LOCKED;
71169 if (!(flags & MCL_CURRENT))
71170 newflags &= ~VM_LOCKED;
71171 @@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
71172 lock_limit >>= PAGE_SHIFT;
71175 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
71176 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
71177 capable(CAP_IPC_LOCK))
71178 ret = do_mlockall(flags);
71179 diff --git a/mm/mmap.c b/mm/mmap.c
71180 index a65efd4..17d61ff 100644
71184 #define arch_rebalance_pgtables(addr, len) (addr)
71187 +static inline void verify_mm_writelocked(struct mm_struct *mm)
71189 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
71190 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
71191 + up_read(&mm->mmap_sem);
71197 static void unmap_region(struct mm_struct *mm,
71198 struct vm_area_struct *vma, struct vm_area_struct *prev,
71199 unsigned long start, unsigned long end);
71200 @@ -71,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
71201 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
71204 -pgprot_t protection_map[16] = {
71205 +pgprot_t protection_map[16] __read_only = {
71206 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
71207 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
71210 -pgprot_t vm_get_page_prot(unsigned long vm_flags)
71211 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
71213 - return __pgprot(pgprot_val(protection_map[vm_flags &
71214 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
71215 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
71216 pgprot_val(arch_vm_get_page_prot(vm_flags)));
71218 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71219 + if (!(__supported_pte_mask & _PAGE_NX) &&
71220 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
71221 + (vm_flags & (VM_READ | VM_WRITE)))
71222 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
71227 EXPORT_SYMBOL(vm_get_page_prot);
71229 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
71230 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
71231 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
71232 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
71234 * Make sure vm_committed_as in one cacheline and not cacheline shared with
71235 * other variables. It can be updated by several CPUs frequently.
71236 @@ -228,6 +248,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
71237 struct vm_area_struct *next = vma->vm_next;
71240 + BUG_ON(vma->vm_mirror);
71241 if (vma->vm_ops && vma->vm_ops->close)
71242 vma->vm_ops->close(vma);
71243 if (vma->vm_file) {
71244 @@ -272,6 +293,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
71245 * not page aligned -Ram Gupta
71247 rlim = rlimit(RLIMIT_DATA);
71248 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
71249 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
71250 (mm->end_data - mm->start_data) > rlim)
71252 @@ -689,6 +711,12 @@ static int
71253 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
71254 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71257 +#ifdef CONFIG_PAX_SEGMEXEC
71258 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
71262 if (is_mergeable_vma(vma, file, vm_flags) &&
71263 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71264 if (vma->vm_pgoff == vm_pgoff)
71265 @@ -708,6 +736,12 @@ static int
71266 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71267 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
71270 +#ifdef CONFIG_PAX_SEGMEXEC
71271 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
71275 if (is_mergeable_vma(vma, file, vm_flags) &&
71276 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
71278 @@ -750,13 +784,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
71279 struct vm_area_struct *vma_merge(struct mm_struct *mm,
71280 struct vm_area_struct *prev, unsigned long addr,
71281 unsigned long end, unsigned long vm_flags,
71282 - struct anon_vma *anon_vma, struct file *file,
71283 + struct anon_vma *anon_vma, struct file *file,
71284 pgoff_t pgoff, struct mempolicy *policy)
71286 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
71287 struct vm_area_struct *area, *next;
71290 +#ifdef CONFIG_PAX_SEGMEXEC
71291 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
71292 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
71294 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
71298 * We later require that vma->vm_flags == vm_flags,
71299 * so this tests vma->vm_flags & VM_SPECIAL, too.
71300 @@ -772,6 +813,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71301 if (next && next->vm_end == end) /* cases 6, 7, 8 */
71302 next = next->vm_next;
71304 +#ifdef CONFIG_PAX_SEGMEXEC
71306 + prev_m = pax_find_mirror_vma(prev);
71308 + area_m = pax_find_mirror_vma(area);
71310 + next_m = pax_find_mirror_vma(next);
71314 * Can it merge with the predecessor?
71316 @@ -791,9 +841,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71318 err = vma_adjust(prev, prev->vm_start,
71319 next->vm_end, prev->vm_pgoff, NULL);
71320 - } else /* cases 2, 5, 7 */
71322 +#ifdef CONFIG_PAX_SEGMEXEC
71323 + if (!err && prev_m)
71324 + err = vma_adjust(prev_m, prev_m->vm_start,
71325 + next_m->vm_end, prev_m->vm_pgoff, NULL);
71328 + } else { /* cases 2, 5, 7 */
71329 err = vma_adjust(prev, prev->vm_start,
71330 end, prev->vm_pgoff, NULL);
71332 +#ifdef CONFIG_PAX_SEGMEXEC
71333 + if (!err && prev_m)
71334 + err = vma_adjust(prev_m, prev_m->vm_start,
71335 + end_m, prev_m->vm_pgoff, NULL);
71341 khugepaged_enter_vma_merge(prev);
71342 @@ -807,12 +872,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
71343 mpol_equal(policy, vma_policy(next)) &&
71344 can_vma_merge_before(next, vm_flags,
71345 anon_vma, file, pgoff+pglen)) {
71346 - if (prev && addr < prev->vm_end) /* case 4 */
71347 + if (prev && addr < prev->vm_end) { /* case 4 */
71348 err = vma_adjust(prev, prev->vm_start,
71349 addr, prev->vm_pgoff, NULL);
71350 - else /* cases 3, 8 */
71352 +#ifdef CONFIG_PAX_SEGMEXEC
71353 + if (!err && prev_m)
71354 + err = vma_adjust(prev_m, prev_m->vm_start,
71355 + addr_m, prev_m->vm_pgoff, NULL);
71358 + } else { /* cases 3, 8 */
71359 err = vma_adjust(area, addr, next->vm_end,
71360 next->vm_pgoff - pglen, NULL);
71362 +#ifdef CONFIG_PAX_SEGMEXEC
71363 + if (!err && area_m)
71364 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
71365 + next_m->vm_pgoff - pglen, NULL);
71371 khugepaged_enter_vma_merge(area);
71372 @@ -921,14 +1001,11 @@ none:
71373 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
71374 struct file *file, long pages)
71376 - const unsigned long stack_flags
71377 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
71380 mm->shared_vm += pages;
71381 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
71382 mm->exec_vm += pages;
71383 - } else if (flags & stack_flags)
71384 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
71385 mm->stack_vm += pages;
71386 if (flags & (VM_RESERVED|VM_IO))
71387 mm->reserved_vm += pages;
71388 @@ -955,7 +1032,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71389 * (the exception is when the underlying filesystem is noexec
71390 * mounted, in which case we dont add PROT_EXEC.)
71392 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
71393 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
71394 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
71397 @@ -981,7 +1058,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71398 /* Obtain the address to map to. we verify (or select) it and ensure
71399 * that it represents a valid section of the address space.
71401 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
71402 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
71403 if (addr & ~PAGE_MASK)
71406 @@ -992,6 +1069,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71407 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
71408 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
71410 +#ifdef CONFIG_PAX_MPROTECT
71411 + if (mm->pax_flags & MF_PAX_MPROTECT) {
71412 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
71413 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
71414 + gr_log_rwxmmap(file);
71416 +#ifdef CONFIG_PAX_EMUPLT
71417 + vm_flags &= ~VM_EXEC;
71424 + if (!(vm_flags & VM_EXEC))
71425 + vm_flags &= ~VM_MAYEXEC;
71427 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
71428 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
71431 + vm_flags &= ~VM_MAYWRITE;
71435 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71436 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
71437 + vm_flags &= ~VM_PAGEEXEC;
71440 if (flags & MAP_LOCKED)
71441 if (!can_do_mlock())
71443 @@ -1003,6 +1110,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71444 locked += mm->locked_vm;
71445 lock_limit = rlimit(RLIMIT_MEMLOCK);
71446 lock_limit >>= PAGE_SHIFT;
71447 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71448 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
71451 @@ -1073,6 +1181,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
71455 + if (!gr_acl_handle_mmap(file, prot))
71458 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
71460 EXPORT_SYMBOL(do_mmap_pgoff);
71461 @@ -1153,7 +1264,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
71462 vm_flags_t vm_flags = vma->vm_flags;
71464 /* If it was private or non-writable, the write bit is already clear */
71465 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
71466 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
71469 /* The backer wishes to know when pages are first written to? */
71470 @@ -1202,14 +1313,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
71471 unsigned long charged = 0;
71472 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
71474 +#ifdef CONFIG_PAX_SEGMEXEC
71475 + struct vm_area_struct *vma_m = NULL;
71479 + * mm->mmap_sem is required to protect against another thread
71480 + * changing the mappings in case we sleep.
71482 + verify_mm_writelocked(mm);
71484 /* Clear old maps */
71487 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71488 if (vma && vma->vm_start < addr + len) {
71489 if (do_munmap(mm, addr, len))
71491 - goto munmap_back;
71492 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71493 + BUG_ON(vma && vma->vm_start < addr + len);
71496 /* Check against address space limit. */
71497 @@ -1258,6 +1379,16 @@ munmap_back:
71501 +#ifdef CONFIG_PAX_SEGMEXEC
71502 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
71503 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71512 vma->vm_start = addr;
71513 vma->vm_end = addr + len;
71514 @@ -1281,6 +1412,19 @@ munmap_back:
71515 error = file->f_op->mmap(file, vma);
71517 goto unmap_and_free_vma;
71519 +#ifdef CONFIG_PAX_SEGMEXEC
71520 + if (vma_m && (vm_flags & VM_EXECUTABLE))
71521 + added_exe_file_vma(mm);
71524 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71525 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
71526 + vma->vm_flags |= VM_PAGEEXEC;
71527 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
71531 if (vm_flags & VM_EXECUTABLE)
71532 added_exe_file_vma(mm);
71534 @@ -1316,6 +1460,11 @@ munmap_back:
71535 vma_link(mm, vma, prev, rb_link, rb_parent);
71536 file = vma->vm_file;
71538 +#ifdef CONFIG_PAX_SEGMEXEC
71540 + BUG_ON(pax_mirror_vma(vma_m, vma));
71543 /* Once vma denies write, undo our temporary denial count */
71544 if (correct_wcount)
71545 atomic_inc(&inode->i_writecount);
71546 @@ -1324,6 +1473,7 @@ out:
71548 mm->total_vm += len >> PAGE_SHIFT;
71549 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
71550 + track_exec_limit(mm, addr, addr + len, vm_flags);
71551 if (vm_flags & VM_LOCKED) {
71552 if (!mlock_vma_pages_range(vma, addr, addr + len))
71553 mm->locked_vm += (len >> PAGE_SHIFT);
71554 @@ -1341,6 +1491,12 @@ unmap_and_free_vma:
71555 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
71559 +#ifdef CONFIG_PAX_SEGMEXEC
71561 + kmem_cache_free(vm_area_cachep, vma_m);
71564 kmem_cache_free(vm_area_cachep, vma);
71567 @@ -1348,6 +1504,44 @@ unacct_error:
71571 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
71574 +#ifdef CONFIG_STACK_GROWSUP
71575 + if (addr > sysctl_heap_stack_gap)
71576 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
71578 + vma = find_vma(current->mm, 0);
71579 + if (vma && (vma->vm_flags & VM_GROWSUP))
71585 + if (addr + len > vma->vm_start)
71588 + if (vma->vm_flags & VM_GROWSDOWN)
71589 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
71590 +#ifdef CONFIG_STACK_GROWSUP
71591 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
71592 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
71598 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
71600 + if (vma->vm_start < len)
71602 + if (!(vma->vm_flags & VM_GROWSDOWN))
71603 + return vma->vm_start - len;
71604 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
71605 + return vma->vm_start - len - sysctl_heap_stack_gap;
71609 /* Get an address range which is currently unmapped.
71610 * For shmat() with addr=0.
71612 @@ -1374,18 +1568,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
71613 if (flags & MAP_FIXED)
71616 +#ifdef CONFIG_PAX_RANDMMAP
71617 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71621 addr = PAGE_ALIGN(addr);
71622 - vma = find_vma(mm, addr);
71623 - if (TASK_SIZE - len >= addr &&
71624 - (!vma || addr + len <= vma->vm_start))
71626 + if (TASK_SIZE - len >= addr) {
71627 + vma = find_vma(mm, addr);
71628 + if (check_heap_stack_gap(vma, addr, len))
71632 if (len > mm->cached_hole_size) {
71633 - start_addr = addr = mm->free_area_cache;
71634 + start_addr = addr = mm->free_area_cache;
71636 - start_addr = addr = TASK_UNMAPPED_BASE;
71637 - mm->cached_hole_size = 0;
71638 + start_addr = addr = mm->mmap_base;
71639 + mm->cached_hole_size = 0;
71643 @@ -1396,34 +1595,40 @@ full_search:
71644 * Start a new search - just in case we missed
71647 - if (start_addr != TASK_UNMAPPED_BASE) {
71648 - addr = TASK_UNMAPPED_BASE;
71649 - start_addr = addr;
71650 + if (start_addr != mm->mmap_base) {
71651 + start_addr = addr = mm->mmap_base;
71652 mm->cached_hole_size = 0;
71657 - if (!vma || addr + len <= vma->vm_start) {
71659 - * Remember the place where we stopped the search:
71661 - mm->free_area_cache = addr + len;
71664 + if (check_heap_stack_gap(vma, addr, len))
71666 if (addr + mm->cached_hole_size < vma->vm_start)
71667 mm->cached_hole_size = vma->vm_start - addr;
71668 addr = vma->vm_end;
71672 + * Remember the place where we stopped the search:
71674 + mm->free_area_cache = addr + len;
71679 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
71682 +#ifdef CONFIG_PAX_SEGMEXEC
71683 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71688 * Is this a new hole at the lowest possible address?
71690 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
71691 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
71692 mm->free_area_cache = addr;
71693 mm->cached_hole_size = ~0UL;
71695 @@ -1441,7 +1646,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71697 struct vm_area_struct *vma;
71698 struct mm_struct *mm = current->mm;
71699 - unsigned long addr = addr0;
71700 + unsigned long base = mm->mmap_base, addr = addr0;
71702 /* requested length too big for entire address space */
71703 if (len > TASK_SIZE)
71704 @@ -1450,13 +1655,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71705 if (flags & MAP_FIXED)
71708 +#ifdef CONFIG_PAX_RANDMMAP
71709 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71712 /* requesting a specific address */
71714 addr = PAGE_ALIGN(addr);
71715 - vma = find_vma(mm, addr);
71716 - if (TASK_SIZE - len >= addr &&
71717 - (!vma || addr + len <= vma->vm_start))
71719 + if (TASK_SIZE - len >= addr) {
71720 + vma = find_vma(mm, addr);
71721 + if (check_heap_stack_gap(vma, addr, len))
71726 /* check if free_area_cache is useful for us */
71727 @@ -1471,7 +1681,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71728 /* make sure it can fit in the remaining address space */
71730 vma = find_vma(mm, addr-len);
71731 - if (!vma || addr <= vma->vm_start)
71732 + if (check_heap_stack_gap(vma, addr - len, len))
71733 /* remember the address as a hint for next time */
71734 return (mm->free_area_cache = addr-len);
71736 @@ -1488,7 +1698,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71737 * return with success:
71739 vma = find_vma(mm, addr);
71740 - if (!vma || addr+len <= vma->vm_start)
71741 + if (check_heap_stack_gap(vma, addr, len))
71742 /* remember the address as a hint for next time */
71743 return (mm->free_area_cache = addr);
71745 @@ -1497,8 +1707,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
71746 mm->cached_hole_size = vma->vm_start - addr;
71748 /* try just below the current vma->vm_start */
71749 - addr = vma->vm_start-len;
71750 - } while (len < vma->vm_start);
71751 + addr = skip_heap_stack_gap(vma, len);
71752 + } while (!IS_ERR_VALUE(addr));
71756 @@ -1507,13 +1717,21 @@ bottomup:
71757 * can happen with large stack limits and large mmap()
71760 + mm->mmap_base = TASK_UNMAPPED_BASE;
71762 +#ifdef CONFIG_PAX_RANDMMAP
71763 + if (mm->pax_flags & MF_PAX_RANDMMAP)
71764 + mm->mmap_base += mm->delta_mmap;
71767 + mm->free_area_cache = mm->mmap_base;
71768 mm->cached_hole_size = ~0UL;
71769 - mm->free_area_cache = TASK_UNMAPPED_BASE;
71770 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
71772 * Restore the topdown base:
71774 - mm->free_area_cache = mm->mmap_base;
71775 + mm->mmap_base = base;
71776 + mm->free_area_cache = base;
71777 mm->cached_hole_size = ~0UL;
71780 @@ -1522,6 +1740,12 @@ bottomup:
71782 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71785 +#ifdef CONFIG_PAX_SEGMEXEC
71786 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71791 * Is this a new hole at the highest possible address?
71793 @@ -1529,8 +1753,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71794 mm->free_area_cache = addr;
71796 /* dont allow allocations above current base */
71797 - if (mm->free_area_cache > mm->mmap_base)
71798 + if (mm->free_area_cache > mm->mmap_base) {
71799 mm->free_area_cache = mm->mmap_base;
71800 + mm->cached_hole_size = ~0UL;
71805 @@ -1638,6 +1864,28 @@ out:
71806 return prev ? prev->vm_next : vma;
71809 +#ifdef CONFIG_PAX_SEGMEXEC
71810 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
71812 + struct vm_area_struct *vma_m;
71814 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
71815 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
71816 + BUG_ON(vma->vm_mirror);
71819 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
71820 + vma_m = vma->vm_mirror;
71821 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
71822 + BUG_ON(vma->vm_file != vma_m->vm_file);
71823 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
71824 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
71825 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
71826 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
71832 * Verify that the stack growth is acceptable and
71833 * update accounting. This is shared with both the
71834 @@ -1654,6 +1902,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71837 /* Stack limit test */
71838 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
71839 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
71842 @@ -1664,6 +1913,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71843 locked = mm->locked_vm + grow;
71844 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
71845 limit >>= PAGE_SHIFT;
71846 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71847 if (locked > limit && !capable(CAP_IPC_LOCK))
71850 @@ -1694,37 +1944,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
71851 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
71852 * vma is the last one with address > vma->vm_end. Have to extend vma.
71854 +#ifndef CONFIG_IA64
71857 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71862 if (!(vma->vm_flags & VM_GROWSUP))
71865 + /* Also guard against wrapping around to address 0. */
71866 + if (address < PAGE_ALIGN(address+1))
71867 + address = PAGE_ALIGN(address+1);
71872 * We must make sure the anon_vma is allocated
71873 * so that the anon_vma locking is not a noop.
71875 if (unlikely(anon_vma_prepare(vma)))
71877 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
71878 + if (locknext && anon_vma_prepare(vma->vm_next))
71880 vma_lock_anon_vma(vma);
71882 + vma_lock_anon_vma(vma->vm_next);
71885 * vma->vm_start/vm_end cannot change under us because the caller
71886 * is required to hold the mmap_sem in read mode. We need the
71887 - * anon_vma lock to serialize against concurrent expand_stacks.
71888 - * Also guard against wrapping around to address 0.
71889 + * anon_vma locks to serialize against concurrent expand_stacks
71890 + * and expand_upwards.
71892 - if (address < PAGE_ALIGN(address+4))
71893 - address = PAGE_ALIGN(address+4);
71895 - vma_unlock_anon_vma(vma);
71900 /* Somebody else might have raced and expanded it already */
71901 - if (address > vma->vm_end) {
71902 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
71904 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
71905 unsigned long size, grow;
71907 size = address - vma->vm_start;
71908 @@ -1739,6 +2000,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71913 + vma_unlock_anon_vma(vma->vm_next);
71914 vma_unlock_anon_vma(vma);
71915 khugepaged_enter_vma_merge(vma);
71917 @@ -1752,6 +2015,8 @@ int expand_downwards(struct vm_area_struct *vma,
71918 unsigned long address)
71921 + bool lockprev = false;
71922 + struct vm_area_struct *prev;
71925 * We must make sure the anon_vma is allocated
71926 @@ -1765,6 +2030,15 @@ int expand_downwards(struct vm_area_struct *vma,
71930 + prev = vma->vm_prev;
71931 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
71932 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
71934 + if (lockprev && anon_vma_prepare(prev))
71937 + vma_lock_anon_vma(prev);
71939 vma_lock_anon_vma(vma);
71942 @@ -1774,9 +2048,17 @@ int expand_downwards(struct vm_area_struct *vma,
71945 /* Somebody else might have raced and expanded it already */
71946 - if (address < vma->vm_start) {
71947 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
71949 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
71950 unsigned long size, grow;
71952 +#ifdef CONFIG_PAX_SEGMEXEC
71953 + struct vm_area_struct *vma_m;
71955 + vma_m = pax_find_mirror_vma(vma);
71958 size = vma->vm_end - address;
71959 grow = (vma->vm_start - address) >> PAGE_SHIFT;
71961 @@ -1786,11 +2068,22 @@ int expand_downwards(struct vm_area_struct *vma,
71963 vma->vm_start = address;
71964 vma->vm_pgoff -= grow;
71965 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
71967 +#ifdef CONFIG_PAX_SEGMEXEC
71969 + vma_m->vm_start -= grow << PAGE_SHIFT;
71970 + vma_m->vm_pgoff -= grow;
71974 perf_event_mmap(vma);
71978 vma_unlock_anon_vma(vma);
71980 + vma_unlock_anon_vma(prev);
71981 khugepaged_enter_vma_merge(vma);
71984 @@ -1860,6 +2153,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
71986 long nrpages = vma_pages(vma);
71988 +#ifdef CONFIG_PAX_SEGMEXEC
71989 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
71990 + vma = remove_vma(vma);
71995 mm->total_vm -= nrpages;
71996 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
71997 vma = remove_vma(vma);
71998 @@ -1905,6 +2205,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
71999 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
72000 vma->vm_prev = NULL;
72003 +#ifdef CONFIG_PAX_SEGMEXEC
72004 + if (vma->vm_mirror) {
72005 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
72006 + vma->vm_mirror->vm_mirror = NULL;
72007 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
72008 + vma->vm_mirror = NULL;
72012 rb_erase(&vma->vm_rb, &mm->mm_rb);
72015 @@ -1933,14 +2243,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72016 struct vm_area_struct *new;
72019 +#ifdef CONFIG_PAX_SEGMEXEC
72020 + struct vm_area_struct *vma_m, *new_m = NULL;
72021 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
72024 if (is_vm_hugetlb_page(vma) && (addr &
72025 ~(huge_page_mask(hstate_vma(vma)))))
72028 +#ifdef CONFIG_PAX_SEGMEXEC
72029 + vma_m = pax_find_mirror_vma(vma);
72032 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72036 +#ifdef CONFIG_PAX_SEGMEXEC
72038 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
72040 + kmem_cache_free(vm_area_cachep, new);
72046 /* most fields are the same, copy all, and then fixup */
72049 @@ -1953,6 +2282,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72050 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
72053 +#ifdef CONFIG_PAX_SEGMEXEC
72056 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
72057 + new_m->vm_mirror = new;
72058 + new->vm_mirror = new_m;
72061 + new_m->vm_end = addr_m;
72063 + new_m->vm_start = addr_m;
72064 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
72069 pol = mpol_dup(vma_policy(vma));
72071 err = PTR_ERR(pol);
72072 @@ -1978,6 +2323,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72074 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
72076 +#ifdef CONFIG_PAX_SEGMEXEC
72077 + if (!err && vma_m) {
72078 + if (anon_vma_clone(new_m, vma_m))
72079 + goto out_free_mpol;
72082 + vma_set_policy(new_m, pol);
72084 + if (new_m->vm_file) {
72085 + get_file(new_m->vm_file);
72086 + if (vma_m->vm_flags & VM_EXECUTABLE)
72087 + added_exe_file_vma(mm);
72090 + if (new_m->vm_ops && new_m->vm_ops->open)
72091 + new_m->vm_ops->open(new_m);
72094 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
72095 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
72097 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
72100 + if (new_m->vm_ops && new_m->vm_ops->close)
72101 + new_m->vm_ops->close(new_m);
72102 + if (new_m->vm_file) {
72103 + if (vma_m->vm_flags & VM_EXECUTABLE)
72104 + removed_exe_file_vma(mm);
72105 + fput(new_m->vm_file);
72115 @@ -1990,10 +2371,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72116 removed_exe_file_vma(mm);
72117 fput(new->vm_file);
72119 - unlink_anon_vmas(new);
72124 +#ifdef CONFIG_PAX_SEGMEXEC
72126 + unlink_anon_vmas(new_m);
72127 + kmem_cache_free(vm_area_cachep, new_m);
72131 + unlink_anon_vmas(new);
72132 kmem_cache_free(vm_area_cachep, new);
72135 @@ -2006,6 +2395,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
72136 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72137 unsigned long addr, int new_below)
72140 +#ifdef CONFIG_PAX_SEGMEXEC
72141 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72142 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
72143 + if (mm->map_count >= sysctl_max_map_count-1)
72148 if (mm->map_count >= sysctl_max_map_count)
72151 @@ -2017,11 +2415,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72152 * work. This now handles partial unmappings.
72153 * Jeremy Fitzhardinge <jeremy@goop.org>
72155 +#ifdef CONFIG_PAX_SEGMEXEC
72156 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72158 + int ret = __do_munmap(mm, start, len);
72159 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
72162 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
72165 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72167 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72171 struct vm_area_struct *vma, *prev, *last;
72174 + * mm->mmap_sem is required to protect against another thread
72175 + * changing the mappings in case we sleep.
72177 + verify_mm_writelocked(mm);
72179 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
72182 @@ -2096,6 +2513,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
72183 /* Fix up all other VM information */
72184 remove_vma_list(mm, vma);
72186 + track_exec_limit(mm, start, end, 0UL);
72191 @@ -2108,22 +2527,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
72193 profile_munmap(addr);
72195 +#ifdef CONFIG_PAX_SEGMEXEC
72196 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
72197 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
72201 down_write(&mm->mmap_sem);
72202 ret = do_munmap(mm, addr, len);
72203 up_write(&mm->mmap_sem);
72207 -static inline void verify_mm_writelocked(struct mm_struct *mm)
72209 -#ifdef CONFIG_DEBUG_VM
72210 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72212 - up_read(&mm->mmap_sem);
72218 * this is really a simplified "do_mmap". it only handles
72219 * anonymous maps. eventually we may be able to do some
72220 @@ -2137,6 +2552,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72221 struct rb_node ** rb_link, * rb_parent;
72222 pgoff_t pgoff = addr >> PAGE_SHIFT;
72224 + unsigned long charged;
72226 len = PAGE_ALIGN(len);
72228 @@ -2148,16 +2564,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72230 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
72232 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
72233 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
72234 + flags &= ~VM_EXEC;
72236 +#ifdef CONFIG_PAX_MPROTECT
72237 + if (mm->pax_flags & MF_PAX_MPROTECT)
72238 + flags &= ~VM_MAYEXEC;
72244 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
72245 if (error & ~PAGE_MASK)
72248 + charged = len >> PAGE_SHIFT;
72251 * mlock MCL_FUTURE?
72253 if (mm->def_flags & VM_LOCKED) {
72254 unsigned long locked, lock_limit;
72255 - locked = len >> PAGE_SHIFT;
72256 + locked = charged;
72257 locked += mm->locked_vm;
72258 lock_limit = rlimit(RLIMIT_MEMLOCK);
72259 lock_limit >>= PAGE_SHIFT;
72260 @@ -2174,22 +2604,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72262 * Clear old maps. this also does some error checking for us
72265 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72266 if (vma && vma->vm_start < addr + len) {
72267 if (do_munmap(mm, addr, len))
72269 - goto munmap_back;
72270 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72271 + BUG_ON(vma && vma->vm_start < addr + len);
72274 /* Check against address space limits *after* clearing old maps... */
72275 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
72276 + if (!may_expand_vm(mm, charged))
72279 if (mm->map_count > sysctl_max_map_count)
72282 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
72283 + if (security_vm_enough_memory(charged))
72286 /* Can we just expand an old private anonymous mapping? */
72287 @@ -2203,7 +2633,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72289 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72291 - vm_unacct_memory(len >> PAGE_SHIFT);
72292 + vm_unacct_memory(charged);
72296 @@ -2217,11 +2647,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
72297 vma_link(mm, vma, prev, rb_link, rb_parent);
72299 perf_event_mmap(vma);
72300 - mm->total_vm += len >> PAGE_SHIFT;
72301 + mm->total_vm += charged;
72302 if (flags & VM_LOCKED) {
72303 if (!mlock_vma_pages_range(vma, addr, addr + len))
72304 - mm->locked_vm += (len >> PAGE_SHIFT);
72305 + mm->locked_vm += charged;
72307 + track_exec_limit(mm, addr, addr + len, flags);
72311 @@ -2268,8 +2699,10 @@ void exit_mmap(struct mm_struct *mm)
72312 * Walk the list again, actually closing and freeing it,
72313 * with preemption enabled, without holding any MM locks.
72317 + vma->vm_mirror = NULL;
72318 vma = remove_vma(vma);
72321 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
72323 @@ -2283,6 +2716,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72324 struct vm_area_struct * __vma, * prev;
72325 struct rb_node ** rb_link, * rb_parent;
72327 +#ifdef CONFIG_PAX_SEGMEXEC
72328 + struct vm_area_struct *vma_m = NULL;
72331 + if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
72335 * The vm_pgoff of a purely anonymous vma should be irrelevant
72336 * until its first write fault, when page's anon_vma and index
72337 @@ -2305,7 +2745,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
72338 if ((vma->vm_flags & VM_ACCOUNT) &&
72339 security_vm_enough_memory_mm(mm, vma_pages(vma)))
72342 +#ifdef CONFIG_PAX_SEGMEXEC
72343 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
72344 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72350 vma_link(mm, vma, prev, rb_link, rb_parent);
72352 +#ifdef CONFIG_PAX_SEGMEXEC
72354 + BUG_ON(pax_mirror_vma(vma_m, vma));
72360 @@ -2323,6 +2778,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72361 struct rb_node **rb_link, *rb_parent;
72362 struct mempolicy *pol;
72364 + BUG_ON(vma->vm_mirror);
72367 * If anonymous vma has not yet been faulted, update new pgoff
72368 * to match new location, to increase its chance of merging.
72369 @@ -2373,6 +2830,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
72373 +#ifdef CONFIG_PAX_SEGMEXEC
72374 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
72376 + struct vm_area_struct *prev_m;
72377 + struct rb_node **rb_link_m, *rb_parent_m;
72378 + struct mempolicy *pol_m;
72380 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
72381 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
72382 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
72384 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
72385 + if (anon_vma_clone(vma_m, vma))
72387 + pol_m = vma_policy(vma_m);
72389 + vma_set_policy(vma_m, pol_m);
72390 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
72391 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
72392 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
72393 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
72394 + if (vma_m->vm_file)
72395 + get_file(vma_m->vm_file);
72396 + if (vma_m->vm_ops && vma_m->vm_ops->open)
72397 + vma_m->vm_ops->open(vma_m);
72398 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
72399 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
72400 + vma_m->vm_mirror = vma;
72401 + vma->vm_mirror = vma_m;
72407 * Return true if the calling process may expand its vm space by the passed
72409 @@ -2383,7 +2873,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
72412 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
72414 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
72415 if (cur + npages > lim)
72418 @@ -2454,6 +2944,22 @@ int install_special_mapping(struct mm_struct *mm,
72419 vma->vm_start = addr;
72420 vma->vm_end = addr + len;
72422 +#ifdef CONFIG_PAX_MPROTECT
72423 + if (mm->pax_flags & MF_PAX_MPROTECT) {
72424 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
72425 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
72427 + if (!(vm_flags & VM_EXEC))
72428 + vm_flags &= ~VM_MAYEXEC;
72430 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72431 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72434 + vm_flags &= ~VM_MAYWRITE;
72438 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
72439 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72441 diff --git a/mm/mprotect.c b/mm/mprotect.c
72442 index 5a688a2..27e031c 100644
72443 --- a/mm/mprotect.c
72444 +++ b/mm/mprotect.c
72445 @@ -23,10 +23,16 @@
72446 #include <linux/mmu_notifier.h>
72447 #include <linux/migrate.h>
72448 #include <linux/perf_event.h>
72450 +#ifdef CONFIG_PAX_MPROTECT
72451 +#include <linux/elf.h>
72454 #include <asm/uaccess.h>
72455 #include <asm/pgtable.h>
72456 #include <asm/cacheflush.h>
72457 #include <asm/tlbflush.h>
72458 +#include <asm/mmu_context.h>
72460 #ifndef pgprot_modify
72461 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
72462 @@ -141,6 +147,48 @@ static void change_protection(struct vm_area_struct *vma,
72463 flush_tlb_range(vma, start, end);
72466 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72467 +/* called while holding the mmap semaphor for writing except stack expansion */
72468 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
72470 + unsigned long oldlimit, newlimit = 0UL;
72472 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
72475 + spin_lock(&mm->page_table_lock);
72476 + oldlimit = mm->context.user_cs_limit;
72477 + if ((prot & VM_EXEC) && oldlimit < end)
72478 + /* USER_CS limit moved up */
72480 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
72481 + /* USER_CS limit moved down */
72482 + newlimit = start;
72485 + mm->context.user_cs_limit = newlimit;
72489 + cpus_clear(mm->context.cpu_user_cs_mask);
72490 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
72493 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
72495 + spin_unlock(&mm->page_table_lock);
72496 + if (newlimit == end) {
72497 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
72499 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
72500 + if (is_vm_hugetlb_page(vma))
72501 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
72503 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
72509 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72510 unsigned long start, unsigned long end, unsigned long newflags)
72511 @@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72513 int dirty_accountable = 0;
72515 +#ifdef CONFIG_PAX_SEGMEXEC
72516 + struct vm_area_struct *vma_m = NULL;
72517 + unsigned long start_m, end_m;
72519 + start_m = start + SEGMEXEC_TASK_SIZE;
72520 + end_m = end + SEGMEXEC_TASK_SIZE;
72523 if (newflags == oldflags) {
72528 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
72529 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
72531 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
72534 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
72539 * If we make a private mapping writable we increase our commit;
72540 * but (without finer accounting) cannot reduce our commit if we
72541 @@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72545 +#ifdef CONFIG_PAX_SEGMEXEC
72546 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
72547 + if (start != vma->vm_start) {
72548 + error = split_vma(mm, vma, start, 1);
72551 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
72552 + *pprev = (*pprev)->vm_next;
72555 + if (end != vma->vm_end) {
72556 + error = split_vma(mm, vma, end, 0);
72561 + if (pax_find_mirror_vma(vma)) {
72562 + error = __do_munmap(mm, start_m, end_m - start_m);
72566 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72571 + vma->vm_flags = newflags;
72572 + error = pax_mirror_vma(vma_m, vma);
72574 + vma->vm_flags = oldflags;
72582 * First try to merge with previous and/or next vma.
72584 @@ -204,9 +306,21 @@ success:
72585 * vm_flags and vm_page_prot are protected by the mmap_sem
72586 * held in write mode.
72589 +#ifdef CONFIG_PAX_SEGMEXEC
72590 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
72591 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
72594 vma->vm_flags = newflags;
72596 +#ifdef CONFIG_PAX_MPROTECT
72597 + if (mm->binfmt && mm->binfmt->handle_mprotect)
72598 + mm->binfmt->handle_mprotect(vma, newflags);
72601 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
72602 - vm_get_page_prot(newflags));
72603 + vm_get_page_prot(vma->vm_flags));
72605 if (vma_wants_writenotify(vma)) {
72606 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
72607 @@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72612 +#ifdef CONFIG_PAX_SEGMEXEC
72613 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
72614 + if (end > SEGMEXEC_TASK_SIZE)
72619 + if (end > TASK_SIZE)
72622 if (!arch_validate_prot(prot))
72625 @@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72627 * Does the application expect PROT_READ to imply PROT_EXEC:
72629 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72630 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72633 vm_flags = calc_vm_prot_bits(prot);
72634 @@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72635 if (start > vma->vm_start)
72638 +#ifdef CONFIG_PAX_MPROTECT
72639 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
72640 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
72643 for (nstart = start ; ; ) {
72644 unsigned long newflags;
72646 @@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72648 /* newflags >> 4 shift VM_MAY% in place of VM_% */
72649 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
72650 + if (prot & (PROT_WRITE | PROT_EXEC))
72651 + gr_log_rwxmprotect(vma->vm_file);
72657 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
72661 @@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
72662 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
72666 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
72670 if (nstart < prev->vm_end)
72671 diff --git a/mm/mremap.c b/mm/mremap.c
72672 index 506fa44..ccc0ba9 100644
72675 @@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
72677 pte = ptep_clear_flush(vma, old_addr, old_pte);
72678 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
72680 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72681 + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
72682 + pte = pte_exprotect(pte);
72685 set_pte_at(mm, new_addr, new_pte, pte);
72688 @@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
72689 if (is_vm_hugetlb_page(vma))
72692 +#ifdef CONFIG_PAX_SEGMEXEC
72693 + if (pax_find_mirror_vma(vma))
72697 /* We can't remap across vm area boundaries */
72698 if (old_len > vma->vm_end - addr)
72700 @@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned long addr,
72701 unsigned long ret = -EINVAL;
72702 unsigned long charged = 0;
72703 unsigned long map_flags;
72704 + unsigned long pax_task_size = TASK_SIZE;
72706 if (new_addr & ~PAGE_MASK)
72709 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
72710 +#ifdef CONFIG_PAX_SEGMEXEC
72711 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
72712 + pax_task_size = SEGMEXEC_TASK_SIZE;
72715 + pax_task_size -= PAGE_SIZE;
72717 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
72720 /* Check if the location we're moving into overlaps the
72721 * old location at all, and fail if it does.
72723 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
72726 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
72727 + if (addr + old_len > new_addr && new_addr + new_len > addr)
72730 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72731 @@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long addr,
72732 struct vm_area_struct *vma;
72733 unsigned long ret = -EINVAL;
72734 unsigned long charged = 0;
72735 + unsigned long pax_task_size = TASK_SIZE;
72737 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
72739 @@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long addr,
72743 +#ifdef CONFIG_PAX_SEGMEXEC
72744 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
72745 + pax_task_size = SEGMEXEC_TASK_SIZE;
72748 + pax_task_size -= PAGE_SIZE;
72750 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
72751 + old_len > pax_task_size || addr > pax_task_size-old_len)
72754 if (flags & MREMAP_FIXED) {
72755 if (flags & MREMAP_MAYMOVE)
72756 ret = mremap_to(addr, old_len, new_addr, new_len);
72757 @@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long addr,
72761 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
72765 @@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long addr,
72766 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72770 + map_flags = vma->vm_flags;
72771 ret = move_vma(vma, addr, old_len, new_len, new_addr);
72772 + if (!(ret & ~PAGE_MASK)) {
72773 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
72774 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
72778 if (ret & ~PAGE_MASK)
72779 diff --git a/mm/nobootmem.c b/mm/nobootmem.c
72780 index 6e93dc7..c98df0c 100644
72781 --- a/mm/nobootmem.c
72782 +++ b/mm/nobootmem.c
72783 @@ -110,19 +110,30 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
72784 unsigned long __init free_all_memory_core_early(int nodeid)
72788 + u64 start, end, startrange, endrange;
72789 unsigned long count = 0;
72790 - struct range *range = NULL;
72791 + struct range *range = NULL, rangerange = { 0, 0 };
72794 nr_range = get_free_all_memory_range(&range, nodeid);
72795 + startrange = __pa(range) >> PAGE_SHIFT;
72796 + endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
72798 for (i = 0; i < nr_range; i++) {
72799 start = range[i].start;
72800 end = range[i].end;
72801 + if (start <= endrange && startrange < end) {
72802 + BUG_ON(rangerange.start | rangerange.end);
72803 + rangerange = range[i];
72806 count += end - start;
72807 __free_pages_memory(start, end);
72809 + start = rangerange.start;
72810 + end = rangerange.end;
72811 + count += end - start;
72812 + __free_pages_memory(start, end);
72816 diff --git a/mm/nommu.c b/mm/nommu.c
72817 index 4358032..e79b99f 100644
72820 @@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72821 int sysctl_overcommit_ratio = 50; /* default is 50% */
72822 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
72823 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
72824 -int heap_stack_gap = 0;
72826 atomic_long_t mmap_pages_allocated;
72828 @@ -825,15 +824,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
72829 EXPORT_SYMBOL(find_vma);
72833 - * - we don't extend stack VMAs under NOMMU conditions
72835 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
72837 - return find_vma(mm, addr);
72841 * expand a stack to a given address
72842 * - not supported under NOMMU conditions
72844 @@ -1553,6 +1543,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
72846 /* most fields are the same, copy all, and then fixup */
72848 + INIT_LIST_HEAD(&new->anon_vma_chain);
72849 *region = *vma->vm_region;
72850 new->vm_region = region;
72852 diff --git a/mm/oom_kill.c b/mm/oom_kill.c
72853 index 626303b..e9a1785 100644
72854 --- a/mm/oom_kill.c
72855 +++ b/mm/oom_kill.c
72856 @@ -162,7 +162,7 @@ static bool oom_unkillable_task(struct task_struct *p,
72857 unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
72858 const nodemask_t *nodemask, unsigned long totalpages)
72863 if (oom_unkillable_task(p, mem, nodemask))
72865 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
72866 index e8fae15..18c0442 100644
72867 --- a/mm/page_alloc.c
72868 +++ b/mm/page_alloc.c
72869 @@ -340,7 +340,7 @@ out:
72870 * This usage means that zero-order pages may not be compound.
72873 -static void free_compound_page(struct page *page)
72874 +void free_compound_page(struct page *page)
72876 __free_pages_ok(page, compound_order(page));
72878 @@ -653,6 +653,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72882 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
72883 + unsigned long index = 1UL << order;
72886 trace_mm_page_free_direct(page, order);
72887 kmemcheck_free_shadow(page, order);
72889 @@ -668,6 +672,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
72890 debug_check_no_obj_freed(page_address(page),
72891 PAGE_SIZE << order);
72894 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
72895 + for (; index; --index)
72896 + sanitize_highpage(page + index - 1);
72899 arch_free_page(page, order);
72900 kernel_map_pages(page, 1 << order, 0);
72902 @@ -783,8 +793,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
72903 arch_alloc_page(page, order);
72904 kernel_map_pages(page, 1 << order, 1);
72906 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
72907 if (gfp_flags & __GFP_ZERO)
72908 prep_zero_page(page, order, gfp_flags);
72911 if (order && (gfp_flags & __GFP_COMP))
72912 prep_compound_page(page, order);
72913 @@ -2539,6 +2551,8 @@ void show_free_areas(unsigned int filter)
72917 + pax_track_stack();
72919 for_each_populated_zone(zone) {
72920 if (skip_free_areas_node(filter, zone_to_nid(zone)))
72922 @@ -3350,7 +3364,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
72925 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
72926 +#ifdef CONFIG_X86_32
72927 + /* boot failures in VMware 8 on 32bit vanilla since
72929 + if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
72931 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
72936 diff --git a/mm/percpu.c b/mm/percpu.c
72937 index 93b5a7c..28d642c 100644
72940 @@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
72941 static unsigned int pcpu_high_unit_cpu __read_mostly;
72943 /* the address of the first chunk which starts with the kernel static area */
72944 -void *pcpu_base_addr __read_mostly;
72945 +void *pcpu_base_addr __read_only;
72946 EXPORT_SYMBOL_GPL(pcpu_base_addr);
72948 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
72949 diff --git a/mm/rmap.c b/mm/rmap.c
72950 index 8005080..198c2cd 100644
72953 @@ -152,6 +152,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72954 struct anon_vma *anon_vma = vma->anon_vma;
72955 struct anon_vma_chain *avc;
72957 +#ifdef CONFIG_PAX_SEGMEXEC
72958 + struct anon_vma_chain *avc_m = NULL;
72962 if (unlikely(!anon_vma)) {
72963 struct mm_struct *mm = vma->vm_mm;
72964 @@ -161,6 +165,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72968 +#ifdef CONFIG_PAX_SEGMEXEC
72969 + avc_m = anon_vma_chain_alloc(GFP_KERNEL);
72971 + goto out_enomem_free_avc;
72974 anon_vma = find_mergeable_anon_vma(vma);
72977 @@ -174,6 +184,21 @@ int anon_vma_prepare(struct vm_area_struct *vma)
72978 /* page_table_lock to protect against threads */
72979 spin_lock(&mm->page_table_lock);
72980 if (likely(!vma->anon_vma)) {
72982 +#ifdef CONFIG_PAX_SEGMEXEC
72983 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
72986 + BUG_ON(vma_m->anon_vma);
72987 + vma_m->anon_vma = anon_vma;
72988 + avc_m->anon_vma = anon_vma;
72989 + avc_m->vma = vma;
72990 + list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
72991 + list_add(&avc_m->same_anon_vma, &anon_vma->head);
72996 vma->anon_vma = anon_vma;
72997 avc->anon_vma = anon_vma;
72999 @@ -187,12 +212,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73001 if (unlikely(allocated))
73002 put_anon_vma(allocated);
73004 +#ifdef CONFIG_PAX_SEGMEXEC
73005 + if (unlikely(avc_m))
73006 + anon_vma_chain_free(avc_m);
73010 anon_vma_chain_free(avc);
73014 out_enomem_free_avc:
73016 +#ifdef CONFIG_PAX_SEGMEXEC
73018 + anon_vma_chain_free(avc_m);
73021 anon_vma_chain_free(avc);
73024 @@ -243,7 +280,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
73025 * Attach the anon_vmas from src to dst.
73026 * Returns 0 on success, -ENOMEM on failure.
73028 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73029 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
73031 struct anon_vma_chain *avc, *pavc;
73032 struct anon_vma *root = NULL;
73033 @@ -276,7 +313,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
73034 * the corresponding VMA in the parent process is attached to.
73035 * Returns 0 on success, non-zero on failure.
73037 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
73038 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
73040 struct anon_vma_chain *avc;
73041 struct anon_vma *anon_vma;
73042 diff --git a/mm/shmem.c b/mm/shmem.c
73043 index 32f6763..431c405 100644
73047 #include <linux/module.h>
73048 #include <linux/swap.h>
73050 -static struct vfsmount *shm_mnt;
73051 +struct vfsmount *shm_mnt;
73053 #ifdef CONFIG_SHMEM
73055 @@ -74,7 +74,7 @@ static struct vfsmount *shm_mnt;
73056 #define BOGO_DIRENT_SIZE 20
73058 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
73059 -#define SHORT_SYMLINK_LEN 128
73060 +#define SHORT_SYMLINK_LEN 64
73062 struct shmem_xattr {
73063 struct list_head list; /* anchored by shmem_inode_info->xattr_list */
73064 @@ -769,6 +769,8 @@ static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
73065 struct mempolicy mpol, *spol;
73066 struct vm_area_struct pvma;
73068 + pax_track_stack();
73070 spol = mpol_cond_copy(&mpol,
73071 mpol_shared_policy_lookup(&info->policy, index));
73073 @@ -2149,8 +2151,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
73076 /* Round up to L1_CACHE_BYTES to resist false sharing */
73077 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
73078 - L1_CACHE_BYTES), GFP_KERNEL);
73079 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
73083 diff --git a/mm/slab.c b/mm/slab.c
73084 index 893c76d..a742de2 100644
73087 @@ -151,7 +151,7 @@
73089 /* Legal flag mask for kmem_cache_create(). */
73091 -# define CREATE_MASK (SLAB_RED_ZONE | \
73092 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
73093 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
73095 SLAB_STORE_USER | \
73096 @@ -159,7 +159,7 @@
73097 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73098 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
73100 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
73101 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
73103 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
73104 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
73105 @@ -288,7 +288,7 @@ struct kmem_list3 {
73106 * Need this for bootstrapping a per node allocator.
73108 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
73109 -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
73110 +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
73111 #define CACHE_CACHE 0
73112 #define SIZE_AC MAX_NUMNODES
73113 #define SIZE_L3 (2 * MAX_NUMNODES)
73114 @@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
73115 if ((x)->max_freeable < i) \
73116 (x)->max_freeable = i; \
73118 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
73119 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
73120 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
73121 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
73122 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
73123 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
73124 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
73125 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
73127 #define STATS_INC_ACTIVE(x) do { } while (0)
73128 #define STATS_DEC_ACTIVE(x) do { } while (0)
73129 @@ -538,7 +538,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
73130 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
73132 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
73133 - const struct slab *slab, void *obj)
73134 + const struct slab *slab, const void *obj)
73136 u32 offset = (obj - slab->s_mem);
73137 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
73138 @@ -564,7 +564,7 @@ struct cache_names {
73139 static struct cache_names __initdata cache_names[] = {
73140 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
73141 #include <linux/kmalloc_sizes.h>
73147 @@ -1572,7 +1572,7 @@ void __init kmem_cache_init(void)
73148 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
73149 sizes[INDEX_AC].cs_size,
73150 ARCH_KMALLOC_MINALIGN,
73151 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73152 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73155 if (INDEX_AC != INDEX_L3) {
73156 @@ -1580,7 +1580,7 @@ void __init kmem_cache_init(void)
73157 kmem_cache_create(names[INDEX_L3].name,
73158 sizes[INDEX_L3].cs_size,
73159 ARCH_KMALLOC_MINALIGN,
73160 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73161 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73165 @@ -1598,7 +1598,7 @@ void __init kmem_cache_init(void)
73166 sizes->cs_cachep = kmem_cache_create(names->name,
73168 ARCH_KMALLOC_MINALIGN,
73169 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
73170 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
73173 #ifdef CONFIG_ZONE_DMA
73174 @@ -4327,10 +4327,10 @@ static int s_show(struct seq_file *m, void *p)
73178 - unsigned long allochit = atomic_read(&cachep->allochit);
73179 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
73180 - unsigned long freehit = atomic_read(&cachep->freehit);
73181 - unsigned long freemiss = atomic_read(&cachep->freemiss);
73182 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
73183 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
73184 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
73185 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
73187 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
73188 allochit, allocmiss, freehit, freemiss);
73189 @@ -4587,15 +4587,70 @@ static const struct file_operations proc_slabstats_operations = {
73191 static int __init slab_proc_init(void)
73193 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
73194 + mode_t gr_mode = S_IRUGO;
73196 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
73197 + gr_mode = S_IRUSR;
73200 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
73201 #ifdef CONFIG_DEBUG_SLAB_LEAK
73202 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
73203 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
73207 module_init(slab_proc_init);
73210 +void check_object_size(const void *ptr, unsigned long n, bool to)
73213 +#ifdef CONFIG_PAX_USERCOPY
73214 + struct page *page;
73215 + struct kmem_cache *cachep = NULL;
73216 + struct slab *slabp;
73217 + unsigned int objnr;
73218 + unsigned long offset;
73219 + const char *type;
73225 + if (ZERO_OR_NULL_PTR(ptr))
73228 + if (!virt_addr_valid(ptr))
73231 + page = virt_to_head_page(ptr);
73233 + type = "<process stack>";
73234 + if (!PageSlab(page)) {
73235 + if (object_is_on_stack(ptr, n) == -1)
73240 + cachep = page_get_cache(page);
73241 + type = cachep->name;
73242 + if (!(cachep->flags & SLAB_USERCOPY))
73245 + slabp = page_get_slab(page);
73246 + objnr = obj_to_index(cachep, slabp, ptr);
73247 + BUG_ON(objnr >= cachep->num);
73248 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
73249 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
73253 + pax_report_usercopy(ptr, n, to, type);
73257 +EXPORT_SYMBOL(check_object_size);
73260 * ksize - get the actual amount of memory allocated for a given object
73261 * @objp: Pointer to the object
73262 diff --git a/mm/slob.c b/mm/slob.c
73263 index bf39181..727f7a3 100644
73267 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
73268 * alloc_pages() directly, allocating compound pages so the page order
73269 * does not have to be separately tracked, and also stores the exact
73270 - * allocation size in page->private so that it can be used to accurately
73271 + * allocation size in slob_page->size so that it can be used to accurately
73272 * provide ksize(). These objects are detected in kfree() because slob_page()
73273 * is false for them.
73278 #include <linux/kernel.h>
73279 +#include <linux/sched.h>
73280 #include <linux/slab.h>
73281 #include <linux/mm.h>
73282 #include <linux/swap.h> /* struct reclaim_state */
73283 @@ -102,7 +103,8 @@ struct slob_page {
73284 unsigned long flags; /* mandatory */
73285 atomic_t _count; /* mandatory */
73286 slobidx_t units; /* free units left in page */
73287 - unsigned long pad[2];
73288 + unsigned long pad[1];
73289 + unsigned long size; /* size when >=PAGE_SIZE */
73290 slob_t *free; /* first free slob_t in page */
73291 struct list_head list; /* linked list of free pages */
73293 @@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
73295 static inline int is_slob_page(struct slob_page *sp)
73297 - return PageSlab((struct page *)sp);
73298 + return PageSlab((struct page *)sp) && !sp->size;
73301 static inline void set_slob_page(struct slob_page *sp)
73302 @@ -150,7 +152,7 @@ static inline void clear_slob_page(struct slob_page *sp)
73304 static inline struct slob_page *slob_page(const void *addr)
73306 - return (struct slob_page *)virt_to_page(addr);
73307 + return (struct slob_page *)virt_to_head_page(addr);
73311 @@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
73313 * Return the size of a slob block.
73315 -static slobidx_t slob_units(slob_t *s)
73316 +static slobidx_t slob_units(const slob_t *s)
73320 @@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
73322 * Return the next free slob block pointer after this one.
73324 -static slob_t *slob_next(slob_t *s)
73325 +static slob_t *slob_next(const slob_t *s)
73327 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
73329 @@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
73331 * Returns true if s is the last free block in its page.
73333 -static int slob_last(slob_t *s)
73334 +static int slob_last(const slob_t *s)
73336 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
73338 @@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
73342 + set_slob_page(page);
73343 return page_address(page);
73346 @@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
73350 - set_slob_page(sp);
73352 spin_lock_irqsave(&slob_lock, flags);
73353 sp->units = SLOB_UNITS(PAGE_SIZE);
73356 INIT_LIST_HEAD(&sp->list);
73357 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
73358 set_slob_page_free(sp, slob_list);
73359 @@ -476,10 +479,9 @@ out:
73360 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
73363 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73364 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
73367 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73371 gfp &= gfp_allowed_mask;
73372 @@ -494,7 +496,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73377 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
73378 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
73379 + m[0].units = size;
73380 + m[1].units = align;
73381 ret = (void *)m + align;
73383 trace_kmalloc_node(_RET_IP_, ret,
73384 @@ -506,16 +511,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73386 ret = slob_new_pages(gfp, order, node);
73388 - struct page *page;
73389 - page = virt_to_page(ret);
73390 - page->private = size;
73391 + struct slob_page *sp;
73392 + sp = slob_page(ret);
73396 trace_kmalloc_node(_RET_IP_, ret,
73397 size, PAGE_SIZE << order, gfp, node);
73400 - kmemleak_alloc(ret, size, 1, gfp);
73404 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
73406 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73407 + void *ret = __kmalloc_node_align(size, gfp, node, align);
73409 + if (!ZERO_OR_NULL_PTR(ret))
73410 + kmemleak_alloc(ret, size, 1, gfp);
73413 EXPORT_SYMBOL(__kmalloc_node);
73414 @@ -533,13 +547,92 @@ void kfree(const void *block)
73415 sp = slob_page(block);
73416 if (is_slob_page(sp)) {
73417 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73418 - unsigned int *m = (unsigned int *)(block - align);
73419 - slob_free(m, *m + align);
73421 + slob_t *m = (slob_t *)(block - align);
73422 + slob_free(m, m[0].units + align);
73424 + clear_slob_page(sp);
73425 + free_slob_page(sp);
73427 put_page(&sp->page);
73430 EXPORT_SYMBOL(kfree);
73432 +void check_object_size(const void *ptr, unsigned long n, bool to)
73435 +#ifdef CONFIG_PAX_USERCOPY
73436 + struct slob_page *sp;
73437 + const slob_t *free;
73438 + const void *base;
73439 + unsigned long flags;
73440 + const char *type;
73446 + if (ZERO_OR_NULL_PTR(ptr))
73449 + if (!virt_addr_valid(ptr))
73452 + type = "<process stack>";
73453 + sp = slob_page(ptr);
73454 + if (!PageSlab((struct page*)sp)) {
73455 + if (object_is_on_stack(ptr, n) == -1)
73462 + base = page_address(&sp->page);
73463 + if (base <= ptr && n <= sp->size - (ptr - base))
73468 + /* some tricky double walking to find the chunk */
73469 + spin_lock_irqsave(&slob_lock, flags);
73470 + base = (void *)((unsigned long)ptr & PAGE_MASK);
73473 + while (!slob_last(free) && (void *)free <= ptr) {
73474 + base = free + slob_units(free);
73475 + free = slob_next(free);
73478 + while (base < (void *)free) {
73479 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
73480 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
73483 + if (ptr < base + align)
73486 + offset = ptr - base - align;
73487 + if (offset >= m) {
73492 + if (n > m - offset)
73495 + spin_unlock_irqrestore(&slob_lock, flags);
73499 + spin_unlock_irqrestore(&slob_lock, flags);
73501 + pax_report_usercopy(ptr, n, to, type);
73505 +EXPORT_SYMBOL(check_object_size);
73507 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
73508 size_t ksize(const void *block)
73510 @@ -552,10 +645,10 @@ size_t ksize(const void *block)
73511 sp = slob_page(block);
73512 if (is_slob_page(sp)) {
73513 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
73514 - unsigned int *m = (unsigned int *)(block - align);
73515 - return SLOB_UNITS(*m) * SLOB_UNIT;
73516 + slob_t *m = (slob_t *)(block - align);
73517 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
73519 - return sp->page.private;
73522 EXPORT_SYMBOL(ksize);
73524 @@ -571,8 +664,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73526 struct kmem_cache *c;
73528 +#ifdef CONFIG_PAX_USERCOPY
73529 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
73530 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
73532 c = slob_alloc(sizeof(struct kmem_cache),
73533 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
73538 @@ -614,17 +712,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
73540 lockdep_trace_alloc(flags);
73542 +#ifdef CONFIG_PAX_USERCOPY
73543 + b = __kmalloc_node_align(c->size, flags, node, c->align);
73545 if (c->size < PAGE_SIZE) {
73546 b = slob_alloc(c->size, flags, c->align, node);
73547 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73548 SLOB_UNITS(c->size) * SLOB_UNIT,
73551 + struct slob_page *sp;
73553 b = slob_new_pages(flags, get_order(c->size), node);
73554 + sp = slob_page(b);
73555 + sp->size = c->size;
73556 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73557 PAGE_SIZE << get_order(c->size),
73564 @@ -636,10 +742,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
73566 static void __kmem_cache_free(void *b, int size)
73568 - if (size < PAGE_SIZE)
73569 + struct slob_page *sp = slob_page(b);
73571 + if (is_slob_page(sp))
73572 slob_free(b, size);
73575 + clear_slob_page(sp);
73576 + free_slob_page(sp);
73578 slob_free_pages(b, get_order(size));
73582 static void kmem_rcu_free(struct rcu_head *head)
73583 @@ -652,17 +764,31 @@ static void kmem_rcu_free(struct rcu_head *head)
73585 void kmem_cache_free(struct kmem_cache *c, void *b)
73587 + int size = c->size;
73589 +#ifdef CONFIG_PAX_USERCOPY
73590 + if (size + c->align < PAGE_SIZE) {
73591 + size += c->align;
73596 kmemleak_free_recursive(b, c->flags);
73597 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
73598 struct slob_rcu *slob_rcu;
73599 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
73600 - slob_rcu->size = c->size;
73601 + slob_rcu = b + (size - sizeof(struct slob_rcu));
73602 + slob_rcu->size = size;
73603 call_rcu(&slob_rcu->head, kmem_rcu_free);
73605 - __kmem_cache_free(b, c->size);
73606 + __kmem_cache_free(b, size);
73609 +#ifdef CONFIG_PAX_USERCOPY
73610 + trace_kfree(_RET_IP_, b);
73612 trace_kmem_cache_free(_RET_IP_, b);
73616 EXPORT_SYMBOL(kmem_cache_free);
73618 diff --git a/mm/slub.c b/mm/slub.c
73619 index 7c54fe8..0bb4ac5 100644
73622 @@ -208,7 +208,7 @@ struct track {
73624 enum track_item { TRACK_ALLOC, TRACK_FREE };
73626 -#ifdef CONFIG_SYSFS
73627 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73628 static int sysfs_slab_add(struct kmem_cache *);
73629 static int sysfs_slab_alias(struct kmem_cache *, const char *);
73630 static void sysfs_slab_remove(struct kmem_cache *);
73631 @@ -556,7 +556,7 @@ static void print_track(const char *s, struct track *t)
73635 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
73636 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
73637 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
73638 #ifdef CONFIG_STACKTRACE
73640 @@ -2456,6 +2456,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
73642 page = virt_to_head_page(x);
73644 + BUG_ON(!PageSlab(page));
73646 slab_free(s, page, x, _RET_IP_);
73648 trace_kmem_cache_free(_RET_IP_, x);
73649 @@ -2489,7 +2491,7 @@ static int slub_min_objects;
73650 * Merge control. If this is set then no merging of slab caches will occur.
73651 * (Could be removed. This was introduced to pacify the merge skeptics.)
73653 -static int slub_nomerge;
73654 +static int slub_nomerge = 1;
73657 * Calculate the order of allocation given an slab object size.
73658 @@ -2912,7 +2914,7 @@ static int kmem_cache_open(struct kmem_cache *s,
73659 * list to avoid pounding the page allocator excessively.
73661 set_min_partial(s, ilog2(s->size));
73663 + atomic_set(&s->refcount, 1);
73665 s->remote_node_defrag_ratio = 1000;
73667 @@ -3017,8 +3019,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
73668 void kmem_cache_destroy(struct kmem_cache *s)
73670 down_write(&slub_lock);
73672 - if (!s->refcount) {
73673 + if (atomic_dec_and_test(&s->refcount)) {
73674 list_del(&s->list);
73675 if (kmem_cache_close(s)) {
73676 printk(KERN_ERR "SLUB %s: %s called for cache that "
73677 @@ -3228,6 +3229,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
73678 EXPORT_SYMBOL(__kmalloc_node);
73681 +void check_object_size(const void *ptr, unsigned long n, bool to)
73684 +#ifdef CONFIG_PAX_USERCOPY
73685 + struct page *page;
73686 + struct kmem_cache *s = NULL;
73687 + unsigned long offset;
73688 + const char *type;
73694 + if (ZERO_OR_NULL_PTR(ptr))
73697 + if (!virt_addr_valid(ptr))
73700 + page = virt_to_head_page(ptr);
73702 + type = "<process stack>";
73703 + if (!PageSlab(page)) {
73704 + if (object_is_on_stack(ptr, n) == -1)
73711 + if (!(s->flags & SLAB_USERCOPY))
73714 + offset = (ptr - page_address(page)) % s->size;
73715 + if (offset <= s->objsize && n <= s->objsize - offset)
73719 + pax_report_usercopy(ptr, n, to, type);
73723 +EXPORT_SYMBOL(check_object_size);
73725 size_t ksize(const void *object)
73728 @@ -3502,7 +3547,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
73731 list_add(&s->list, &slab_caches);
73732 - s->refcount = -1;
73733 + atomic_set(&s->refcount, -1);
73735 for_each_node_state(node, N_NORMAL_MEMORY) {
73736 struct kmem_cache_node *n = get_node(s, node);
73737 @@ -3619,17 +3664,17 @@ void __init kmem_cache_init(void)
73739 /* Caches that are not of the two-to-the-power-of size */
73740 if (KMALLOC_MIN_SIZE <= 32) {
73741 - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
73742 + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
73746 if (KMALLOC_MIN_SIZE <= 64) {
73747 - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
73748 + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
73752 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
73753 - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
73754 + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
73758 @@ -3697,7 +3742,7 @@ static int slab_unmergeable(struct kmem_cache *s)
73760 * We may have set a slab to be unmergeable during bootstrap.
73762 - if (s->refcount < 0)
73763 + if (atomic_read(&s->refcount) < 0)
73767 @@ -3756,7 +3801,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73768 down_write(&slub_lock);
73769 s = find_mergeable(size, align, flags, name, ctor);
73772 + atomic_inc(&s->refcount);
73774 * Adjust the object sizes so that we clear
73775 * the complete object on kzalloc.
73776 @@ -3765,7 +3810,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
73777 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
73779 if (sysfs_slab_alias(s, name)) {
73781 + atomic_dec(&s->refcount);
73784 up_write(&slub_lock);
73785 @@ -3893,7 +3938,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
73789 -#ifdef CONFIG_SYSFS
73790 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73791 static int count_inuse(struct page *page)
73793 return page->inuse;
73794 @@ -4280,12 +4325,12 @@ static void resiliency_test(void)
73795 validate_slab_cache(kmalloc_caches[9]);
73798 -#ifdef CONFIG_SYSFS
73799 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73800 static void resiliency_test(void) {};
73804 -#ifdef CONFIG_SYSFS
73805 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73806 enum slab_stat_type {
73807 SL_ALL, /* All slabs */
73808 SL_PARTIAL, /* Only partially allocated slabs */
73809 @@ -4495,7 +4540,7 @@ SLAB_ATTR_RO(ctor);
73811 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
73813 - return sprintf(buf, "%d\n", s->refcount - 1);
73814 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
73816 SLAB_ATTR_RO(aliases);
73818 @@ -5025,6 +5070,7 @@ static char *create_unique_id(struct kmem_cache *s)
73822 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73823 static int sysfs_slab_add(struct kmem_cache *s)
73826 @@ -5087,6 +5133,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
73827 kobject_del(&s->kobj);
73828 kobject_put(&s->kobj);
73833 * Need to buffer aliases during bootup until sysfs becomes
73834 @@ -5100,6 +5147,7 @@ struct saved_alias {
73836 static struct saved_alias *alias_list;
73838 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
73839 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73841 struct saved_alias *al;
73842 @@ -5122,6 +5170,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
73848 static int __init slab_sysfs_init(void)
73850 @@ -5257,7 +5306,13 @@ static const struct file_operations proc_slabinfo_operations = {
73852 static int __init slab_proc_init(void)
73854 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
73855 + mode_t gr_mode = S_IRUGO;
73857 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
73858 + gr_mode = S_IRUSR;
73861 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
73864 module_init(slab_proc_init);
73865 diff --git a/mm/swap.c b/mm/swap.c
73866 index 87627f1..8a9eb34 100644
73870 #include <linux/backing-dev.h>
73871 #include <linux/memcontrol.h>
73872 #include <linux/gfp.h>
73873 +#include <linux/hugetlb.h>
73875 #include "internal.h"
73877 @@ -71,6 +72,8 @@ static void __put_compound_page(struct page *page)
73879 __page_cache_release(page);
73880 dtor = get_compound_page_dtor(page);
73881 + if (!PageHuge(page))
73882 + BUG_ON(dtor != free_compound_page);
73886 diff --git a/mm/swapfile.c b/mm/swapfile.c
73887 index 17bc224..1677059 100644
73888 --- a/mm/swapfile.c
73889 +++ b/mm/swapfile.c
73890 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
73892 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
73893 /* Activity counter to indicate that a swapon or swapoff has occurred */
73894 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
73895 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
73897 static inline unsigned char swap_count(unsigned char ent)
73899 @@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
73901 filp_close(swap_file, NULL);
73903 - atomic_inc(&proc_poll_event);
73904 + atomic_inc_unchecked(&proc_poll_event);
73905 wake_up_interruptible(&proc_poll_wait);
73908 @@ -1687,8 +1687,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
73910 poll_wait(file, &proc_poll_wait, wait);
73912 - if (seq->poll_event != atomic_read(&proc_poll_event)) {
73913 - seq->poll_event = atomic_read(&proc_poll_event);
73914 + if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
73915 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73916 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
73919 @@ -1786,7 +1786,7 @@ static int swaps_open(struct inode *inode, struct file *file)
73922 seq = file->private_data;
73923 - seq->poll_event = atomic_read(&proc_poll_event);
73924 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
73928 @@ -2124,7 +2124,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
73929 (p->flags & SWP_DISCARDABLE) ? "D" : "");
73931 mutex_unlock(&swapon_mutex);
73932 - atomic_inc(&proc_poll_event);
73933 + atomic_inc_unchecked(&proc_poll_event);
73934 wake_up_interruptible(&proc_poll_wait);
73936 if (S_ISREG(inode->i_mode))
73937 diff --git a/mm/util.c b/mm/util.c
73938 index 88ea1bd..0f1dfdb 100644
73941 @@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
73942 * allocated buffer. Use this if you don't want to free the buffer immediately
73943 * like, for example, with RCU.
73946 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
73949 @@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
73950 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
73951 * %NULL pointer, the object pointed to is freed.
73954 void *krealloc(const void *p, size_t new_size, gfp_t flags)
73957 @@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
73958 void arch_pick_mmap_layout(struct mm_struct *mm)
73960 mm->mmap_base = TASK_UNMAPPED_BASE;
73962 +#ifdef CONFIG_PAX_RANDMMAP
73963 + if (mm->pax_flags & MF_PAX_RANDMMAP)
73964 + mm->mmap_base += mm->delta_mmap;
73967 mm->get_unmapped_area = arch_get_unmapped_area;
73968 mm->unmap_area = arch_unmap_area;
73970 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
73971 index 3a65d6f7..39d5e33 100644
73974 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
73976 pte = pte_offset_kernel(pmd, addr);
73978 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73979 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73981 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73982 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
73983 + BUG_ON(!pte_exec(*pte));
73984 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
73990 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73991 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73993 } while (pte++, addr += PAGE_SIZE, addr != end);
73996 @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
73997 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
74000 + int ret = -ENOMEM;
74003 * nr is a running index into the array which helps higher level
74004 @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
74005 pte = pte_alloc_kernel(pmd, addr);
74009 + pax_open_kernel();
74011 struct page *page = pages[*nr];
74013 - if (WARN_ON(!pte_none(*pte)))
74015 - if (WARN_ON(!page))
74017 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74018 + if (pgprot_val(prot) & _PAGE_NX)
74021 + if (WARN_ON(!pte_none(*pte))) {
74025 + if (WARN_ON(!page)) {
74029 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
74031 } while (pte++, addr += PAGE_SIZE, addr != end);
74035 + pax_close_kernel();
74039 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
74040 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
74041 * and fall back on vmalloc() if that fails. Others
74042 * just put it in the vmalloc space.
74044 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
74045 +#ifdef CONFIG_MODULES
74046 +#ifdef MODULES_VADDR
74047 unsigned long addr = (unsigned long)x;
74048 if (addr >= MODULES_VADDR && addr < MODULES_END)
74052 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
74053 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
74059 return is_vmalloc_addr(x);
74062 @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
74064 if (!pgd_none(*pgd)) {
74065 pud_t *pud = pud_offset(pgd, addr);
74067 + if (!pud_large(*pud))
74069 if (!pud_none(*pud)) {
74070 pmd_t *pmd = pmd_offset(pud, addr);
74072 + if (!pmd_large(*pmd))
74074 if (!pmd_none(*pmd)) {
74077 @@ -1290,10 +1330,20 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
74078 unsigned long align, unsigned long flags, unsigned long start,
74079 unsigned long end, int node, gfp_t gfp_mask, void *caller)
74081 - static struct vmap_area *va;
74082 + struct vmap_area *va;
74083 struct vm_struct *area;
74085 BUG_ON(in_interrupt());
74087 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74088 + if (flags & VM_KERNEXEC) {
74089 + if (start != VMALLOC_START || end != VMALLOC_END)
74091 + start = (unsigned long)MODULES_EXEC_VADDR;
74092 + end = (unsigned long)MODULES_EXEC_END;
74096 if (flags & VM_IOREMAP) {
74097 int bit = fls(size);
74099 @@ -1526,6 +1576,11 @@ void *vmap(struct page **pages, unsigned int count,
74100 if (count > totalram_pages)
74103 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74104 + if (!(pgprot_val(prot) & _PAGE_NX))
74105 + flags |= VM_KERNEXEC;
74108 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
74109 __builtin_return_address(0));
74111 @@ -1627,6 +1682,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
74112 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
74115 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
74116 + if (!(pgprot_val(prot) & _PAGE_NX))
74117 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
74118 + VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
74122 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
74123 start, end, node, gfp_mask, caller);
74125 @@ -1674,6 +1736,7 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
74126 gfp_mask, prot, node, caller);
74130 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
74132 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
74133 @@ -1697,6 +1760,7 @@ static inline void *__vmalloc_node_flags(unsigned long size,
74134 * For tight control over page level allocator and protection flags
74135 * use __vmalloc() instead.
74138 void *vmalloc(unsigned long size)
74140 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
74141 @@ -1713,6 +1777,7 @@ EXPORT_SYMBOL(vmalloc);
74142 * For tight control over page level allocator and protection flags
74143 * use __vmalloc() instead.
74146 void *vzalloc(unsigned long size)
74148 return __vmalloc_node_flags(size, -1,
74149 @@ -1727,6 +1792,7 @@ EXPORT_SYMBOL(vzalloc);
74150 * The resulting memory area is zeroed so it can be mapped to userspace
74151 * without leaking data.
74153 +#undef vmalloc_user
74154 void *vmalloc_user(unsigned long size)
74156 struct vm_struct *area;
74157 @@ -1754,6 +1820,7 @@ EXPORT_SYMBOL(vmalloc_user);
74158 * For tight control over page level allocator and protection flags
74159 * use __vmalloc() instead.
74161 +#undef vmalloc_node
74162 void *vmalloc_node(unsigned long size, int node)
74164 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
74165 @@ -1773,6 +1840,7 @@ EXPORT_SYMBOL(vmalloc_node);
74166 * For tight control over page level allocator and protection flags
74167 * use __vmalloc_node() instead.
74169 +#undef vzalloc_node
74170 void *vzalloc_node(unsigned long size, int node)
74172 return __vmalloc_node_flags(size, node,
74173 @@ -1795,10 +1863,10 @@ EXPORT_SYMBOL(vzalloc_node);
74174 * For tight control over page level allocator and protection flags
74175 * use __vmalloc() instead.
74178 +#undef vmalloc_exec
74179 void *vmalloc_exec(unsigned long size)
74181 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
74182 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
74183 -1, __builtin_return_address(0));
74186 @@ -1817,6 +1885,7 @@ void *vmalloc_exec(unsigned long size)
74187 * Allocate enough 32bit PA addressable pages to cover @size from the
74188 * page level allocator and map them into contiguous kernel virtual space.
74191 void *vmalloc_32(unsigned long size)
74193 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
74194 @@ -1831,6 +1900,7 @@ EXPORT_SYMBOL(vmalloc_32);
74195 * The resulting memory area is 32bit addressable and zeroed so it can be
74196 * mapped to userspace without leaking data.
74198 +#undef vmalloc_32_user
74199 void *vmalloc_32_user(unsigned long size)
74201 struct vm_struct *area;
74202 @@ -2093,6 +2163,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
74203 unsigned long uaddr = vma->vm_start;
74204 unsigned long usize = vma->vm_end - vma->vm_start;
74206 + BUG_ON(vma->vm_mirror);
74208 if ((PAGE_SIZE-1) & (unsigned long)addr)
74211 diff --git a/mm/vmstat.c b/mm/vmstat.c
74212 index d52b13d..381d1ac 100644
74215 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
74217 * vm_stat contains the global counters
74219 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74220 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
74221 EXPORT_SYMBOL(vm_stat);
74224 @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
74225 v = p->vm_stat_diff[i];
74226 p->vm_stat_diff[i] = 0;
74227 local_irq_restore(flags);
74228 - atomic_long_add(v, &zone->vm_stat[i]);
74229 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
74230 global_diff[i] += v;
74232 /* 3 seconds idle till flush */
74233 @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
74235 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
74236 if (global_diff[i])
74237 - atomic_long_add(global_diff[i], &vm_stat[i]);
74238 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
74242 @@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
74243 start_cpu_timer(cpu);
74245 #ifdef CONFIG_PROC_FS
74246 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
74247 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
74248 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
74249 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
74251 + mode_t gr_mode = S_IRUGO;
74252 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
74253 + gr_mode = S_IRUSR;
74255 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
74256 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
74257 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
74258 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
74260 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
74262 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
74267 diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
74268 index 8970ba1..e3361fe 100644
74269 --- a/net/8021q/vlan.c
74270 +++ b/net/8021q/vlan.c
74271 @@ -588,8 +588,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
74273 if (!capable(CAP_NET_ADMIN))
74275 - if ((args.u.name_type >= 0) &&
74276 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
74277 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
74278 struct vlan_net *vn;
74280 vn = net_generic(net, vlan_net_id);
74281 diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
74282 index fdfdb57..38d368c 100644
74283 --- a/net/9p/trans_fd.c
74284 +++ b/net/9p/trans_fd.c
74285 @@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
74288 /* The cast to a user pointer is valid due to the set_fs() */
74289 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
74290 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
74293 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
74294 diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
74295 index e317583..3c8aeaf 100644
74296 --- a/net/9p/trans_virtio.c
74297 +++ b/net/9p/trans_virtio.c
74298 @@ -327,7 +327,7 @@ req_retry_pinned:
74301 if (req->tc->pubuf)
74302 - pbuf = (__force char *) req->tc->pubuf;
74303 + pbuf = (char __force_kernel *) req->tc->pubuf;
74305 pbuf = req->tc->pkbuf;
74306 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
74307 @@ -357,7 +357,7 @@ req_retry_pinned:
74310 if (req->tc->pubuf)
74311 - pbuf = (__force char *) req->tc->pubuf;
74312 + pbuf = (char __force_kernel *) req->tc->pubuf;
74314 pbuf = req->tc->pkbuf;
74316 diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
74317 index f41f026..fe76ea8 100644
74318 --- a/net/atm/atm_misc.c
74319 +++ b/net/atm/atm_misc.c
74320 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
74321 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
74323 atm_return(vcc, truesize);
74324 - atomic_inc(&vcc->stats->rx_drop);
74325 + atomic_inc_unchecked(&vcc->stats->rx_drop);
74328 EXPORT_SYMBOL(atm_charge);
74329 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
74332 atm_return(vcc, guess);
74333 - atomic_inc(&vcc->stats->rx_drop);
74334 + atomic_inc_unchecked(&vcc->stats->rx_drop);
74337 EXPORT_SYMBOL(atm_alloc_charge);
74338 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
74340 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74342 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74343 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74345 #undef __HANDLE_ITEM
74347 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
74349 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
74351 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74352 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
74354 #undef __HANDLE_ITEM
74356 diff --git a/net/atm/lec.h b/net/atm/lec.h
74357 index dfc0719..47c5322 100644
74358 --- a/net/atm/lec.h
74359 +++ b/net/atm/lec.h
74360 @@ -48,7 +48,7 @@ struct lane2_ops {
74361 const u8 *tlvs, u32 sizeoftlvs);
74362 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
74363 const u8 *tlvs, u32 sizeoftlvs);
74368 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
74369 diff --git a/net/atm/mpc.h b/net/atm/mpc.h
74370 index 0919a88..a23d54e 100644
74371 --- a/net/atm/mpc.h
74372 +++ b/net/atm/mpc.h
74373 @@ -33,7 +33,7 @@ struct mpoa_client {
74374 struct mpc_parameters parameters; /* parameters for this client */
74376 const struct net_device_ops *old_ops;
74377 - struct net_device_ops new_ops;
74378 + net_device_ops_no_const new_ops;
74382 diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
74383 index d1b2d9a..7cc2219 100644
74384 --- a/net/atm/mpoa_caches.c
74385 +++ b/net/atm/mpoa_caches.c
74386 @@ -255,6 +255,8 @@ static void check_resolving_entries(struct mpoa_client *client)
74387 struct timeval now;
74388 struct k_message msg;
74390 + pax_track_stack();
74392 do_gettimeofday(&now);
74394 read_lock_bh(&client->ingress_lock);
74395 diff --git a/net/atm/proc.c b/net/atm/proc.c
74396 index 0d020de..011c7bb 100644
74397 --- a/net/atm/proc.c
74398 +++ b/net/atm/proc.c
74399 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
74400 const struct k_atm_aal_stats *stats)
74402 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
74403 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
74404 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
74405 - atomic_read(&stats->rx_drop));
74406 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
74407 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
74408 + atomic_read_unchecked(&stats->rx_drop));
74411 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
74412 diff --git a/net/atm/resources.c b/net/atm/resources.c
74413 index 23f45ce..c748f1a 100644
74414 --- a/net/atm/resources.c
74415 +++ b/net/atm/resources.c
74416 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
74417 static void copy_aal_stats(struct k_atm_aal_stats *from,
74418 struct atm_aal_stats *to)
74420 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
74421 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
74423 #undef __HANDLE_ITEM
74425 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
74426 static void subtract_aal_stats(struct k_atm_aal_stats *from,
74427 struct atm_aal_stats *to)
74429 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
74430 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
74432 #undef __HANDLE_ITEM
74434 diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
74435 index db7aacf..991e539 100644
74436 --- a/net/batman-adv/hard-interface.c
74437 +++ b/net/batman-adv/hard-interface.c
74438 @@ -347,8 +347,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
74439 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
74440 dev_add_pack(&hard_iface->batman_adv_ptype);
74442 - atomic_set(&hard_iface->seqno, 1);
74443 - atomic_set(&hard_iface->frag_seqno, 1);
74444 + atomic_set_unchecked(&hard_iface->seqno, 1);
74445 + atomic_set_unchecked(&hard_iface->frag_seqno, 1);
74446 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
74447 hard_iface->net_dev->name);
74449 diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
74450 index 0f32c81..82d1895 100644
74451 --- a/net/batman-adv/routing.c
74452 +++ b/net/batman-adv/routing.c
74453 @@ -656,7 +656,7 @@ void receive_bat_packet(const struct ethhdr *ethhdr,
74456 /* could be changed by schedule_own_packet() */
74457 - if_incoming_seqno = atomic_read(&if_incoming->seqno);
74458 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
74460 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
74462 diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
74463 index 58d1447..2a66c8c 100644
74464 --- a/net/batman-adv/send.c
74465 +++ b/net/batman-adv/send.c
74466 @@ -326,7 +326,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74468 /* change sequence number to network order */
74469 batman_packet->seqno =
74470 - htonl((uint32_t)atomic_read(&hard_iface->seqno));
74471 + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
74473 batman_packet->ttvn = atomic_read(&bat_priv->ttvn);
74474 batman_packet->tt_crc = htons((uint16_t)atomic_read(&bat_priv->tt_crc));
74475 @@ -343,7 +343,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
74477 batman_packet->gw_flags = NO_FLAGS;
74479 - atomic_inc(&hard_iface->seqno);
74480 + atomic_inc_unchecked(&hard_iface->seqno);
74482 slide_own_bcast_window(hard_iface);
74483 send_time = own_send_time(bat_priv);
74484 diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
74485 index 05dd351..2ecd19b 100644
74486 --- a/net/batman-adv/soft-interface.c
74487 +++ b/net/batman-adv/soft-interface.c
74488 @@ -632,7 +632,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
74490 /* set broadcast sequence number */
74491 bcast_packet->seqno =
74492 - htonl(atomic_inc_return(&bat_priv->bcast_seqno));
74493 + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
74495 add_bcast_packet_to_list(bat_priv, skb, 1);
74497 @@ -824,7 +824,7 @@ struct net_device *softif_create(const char *name)
74498 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
74500 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
74501 - atomic_set(&bat_priv->bcast_seqno, 1);
74502 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
74503 atomic_set(&bat_priv->ttvn, 0);
74504 atomic_set(&bat_priv->tt_local_changes, 0);
74505 atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
74506 diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
74507 index 51a0db7..b8a62be 100644
74508 --- a/net/batman-adv/types.h
74509 +++ b/net/batman-adv/types.h
74510 @@ -38,8 +38,8 @@ struct hard_iface {
74513 struct net_device *net_dev;
74515 - atomic_t frag_seqno;
74516 + atomic_unchecked_t seqno;
74517 + atomic_unchecked_t frag_seqno;
74518 unsigned char *packet_buff;
74520 struct kobject *hardif_obj;
74521 @@ -153,7 +153,7 @@ struct bat_priv {
74522 atomic_t orig_interval; /* uint */
74523 atomic_t hop_penalty; /* uint */
74524 atomic_t log_level; /* uint */
74525 - atomic_t bcast_seqno;
74526 + atomic_unchecked_t bcast_seqno;
74527 atomic_t bcast_queue_left;
74528 atomic_t batman_queue_left;
74529 atomic_t ttvn; /* tranlation table version number */
74530 diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
74531 index 32b125f..f1447e0 100644
74532 --- a/net/batman-adv/unicast.c
74533 +++ b/net/batman-adv/unicast.c
74534 @@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
74535 frag1->flags = UNI_FRAG_HEAD | large_tail;
74536 frag2->flags = large_tail;
74538 - seqno = atomic_add_return(2, &hard_iface->frag_seqno);
74539 + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
74540 frag1->seqno = htons(seqno - 1);
74541 frag2->seqno = htons(seqno);
74543 diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
74544 index ea7f031..0615edc 100644
74545 --- a/net/bluetooth/hci_conn.c
74546 +++ b/net/bluetooth/hci_conn.c
74547 @@ -218,7 +218,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
74548 cp.handle = cpu_to_le16(conn->handle);
74549 memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74551 - memcpy(cp.rand, rand, sizeof(rand));
74552 + memcpy(cp.rand, rand, sizeof(cp.rand));
74554 hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
74556 @@ -234,7 +234,7 @@ void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
74557 memset(&cp, 0, sizeof(cp));
74559 cp.handle = cpu_to_le16(conn->handle);
74560 - memcpy(cp.ltk, ltk, sizeof(ltk));
74561 + memcpy(cp.ltk, ltk, sizeof(cp.ltk));
74563 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
74565 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
74566 index e79ff75..215b57d 100644
74567 --- a/net/bridge/br_multicast.c
74568 +++ b/net/bridge/br_multicast.c
74569 @@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
74570 nexthdr = ip6h->nexthdr;
74571 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
74573 - if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
74574 + if (nexthdr != IPPROTO_ICMPV6)
74577 /* Okay, we found ICMPv6 header */
74578 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
74579 index 5864cc4..94cab18 100644
74580 --- a/net/bridge/netfilter/ebtables.c
74581 +++ b/net/bridge/netfilter/ebtables.c
74582 @@ -1513,7 +1513,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
74583 tmp.valid_hooks = t->table->valid_hooks;
74585 mutex_unlock(&ebt_mutex);
74586 - if (copy_to_user(user, &tmp, *len) != 0){
74587 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
74588 BUGPRINT("c2u Didn't work\n");
74591 @@ -1781,6 +1781,8 @@ static int compat_copy_everything_to_user(struct ebt_table *t,
74595 + pax_track_stack();
74597 memset(&tinfo, 0, sizeof(tinfo));
74599 if (cmd == EBT_SO_GET_ENTRIES) {
74600 diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
74601 index a986280..13444a1 100644
74602 --- a/net/caif/caif_socket.c
74603 +++ b/net/caif/caif_socket.c
74604 @@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
74605 #ifdef CONFIG_DEBUG_FS
74606 struct debug_fs_counter {
74607 atomic_t caif_nr_socks;
74608 - atomic_t caif_sock_create;
74609 - atomic_t num_connect_req;
74610 - atomic_t num_connect_resp;
74611 - atomic_t num_connect_fail_resp;
74612 - atomic_t num_disconnect;
74613 - atomic_t num_remote_shutdown_ind;
74614 - atomic_t num_tx_flow_off_ind;
74615 - atomic_t num_tx_flow_on_ind;
74616 - atomic_t num_rx_flow_off;
74617 - atomic_t num_rx_flow_on;
74618 + atomic_unchecked_t caif_sock_create;
74619 + atomic_unchecked_t num_connect_req;
74620 + atomic_unchecked_t num_connect_resp;
74621 + atomic_unchecked_t num_connect_fail_resp;
74622 + atomic_unchecked_t num_disconnect;
74623 + atomic_unchecked_t num_remote_shutdown_ind;
74624 + atomic_unchecked_t num_tx_flow_off_ind;
74625 + atomic_unchecked_t num_tx_flow_on_ind;
74626 + atomic_unchecked_t num_rx_flow_off;
74627 + atomic_unchecked_t num_rx_flow_on;
74629 static struct debug_fs_counter cnt;
74630 #define dbfs_atomic_inc(v) atomic_inc_return(v)
74631 +#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
74632 #define dbfs_atomic_dec(v) atomic_dec_return(v)
74634 #define dbfs_atomic_inc(v) 0
74635 @@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74636 atomic_read(&cf_sk->sk.sk_rmem_alloc),
74637 sk_rcvbuf_lowwater(cf_sk));
74638 set_rx_flow_off(cf_sk);
74639 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
74640 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74641 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74644 @@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
74645 set_rx_flow_off(cf_sk);
74646 if (net_ratelimit())
74647 pr_debug("sending flow OFF due to rmem_schedule\n");
74648 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
74649 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
74650 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
74653 @@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer *layr,
74655 case CAIF_CTRLCMD_FLOW_ON_IND:
74656 /* OK from modem to start sending again */
74657 - dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
74658 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
74659 set_tx_flow_on(cf_sk);
74660 cf_sk->sk.sk_state_change(&cf_sk->sk);
74663 case CAIF_CTRLCMD_FLOW_OFF_IND:
74664 /* Modem asks us to shut up */
74665 - dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
74666 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
74667 set_tx_flow_off(cf_sk);
74668 cf_sk->sk.sk_state_change(&cf_sk->sk);
74670 @@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74671 /* We're now connected */
74672 caif_client_register_refcnt(&cf_sk->layer,
74673 cfsk_hold, cfsk_put);
74674 - dbfs_atomic_inc(&cnt.num_connect_resp);
74675 + dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
74676 cf_sk->sk.sk_state = CAIF_CONNECTED;
74677 set_tx_flow_on(cf_sk);
74678 cf_sk->sk.sk_state_change(&cf_sk->sk);
74679 @@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74681 case CAIF_CTRLCMD_INIT_FAIL_RSP:
74682 /* Connect request failed */
74683 - dbfs_atomic_inc(&cnt.num_connect_fail_resp);
74684 + dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
74685 cf_sk->sk.sk_err = ECONNREFUSED;
74686 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
74687 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74688 @@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
74690 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
74691 /* Modem has closed this connection, or device is down. */
74692 - dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
74693 + dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
74694 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
74695 cf_sk->sk.sk_err = ECONNRESET;
74696 set_rx_flow_on(cf_sk);
74697 @@ -297,7 +298,7 @@ static void caif_check_flow_release(struct sock *sk)
74700 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
74701 - dbfs_atomic_inc(&cnt.num_rx_flow_on);
74702 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
74703 set_rx_flow_on(cf_sk);
74704 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
74706 @@ -854,7 +855,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
74707 /*ifindex = id of the interface.*/
74708 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
74710 - dbfs_atomic_inc(&cnt.num_connect_req);
74711 + dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
74712 cf_sk->layer.receive = caif_sktrecv_cb;
74714 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
74715 @@ -943,7 +944,7 @@ static int caif_release(struct socket *sock)
74716 spin_unlock_bh(&sk->sk_receive_queue.lock);
74719 - dbfs_atomic_inc(&cnt.num_disconnect);
74720 + dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
74722 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
74723 if (cf_sk->debugfs_socket_dir != NULL)
74724 @@ -1122,7 +1123,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
74725 cf_sk->conn_req.protocol = protocol;
74726 /* Increase the number of sockets created. */
74727 dbfs_atomic_inc(&cnt.caif_nr_socks);
74728 - num = dbfs_atomic_inc(&cnt.caif_sock_create);
74729 + num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
74730 #ifdef CONFIG_DEBUG_FS
74731 if (!IS_ERR(debugfsdir)) {
74733 diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
74734 index e22671b..6598ea0 100644
74735 --- a/net/caif/cfctrl.c
74736 +++ b/net/caif/cfctrl.c
74738 #include <linux/stddef.h>
74739 #include <linux/spinlock.h>
74740 #include <linux/slab.h>
74741 +#include <linux/sched.h>
74742 #include <net/caif/caif_layer.h>
74743 #include <net/caif/cfpkt.h>
74744 #include <net/caif/cfctrl.h>
74745 @@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
74746 dev_info.id = 0xff;
74747 memset(this, 0, sizeof(*this));
74748 cfsrvl_init(&this->serv, 0, &dev_info, false);
74749 - atomic_set(&this->req_seq_no, 1);
74750 - atomic_set(&this->rsp_seq_no, 1);
74751 + atomic_set_unchecked(&this->req_seq_no, 1);
74752 + atomic_set_unchecked(&this->rsp_seq_no, 1);
74753 this->serv.layer.receive = cfctrl_recv;
74754 sprintf(this->serv.layer.name, "ctrl");
74755 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
74756 @@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
74757 struct cfctrl_request_info *req)
74759 spin_lock_bh(&ctrl->info_list_lock);
74760 - atomic_inc(&ctrl->req_seq_no);
74761 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
74762 + atomic_inc_unchecked(&ctrl->req_seq_no);
74763 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
74764 list_add_tail(&req->list, &ctrl->list);
74765 spin_unlock_bh(&ctrl->info_list_lock);
74767 @@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
74769 pr_warn("Requests are not received in order\n");
74771 - atomic_set(&ctrl->rsp_seq_no,
74772 + atomic_set_unchecked(&ctrl->rsp_seq_no,
74774 list_del(&p->list);
74776 @@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
74777 struct cfctrl *cfctrl = container_obj(layer);
74778 struct cfctrl_request_info rsp, *req;
74780 + pax_track_stack();
74782 cfpkt_extr_head(pkt, &cmdrsp, 1);
74783 cmd = cmdrsp & CFCTRL_CMD_MASK;
74784 diff --git a/net/compat.c b/net/compat.c
74785 index c578d93..257fab7 100644
74788 @@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
74789 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
74790 __get_user(kmsg->msg_flags, &umsg->msg_flags))
74792 - kmsg->msg_name = compat_ptr(tmp1);
74793 - kmsg->msg_iov = compat_ptr(tmp2);
74794 - kmsg->msg_control = compat_ptr(tmp3);
74795 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
74796 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
74797 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
74801 @@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74803 if (kern_msg->msg_namelen) {
74804 if (mode == VERIFY_READ) {
74805 - int err = move_addr_to_kernel(kern_msg->msg_name,
74806 + int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
74807 kern_msg->msg_namelen,
74810 @@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74811 kern_msg->msg_name = NULL;
74813 tot_len = iov_from_user_compat_to_kern(kern_iov,
74814 - (struct compat_iovec __user *)kern_msg->msg_iov,
74815 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
74816 kern_msg->msg_iovlen);
74818 kern_msg->msg_iov = kern_iov;
74819 @@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
74821 #define CMSG_COMPAT_FIRSTHDR(msg) \
74822 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
74823 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
74824 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
74825 (struct compat_cmsghdr __user *)NULL)
74827 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
74828 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
74829 (ucmlen) <= (unsigned long) \
74830 ((mhdr)->msg_controllen - \
74831 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
74832 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
74834 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
74835 struct compat_cmsghdr __user *cmsg, int cmsg_len)
74837 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
74838 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
74839 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
74840 msg->msg_controllen)
74842 return (struct compat_cmsghdr __user *)ptr;
74843 @@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74845 struct compat_timeval ctv;
74846 struct compat_timespec cts[3];
74847 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74848 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74849 struct compat_cmsghdr cmhdr;
74852 @@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
74854 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
74856 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
74857 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
74858 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
74859 int fdnum = scm->fp->count;
74860 struct file **fp = scm->fp->fp;
74861 @@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
74865 - err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
74866 + err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
74870 @@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
74871 len = sizeof(ktime);
74874 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
74875 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
74879 @@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74880 case MCAST_JOIN_GROUP:
74881 case MCAST_LEAVE_GROUP:
74883 - struct compat_group_req __user *gr32 = (void *)optval;
74884 + struct compat_group_req __user *gr32 = (void __user *)optval;
74885 struct group_req __user *kgr =
74886 compat_alloc_user_space(sizeof(struct group_req));
74888 @@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74889 case MCAST_BLOCK_SOURCE:
74890 case MCAST_UNBLOCK_SOURCE:
74892 - struct compat_group_source_req __user *gsr32 = (void *)optval;
74893 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
74894 struct group_source_req __user *kgsr = compat_alloc_user_space(
74895 sizeof(struct group_source_req));
74897 @@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
74899 case MCAST_MSFILTER:
74901 - struct compat_group_filter __user *gf32 = (void *)optval;
74902 + struct compat_group_filter __user *gf32 = (void __user *)optval;
74903 struct group_filter __user *kgf;
74904 u32 interface, fmode, numsrc;
74906 @@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
74907 char __user *optval, int __user *optlen,
74908 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
74910 - struct compat_group_filter __user *gf32 = (void *)optval;
74911 + struct compat_group_filter __user *gf32 = (void __user *)optval;
74912 struct group_filter __user *kgf;
74913 int __user *koptlen;
74914 u32 interface, fmode, numsrc;
74915 diff --git a/net/core/datagram.c b/net/core/datagram.c
74916 index 18ac112..fe95ed9 100644
74917 --- a/net/core/datagram.c
74918 +++ b/net/core/datagram.c
74919 @@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
74923 - atomic_inc(&sk->sk_drops);
74924 + atomic_inc_unchecked(&sk->sk_drops);
74925 sk_mem_reclaim_partial(sk);
74928 diff --git a/net/core/dev.c b/net/core/dev.c
74929 index ae5cf2d..2c950a1 100644
74930 --- a/net/core/dev.c
74931 +++ b/net/core/dev.c
74932 @@ -1135,10 +1135,14 @@ void dev_load(struct net *net, const char *name)
74933 if (no_module && capable(CAP_NET_ADMIN))
74934 no_module = request_module("netdev-%s", name);
74935 if (no_module && capable(CAP_SYS_MODULE)) {
74936 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
74937 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
74939 if (!request_module("%s", name))
74940 pr_err("Loading kernel module for a network device "
74941 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
74942 "instead\n", name);
74946 EXPORT_SYMBOL(dev_load);
74947 @@ -1977,7 +1981,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
74949 struct dev_gso_cb {
74950 void (*destructor)(struct sk_buff *skb);
74954 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
74956 @@ -2930,7 +2934,7 @@ int netif_rx_ni(struct sk_buff *skb)
74958 EXPORT_SYMBOL(netif_rx_ni);
74960 -static void net_tx_action(struct softirq_action *h)
74961 +static void net_tx_action(void)
74963 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74965 @@ -3779,7 +3783,7 @@ void netif_napi_del(struct napi_struct *napi)
74967 EXPORT_SYMBOL(netif_napi_del);
74969 -static void net_rx_action(struct softirq_action *h)
74970 +static void net_rx_action(void)
74972 struct softnet_data *sd = &__get_cpu_var(softnet_data);
74973 unsigned long time_limit = jiffies + 2;
74974 diff --git a/net/core/flow.c b/net/core/flow.c
74975 index 555a456..de48421 100644
74976 --- a/net/core/flow.c
74977 +++ b/net/core/flow.c
74978 @@ -61,7 +61,7 @@ struct flow_cache {
74979 struct timer_list rnd_timer;
74982 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
74983 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
74984 EXPORT_SYMBOL(flow_cache_genid);
74985 static struct flow_cache flow_cache_global;
74986 static struct kmem_cache *flow_cachep __read_mostly;
74987 @@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
74989 static int flow_entry_valid(struct flow_cache_entry *fle)
74991 - if (atomic_read(&flow_cache_genid) != fle->genid)
74992 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
74994 if (fle->object && !fle->object->ops->check(fle->object))
74996 @@ -259,7 +259,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
74997 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
75000 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75001 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75005 @@ -280,7 +280,7 @@ nocache:
75007 flo = resolver(net, key, family, dir, flo, ctx);
75009 - fle->genid = atomic_read(&flow_cache_genid);
75010 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
75014 diff --git a/net/core/iovec.c b/net/core/iovec.c
75015 index c40f27e..7f49254 100644
75016 --- a/net/core/iovec.c
75017 +++ b/net/core/iovec.c
75018 @@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75019 if (m->msg_namelen) {
75020 if (mode == VERIFY_READ) {
75021 void __user *namep;
75022 - namep = (void __user __force *) m->msg_name;
75023 + namep = (void __force_user *) m->msg_name;
75024 err = move_addr_to_kernel(namep, m->msg_namelen,
75027 @@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
75030 size = m->msg_iovlen * sizeof(struct iovec);
75031 - if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
75032 + if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
75036 diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
75037 index 1683e5d..f3621f6 100644
75038 --- a/net/core/net-sysfs.c
75039 +++ b/net/core/net-sysfs.c
75040 @@ -664,11 +664,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
75044 - if (count > 1<<30) {
75045 - /* Enforce a limit to prevent overflow */
75046 + if (count > INT_MAX)
75049 count = roundup_pow_of_two(count);
75050 + if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table))
75051 + / sizeof(struct rps_dev_flow)) {
75052 + /* Enforce a limit to prevent overflow */
75055 table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
75058 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
75059 index 99d9e95..209bae2 100644
75060 --- a/net/core/rtnetlink.c
75061 +++ b/net/core/rtnetlink.c
75062 @@ -57,7 +57,7 @@ struct rtnl_link {
75063 rtnl_doit_func doit;
75064 rtnl_dumpit_func dumpit;
75065 rtnl_calcit_func calcit;
75069 static DEFINE_MUTEX(rtnl_mutex);
75070 static u16 min_ifinfo_dump_size;
75071 diff --git a/net/core/scm.c b/net/core/scm.c
75072 index 811b53f..5d6c343 100644
75073 --- a/net/core/scm.c
75074 +++ b/net/core/scm.c
75075 @@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
75076 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75078 struct cmsghdr __user *cm
75079 - = (__force struct cmsghdr __user *)msg->msg_control;
75080 + = (struct cmsghdr __force_user *)msg->msg_control;
75081 struct cmsghdr cmhdr;
75082 int cmlen = CMSG_LEN(len);
75084 @@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75086 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
75088 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
75089 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
75091 cmlen = CMSG_SPACE(len);
75092 if (msg->msg_controllen < cmlen)
75093 @@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
75094 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75096 struct cmsghdr __user *cm
75097 - = (__force struct cmsghdr __user*)msg->msg_control;
75098 + = (struct cmsghdr __force_user *)msg->msg_control;
75101 int fdnum = scm->fp->count;
75102 @@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75106 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
75107 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
75111 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
75112 index 387703f..035abcf 100644
75113 --- a/net/core/skbuff.c
75114 +++ b/net/core/skbuff.c
75115 @@ -1650,6 +1650,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
75116 struct sock *sk = skb->sk;
75119 + pax_track_stack();
75121 if (splice_grow_spd(pipe, &spd))
75124 diff --git a/net/core/sock.c b/net/core/sock.c
75125 index 11d67b3..df26d4b 100644
75126 --- a/net/core/sock.c
75127 +++ b/net/core/sock.c
75128 @@ -293,7 +293,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75130 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
75131 (unsigned)sk->sk_rcvbuf) {
75132 - atomic_inc(&sk->sk_drops);
75133 + atomic_inc_unchecked(&sk->sk_drops);
75134 trace_sock_rcvqueue_full(sk, skb);
75137 @@ -303,7 +303,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75140 if (!sk_rmem_schedule(sk, skb->truesize)) {
75141 - atomic_inc(&sk->sk_drops);
75142 + atomic_inc_unchecked(&sk->sk_drops);
75146 @@ -323,7 +323,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75147 skb_dst_force(skb);
75149 spin_lock_irqsave(&list->lock, flags);
75150 - skb->dropcount = atomic_read(&sk->sk_drops);
75151 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
75152 __skb_queue_tail(list, skb);
75153 spin_unlock_irqrestore(&list->lock, flags);
75155 @@ -343,7 +343,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
75158 if (sk_rcvqueues_full(sk, skb)) {
75159 - atomic_inc(&sk->sk_drops);
75160 + atomic_inc_unchecked(&sk->sk_drops);
75161 goto discard_and_relse;
75164 @@ -361,7 +361,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
75165 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
75166 } else if (sk_add_backlog(sk, skb)) {
75167 bh_unlock_sock(sk);
75168 - atomic_inc(&sk->sk_drops);
75169 + atomic_inc_unchecked(&sk->sk_drops);
75170 goto discard_and_relse;
75173 @@ -924,7 +924,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75174 if (len > sizeof(peercred))
75175 len = sizeof(peercred);
75176 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
75177 - if (copy_to_user(optval, &peercred, len))
75178 + if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
75182 @@ -937,7 +937,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75186 - if (copy_to_user(optval, address, len))
75187 + if (len > sizeof(address) || copy_to_user(optval, address, len))
75191 @@ -970,7 +970,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
75195 - if (copy_to_user(optval, &v, len))
75196 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
75199 if (put_user(len, optlen))
75200 @@ -2029,7 +2029,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
75203 atomic_set(&sk->sk_refcnt, 1);
75204 - atomic_set(&sk->sk_drops, 0);
75205 + atomic_set_unchecked(&sk->sk_drops, 0);
75207 EXPORT_SYMBOL(sock_init_data);
75209 diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
75210 index 02e75d1..9a57a7c 100644
75211 --- a/net/decnet/sysctl_net_decnet.c
75212 +++ b/net/decnet/sysctl_net_decnet.c
75213 @@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
75215 if (len > *lenp) len = *lenp;
75217 - if (copy_to_user(buffer, addr, len))
75218 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
75222 @@ -237,7 +237,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
75224 if (len > *lenp) len = *lenp;
75226 - if (copy_to_user(buffer, devname, len))
75227 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
75231 diff --git a/net/econet/Kconfig b/net/econet/Kconfig
75232 index 39a2d29..f39c0fe 100644
75233 --- a/net/econet/Kconfig
75234 +++ b/net/econet/Kconfig
75238 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
75239 - depends on EXPERIMENTAL && INET
75240 + depends on EXPERIMENTAL && INET && BROKEN
75242 Econet is a fairly old and slow networking protocol mainly used by
75243 Acorn computers to access file and print servers. It uses native
75244 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
75245 index 92fc5f6..b790d91 100644
75246 --- a/net/ipv4/fib_frontend.c
75247 +++ b/net/ipv4/fib_frontend.c
75248 @@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
75249 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75252 - atomic_inc(&net->ipv4.dev_addr_genid);
75253 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75254 rt_cache_flush(dev_net(dev), -1);
75257 fib_del_ifaddr(ifa, NULL);
75258 - atomic_inc(&net->ipv4.dev_addr_genid);
75259 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75260 if (ifa->ifa_dev->ifa_list == NULL) {
75261 /* Last address was deleted from this interface.
75263 @@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
75264 #ifdef CONFIG_IP_ROUTE_MULTIPATH
75267 - atomic_inc(&net->ipv4.dev_addr_genid);
75268 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
75269 rt_cache_flush(dev_net(dev), -1);
75272 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
75273 index 80106d8..232e898 100644
75274 --- a/net/ipv4/fib_semantics.c
75275 +++ b/net/ipv4/fib_semantics.c
75276 @@ -699,7 +699,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
75277 nh->nh_saddr = inet_select_addr(nh->nh_dev,
75279 nh->nh_parent->fib_scope);
75280 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
75281 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
75283 return nh->nh_saddr;
75285 diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
75286 index 389a2e6..ac1c1de 100644
75287 --- a/net/ipv4/inet_diag.c
75288 +++ b/net/ipv4/inet_diag.c
75289 @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct sock *sk,
75290 r->idiag_retrans = 0;
75292 r->id.idiag_if = sk->sk_bound_dev_if;
75294 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75295 + r->id.idiag_cookie[0] = 0;
75296 + r->id.idiag_cookie[1] = 0;
75298 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
75299 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
75302 r->id.idiag_sport = inet->inet_sport;
75303 r->id.idiag_dport = inet->inet_dport;
75304 @@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
75305 r->idiag_family = tw->tw_family;
75306 r->idiag_retrans = 0;
75307 r->id.idiag_if = tw->tw_bound_dev_if;
75309 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75310 + r->id.idiag_cookie[0] = 0;
75311 + r->id.idiag_cookie[1] = 0;
75313 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
75314 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
75317 r->id.idiag_sport = tw->tw_sport;
75318 r->id.idiag_dport = tw->tw_dport;
75319 r->id.idiag_src[0] = tw->tw_rcv_saddr;
75320 @@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
75324 +#ifndef CONFIG_GRKERNSEC_HIDESYM
75326 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
75327 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
75328 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
75329 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
75334 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
75335 @@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
75336 r->idiag_retrans = req->retrans;
75338 r->id.idiag_if = sk->sk_bound_dev_if;
75340 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75341 + r->id.idiag_cookie[0] = 0;
75342 + r->id.idiag_cookie[1] = 0;
75344 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
75345 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
75348 tmo = req->expires - jiffies;
75350 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
75351 index 984ec65..97ac518 100644
75352 --- a/net/ipv4/inet_hashtables.c
75353 +++ b/net/ipv4/inet_hashtables.c
75354 @@ -18,12 +18,15 @@
75355 #include <linux/sched.h>
75356 #include <linux/slab.h>
75357 #include <linux/wait.h>
75358 +#include <linux/security.h>
75360 #include <net/inet_connection_sock.h>
75361 #include <net/inet_hashtables.h>
75362 #include <net/secure_seq.h>
75363 #include <net/ip.h>
75365 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
75368 * Allocate and initialize a new local port bind bucket.
75369 * The bindhash mutex for snum's hash chain must be held here.
75370 @@ -530,6 +533,8 @@ ok:
75371 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
75372 spin_unlock(&head->lock);
75374 + gr_update_task_in_ip_table(current, inet_sk(sk));
75377 inet_twsk_deschedule(tw, death_row);
75379 diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
75380 index 86f13c67..0bce60f 100644
75381 --- a/net/ipv4/inetpeer.c
75382 +++ b/net/ipv4/inetpeer.c
75383 @@ -400,6 +400,8 @@ struct inet_peer *inet_getpeer(const struct inetpeer_addr *daddr, int create)
75384 unsigned int sequence;
75385 int invalidated, gccnt = 0;
75387 + pax_track_stack();
75389 /* Attempt a lockless lookup first.
75390 * Because of a concurrent writer, we might not find an existing entry.
75392 @@ -436,8 +438,8 @@ relookup:
75395 atomic_set(&p->refcnt, 1);
75396 - atomic_set(&p->rid, 0);
75397 - atomic_set(&p->ip_id_count,
75398 + atomic_set_unchecked(&p->rid, 0);
75399 + atomic_set_unchecked(&p->ip_id_count,
75400 (daddr->family == AF_INET) ?
75401 secure_ip_id(daddr->addr.a4) :
75402 secure_ipv6_id(daddr->addr.a6));
75403 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
75404 index 0e0ab98..2ed7dd5 100644
75405 --- a/net/ipv4/ip_fragment.c
75406 +++ b/net/ipv4/ip_fragment.c
75407 @@ -316,7 +316,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
75411 - end = atomic_inc_return(&peer->rid);
75412 + end = atomic_inc_return_unchecked(&peer->rid);
75415 rc = qp->q.fragments && (end - start) > max;
75416 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
75417 index 8905e92..0b179fb 100644
75418 --- a/net/ipv4/ip_sockglue.c
75419 +++ b/net/ipv4/ip_sockglue.c
75420 @@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75424 + pax_track_stack();
75426 if (level != SOL_IP)
75427 return -EOPNOTSUPP;
75429 @@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75430 len = min_t(unsigned int, len, opt->optlen);
75431 if (put_user(len, optlen))
75433 - if (copy_to_user(optval, opt->__data, len))
75434 + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
75435 + copy_to_user(optval, opt->__data, len))
75439 @@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
75440 if (sk->sk_type != SOCK_STREAM)
75441 return -ENOPROTOOPT;
75443 - msg.msg_control = optval;
75444 + msg.msg_control = (void __force_kernel *)optval;
75445 msg.msg_controllen = len;
75446 msg.msg_flags = flags;
75448 diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
75449 index 472a8c4..6507cd4 100644
75450 --- a/net/ipv4/ipconfig.c
75451 +++ b/net/ipv4/ipconfig.c
75452 @@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
75454 mm_segment_t oldfs = get_fs();
75456 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75457 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75461 @@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
75463 mm_segment_t oldfs = get_fs();
75465 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
75466 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
75470 @@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
75472 mm_segment_t oldfs = get_fs();
75474 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
75475 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
75479 diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75480 index 076b7c8..9c8d038 100644
75481 --- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
75482 +++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
75483 @@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
75487 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
75488 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
75489 if (*octets == NULL) {
75490 if (net_ratelimit())
75491 pr_notice("OOM in bsalg (%d)\n", __LINE__);
75492 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
75493 index 39b403f..8e6a0a8 100644
75494 --- a/net/ipv4/ping.c
75495 +++ b/net/ipv4/ping.c
75496 @@ -837,7 +837,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
75497 sk_rmem_alloc_get(sp),
75498 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75499 atomic_read(&sp->sk_refcnt), sp,
75500 - atomic_read(&sp->sk_drops), len);
75501 + atomic_read_unchecked(&sp->sk_drops), len);
75504 static int ping_seq_show(struct seq_file *seq, void *v)
75505 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
75506 index 61714bd..c9cee6d 100644
75507 --- a/net/ipv4/raw.c
75508 +++ b/net/ipv4/raw.c
75509 @@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
75510 int raw_rcv(struct sock *sk, struct sk_buff *skb)
75512 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
75513 - atomic_inc(&sk->sk_drops);
75514 + atomic_inc_unchecked(&sk->sk_drops);
75516 return NET_RX_DROP;
75518 @@ -737,16 +737,20 @@ static int raw_init(struct sock *sk)
75520 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
75522 + struct icmp_filter filter;
75524 if (optlen > sizeof(struct icmp_filter))
75525 optlen = sizeof(struct icmp_filter);
75526 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
75527 + if (copy_from_user(&filter, optval, optlen))
75529 + raw_sk(sk)->filter = filter;
75533 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
75535 int len, ret = -EFAULT;
75536 + struct icmp_filter filter;
75538 if (get_user(len, optlen))
75540 @@ -756,8 +760,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
75541 if (len > sizeof(struct icmp_filter))
75542 len = sizeof(struct icmp_filter);
75544 - if (put_user(len, optlen) ||
75545 - copy_to_user(optval, &raw_sk(sk)->filter, len))
75546 + filter = raw_sk(sk)->filter;
75547 + if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
75551 @@ -985,7 +989,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
75552 sk_wmem_alloc_get(sp),
75553 sk_rmem_alloc_get(sp),
75554 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75555 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
75556 + atomic_read(&sp->sk_refcnt),
75557 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75562 + atomic_read_unchecked(&sp->sk_drops));
75565 static int raw_seq_show(struct seq_file *seq, void *v)
75566 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
75567 index 05ac666c..82384a7 100644
75568 --- a/net/ipv4/route.c
75569 +++ b/net/ipv4/route.c
75570 @@ -309,7 +309,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
75572 static inline int rt_genid(struct net *net)
75574 - return atomic_read(&net->ipv4.rt_genid);
75575 + return atomic_read_unchecked(&net->ipv4.rt_genid);
75578 #ifdef CONFIG_PROC_FS
75579 @@ -842,7 +842,7 @@ static void rt_cache_invalidate(struct net *net)
75580 unsigned char shuffle;
75582 get_random_bytes(&shuffle, sizeof(shuffle));
75583 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
75584 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
75588 @@ -2920,7 +2920,7 @@ static int rt_fill_info(struct net *net,
75589 error = rt->dst.error;
75591 inet_peer_refcheck(rt->peer);
75592 - id = atomic_read(&peer->ip_id_count) & 0xffff;
75593 + id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
75594 if (peer->tcp_ts_stamp) {
75596 tsage = get_seconds() - peer->tcp_ts_stamp;
75597 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
75598 index 46febca..98b73a4 100644
75599 --- a/net/ipv4/tcp.c
75600 +++ b/net/ipv4/tcp.c
75601 @@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
75605 + pax_track_stack();
75607 /* These are data/string values, all the others are ints */
75609 case TCP_CONGESTION: {
75610 @@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
75611 struct tcp_sock *tp = tcp_sk(sk);
75614 + pax_track_stack();
75616 if (get_user(len, optlen))
75619 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
75620 index 7963e03..c44f5d0 100644
75621 --- a/net/ipv4/tcp_ipv4.c
75622 +++ b/net/ipv4/tcp_ipv4.c
75623 @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
75624 int sysctl_tcp_low_latency __read_mostly;
75625 EXPORT_SYMBOL(sysctl_tcp_low_latency);
75627 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75628 +extern int grsec_enable_blackhole;
75631 #ifdef CONFIG_TCP_MD5SIG
75632 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
75633 @@ -1622,6 +1625,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
75637 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75638 + if (!grsec_enable_blackhole)
75640 tcp_v4_send_reset(rsk, skb);
75643 @@ -1684,12 +1690,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
75644 TCP_SKB_CB(skb)->sacked = 0;
75646 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
75649 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75652 goto no_tcp_socket;
75656 - if (sk->sk_state == TCP_TIME_WAIT)
75657 + if (sk->sk_state == TCP_TIME_WAIT) {
75658 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75664 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
75665 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
75666 @@ -1739,6 +1752,10 @@ no_tcp_socket:
75668 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
75670 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75671 + if (!grsec_enable_blackhole || (ret == 1 &&
75672 + (skb->dev->flags & IFF_LOOPBACK)))
75674 tcp_v4_send_reset(NULL, skb);
75677 @@ -2403,7 +2420,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
75678 0, /* non standard timer */
75679 0, /* open_requests have no inode */
75680 atomic_read(&sk->sk_refcnt),
75681 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75689 @@ -2453,7 +2474,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
75691 icsk->icsk_probes_out,
75693 - atomic_read(&sk->sk_refcnt), sk,
75694 + atomic_read(&sk->sk_refcnt),
75695 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75700 jiffies_to_clock_t(icsk->icsk_rto),
75701 jiffies_to_clock_t(icsk->icsk_ack.ato),
75702 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
75703 @@ -2481,7 +2507,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
75704 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
75705 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
75706 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
75707 - atomic_read(&tw->tw_refcnt), tw, len);
75708 + atomic_read(&tw->tw_refcnt),
75709 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75718 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
75719 index 0ce3d06..e182e59 100644
75720 --- a/net/ipv4/tcp_minisocks.c
75721 +++ b/net/ipv4/tcp_minisocks.c
75723 #include <net/inet_common.h>
75724 #include <net/xfrm.h>
75726 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75727 +extern int grsec_enable_blackhole;
75730 int sysctl_tcp_syncookies __read_mostly = 1;
75731 EXPORT_SYMBOL(sysctl_tcp_syncookies);
75733 @@ -750,6 +754,10 @@ listen_overflow:
75736 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
75738 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75739 + if (!grsec_enable_blackhole)
75741 if (!(flg & TCP_FLAG_RST))
75742 req->rsk_ops->send_reset(sk, skb);
75744 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
75745 index 882e0b0..2eba47f 100644
75746 --- a/net/ipv4/tcp_output.c
75747 +++ b/net/ipv4/tcp_output.c
75748 @@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
75750 int s_data_desired = 0;
75752 + pax_track_stack();
75754 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
75755 s_data_desired = cvp->s_data_desired;
75756 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
75757 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
75758 index 85ee7eb..53277ab 100644
75759 --- a/net/ipv4/tcp_probe.c
75760 +++ b/net/ipv4/tcp_probe.c
75761 @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
75762 if (cnt + width >= len)
75765 - if (copy_to_user(buf + cnt, tbuf, width))
75766 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
75770 diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
75771 index ecd44b0..b32fba6 100644
75772 --- a/net/ipv4/tcp_timer.c
75773 +++ b/net/ipv4/tcp_timer.c
75775 #include <linux/gfp.h>
75776 #include <net/tcp.h>
75778 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75779 +extern int grsec_lastack_retries;
75782 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
75783 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
75784 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
75785 @@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock *sk)
75789 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75790 + if ((sk->sk_state == TCP_LAST_ACK) &&
75791 + (grsec_lastack_retries > 0) &&
75792 + (grsec_lastack_retries < retry_until))
75793 + retry_until = grsec_lastack_retries;
75796 if (retransmits_timed_out(sk, retry_until,
75797 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
75798 /* Has it gone just too far? */
75799 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
75800 index 1b5a193..bd354b0 100644
75801 --- a/net/ipv4/udp.c
75802 +++ b/net/ipv4/udp.c
75804 #include <linux/types.h>
75805 #include <linux/fcntl.h>
75806 #include <linux/module.h>
75807 +#include <linux/security.h>
75808 #include <linux/socket.h>
75809 #include <linux/sockios.h>
75810 #include <linux/igmp.h>
75811 @@ -108,6 +109,10 @@
75812 #include <trace/events/udp.h>
75813 #include "udp_impl.h"
75815 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75816 +extern int grsec_enable_blackhole;
75819 struct udp_table udp_table __read_mostly;
75820 EXPORT_SYMBOL(udp_table);
75822 @@ -565,6 +570,9 @@ found:
75826 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
75827 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
75830 * This routine is called by the ICMP module when it gets some
75831 * sort of error condition. If err < 0 then the socket should
75832 @@ -856,9 +864,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
75833 dport = usin->sin_port;
75837 + err = gr_search_udp_sendmsg(sk, usin);
75841 if (sk->sk_state != TCP_ESTABLISHED)
75842 return -EDESTADDRREQ;
75844 + err = gr_search_udp_sendmsg(sk, NULL);
75848 daddr = inet->inet_daddr;
75849 dport = inet->inet_dport;
75850 /* Open fast path for connected socket.
75851 @@ -1099,7 +1116,7 @@ static unsigned int first_packet_length(struct sock *sk)
75852 udp_lib_checksum_complete(skb)) {
75853 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75855 - atomic_inc(&sk->sk_drops);
75856 + atomic_inc_unchecked(&sk->sk_drops);
75857 __skb_unlink(skb, rcvq);
75858 __skb_queue_tail(&list_kill, skb);
75860 @@ -1185,6 +1202,10 @@ try_again:
75864 + err = gr_search_udp_recvmsg(sk, skb);
75868 ulen = skb->len - sizeof(struct udphdr);
75871 @@ -1485,7 +1506,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
75874 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
75875 - atomic_inc(&sk->sk_drops);
75876 + atomic_inc_unchecked(&sk->sk_drops);
75880 @@ -1504,7 +1525,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
75881 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
75884 - atomic_inc(&sk->sk_drops);
75885 + atomic_inc_unchecked(&sk->sk_drops);
75886 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
75888 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
75889 @@ -1673,6 +1694,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
75892 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
75893 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75894 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
75896 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
75899 @@ -2100,8 +2124,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
75900 sk_wmem_alloc_get(sp),
75901 sk_rmem_alloc_get(sp),
75902 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
75903 - atomic_read(&sp->sk_refcnt), sp,
75904 - atomic_read(&sp->sk_drops), len);
75905 + atomic_read(&sp->sk_refcnt),
75906 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75911 + atomic_read_unchecked(&sp->sk_drops), len);
75914 int udp4_seq_show(struct seq_file *seq, void *v)
75915 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
75916 index 12368c5..fbf899f 100644
75917 --- a/net/ipv6/addrconf.c
75918 +++ b/net/ipv6/addrconf.c
75919 @@ -2083,7 +2083,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
75921 p.iph.protocol = IPPROTO_IPV6;
75923 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
75924 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
75926 if (ops->ndo_do_ioctl) {
75927 mm_segment_t oldfs = get_fs();
75928 diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
75929 index 8a58e8c..8b5e631 100644
75930 --- a/net/ipv6/inet6_connection_sock.c
75931 +++ b/net/ipv6/inet6_connection_sock.c
75932 @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
75935 struct rt6_info *rt = (struct rt6_info *)dst;
75936 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
75937 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
75941 @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
75944 struct rt6_info *rt = (struct rt6_info *)dst;
75945 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
75946 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
75947 __sk_dst_reset(sk);
75950 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
75951 index 2fbda5f..26ed683 100644
75952 --- a/net/ipv6/ipv6_sockglue.c
75953 +++ b/net/ipv6/ipv6_sockglue.c
75954 @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
75956 int retv = -ENOPROTOOPT;
75958 + pax_track_stack();
75960 if (optval == NULL)
75963 @@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75967 + pax_track_stack();
75969 if (ip6_mroute_opt(optname))
75970 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
75972 @@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
75973 if (sk->sk_type != SOCK_STREAM)
75974 return -ENOPROTOOPT;
75976 - msg.msg_control = optval;
75977 + msg.msg_control = (void __force_kernel *)optval;
75978 msg.msg_controllen = len;
75979 msg.msg_flags = flags;
75981 diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
75982 index 343852e..c92bd15 100644
75983 --- a/net/ipv6/raw.c
75984 +++ b/net/ipv6/raw.c
75985 @@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
75987 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
75988 skb_checksum_complete(skb)) {
75989 - atomic_inc(&sk->sk_drops);
75990 + atomic_inc_unchecked(&sk->sk_drops);
75992 return NET_RX_DROP;
75994 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
75995 struct raw6_sock *rp = raw6_sk(sk);
75997 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
75998 - atomic_inc(&sk->sk_drops);
75999 + atomic_inc_unchecked(&sk->sk_drops);
76001 return NET_RX_DROP;
76003 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76005 if (inet->hdrincl) {
76006 if (skb_checksum_complete(skb)) {
76007 - atomic_inc(&sk->sk_drops);
76008 + atomic_inc_unchecked(&sk->sk_drops);
76010 return NET_RX_DROP;
76012 @@ -601,7 +601,7 @@ out:
76016 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76017 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76018 struct flowi6 *fl6, struct dst_entry **dstp,
76019 unsigned int flags)
76021 @@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
76025 + pax_track_stack();
76027 /* Rough check on arithmetic overflow,
76028 better check is made in ip6_append_data().
76030 @@ -909,12 +911,15 @@ do_confirm:
76031 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76032 char __user *optval, int optlen)
76034 + struct icmp6_filter filter;
76037 case ICMPV6_FILTER:
76038 if (optlen > sizeof(struct icmp6_filter))
76039 optlen = sizeof(struct icmp6_filter);
76040 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76041 + if (copy_from_user(&filter, optval, optlen))
76043 + raw6_sk(sk)->filter = filter;
76046 return -ENOPROTOOPT;
76047 @@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76048 char __user *optval, int __user *optlen)
76051 + struct icmp6_filter filter;
76054 case ICMPV6_FILTER:
76055 @@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76056 len = sizeof(struct icmp6_filter);
76057 if (put_user(len, optlen))
76059 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76060 + filter = raw6_sk(sk)->filter;
76061 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
76065 @@ -1245,7 +1252,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
76069 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76070 + atomic_read(&sp->sk_refcnt),
76071 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76076 + atomic_read_unchecked(&sp->sk_drops));
76079 static int raw6_seq_show(struct seq_file *seq, void *v)
76080 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
76081 index 7b8fc57..c6185da 100644
76082 --- a/net/ipv6/tcp_ipv6.c
76083 +++ b/net/ipv6/tcp_ipv6.c
76084 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
76088 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76089 +extern int grsec_enable_blackhole;
76092 static void tcp_v6_hash(struct sock *sk)
76094 if (sk->sk_state != TCP_CLOSE) {
76095 @@ -1647,6 +1651,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
76099 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76100 + if (!grsec_enable_blackhole)
76102 tcp_v6_send_reset(sk, skb);
76105 @@ -1726,12 +1733,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
76106 TCP_SKB_CB(skb)->sacked = 0;
76108 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76111 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76114 goto no_tcp_socket;
76118 - if (sk->sk_state == TCP_TIME_WAIT)
76119 + if (sk->sk_state == TCP_TIME_WAIT) {
76120 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76126 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76127 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76128 @@ -1779,6 +1794,10 @@ no_tcp_socket:
76130 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76132 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76133 + if (!grsec_enable_blackhole || (ret == 1 &&
76134 + (skb->dev->flags & IFF_LOOPBACK)))
76136 tcp_v6_send_reset(NULL, skb);
76139 @@ -2039,7 +2058,13 @@ static void get_openreq6(struct seq_file *seq,
76141 0, /* non standard timer */
76142 0, /* open_requests have no inode */
76145 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76153 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76154 @@ -2089,7 +2114,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76156 icsk->icsk_probes_out,
76158 - atomic_read(&sp->sk_refcnt), sp,
76159 + atomic_read(&sp->sk_refcnt),
76160 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76165 jiffies_to_clock_t(icsk->icsk_rto),
76166 jiffies_to_clock_t(icsk->icsk_ack.ato),
76167 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76168 @@ -2124,7 +2154,13 @@ static void get_timewait6_sock(struct seq_file *seq,
76169 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76170 tw->tw_substate, 0, 0,
76171 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76172 - atomic_read(&tw->tw_refcnt), tw);
76173 + atomic_read(&tw->tw_refcnt),
76174 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76182 static int tcp6_seq_show(struct seq_file *seq, void *v)
76183 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
76184 index bb95e8e..ae0ee80 100644
76185 --- a/net/ipv6/udp.c
76186 +++ b/net/ipv6/udp.c
76188 #include <linux/seq_file.h>
76189 #include "udp_impl.h"
76191 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76192 +extern int grsec_enable_blackhole;
76195 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76197 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76198 @@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
76202 - atomic_inc(&sk->sk_drops);
76203 + atomic_inc_unchecked(&sk->sk_drops);
76204 drop_no_sk_drops_inc:
76205 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76207 @@ -624,7 +628,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
76211 - atomic_inc(&sk->sk_drops);
76212 + atomic_inc_unchecked(&sk->sk_drops);
76213 UDP6_INC_STATS_BH(sock_net(sk),
76214 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76215 UDP6_INC_STATS_BH(sock_net(sk),
76216 @@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76217 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76218 proto == IPPROTO_UDPLITE);
76220 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76221 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76223 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
76226 @@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76227 if (!sock_owned_by_user(sk))
76228 udpv6_queue_rcv_skb(sk, skb);
76229 else if (sk_add_backlog(sk, skb)) {
76230 - atomic_inc(&sk->sk_drops);
76231 + atomic_inc_unchecked(&sk->sk_drops);
76232 bh_unlock_sock(sk);
76235 @@ -1406,8 +1413,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
76239 - atomic_read(&sp->sk_refcnt), sp,
76240 - atomic_read(&sp->sk_drops));
76241 + atomic_read(&sp->sk_refcnt),
76242 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76247 + atomic_read_unchecked(&sp->sk_drops));
76250 int udp6_seq_show(struct seq_file *seq, void *v)
76251 diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
76252 index b3cc8b3..baa02d0 100644
76253 --- a/net/irda/ircomm/ircomm_tty.c
76254 +++ b/net/irda/ircomm/ircomm_tty.c
76255 @@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76256 add_wait_queue(&self->open_wait, &wait);
76258 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76259 - __FILE__,__LINE__, tty->driver->name, self->open_count );
76260 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76262 /* As far as I can see, we protect open_count - Jean II */
76263 spin_lock_irqsave(&self->spinlock, flags);
76264 if (!tty_hung_up_p(filp)) {
76266 - self->open_count--;
76267 + local_dec(&self->open_count);
76269 spin_unlock_irqrestore(&self->spinlock, flags);
76270 - self->blocked_open++;
76271 + local_inc(&self->blocked_open);
76274 if (tty->termios->c_cflag & CBAUD) {
76275 @@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76278 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
76279 - __FILE__,__LINE__, tty->driver->name, self->open_count );
76280 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76284 @@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
76286 /* ++ is not atomic, so this should be protected - Jean II */
76287 spin_lock_irqsave(&self->spinlock, flags);
76288 - self->open_count++;
76289 + local_inc(&self->open_count);
76290 spin_unlock_irqrestore(&self->spinlock, flags);
76292 - self->blocked_open--;
76293 + local_dec(&self->blocked_open);
76295 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
76296 - __FILE__,__LINE__, tty->driver->name, self->open_count);
76297 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
76300 self->flags |= ASYNC_NORMAL_ACTIVE;
76301 @@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
76303 /* ++ is not atomic, so this should be protected - Jean II */
76304 spin_lock_irqsave(&self->spinlock, flags);
76305 - self->open_count++;
76306 + local_inc(&self->open_count);
76308 tty->driver_data = self;
76310 spin_unlock_irqrestore(&self->spinlock, flags);
76312 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
76313 - self->line, self->open_count);
76314 + self->line, local_read(&self->open_count));
76316 /* Not really used by us, but lets do it anyway */
76317 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
76318 @@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76322 - if ((tty->count == 1) && (self->open_count != 1)) {
76323 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
76325 * Uh, oh. tty->count is 1, which means that the tty
76326 * structure will be freed. state->count should always
76327 @@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76329 IRDA_DEBUG(0, "%s(), bad serial port count; "
76330 "tty->count is 1, state->count is %d\n", __func__ ,
76331 - self->open_count);
76332 - self->open_count = 1;
76333 + local_read(&self->open_count));
76334 + local_set(&self->open_count, 1);
76337 - if (--self->open_count < 0) {
76338 + if (local_dec_return(&self->open_count) < 0) {
76339 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
76340 - __func__, self->line, self->open_count);
76341 - self->open_count = 0;
76342 + __func__, self->line, local_read(&self->open_count));
76343 + local_set(&self->open_count, 0);
76345 - if (self->open_count) {
76346 + if (local_read(&self->open_count)) {
76347 spin_unlock_irqrestore(&self->spinlock, flags);
76349 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
76350 @@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
76354 - if (self->blocked_open) {
76355 + if (local_read(&self->blocked_open)) {
76356 if (self->close_delay)
76357 schedule_timeout_interruptible(self->close_delay);
76358 wake_up_interruptible(&self->open_wait);
76359 @@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
76360 spin_lock_irqsave(&self->spinlock, flags);
76361 self->flags &= ~ASYNC_NORMAL_ACTIVE;
76363 - self->open_count = 0;
76364 + local_set(&self->open_count, 0);
76365 spin_unlock_irqrestore(&self->spinlock, flags);
76367 wake_up_interruptible(&self->open_wait);
76368 @@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
76371 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
76372 - seq_printf(m, "Open count: %d\n", self->open_count);
76373 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
76374 seq_printf(m, "Max data size: %d\n", self->max_data_size);
76375 seq_printf(m, "Max header size: %d\n", self->max_header_size);
76377 diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
76378 index e2013e4..edfc1e3 100644
76379 --- a/net/iucv/af_iucv.c
76380 +++ b/net/iucv/af_iucv.c
76381 @@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct sock *sk)
76383 write_lock_bh(&iucv_sk_list.lock);
76385 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
76386 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76387 while (__iucv_get_sock_by_name(name)) {
76388 sprintf(name, "%08x",
76389 - atomic_inc_return(&iucv_sk_list.autobind_name));
76390 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
76393 write_unlock_bh(&iucv_sk_list.lock);
76394 diff --git a/net/key/af_key.c b/net/key/af_key.c
76395 index 1e733e9..c84de2f 100644
76396 --- a/net/key/af_key.c
76397 +++ b/net/key/af_key.c
76398 @@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
76399 struct xfrm_migrate m[XFRM_MAX_DEPTH];
76400 struct xfrm_kmaddress k;
76402 + pax_track_stack();
76404 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
76405 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
76406 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
76407 @@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
76408 static u32 get_acqseq(void)
76411 - static atomic_t acqseq;
76412 + static atomic_unchecked_t acqseq;
76415 - res = atomic_inc_return(&acqseq);
76416 + res = atomic_inc_return_unchecked(&acqseq);
76420 diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
76421 index 956b7e4..f01d328 100644
76422 --- a/net/lapb/lapb_iface.c
76423 +++ b/net/lapb/lapb_iface.c
76424 @@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
76428 - lapb->callbacks = *callbacks;
76429 + lapb->callbacks = callbacks;
76431 __lapb_insert_cb(lapb);
76433 @@ -380,32 +380,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
76435 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
76437 - if (lapb->callbacks.connect_confirmation)
76438 - lapb->callbacks.connect_confirmation(lapb->dev, reason);
76439 + if (lapb->callbacks->connect_confirmation)
76440 + lapb->callbacks->connect_confirmation(lapb->dev, reason);
76443 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
76445 - if (lapb->callbacks.connect_indication)
76446 - lapb->callbacks.connect_indication(lapb->dev, reason);
76447 + if (lapb->callbacks->connect_indication)
76448 + lapb->callbacks->connect_indication(lapb->dev, reason);
76451 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
76453 - if (lapb->callbacks.disconnect_confirmation)
76454 - lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
76455 + if (lapb->callbacks->disconnect_confirmation)
76456 + lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
76459 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
76461 - if (lapb->callbacks.disconnect_indication)
76462 - lapb->callbacks.disconnect_indication(lapb->dev, reason);
76463 + if (lapb->callbacks->disconnect_indication)
76464 + lapb->callbacks->disconnect_indication(lapb->dev, reason);
76467 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
76469 - if (lapb->callbacks.data_indication)
76470 - return lapb->callbacks.data_indication(lapb->dev, skb);
76471 + if (lapb->callbacks->data_indication)
76472 + return lapb->callbacks->data_indication(lapb->dev, skb);
76475 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
76476 @@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
76480 - if (lapb->callbacks.data_transmit) {
76481 - lapb->callbacks.data_transmit(lapb->dev, skb);
76482 + if (lapb->callbacks->data_transmit) {
76483 + lapb->callbacks->data_transmit(lapb->dev, skb);
76487 diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
76488 index a01d213..6a1f1ab 100644
76489 --- a/net/mac80211/debugfs_sta.c
76490 +++ b/net/mac80211/debugfs_sta.c
76491 @@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
76492 struct tid_ampdu_rx *tid_rx;
76493 struct tid_ampdu_tx *tid_tx;
76495 + pax_track_stack();
76499 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
76500 @@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
76501 struct sta_info *sta = file->private_data;
76502 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
76504 + pax_track_stack();
76506 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
76507 htc->ht_supported ? "" : "not ");
76508 if (htc->ht_supported) {
76509 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
76510 index 9fab144..7f0fc14 100644
76511 --- a/net/mac80211/ieee80211_i.h
76512 +++ b/net/mac80211/ieee80211_i.h
76514 #include <net/ieee80211_radiotap.h>
76515 #include <net/cfg80211.h>
76516 #include <net/mac80211.h>
76517 +#include <asm/local.h>
76519 #include "sta_info.h"
76521 @@ -754,7 +755,7 @@ struct ieee80211_local {
76522 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
76523 spinlock_t queue_stop_reason_lock;
76526 + local_t open_count;
76527 int monitors, cooked_mntrs;
76528 /* number of interfaces with corresponding FIF_ flags */
76529 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
76530 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
76531 index 556e7e6..120dcaf 100644
76532 --- a/net/mac80211/iface.c
76533 +++ b/net/mac80211/iface.c
76534 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76538 - if (local->open_count == 0) {
76539 + if (local_read(&local->open_count) == 0) {
76540 res = drv_start(local);
76543 @@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76544 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
76546 if (!is_valid_ether_addr(dev->dev_addr)) {
76547 - if (!local->open_count)
76548 + if (!local_read(&local->open_count))
76550 return -EADDRNOTAVAIL;
76552 @@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76553 mutex_unlock(&local->mtx);
76556 - local->open_count++;
76557 + local_inc(&local->open_count);
76559 if (hw_reconf_flags) {
76560 ieee80211_hw_config(local, hw_reconf_flags);
76561 @@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
76563 drv_remove_interface(local, &sdata->vif);
76565 - if (!local->open_count)
76566 + if (!local_read(&local->open_count))
76570 @@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76574 - local->open_count--;
76575 + local_dec(&local->open_count);
76577 switch (sdata->vif.type) {
76578 case NL80211_IFTYPE_AP_VLAN:
76579 @@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
76581 ieee80211_recalc_ps(local, -1);
76583 - if (local->open_count == 0) {
76584 + if (local_read(&local->open_count) == 0) {
76585 if (local->ops->napi_poll)
76586 napi_disable(&local->napi);
76587 ieee80211_clear_tx_pending(local);
76588 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
76589 index 3d90dad..36884d5 100644
76590 --- a/net/mac80211/main.c
76591 +++ b/net/mac80211/main.c
76592 @@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
76593 local->hw.conf.power_level = power;
76596 - if (changed && local->open_count) {
76597 + if (changed && local_read(&local->open_count)) {
76598 ret = drv_config(local, changed);
76601 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
76602 index 0f48368..d48e688 100644
76603 --- a/net/mac80211/mlme.c
76604 +++ b/net/mac80211/mlme.c
76605 @@ -1464,6 +1464,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
76606 bool have_higher_than_11mbit = false;
76607 u16 ap_ht_cap_flags;
76609 + pax_track_stack();
76611 /* AssocResp and ReassocResp have identical structure */
76613 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
76614 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
76615 index 6326d34..7225f61 100644
76616 --- a/net/mac80211/pm.c
76617 +++ b/net/mac80211/pm.c
76618 @@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76619 struct ieee80211_sub_if_data *sdata;
76620 struct sta_info *sta;
76622 - if (!local->open_count)
76623 + if (!local_read(&local->open_count))
76626 ieee80211_scan_cancel(local);
76627 @@ -72,7 +72,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76628 cancel_work_sync(&local->dynamic_ps_enable_work);
76629 del_timer_sync(&local->dynamic_ps_timer);
76631 - local->wowlan = wowlan && local->open_count;
76632 + local->wowlan = wowlan && local_read(&local->open_count);
76633 if (local->wowlan) {
76634 int err = drv_suspend(local, wowlan);
76636 @@ -129,7 +129,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
76639 /* stop hardware - this must stop RX */
76640 - if (local->open_count)
76641 + if (local_read(&local->open_count))
76642 ieee80211_stop_device(local);
76645 diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
76646 index 3d5a2cb..b17ad48 100644
76647 --- a/net/mac80211/rate.c
76648 +++ b/net/mac80211/rate.c
76649 @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
76653 - if (local->open_count)
76654 + if (local_read(&local->open_count))
76657 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
76658 diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
76659 index 4851e9e..d860e05 100644
76660 --- a/net/mac80211/rc80211_pid_debugfs.c
76661 +++ b/net/mac80211/rc80211_pid_debugfs.c
76662 @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
76664 spin_unlock_irqrestore(&events->lock, status);
76666 - if (copy_to_user(buf, pb, p))
76667 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
76671 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
76672 index fd031e8..84fbfcf 100644
76673 --- a/net/mac80211/util.c
76674 +++ b/net/mac80211/util.c
76675 @@ -1170,7 +1170,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
76676 drv_set_coverage_class(local, hw->wiphy->coverage_class);
76678 /* everything else happens only if HW was up & running */
76679 - if (!local->open_count)
76680 + if (!local_read(&local->open_count))
76684 diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
76685 index 32bff6d..d0cf986 100644
76686 --- a/net/netfilter/Kconfig
76687 +++ b/net/netfilter/Kconfig
76688 @@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
76690 To compile it as a module, choose M here. If unsure, say N.
76692 +config NETFILTER_XT_MATCH_GRADM
76693 + tristate '"gradm" match support'
76694 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
76695 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
76697 + The gradm match allows to match on grsecurity RBAC being enabled.
76698 + It is useful when iptables rules are applied early on bootup to
76699 + prevent connections to the machine (except from a trusted host)
76700 + while the RBAC system is disabled.
76702 config NETFILTER_XT_MATCH_HASHLIMIT
76703 tristate '"hashlimit" match support'
76704 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
76705 diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
76706 index 1a02853..5d8c22e 100644
76707 --- a/net/netfilter/Makefile
76708 +++ b/net/netfilter/Makefile
76709 @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
76710 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
76711 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
76712 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
76713 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
76714 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
76715 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
76716 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
76717 diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
76718 index 12571fb..fb73976 100644
76719 --- a/net/netfilter/ipvs/ip_vs_conn.c
76720 +++ b/net/netfilter/ipvs/ip_vs_conn.c
76721 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
76722 /* Increase the refcnt counter of the dest */
76723 atomic_inc(&dest->refcnt);
76725 - conn_flags = atomic_read(&dest->conn_flags);
76726 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
76727 if (cp->protocol != IPPROTO_UDP)
76728 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
76729 /* Bind with the destination and its corresponding transmitter */
76730 @@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
76731 atomic_set(&cp->refcnt, 1);
76733 atomic_set(&cp->n_control, 0);
76734 - atomic_set(&cp->in_pkts, 0);
76735 + atomic_set_unchecked(&cp->in_pkts, 0);
76737 atomic_inc(&ipvs->conn_count);
76738 if (flags & IP_VS_CONN_F_NO_CPORT)
76739 @@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
76741 /* Don't drop the entry if its number of incoming packets is not
76742 located in [0, 8] */
76743 - i = atomic_read(&cp->in_pkts);
76744 + i = atomic_read_unchecked(&cp->in_pkts);
76745 if (i > 8 || i < 0) return 0;
76747 if (!todrop_rate[i]) return 0;
76748 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
76749 index 4f77bb1..5d0bc26 100644
76750 --- a/net/netfilter/ipvs/ip_vs_core.c
76751 +++ b/net/netfilter/ipvs/ip_vs_core.c
76752 @@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
76753 ret = cp->packet_xmit(skb, cp, pd->pp);
76754 /* do not touch skb anymore */
76756 - atomic_inc(&cp->in_pkts);
76757 + atomic_inc_unchecked(&cp->in_pkts);
76758 ip_vs_conn_put(cp);
76761 @@ -1612,7 +1612,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
76762 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
76763 pkts = sysctl_sync_threshold(ipvs);
76765 - pkts = atomic_add_return(1, &cp->in_pkts);
76766 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76768 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
76769 cp->protocol == IPPROTO_SCTP) {
76770 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
76771 index e3be48b..d658c8c 100644
76772 --- a/net/netfilter/ipvs/ip_vs_ctl.c
76773 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
76774 @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
76775 ip_vs_rs_hash(ipvs, dest);
76776 write_unlock_bh(&ipvs->rs_lock);
76778 - atomic_set(&dest->conn_flags, conn_flags);
76779 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
76781 /* bind the service */
76783 @@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76784 " %-7s %-6d %-10d %-10d\n",
76787 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76788 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76789 atomic_read(&dest->weight),
76790 atomic_read(&dest->activeconns),
76791 atomic_read(&dest->inactconns));
76792 @@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
76793 "%-7s %-6d %-10d %-10d\n",
76794 ntohl(dest->addr.ip),
76796 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
76797 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
76798 atomic_read(&dest->weight),
76799 atomic_read(&dest->activeconns),
76800 atomic_read(&dest->inactconns));
76801 @@ -2285,6 +2285,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
76802 struct ip_vs_dest_user_kern udest;
76803 struct netns_ipvs *ipvs = net_ipvs(net);
76805 + pax_track_stack();
76807 if (!capable(CAP_NET_ADMIN))
76810 @@ -2508,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
76812 entry.addr = dest->addr.ip;
76813 entry.port = dest->port;
76814 - entry.conn_flags = atomic_read(&dest->conn_flags);
76815 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
76816 entry.weight = atomic_read(&dest->weight);
76817 entry.u_threshold = dest->u_threshold;
76818 entry.l_threshold = dest->l_threshold;
76819 @@ -3041,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
76820 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
76822 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
76823 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76824 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
76825 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
76826 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
76827 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
76828 diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
76829 index 3cdd479..116afa8 100644
76830 --- a/net/netfilter/ipvs/ip_vs_sync.c
76831 +++ b/net/netfilter/ipvs/ip_vs_sync.c
76832 @@ -649,7 +649,7 @@ control:
76833 * i.e only increment in_pkts for Templates.
76835 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
76836 - int pkts = atomic_add_return(1, &cp->in_pkts);
76837 + int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
76839 if (pkts % sysctl_sync_period(ipvs) != 1)
76841 @@ -795,7 +795,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
76844 memcpy(&cp->in_seq, opt, sizeof(*opt));
76845 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76846 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
76848 cp->old_state = cp->state;
76850 diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
76851 index ee319a4..8a285ee 100644
76852 --- a/net/netfilter/ipvs/ip_vs_xmit.c
76853 +++ b/net/netfilter/ipvs/ip_vs_xmit.c
76854 @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
76857 /* do not touch skb anymore */
76858 - atomic_inc(&cp->in_pkts);
76859 + atomic_inc_unchecked(&cp->in_pkts);
76863 @@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
76866 /* do not touch skb anymore */
76867 - atomic_inc(&cp->in_pkts);
76868 + atomic_inc_unchecked(&cp->in_pkts);
76872 diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
76873 index 7dec88a..0996ce3 100644
76874 --- a/net/netfilter/nf_conntrack_netlink.c
76875 +++ b/net/netfilter/nf_conntrack_netlink.c
76876 @@ -135,7 +135,7 @@ nla_put_failure:
76878 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
76880 - long timeout = (ct->timeout.expires - jiffies) / HZ;
76881 + long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
76885 @@ -1638,7 +1638,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
76886 const struct nf_conntrack_expect *exp)
76888 struct nf_conn *master = exp->master;
76889 - long timeout = (exp->timeout.expires - jiffies) / HZ;
76890 + long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
76891 struct nf_conn_help *help;
76894 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
76895 index 2d8158a..5dca296 100644
76896 --- a/net/netfilter/nfnetlink_log.c
76897 +++ b/net/netfilter/nfnetlink_log.c
76898 @@ -70,7 +70,7 @@ struct nfulnl_instance {
76901 static DEFINE_SPINLOCK(instances_lock);
76902 -static atomic_t global_seq;
76903 +static atomic_unchecked_t global_seq;
76905 #define INSTANCE_BUCKETS 16
76906 static struct hlist_head instance_table[INSTANCE_BUCKETS];
76907 @@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_instance *inst,
76908 /* global sequence number */
76909 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
76910 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
76911 - htonl(atomic_inc_return(&global_seq)));
76912 + htonl(atomic_inc_return_unchecked(&global_seq)));
76915 struct nlattr *nla;
76916 diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
76917 new file mode 100644
76918 index 0000000..6905327
76920 +++ b/net/netfilter/xt_gradm.c
76923 + * gradm match for netfilter
76924 + * Copyright © Zbigniew Krzystolik, 2010
76926 + * This program is free software; you can redistribute it and/or modify
76927 + * it under the terms of the GNU General Public License; either version
76928 + * 2 or 3 as published by the Free Software Foundation.
76930 +#include <linux/module.h>
76931 +#include <linux/moduleparam.h>
76932 +#include <linux/skbuff.h>
76933 +#include <linux/netfilter/x_tables.h>
76934 +#include <linux/grsecurity.h>
76935 +#include <linux/netfilter/xt_gradm.h>
76938 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
76940 + const struct xt_gradm_mtinfo *info = par->matchinfo;
76941 + bool retval = false;
76942 + if (gr_acl_is_enabled())
76944 + return retval ^ info->invflags;
76947 +static struct xt_match gradm_mt_reg __read_mostly = {
76950 + .family = NFPROTO_UNSPEC,
76951 + .match = gradm_mt,
76952 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
76953 + .me = THIS_MODULE,
76956 +static int __init gradm_mt_init(void)
76958 + return xt_register_match(&gradm_mt_reg);
76961 +static void __exit gradm_mt_exit(void)
76963 + xt_unregister_match(&gradm_mt_reg);
76966 +module_init(gradm_mt_init);
76967 +module_exit(gradm_mt_exit);
76968 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
76969 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
76970 +MODULE_LICENSE("GPL");
76971 +MODULE_ALIAS("ipt_gradm");
76972 +MODULE_ALIAS("ip6t_gradm");
76973 diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
76974 index 42ecb71..8d687c0 100644
76975 --- a/net/netfilter/xt_statistic.c
76976 +++ b/net/netfilter/xt_statistic.c
76978 #include <linux/netfilter/x_tables.h>
76980 struct xt_statistic_priv {
76982 + atomic_unchecked_t count;
76983 } ____cacheline_aligned_in_smp;
76985 MODULE_LICENSE("GPL");
76986 @@ -41,9 +41,9 @@ statistic_mt(const struct sk_buff *skb, struct xt_action_param *par)
76988 case XT_STATISTIC_MODE_NTH:
76990 - oval = atomic_read(&info->master->count);
76991 + oval = atomic_read_unchecked(&info->master->count);
76992 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
76993 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
76994 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
76998 @@ -63,7 +63,7 @@ static int statistic_mt_check(const struct xt_mtchk_param *par)
76999 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
77000 if (info->master == NULL)
77002 - atomic_set(&info->master->count, info->u.nth.count);
77003 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
77007 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
77008 index 0a4db02..604f748 100644
77009 --- a/net/netlink/af_netlink.c
77010 +++ b/net/netlink/af_netlink.c
77011 @@ -742,7 +742,7 @@ static void netlink_overrun(struct sock *sk)
77012 sk->sk_error_report(sk);
77015 - atomic_inc(&sk->sk_drops);
77016 + atomic_inc_unchecked(&sk->sk_drops);
77019 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
77020 @@ -2000,7 +2000,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
77021 sk_wmem_alloc_get(s),
77023 atomic_read(&s->sk_refcnt),
77024 - atomic_read(&s->sk_drops),
77025 + atomic_read_unchecked(&s->sk_drops),
77029 diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
77030 index 732152f..60bb09e 100644
77031 --- a/net/netrom/af_netrom.c
77032 +++ b/net/netrom/af_netrom.c
77033 @@ -839,6 +839,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
77034 struct sock *sk = sock->sk;
77035 struct nr_sock *nr = nr_sk(sk);
77037 + memset(sax, 0, sizeof(*sax));
77040 if (sk->sk_state != TCP_ESTABLISHED) {
77041 @@ -853,7 +854,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
77042 *uaddr_len = sizeof(struct full_sockaddr_ax25);
77044 sax->fsa_ax25.sax25_family = AF_NETROM;
77045 - sax->fsa_ax25.sax25_ndigis = 0;
77046 sax->fsa_ax25.sax25_call = nr->source_addr;
77047 *uaddr_len = sizeof(struct sockaddr_ax25);
77049 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
77050 index fabb4fa..37aaea0 100644
77051 --- a/net/packet/af_packet.c
77052 +++ b/net/packet/af_packet.c
77053 @@ -954,7 +954,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
77055 spin_lock(&sk->sk_receive_queue.lock);
77056 po->stats.tp_packets++;
77057 - skb->dropcount = atomic_read(&sk->sk_drops);
77058 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
77059 __skb_queue_tail(&sk->sk_receive_queue, skb);
77060 spin_unlock(&sk->sk_receive_queue.lock);
77061 sk->sk_data_ready(sk, skb->len);
77062 @@ -963,7 +963,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
77064 spin_lock(&sk->sk_receive_queue.lock);
77065 po->stats.tp_drops++;
77066 - atomic_inc(&sk->sk_drops);
77067 + atomic_inc_unchecked(&sk->sk_drops);
77068 spin_unlock(&sk->sk_receive_queue.lock);
77071 @@ -1691,8 +1691,12 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
77073 struct packet_sock *po = pkt_sk(sk);
77076 + if (po->fanout) {
77085 @@ -2479,7 +2483,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
77086 case PACKET_HDRLEN:
77087 if (len > sizeof(int))
77089 - if (copy_from_user(&val, optval, len))
77090 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
77094 @@ -2526,7 +2530,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
77096 if (put_user(len, optlen))
77098 - if (copy_to_user(optval, data, len))
77099 + if (len > sizeof(st) || copy_to_user(optval, data, len))
77103 diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
77104 index c6fffd9..a7ffa0c 100644
77105 --- a/net/phonet/af_phonet.c
77106 +++ b/net/phonet/af_phonet.c
77107 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
77109 struct phonet_protocol *pp;
77111 - if (protocol >= PHONET_NPROTO)
77112 + if (protocol < 0 || protocol >= PHONET_NPROTO)
77116 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
77120 - if (protocol >= PHONET_NPROTO)
77121 + if (protocol < 0 || protocol >= PHONET_NPROTO)
77124 err = proto_register(pp->prot, 1);
77125 diff --git a/net/phonet/pep.c b/net/phonet/pep.c
77126 index f17fd84..edffce8 100644
77127 --- a/net/phonet/pep.c
77128 +++ b/net/phonet/pep.c
77129 @@ -387,7 +387,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
77131 case PNS_PEP_CTRL_REQ:
77132 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
77133 - atomic_inc(&sk->sk_drops);
77134 + atomic_inc_unchecked(&sk->sk_drops);
77137 __skb_pull(skb, 4);
77138 @@ -408,7 +408,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
77141 if (pn->rx_credits == 0) {
77142 - atomic_inc(&sk->sk_drops);
77143 + atomic_inc_unchecked(&sk->sk_drops);
77147 @@ -556,7 +556,7 @@ static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
77150 if (pn->rx_credits == 0) {
77151 - atomic_inc(&sk->sk_drops);
77152 + atomic_inc_unchecked(&sk->sk_drops);
77156 diff --git a/net/phonet/socket.c b/net/phonet/socket.c
77157 index ab07711..9d4ac5d 100644
77158 --- a/net/phonet/socket.c
77159 +++ b/net/phonet/socket.c
77160 @@ -612,8 +612,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
77161 pn->resource, sk->sk_state,
77162 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
77163 sock_i_uid(sk), sock_i_ino(sk),
77164 - atomic_read(&sk->sk_refcnt), sk,
77165 - atomic_read(&sk->sk_drops), &len);
77166 + atomic_read(&sk->sk_refcnt),
77167 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77172 + atomic_read_unchecked(&sk->sk_drops), &len);
77174 seq_printf(seq, "%*s\n", 127 - len, "");
77176 diff --git a/net/rds/cong.c b/net/rds/cong.c
77177 index 6daaa49..fbf6af5 100644
77178 --- a/net/rds/cong.c
77179 +++ b/net/rds/cong.c
77181 * finds that the saved generation number is smaller than the global generation
77182 * number, it wakes up the process.
77184 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
77185 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
77188 * Congestion monitoring
77189 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
77190 rdsdebug("waking map %p for %pI4\n",
77191 map, &map->m_addr);
77192 rds_stats_inc(s_cong_update_received);
77193 - atomic_inc(&rds_cong_generation);
77194 + atomic_inc_unchecked(&rds_cong_generation);
77195 if (waitqueue_active(&map->m_waitq))
77196 wake_up(&map->m_waitq);
77197 if (waitqueue_active(&rds_poll_waitq))
77198 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
77200 int rds_cong_updated_since(unsigned long *recent)
77202 - unsigned long gen = atomic_read(&rds_cong_generation);
77203 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
77205 if (likely(*recent == gen))
77207 diff --git a/net/rds/ib.h b/net/rds/ib.h
77208 index edfaaaf..8c89879 100644
77211 @@ -128,7 +128,7 @@ struct rds_ib_connection {
77213 unsigned long i_ack_flags;
77214 #ifdef KERNEL_HAS_ATOMIC64
77215 - atomic64_t i_ack_next; /* next ACK to send */
77216 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
77218 spinlock_t i_ack_lock; /* protect i_ack_next */
77219 u64 i_ack_next; /* next ACK to send */
77220 diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
77221 index cd67026..0b9a54a 100644
77222 --- a/net/rds/ib_cm.c
77223 +++ b/net/rds/ib_cm.c
77224 @@ -720,7 +720,7 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
77225 /* Clear the ACK state */
77226 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
77227 #ifdef KERNEL_HAS_ATOMIC64
77228 - atomic64_set(&ic->i_ack_next, 0);
77229 + atomic64_set_unchecked(&ic->i_ack_next, 0);
77231 ic->i_ack_next = 0;
77233 diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
77234 index e29e0ca..fa3a6a3 100644
77235 --- a/net/rds/ib_recv.c
77236 +++ b/net/rds/ib_recv.c
77237 @@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
77238 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
77241 - atomic64_set(&ic->i_ack_next, seq);
77242 + atomic64_set_unchecked(&ic->i_ack_next, seq);
77243 if (ack_required) {
77244 smp_mb__before_clear_bit();
77245 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
77246 @@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
77247 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
77248 smp_mb__after_clear_bit();
77250 - return atomic64_read(&ic->i_ack_next);
77251 + return atomic64_read_unchecked(&ic->i_ack_next);
77255 diff --git a/net/rds/iw.h b/net/rds/iw.h
77256 index 04ce3b1..48119a6 100644
77259 @@ -134,7 +134,7 @@ struct rds_iw_connection {
77261 unsigned long i_ack_flags;
77262 #ifdef KERNEL_HAS_ATOMIC64
77263 - atomic64_t i_ack_next; /* next ACK to send */
77264 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
77266 spinlock_t i_ack_lock; /* protect i_ack_next */
77267 u64 i_ack_next; /* next ACK to send */
77268 diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
77269 index 9556d28..f046d0e 100644
77270 --- a/net/rds/iw_cm.c
77271 +++ b/net/rds/iw_cm.c
77272 @@ -663,7 +663,7 @@ void rds_iw_conn_shutdown(struct rds_connection *conn)
77273 /* Clear the ACK state */
77274 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
77275 #ifdef KERNEL_HAS_ATOMIC64
77276 - atomic64_set(&ic->i_ack_next, 0);
77277 + atomic64_set_unchecked(&ic->i_ack_next, 0);
77279 ic->i_ack_next = 0;
77281 diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
77282 index 4e1de17..d121708 100644
77283 --- a/net/rds/iw_rdma.c
77284 +++ b/net/rds/iw_rdma.c
77285 @@ -184,6 +184,8 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
77286 struct rdma_cm_id *pcm_id;
77289 + pax_track_stack();
77291 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
77292 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
77294 diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
77295 index 5e57347..3916042 100644
77296 --- a/net/rds/iw_recv.c
77297 +++ b/net/rds/iw_recv.c
77298 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
77299 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
77302 - atomic64_set(&ic->i_ack_next, seq);
77303 + atomic64_set_unchecked(&ic->i_ack_next, seq);
77304 if (ack_required) {
77305 smp_mb__before_clear_bit();
77306 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
77307 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
77308 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
77309 smp_mb__after_clear_bit();
77311 - return atomic64_read(&ic->i_ack_next);
77312 + return atomic64_read_unchecked(&ic->i_ack_next);
77316 diff --git a/net/rds/tcp.c b/net/rds/tcp.c
77317 index 8e0a320..ee8e38f 100644
77318 --- a/net/rds/tcp.c
77319 +++ b/net/rds/tcp.c
77320 @@ -58,7 +58,7 @@ void rds_tcp_nonagle(struct socket *sock)
77324 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
77325 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
77329 diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
77330 index 1b4fd68..2234175 100644
77331 --- a/net/rds/tcp_send.c
77332 +++ b/net/rds/tcp_send.c
77333 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
77337 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
77338 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
77342 diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
77343 index 74c064c..fdec26f 100644
77344 --- a/net/rxrpc/af_rxrpc.c
77345 +++ b/net/rxrpc/af_rxrpc.c
77346 @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_ops;
77347 __be32 rxrpc_epoch;
77349 /* current debugging ID */
77350 -atomic_t rxrpc_debug_id;
77351 +atomic_unchecked_t rxrpc_debug_id;
77353 /* count of skbs currently in use */
77354 atomic_t rxrpc_n_skbs;
77355 diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
77356 index f99cfce..3682692 100644
77357 --- a/net/rxrpc/ar-ack.c
77358 +++ b/net/rxrpc/ar-ack.c
77359 @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
77361 _enter("{%d,%d,%d,%d},",
77362 call->acks_hard, call->acks_unacked,
77363 - atomic_read(&call->sequence),
77364 + atomic_read_unchecked(&call->sequence),
77365 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
77368 @@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
77370 /* each Tx packet has a new serial number */
77372 - htonl(atomic_inc_return(&call->conn->serial));
77373 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
77375 hdr = (struct rxrpc_header *) txb->head;
77376 hdr->serial = sp->hdr.serial;
77377 @@ -403,7 +403,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
77379 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
77381 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
77382 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
77386 @@ -629,7 +629,7 @@ process_further:
77388 latest = ntohl(sp->hdr.serial);
77389 hard = ntohl(ack.firstPacket);
77390 - tx = atomic_read(&call->sequence);
77391 + tx = atomic_read_unchecked(&call->sequence);
77393 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
77395 @@ -842,6 +842,8 @@ void rxrpc_process_call(struct work_struct *work)
77396 u32 abort_code = RX_PROTOCOL_ERROR;
77399 + pax_track_stack();
77401 //printk("\n--------------------\n");
77402 _enter("{%d,%s,%lx} [%lu]",
77403 call->debug_id, rxrpc_call_states[call->state], call->events,
77404 @@ -1161,7 +1163,7 @@ void rxrpc_process_call(struct work_struct *work)
77405 goto maybe_reschedule;
77407 send_ACK_with_skew:
77408 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
77409 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
77410 ntohl(ack.serial));
77412 mtu = call->conn->trans->peer->if_mtu;
77413 @@ -1173,7 +1175,7 @@ send_ACK:
77414 ackinfo.rxMTU = htonl(5692);
77415 ackinfo.jumbo_max = htonl(4);
77417 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
77418 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
77419 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
77421 ntohs(ack.maxSkew),
77422 @@ -1191,7 +1193,7 @@ send_ACK:
77424 _debug("send message");
77426 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
77427 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
77428 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
77431 diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
77432 index bf656c2..48f9d27 100644
77433 --- a/net/rxrpc/ar-call.c
77434 +++ b/net/rxrpc/ar-call.c
77435 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
77436 spin_lock_init(&call->lock);
77437 rwlock_init(&call->state_lock);
77438 atomic_set(&call->usage, 1);
77439 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
77440 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
77441 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
77443 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
77444 diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
77445 index 4106ca9..a338d7a 100644
77446 --- a/net/rxrpc/ar-connection.c
77447 +++ b/net/rxrpc/ar-connection.c
77448 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
77449 rwlock_init(&conn->lock);
77450 spin_lock_init(&conn->state_lock);
77451 atomic_set(&conn->usage, 1);
77452 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
77453 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
77454 conn->avail_calls = RXRPC_MAXCALLS;
77455 conn->size_align = 4;
77456 conn->header_size = sizeof(struct rxrpc_header);
77457 diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
77458 index e7ed43a..6afa140 100644
77459 --- a/net/rxrpc/ar-connevent.c
77460 +++ b/net/rxrpc/ar-connevent.c
77461 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
77463 len = iov[0].iov_len + iov[1].iov_len;
77465 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
77466 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
77467 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
77469 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
77470 diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
77471 index 1a2b0633..e8d1382 100644
77472 --- a/net/rxrpc/ar-input.c
77473 +++ b/net/rxrpc/ar-input.c
77474 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
77475 /* track the latest serial number on this connection for ACK packet
77477 serial = ntohl(sp->hdr.serial);
77478 - hi_serial = atomic_read(&call->conn->hi_serial);
77479 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
77480 while (serial > hi_serial)
77481 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
77482 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
77485 /* request ACK generation for any ACK or DATA packet that requests
77486 diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
77487 index 8e22bd3..f66d1c0 100644
77488 --- a/net/rxrpc/ar-internal.h
77489 +++ b/net/rxrpc/ar-internal.h
77490 @@ -272,8 +272,8 @@ struct rxrpc_connection {
77491 int error; /* error code for local abort */
77492 int debug_id; /* debug ID for printks */
77493 unsigned call_counter; /* call ID counter */
77494 - atomic_t serial; /* packet serial number counter */
77495 - atomic_t hi_serial; /* highest serial number received */
77496 + atomic_unchecked_t serial; /* packet serial number counter */
77497 + atomic_unchecked_t hi_serial; /* highest serial number received */
77498 u8 avail_calls; /* number of calls available */
77499 u8 size_align; /* data size alignment (for security) */
77500 u8 header_size; /* rxrpc + security header size */
77501 @@ -346,7 +346,7 @@ struct rxrpc_call {
77503 rwlock_t state_lock; /* lock for state transition */
77505 - atomic_t sequence; /* Tx data packet sequence counter */
77506 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
77507 u32 abort_code; /* local/remote abort code */
77508 enum { /* current state of call */
77509 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
77510 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
77512 extern atomic_t rxrpc_n_skbs;
77513 extern __be32 rxrpc_epoch;
77514 -extern atomic_t rxrpc_debug_id;
77515 +extern atomic_unchecked_t rxrpc_debug_id;
77516 extern struct workqueue_struct *rxrpc_workqueue;
77519 diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
77520 index 87f7135..74d3703 100644
77521 --- a/net/rxrpc/ar-local.c
77522 +++ b/net/rxrpc/ar-local.c
77523 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
77524 spin_lock_init(&local->lock);
77525 rwlock_init(&local->services_lock);
77526 atomic_set(&local->usage, 1);
77527 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
77528 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
77529 memcpy(&local->srx, srx, sizeof(*srx));
77532 diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
77533 index 5f22e26..e5bd20f 100644
77534 --- a/net/rxrpc/ar-output.c
77535 +++ b/net/rxrpc/ar-output.c
77536 @@ -681,9 +681,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
77537 sp->hdr.cid = call->cid;
77538 sp->hdr.callNumber = call->call_id;
77540 - htonl(atomic_inc_return(&call->sequence));
77541 + htonl(atomic_inc_return_unchecked(&call->sequence));
77543 - htonl(atomic_inc_return(&conn->serial));
77544 + htonl(atomic_inc_return_unchecked(&conn->serial));
77545 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
77546 sp->hdr.userStatus = 0;
77547 sp->hdr.securityIndex = conn->security_ix;
77548 diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
77549 index 2754f09..b20e38f 100644
77550 --- a/net/rxrpc/ar-peer.c
77551 +++ b/net/rxrpc/ar-peer.c
77552 @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
77553 INIT_LIST_HEAD(&peer->error_targets);
77554 spin_lock_init(&peer->lock);
77555 atomic_set(&peer->usage, 1);
77556 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
77557 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
77558 memcpy(&peer->srx, srx, sizeof(*srx));
77560 rxrpc_assess_MTU_size(peer);
77561 diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
77562 index 38047f7..9f48511 100644
77563 --- a/net/rxrpc/ar-proc.c
77564 +++ b/net/rxrpc/ar-proc.c
77565 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
77566 atomic_read(&conn->usage),
77567 rxrpc_conn_states[conn->state],
77568 key_serial(conn->key),
77569 - atomic_read(&conn->serial),
77570 - atomic_read(&conn->hi_serial));
77571 + atomic_read_unchecked(&conn->serial),
77572 + atomic_read_unchecked(&conn->hi_serial));
77576 diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
77577 index 92df566..87ec1bf 100644
77578 --- a/net/rxrpc/ar-transport.c
77579 +++ b/net/rxrpc/ar-transport.c
77580 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
77581 spin_lock_init(&trans->client_lock);
77582 rwlock_init(&trans->conn_lock);
77583 atomic_set(&trans->usage, 1);
77584 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
77585 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
77587 if (peer->srx.transport.family == AF_INET) {
77588 switch (peer->srx.transport_type) {
77589 diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
77590 index 7635107..5000b71 100644
77591 --- a/net/rxrpc/rxkad.c
77592 +++ b/net/rxrpc/rxkad.c
77593 @@ -211,6 +211,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
77597 + pax_track_stack();
77599 sp = rxrpc_skb(skb);
77602 @@ -338,6 +340,8 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call,
77606 + pax_track_stack();
77610 sp = rxrpc_skb(skb);
77611 @@ -610,7 +614,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
77613 len = iov[0].iov_len + iov[1].iov_len;
77615 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
77616 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
77617 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
77619 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
77620 @@ -660,7 +664,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
77622 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
77624 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
77625 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
77626 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
77628 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
77629 diff --git a/net/sctp/associola.c b/net/sctp/associola.c
77630 index dc16b90..4981482 100644
77631 --- a/net/sctp/associola.c
77632 +++ b/net/sctp/associola.c
77633 @@ -173,7 +173,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
77634 asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
77635 asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
77636 asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
77637 - (unsigned long)sp->autoclose * HZ;
77638 + min_t(unsigned long, sp->autoclose, sctp_max_autoclose) * HZ;
77640 /* Initializes the timers */
77641 for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
77642 diff --git a/net/sctp/auth.c b/net/sctp/auth.c
77643 index 865e68f..bf81204 100644
77644 --- a/net/sctp/auth.c
77645 +++ b/net/sctp/auth.c
77646 @@ -82,7 +82,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
77647 struct sctp_auth_bytes *key;
77649 /* Verify that we are not going to overflow INT_MAX */
77650 - if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
77651 + if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
77654 /* Allocate the shared key */
77655 diff --git a/net/sctp/proc.c b/net/sctp/proc.c
77656 index 05a6ce2..c8bf836 100644
77657 --- a/net/sctp/proc.c
77658 +++ b/net/sctp/proc.c
77659 @@ -318,7 +318,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
77661 "%8pK %8pK %-3d %-3d %-2d %-4d "
77662 "%4d %8d %8d %7d %5lu %-5d %5d ",
77663 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
77665 + sctp_sk(sk)->type, sk->sk_state,
77666 assoc->state, hash,
77668 assoc->sndbuf_used,
77669 diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
77670 index 91784f4..48cb7b9 100644
77671 --- a/net/sctp/protocol.c
77672 +++ b/net/sctp/protocol.c
77673 @@ -1285,6 +1285,9 @@ SCTP_STATIC __init int sctp_init(void)
77674 sctp_max_instreams = SCTP_DEFAULT_INSTREAMS;
77675 sctp_max_outstreams = SCTP_DEFAULT_OUTSTREAMS;
77677 + /* Initialize maximum autoclose timeout. */
77678 + sctp_max_autoclose = INT_MAX / HZ;
77680 /* Initialize handle used for association ids. */
77681 idr_init(&sctp_assocs_id);
77683 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
77684 index 836aa63..e44d3fb 100644
77685 --- a/net/sctp/socket.c
77686 +++ b/net/sctp/socket.c
77687 @@ -2199,8 +2199,6 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
77689 if (copy_from_user(&sp->autoclose, optval, optlen))
77691 - /* make sure it won't exceed MAX_SCHEDULE_TIMEOUT */
77692 - sp->autoclose = min_t(long, sp->autoclose, MAX_SCHEDULE_TIMEOUT / HZ);
77696 @@ -4575,7 +4573,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
77697 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
77698 if (space_left < addrlen)
77700 - if (copy_to_user(to, &temp, addrlen))
77701 + if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
77705 diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
77706 index 6b39529..60ffbd0 100644
77707 --- a/net/sctp/sysctl.c
77708 +++ b/net/sctp/sysctl.c
77709 @@ -53,6 +53,10 @@ static int sack_timer_min = 1;
77710 static int sack_timer_max = 500;
77711 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
77712 static int rwnd_scale_max = 16;
77713 +static unsigned long max_autoclose_min = 0;
77714 +static unsigned long max_autoclose_max =
77715 + (MAX_SCHEDULE_TIMEOUT / HZ > UINT_MAX)
77716 + ? UINT_MAX : MAX_SCHEDULE_TIMEOUT / HZ;
77718 extern long sysctl_sctp_mem[3];
77719 extern int sysctl_sctp_rmem[3];
77720 @@ -258,6 +262,15 @@ static ctl_table sctp_table[] = {
77722 .extra2 = &rwnd_scale_max,
77725 + .procname = "max_autoclose",
77726 + .data = &sctp_max_autoclose,
77727 + .maxlen = sizeof(unsigned long),
77729 + .proc_handler = &proc_doulongvec_minmax,
77730 + .extra1 = &max_autoclose_min,
77731 + .extra2 = &max_autoclose_max,
77736 diff --git a/net/socket.c b/net/socket.c
77737 index ffe92ca..8057b85 100644
77741 #include <linux/nsproxy.h>
77742 #include <linux/magic.h>
77743 #include <linux/slab.h>
77744 +#include <linux/in.h>
77746 #include <asm/uaccess.h>
77747 #include <asm/unistd.h>
77748 @@ -105,6 +106,8 @@
77749 #include <linux/sockios.h>
77750 #include <linux/atalk.h>
77752 +#include <linux/grsock.h>
77754 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
77755 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
77756 unsigned long nr_segs, loff_t pos);
77757 @@ -321,7 +324,7 @@ static struct dentry *sockfs_mount(struct file_system_type *fs_type,
77758 &sockfs_dentry_operations, SOCKFS_MAGIC);
77761 -static struct vfsmount *sock_mnt __read_mostly;
77762 +struct vfsmount *sock_mnt __read_mostly;
77764 static struct file_system_type sock_fs_type = {
77766 @@ -1187,6 +1190,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
77767 return -EAFNOSUPPORT;
77768 if (type < 0 || type >= SOCK_MAX)
77770 + if (protocol < 0)
77775 @@ -1319,6 +1324,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
77776 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
77777 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
77779 + if(!gr_search_socket(family, type, protocol)) {
77780 + retval = -EACCES;
77784 + if (gr_handle_sock_all(family, type, protocol)) {
77785 + retval = -EACCES;
77789 retval = sock_create(family, type, protocol, &sock);
77792 @@ -1431,6 +1446,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
77794 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
77796 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
77800 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
77804 err = security_socket_bind(sock,
77805 (struct sockaddr *)&address,
77807 @@ -1439,6 +1462,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
77808 (struct sockaddr *)
77809 &address, addrlen);
77812 fput_light(sock->file, fput_needed);
77815 @@ -1462,10 +1486,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
77816 if ((unsigned)backlog > somaxconn)
77817 backlog = somaxconn;
77819 + if (gr_handle_sock_server_other(sock->sk)) {
77824 + err = gr_search_listen(sock);
77828 err = security_socket_listen(sock, backlog);
77830 err = sock->ops->listen(sock, backlog);
77833 fput_light(sock->file, fput_needed);
77836 @@ -1509,6 +1543,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
77837 newsock->type = sock->type;
77838 newsock->ops = sock->ops;
77840 + if (gr_handle_sock_server_other(sock->sk)) {
77842 + sock_release(newsock);
77846 + err = gr_search_accept(sock);
77848 + sock_release(newsock);
77853 * We don't need try_module_get here, as the listening socket (sock)
77854 * has the protocol module (sock->ops->owner) held.
77855 @@ -1547,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
77856 fd_install(newfd, newfile);
77859 + gr_attach_curr_ip(newsock->sk);
77862 fput_light(sock->file, fput_needed);
77864 @@ -1579,6 +1627,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
77867 struct socket *sock;
77868 + struct sockaddr *sck;
77869 struct sockaddr_storage address;
77870 int err, fput_needed;
77872 @@ -1589,6 +1638,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
77876 + sck = (struct sockaddr *)&address;
77878 + if (gr_handle_sock_client(sck)) {
77883 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
77888 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
77890 @@ -1890,6 +1950,8 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
77891 unsigned char *ctl_buf = ctl;
77892 int err, ctl_len, iov_size, total_len;
77894 + pax_track_stack();
77897 if (MSG_CMSG_COMPAT & flags) {
77898 if (get_compat_msghdr(msg_sys, msg_compat))
77899 @@ -1950,7 +2012,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
77900 * checking falls down on this.
77902 if (copy_from_user(ctl_buf,
77903 - (void __user __force *)msg_sys->msg_control,
77904 + (void __force_user *)msg_sys->msg_control,
77907 msg_sys->msg_control = ctl_buf;
77908 @@ -2120,7 +2182,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
77909 * kernel msghdr to use the kernel address space)
77912 - uaddr = (__force void __user *)msg_sys->msg_name;
77913 + uaddr = (void __force_user *)msg_sys->msg_name;
77914 uaddr_len = COMPAT_NAMELEN(msg);
77915 if (MSG_CMSG_COMPAT & flags) {
77916 err = verify_compat_iovec(msg_sys, iov,
77917 @@ -2748,7 +2810,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
77920 ifr = compat_alloc_user_space(buf_size);
77921 - rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
77922 + rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
77924 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
77926 @@ -2772,12 +2834,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
77927 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
77929 if (copy_in_user(rxnfc, compat_rxnfc,
77930 - (void *)(&rxnfc->fs.m_ext + 1) -
77931 - (void *)rxnfc) ||
77932 + (void __user *)(&rxnfc->fs.m_ext + 1) -
77933 + (void __user *)rxnfc) ||
77934 copy_in_user(&rxnfc->fs.ring_cookie,
77935 &compat_rxnfc->fs.ring_cookie,
77936 - (void *)(&rxnfc->fs.location + 1) -
77937 - (void *)&rxnfc->fs.ring_cookie) ||
77938 + (void __user *)(&rxnfc->fs.location + 1) -
77939 + (void __user *)&rxnfc->fs.ring_cookie) ||
77940 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
77941 sizeof(rxnfc->rule_cnt)))
77943 @@ -2789,12 +2851,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
77946 if (copy_in_user(compat_rxnfc, rxnfc,
77947 - (const void *)(&rxnfc->fs.m_ext + 1) -
77948 - (const void *)rxnfc) ||
77949 + (const void __user *)(&rxnfc->fs.m_ext + 1) -
77950 + (const void __user *)rxnfc) ||
77951 copy_in_user(&compat_rxnfc->fs.ring_cookie,
77952 &rxnfc->fs.ring_cookie,
77953 - (const void *)(&rxnfc->fs.location + 1) -
77954 - (const void *)&rxnfc->fs.ring_cookie) ||
77955 + (const void __user *)(&rxnfc->fs.location + 1) -
77956 + (const void __user *)&rxnfc->fs.ring_cookie) ||
77957 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
77958 sizeof(rxnfc->rule_cnt)))
77960 @@ -2864,7 +2926,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
77963 err = dev_ioctl(net, cmd,
77964 - (struct ifreq __user __force *) &kifr);
77965 + (struct ifreq __force_user *) &kifr);
77969 @@ -2973,7 +3035,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
77973 - err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
77974 + err = dev_ioctl(net, cmd, (void __force_user *)&ifr);
77977 if (cmd == SIOCGIFMAP && !err) {
77978 @@ -3078,7 +3140,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
77979 ret |= __get_user(rtdev, &(ur4->rt_dev));
77981 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
77982 - r4.rt_dev = (char __user __force *)devname;
77983 + r4.rt_dev = (char __force_user *)devname;
77987 @@ -3318,8 +3380,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
77988 int __user *uoptlen;
77991 - uoptval = (char __user __force *) optval;
77992 - uoptlen = (int __user __force *) optlen;
77993 + uoptval = (char __force_user *) optval;
77994 + uoptlen = (int __force_user *) optlen;
77997 if (level == SOL_SOCKET)
77998 @@ -3339,7 +3401,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
77999 char __user *uoptval;
78002 - uoptval = (char __user __force *) optval;
78003 + uoptval = (char __force_user *) optval;
78006 if (level == SOL_SOCKET)
78007 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
78008 index d12ffa5..0b5a6e2 100644
78009 --- a/net/sunrpc/sched.c
78010 +++ b/net/sunrpc/sched.c
78011 @@ -238,9 +238,9 @@ static int rpc_wait_bit_killable(void *word)
78013 static void rpc_task_set_debuginfo(struct rpc_task *task)
78015 - static atomic_t rpc_pid;
78016 + static atomic_unchecked_t rpc_pid;
78018 - task->tk_pid = atomic_inc_return(&rpc_pid);
78019 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
78022 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
78023 diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
78024 index 767d494..fe17e9d 100644
78025 --- a/net/sunrpc/svcsock.c
78026 +++ b/net/sunrpc/svcsock.c
78027 @@ -394,7 +394,7 @@ static int svc_partial_recvfrom(struct svc_rqst *rqstp,
78028 int buflen, unsigned int base)
78030 size_t save_iovlen;
78031 - void __user *save_iovbase;
78032 + void *save_iovbase;
78036 diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
78037 index 09af4fa..77110a9 100644
78038 --- a/net/sunrpc/xprtrdma/svc_rdma.c
78039 +++ b/net/sunrpc/xprtrdma/svc_rdma.c
78040 @@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
78041 static unsigned int min_max_inline = 4096;
78042 static unsigned int max_max_inline = 65536;
78044 -atomic_t rdma_stat_recv;
78045 -atomic_t rdma_stat_read;
78046 -atomic_t rdma_stat_write;
78047 -atomic_t rdma_stat_sq_starve;
78048 -atomic_t rdma_stat_rq_starve;
78049 -atomic_t rdma_stat_rq_poll;
78050 -atomic_t rdma_stat_rq_prod;
78051 -atomic_t rdma_stat_sq_poll;
78052 -atomic_t rdma_stat_sq_prod;
78053 +atomic_unchecked_t rdma_stat_recv;
78054 +atomic_unchecked_t rdma_stat_read;
78055 +atomic_unchecked_t rdma_stat_write;
78056 +atomic_unchecked_t rdma_stat_sq_starve;
78057 +atomic_unchecked_t rdma_stat_rq_starve;
78058 +atomic_unchecked_t rdma_stat_rq_poll;
78059 +atomic_unchecked_t rdma_stat_rq_prod;
78060 +atomic_unchecked_t rdma_stat_sq_poll;
78061 +atomic_unchecked_t rdma_stat_sq_prod;
78063 /* Temporary NFS request map and context caches */
78064 struct kmem_cache *svc_rdma_map_cachep;
78065 @@ -109,7 +109,7 @@ static int read_reset_stat(ctl_table *table, int write,
78069 - if (len && copy_to_user(buffer, str_buf, len))
78070 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
78074 @@ -150,63 +150,63 @@ static ctl_table svcrdma_parm_table[] = {
78076 .procname = "rdma_stat_read",
78077 .data = &rdma_stat_read,
78078 - .maxlen = sizeof(atomic_t),
78079 + .maxlen = sizeof(atomic_unchecked_t),
78081 .proc_handler = read_reset_stat,
78084 .procname = "rdma_stat_recv",
78085 .data = &rdma_stat_recv,
78086 - .maxlen = sizeof(atomic_t),
78087 + .maxlen = sizeof(atomic_unchecked_t),
78089 .proc_handler = read_reset_stat,
78092 .procname = "rdma_stat_write",
78093 .data = &rdma_stat_write,
78094 - .maxlen = sizeof(atomic_t),
78095 + .maxlen = sizeof(atomic_unchecked_t),
78097 .proc_handler = read_reset_stat,
78100 .procname = "rdma_stat_sq_starve",
78101 .data = &rdma_stat_sq_starve,
78102 - .maxlen = sizeof(atomic_t),
78103 + .maxlen = sizeof(atomic_unchecked_t),
78105 .proc_handler = read_reset_stat,
78108 .procname = "rdma_stat_rq_starve",
78109 .data = &rdma_stat_rq_starve,
78110 - .maxlen = sizeof(atomic_t),
78111 + .maxlen = sizeof(atomic_unchecked_t),
78113 .proc_handler = read_reset_stat,
78116 .procname = "rdma_stat_rq_poll",
78117 .data = &rdma_stat_rq_poll,
78118 - .maxlen = sizeof(atomic_t),
78119 + .maxlen = sizeof(atomic_unchecked_t),
78121 .proc_handler = read_reset_stat,
78124 .procname = "rdma_stat_rq_prod",
78125 .data = &rdma_stat_rq_prod,
78126 - .maxlen = sizeof(atomic_t),
78127 + .maxlen = sizeof(atomic_unchecked_t),
78129 .proc_handler = read_reset_stat,
78132 .procname = "rdma_stat_sq_poll",
78133 .data = &rdma_stat_sq_poll,
78134 - .maxlen = sizeof(atomic_t),
78135 + .maxlen = sizeof(atomic_unchecked_t),
78137 .proc_handler = read_reset_stat,
78140 .procname = "rdma_stat_sq_prod",
78141 .data = &rdma_stat_sq_prod,
78142 - .maxlen = sizeof(atomic_t),
78143 + .maxlen = sizeof(atomic_unchecked_t),
78145 .proc_handler = read_reset_stat,
78147 diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78148 index df67211..c354b13 100644
78149 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78150 +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78151 @@ -499,7 +499,7 @@ next_sge:
78152 svc_rdma_put_context(ctxt, 0);
78155 - atomic_inc(&rdma_stat_read);
78156 + atomic_inc_unchecked(&rdma_stat_read);
78158 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
78159 chl_map->ch[ch_no].count -= read_wr.num_sge;
78160 @@ -609,7 +609,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
78162 list_del_init(&ctxt->dto_q);
78164 - atomic_inc(&rdma_stat_rq_starve);
78165 + atomic_inc_unchecked(&rdma_stat_rq_starve);
78166 clear_bit(XPT_DATA, &xprt->xpt_flags);
78169 @@ -629,7 +629,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
78170 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
78171 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
78172 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
78173 - atomic_inc(&rdma_stat_recv);
78174 + atomic_inc_unchecked(&rdma_stat_recv);
78176 /* Build up the XDR from the receive buffers. */
78177 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
78178 diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78179 index 249a835..fb2794b 100644
78180 --- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78181 +++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78182 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
78183 write_wr.wr.rdma.remote_addr = to;
78186 - atomic_inc(&rdma_stat_write);
78187 + atomic_inc_unchecked(&rdma_stat_write);
78188 if (svc_rdma_send(xprt, &write_wr))
78191 diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
78192 index a385430..32254ea 100644
78193 --- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
78194 +++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
78195 @@ -299,7 +299,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
78198 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
78199 - atomic_inc(&rdma_stat_rq_poll);
78200 + atomic_inc_unchecked(&rdma_stat_rq_poll);
78202 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
78203 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
78204 @@ -321,7 +321,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
78208 - atomic_inc(&rdma_stat_rq_prod);
78209 + atomic_inc_unchecked(&rdma_stat_rq_prod);
78211 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
78213 @@ -393,7 +393,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
78216 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
78217 - atomic_inc(&rdma_stat_sq_poll);
78218 + atomic_inc_unchecked(&rdma_stat_sq_poll);
78219 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
78220 if (wc.status != IB_WC_SUCCESS)
78221 /* Close the transport */
78222 @@ -411,7 +411,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
78226 - atomic_inc(&rdma_stat_sq_prod);
78227 + atomic_inc_unchecked(&rdma_stat_sq_prod);
78230 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
78231 @@ -1273,7 +1273,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
78232 spin_lock_bh(&xprt->sc_lock);
78233 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
78234 spin_unlock_bh(&xprt->sc_lock);
78235 - atomic_inc(&rdma_stat_sq_starve);
78236 + atomic_inc_unchecked(&rdma_stat_sq_starve);
78238 /* See if we can opportunistically reap SQ WR to make room */
78240 diff --git a/net/sysctl_net.c b/net/sysctl_net.c
78241 index ca84212..3aa338f 100644
78242 --- a/net/sysctl_net.c
78243 +++ b/net/sysctl_net.c
78244 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_root *root,
78245 struct ctl_table *table)
78247 /* Allow network administrator to have same access as root. */
78248 - if (capable(CAP_NET_ADMIN)) {
78249 + if (capable_nolog(CAP_NET_ADMIN)) {
78250 int mode = (table->mode >> 6) & 7;
78251 return (mode << 6) | (mode << 3) | mode;
78253 diff --git a/net/tipc/link.c b/net/tipc/link.c
78254 index f89570c..016cf63 100644
78255 --- a/net/tipc/link.c
78256 +++ b/net/tipc/link.c
78257 @@ -1170,7 +1170,7 @@ static int link_send_sections_long(struct tipc_port *sender,
78258 struct tipc_msg fragm_hdr;
78259 struct sk_buff *buf, *buf_chain, *prev;
78260 u32 fragm_crs, fragm_rest, hsz, sect_rest;
78261 - const unchar *sect_crs;
78262 + const unchar __user *sect_crs;
78266 @@ -1214,7 +1214,7 @@ again:
78269 sect_rest = msg_sect[++curr_sect].iov_len;
78270 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
78271 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
78274 if (sect_rest < fragm_rest)
78275 @@ -1233,7 +1233,7 @@ error:
78278 skb_copy_to_linear_data_offset(buf, fragm_crs,
78280 + (const void __force_kernel *)sect_crs, sz);
78284 diff --git a/net/tipc/msg.c b/net/tipc/msg.c
78285 index 83d5096..dcba497 100644
78286 --- a/net/tipc/msg.c
78287 +++ b/net/tipc/msg.c
78288 @@ -99,7 +99,7 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
78289 msg_sect[cnt].iov_len);
78291 skb_copy_to_linear_data_offset(*buf, pos,
78292 - msg_sect[cnt].iov_base,
78293 + (const void __force_kernel *)msg_sect[cnt].iov_base,
78294 msg_sect[cnt].iov_len);
78295 pos += msg_sect[cnt].iov_len;
78297 diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
78298 index 6cf7268..7a488ce 100644
78299 --- a/net/tipc/subscr.c
78300 +++ b/net/tipc/subscr.c
78301 @@ -101,7 +101,7 @@ static void subscr_send_event(struct subscription *sub,
78303 struct iovec msg_sect;
78305 - msg_sect.iov_base = (void *)&sub->evt;
78306 + msg_sect.iov_base = (void __force_user *)&sub->evt;
78307 msg_sect.iov_len = sizeof(struct tipc_event);
78309 sub->evt.event = htohl(event, sub->swap);
78310 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
78311 index ec68e1c..fdd792f 100644
78312 --- a/net/unix/af_unix.c
78313 +++ b/net/unix/af_unix.c
78314 @@ -767,6 +767,12 @@ static struct sock *unix_find_other(struct net *net,
78315 err = -ECONNREFUSED;
78316 if (!S_ISSOCK(inode->i_mode))
78319 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
78324 u = unix_find_socket_byinode(inode);
78327 @@ -787,6 +793,13 @@ static struct sock *unix_find_other(struct net *net,
78329 struct dentry *dentry;
78330 dentry = unix_sk(u)->dentry;
78332 + if (!gr_handle_chroot_unix(pid_vnr(u->sk_peer_pid))) {
78339 touch_atime(unix_sk(u)->mnt, dentry);
78341 @@ -869,11 +882,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
78342 err = security_path_mknod(&path, dentry, mode, 0);
78344 goto out_mknod_drop_write;
78345 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
78347 + goto out_mknod_drop_write;
78349 err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
78350 out_mknod_drop_write:
78351 mnt_drop_write(path.mnt);
78353 goto out_mknod_dput;
78355 + gr_handle_create(dentry, path.mnt);
78357 mutex_unlock(&path.dentry->d_inode->i_mutex);
78359 path.dentry = dentry;
78360 diff --git a/net/wireless/core.h b/net/wireless/core.h
78361 index 8672e02..48782dd 100644
78362 --- a/net/wireless/core.h
78363 +++ b/net/wireless/core.h
78364 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
78367 /* rfkill support */
78368 - struct rfkill_ops rfkill_ops;
78369 + rfkill_ops_no_const rfkill_ops;
78370 struct rfkill *rfkill;
78371 struct work_struct rfkill_sync;
78373 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
78374 index fdbc23c..212d53e 100644
78375 --- a/net/wireless/wext-core.c
78376 +++ b/net/wireless/wext-core.c
78377 @@ -746,8 +746,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
78380 /* Support for very large requests */
78381 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
78382 - (user_length > descr->max_tokens)) {
78383 + if (user_length > descr->max_tokens) {
78384 /* Allow userspace to GET more than max so
78385 * we can support any size GET requests.
78386 * There is still a limit : -ENOMEM.
78387 @@ -784,22 +783,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
78391 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
78393 - * If this is a GET, but not NOMAX, it means that the extra
78394 - * data is not bounded by userspace, but by max_tokens. Thus
78395 - * set the length to max_tokens. This matches the extra data
78397 - * The driver should fill it with the number of tokens it
78398 - * provided, and it may check iwp->length rather than having
78399 - * knowledge of max_tokens. If the driver doesn't change the
78400 - * iwp->length, this ioctl just copies back max_token tokens
78401 - * filled with zeroes. Hopefully the driver isn't claiming
78402 - * them to be valid data.
78404 - iwp->length = descr->max_tokens;
78407 err = handler(dev, info, (union iwreq_data *) iwp, extra);
78409 iwp->length += essid_compat;
78410 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
78411 index 552df27..8e7f238 100644
78412 --- a/net/xfrm/xfrm_policy.c
78413 +++ b/net/xfrm/xfrm_policy.c
78414 @@ -299,7 +299,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
78416 policy->walk.dead = 1;
78418 - atomic_inc(&policy->genid);
78419 + atomic_inc_unchecked(&policy->genid);
78421 if (del_timer(&policy->timer))
78422 xfrm_pol_put(policy);
78423 @@ -583,7 +583,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
78424 hlist_add_head(&policy->bydst, chain);
78425 xfrm_pol_hold(policy);
78426 net->xfrm.policy_count[dir]++;
78427 - atomic_inc(&flow_cache_genid);
78428 + atomic_inc_unchecked(&flow_cache_genid);
78430 __xfrm_policy_unlink(delpol, dir);
78431 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
78432 @@ -1530,7 +1530,7 @@ free_dst:
78438 xfrm_dst_alloc_copy(void **target, const void *src, int size)
78441 @@ -1542,7 +1542,7 @@ xfrm_dst_alloc_copy(void **target, const void *src, int size)
78447 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
78449 #ifdef CONFIG_XFRM_SUB_POLICY
78450 @@ -1554,7 +1554,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
78456 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
78458 #ifdef CONFIG_XFRM_SUB_POLICY
78459 @@ -1648,7 +1648,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
78461 xdst->num_pols = num_pols;
78462 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
78463 - xdst->policy_genid = atomic_read(&pols[0]->genid);
78464 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
78468 @@ -2335,7 +2335,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
78469 if (xdst->xfrm_genid != dst->xfrm->genid)
78471 if (xdst->num_pols > 0 &&
78472 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
78473 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
78476 mtu = dst_mtu(dst->child);
78477 @@ -2870,7 +2870,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
78478 sizeof(pol->xfrm_vec[i].saddr));
78479 pol->xfrm_vec[i].encap_family = mp->new_family;
78480 /* flush bundles */
78481 - atomic_inc(&pol->genid);
78482 + atomic_inc_unchecked(&pol->genid);
78486 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
78487 index 0256b8a..9341ef6 100644
78488 --- a/net/xfrm/xfrm_user.c
78489 +++ b/net/xfrm/xfrm_user.c
78490 @@ -1394,6 +1394,8 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
78491 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
78494 + pax_track_stack();
78496 if (xp->xfrm_nr == 0)
78499 @@ -2062,6 +2064,8 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
78503 + pax_track_stack();
78505 if (attrs[XFRMA_MIGRATE] == NULL)
78508 diff --git a/scripts/Makefile.build b/scripts/Makefile.build
78509 index a0fd502..a8e6e83 100644
78510 --- a/scripts/Makefile.build
78511 +++ b/scripts/Makefile.build
78512 @@ -109,7 +109,7 @@ endif
78515 # Do not include host rules unless needed
78516 -ifneq ($(hostprogs-y)$(hostprogs-m),)
78517 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
78518 include scripts/Makefile.host
78521 diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
78522 index 686cb0d..9d653bf 100644
78523 --- a/scripts/Makefile.clean
78524 +++ b/scripts/Makefile.clean
78525 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
78526 __clean-files := $(extra-y) $(always) \
78527 $(targets) $(clean-files) \
78529 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
78530 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
78531 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
78533 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
78535 diff --git a/scripts/Makefile.host b/scripts/Makefile.host
78536 index 1ac414f..a1c1451 100644
78537 --- a/scripts/Makefile.host
78538 +++ b/scripts/Makefile.host
78540 # Note: Shared libraries consisting of C++ files are not supported
78542 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
78543 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
78546 # Executables compiled from a single .c file
78547 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
78548 # Shared libaries (only .c supported)
78549 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
78550 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
78551 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
78552 # Remove .so files from "xxx-objs"
78553 host-cobjs := $(filter-out %.so,$(host-cobjs))
78555 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
78556 index 291228e..6c55203 100644
78557 --- a/scripts/basic/fixdep.c
78558 +++ b/scripts/basic/fixdep.c
78559 @@ -161,7 +161,7 @@ static unsigned int strhash(const char *str, unsigned int sz)
78561 * Lookup a value in the configuration string.
78563 -static int is_defined_config(const char *name, int len, unsigned int hash)
78564 +static int is_defined_config(const char *name, unsigned int len, unsigned int hash)
78568 @@ -211,10 +211,10 @@ static void clear_config(void)
78570 * Record the use of a CONFIG_* word.
78572 -static void use_config(const char *m, int slen)
78573 +static void use_config(const char *m, unsigned int slen)
78575 unsigned int hash = strhash(m, slen);
78577 + unsigned int c, i;
78579 if (is_defined_config(m, slen, hash))
78581 @@ -235,9 +235,9 @@ static void use_config(const char *m, int slen)
78583 static void parse_config_file(const char *map, size_t len)
78585 - const int *end = (const int *) (map + len);
78586 + const unsigned int *end = (const unsigned int *) (map + len);
78587 /* start at +1, so that p can never be < map */
78588 - const int *m = (const int *) map + 1;
78589 + const unsigned int *m = (const unsigned int *) map + 1;
78592 for (; m < end; m++) {
78593 @@ -405,7 +405,7 @@ static void print_deps(void)
78594 static void traps(void)
78596 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
78597 - int *p = (int *)test;
78598 + unsigned int *p = (unsigned int *)test;
78600 if (*p != INT_CONF) {
78601 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
78602 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
78603 new file mode 100644
78604 index 0000000..8729101
78606 +++ b/scripts/gcc-plugin.sh
78609 +echo -e "#include \"gcc-plugin.h\"\n#include \"tree.h\"\n#include \"tm.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
78610 diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
78611 index e26e2fb..f84937b 100644
78612 --- a/scripts/mod/file2alias.c
78613 +++ b/scripts/mod/file2alias.c
78614 @@ -72,7 +72,7 @@ static void device_id_check(const char *modname, const char *device_id,
78615 unsigned long size, unsigned long id_size,
78621 if (size % id_size || size < id_size) {
78622 if (cross_build != 0)
78623 @@ -102,7 +102,7 @@ static void device_id_check(const char *modname, const char *device_id,
78624 /* USB is special because the bcdDevice can be matched against a numeric range */
78625 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
78626 static void do_usb_entry(struct usb_device_id *id,
78627 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
78628 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
78629 unsigned char range_lo, unsigned char range_hi,
78630 unsigned char max, struct module *mod)
78632 @@ -203,7 +203,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
78634 unsigned int devlo, devhi;
78635 unsigned char chi, clo, max;
78637 + unsigned int ndigits;
78639 id->match_flags = TO_NATIVE(id->match_flags);
78640 id->idVendor = TO_NATIVE(id->idVendor);
78641 @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
78642 for (i = 0; i < count; i++) {
78643 const char *id = (char *)devs[i].id;
78644 char acpi_id[sizeof(devs[0].id)];
78648 buf_printf(&mod->dev_table_buf,
78649 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
78650 @@ -467,7 +467,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
78652 for (j = 0; j < PNP_MAX_DEVICES; j++) {
78653 const char *id = (char *)card->devs[j].id;
78655 + unsigned int i2, j2;
78659 @@ -493,7 +493,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
78660 /* add an individual alias for every device entry */
78662 char acpi_id[sizeof(card->devs[0].id)];
78666 buf_printf(&mod->dev_table_buf,
78667 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
78668 @@ -786,7 +786,7 @@ static void dmi_ascii_filter(char *d, const char *s)
78669 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
78673 + unsigned int i, j;
78675 sprintf(alias, "dmi*");
78677 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
78678 index a509ff8..5822633 100644
78679 --- a/scripts/mod/modpost.c
78680 +++ b/scripts/mod/modpost.c
78681 @@ -919,6 +919,7 @@ enum mismatch {
78682 ANY_INIT_TO_ANY_EXIT,
78683 ANY_EXIT_TO_ANY_INIT,
78684 EXPORT_TO_INIT_EXIT,
78688 struct sectioncheck {
78689 @@ -1027,6 +1028,12 @@ const struct sectioncheck sectioncheck[] = {
78690 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
78691 .mismatch = EXPORT_TO_INIT_EXIT,
78692 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
78694 +/* Do not reference code from writable data */
78696 + .fromsec = { DATA_SECTIONS, NULL },
78697 + .tosec = { TEXT_SECTIONS, NULL },
78698 + .mismatch = DATA_TO_TEXT
78702 @@ -1149,10 +1156,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
78704 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
78706 - if (sym->st_value == addr)
78708 /* Find a symbol nearby - addr are maybe negative */
78709 d = sym->st_value - addr;
78713 d = addr - sym->st_value;
78714 if (d < distance) {
78715 @@ -1431,6 +1438,14 @@ static void report_sec_mismatch(const char *modname,
78716 tosym, prl_to, prl_to, tosym);
78719 + case DATA_TO_TEXT:
78722 + "The variable %s references\n"
78723 + "the %s %s%s%s\n",
78724 + fromsym, to, sec2annotation(tosec), tosym, to_p);
78728 fprintf(stderr, "\n");
78730 @@ -1656,7 +1671,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
78731 static void check_sec_ref(struct module *mod, const char *modname,
78732 struct elf_info *elf)
78736 Elf_Shdr *sechdrs = elf->sechdrs;
78738 /* Walk through all sections */
78739 @@ -1754,7 +1769,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
78743 -void buf_write(struct buffer *buf, const char *s, int len)
78744 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
78746 if (buf->size - buf->pos < len) {
78747 buf->size += len + SZ;
78748 @@ -1966,7 +1981,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
78749 if (fstat(fileno(file), &st) < 0)
78752 - if (st.st_size != b->pos)
78753 + if (st.st_size != (off_t)b->pos)
78756 tmp = NOFAIL(malloc(b->pos));
78757 diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
78758 index 2031119..b5433af 100644
78759 --- a/scripts/mod/modpost.h
78760 +++ b/scripts/mod/modpost.h
78761 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
78767 + unsigned int pos;
78768 + unsigned int size;
78771 void __attribute__((format(printf, 2, 3)))
78772 buf_printf(struct buffer *buf, const char *fmt, ...);
78775 -buf_write(struct buffer *buf, const char *s, int len);
78776 +buf_write(struct buffer *buf, const char *s, unsigned int len);
78779 struct module *next;
78780 diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
78781 index 9dfcd6d..099068e 100644
78782 --- a/scripts/mod/sumversion.c
78783 +++ b/scripts/mod/sumversion.c
78784 @@ -470,7 +470,7 @@ static void write_version(const char *filename, const char *sum,
78788 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
78789 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
78790 warn("writing sum in %s failed: %s\n",
78791 filename, strerror(errno));
78793 diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
78794 index 5c11312..72742b5 100644
78795 --- a/scripts/pnmtologo.c
78796 +++ b/scripts/pnmtologo.c
78797 @@ -237,14 +237,14 @@ static void write_header(void)
78798 fprintf(out, " * Linux logo %s\n", logoname);
78799 fputs(" */\n\n", out);
78800 fputs("#include <linux/linux_logo.h>\n\n", out);
78801 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
78802 + fprintf(out, "static unsigned char %s_data[] = {\n",
78806 static void write_footer(void)
78808 fputs("\n};\n\n", out);
78809 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
78810 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
78811 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
78812 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
78813 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
78814 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
78815 fputs("\n};\n\n", out);
78817 /* write logo clut */
78818 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
78819 + fprintf(out, "static unsigned char %s_clut[] = {\n",
78822 for (i = 0; i < logo_clutsize; i++) {
78823 diff --git a/security/Kconfig b/security/Kconfig
78824 index e0f08b5..7388edd 100644
78825 --- a/security/Kconfig
78826 +++ b/security/Kconfig
78829 menu "Security options"
78831 +source grsecurity/Kconfig
78835 + config ARCH_TRACK_EXEC_LIMIT
78838 + config PAX_KERNEXEC_PLUGIN
78841 + config PAX_PER_CPU_PGD
78844 + config TASK_SIZE_MAX_SHIFT
78846 + depends on X86_64
78847 + default 47 if !PAX_PER_CPU_PGD
78848 + default 42 if PAX_PER_CPU_PGD
78850 + config PAX_ENABLE_PAE
78852 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
78855 + bool "Enable various PaX features"
78856 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
78858 + This allows you to enable various PaX features. PaX adds
78859 + intrusion prevention mechanisms to the kernel that reduce
78860 + the risks posed by exploitable memory corruption bugs.
78862 +menu "PaX Control"
78865 +config PAX_SOFTMODE
78866 + bool 'Support soft mode'
78867 + select PAX_PT_PAX_FLAGS
78869 + Enabling this option will allow you to run PaX in soft mode, that
78870 + is, PaX features will not be enforced by default, only on executables
78871 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
78872 + is the only way to mark executables for soft mode use.
78874 + Soft mode can be activated by using the "pax_softmode=1" kernel command
78875 + line option on boot. Furthermore you can control various PaX features
78876 + at runtime via the entries in /proc/sys/kernel/pax.
78879 + bool 'Use legacy ELF header marking'
78881 + Enabling this option will allow you to control PaX features on
78882 + a per executable basis via the 'chpax' utility available at
78883 + http://pax.grsecurity.net/. The control flags will be read from
78884 + an otherwise reserved part of the ELF header. This marking has
78885 + numerous drawbacks (no support for soft-mode, toolchain does not
78886 + know about the non-standard use of the ELF header) therefore it
78887 + has been deprecated in favour of PT_PAX_FLAGS support.
78889 + Note that if you enable PT_PAX_FLAGS marking support as well,
78890 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
78892 +config PAX_PT_PAX_FLAGS
78893 + bool 'Use ELF program header marking'
78895 + Enabling this option will allow you to control PaX features on
78896 + a per executable basis via the 'paxctl' utility available at
78897 + http://pax.grsecurity.net/. The control flags will be read from
78898 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
78899 + has the benefits of supporting both soft mode and being fully
78900 + integrated into the toolchain (the binutils patch is available
78901 + from http://pax.grsecurity.net).
78903 + If your toolchain does not support PT_PAX_FLAGS markings,
78904 + you can create one in most cases with 'paxctl -C'.
78906 + Note that if you enable the legacy EI_PAX marking support as well,
78907 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
78910 + prompt 'MAC system integration'
78911 + default PAX_HAVE_ACL_FLAGS
78913 + Mandatory Access Control systems have the option of controlling
78914 + PaX flags on a per executable basis, choose the method supported
78915 + by your particular system.
78917 + - "none": if your MAC system does not interact with PaX,
78918 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
78919 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
78921 + NOTE: this option is for developers/integrators only.
78923 + config PAX_NO_ACL_FLAGS
78926 + config PAX_HAVE_ACL_FLAGS
78929 + config PAX_HOOK_ACL_FLAGS
78935 +menu "Non-executable pages"
78939 + bool "Enforce non-executable pages"
78940 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
78942 + By design some architectures do not allow for protecting memory
78943 + pages against execution or even if they do, Linux does not make
78944 + use of this feature. In practice this means that if a page is
78945 + readable (such as the stack or heap) it is also executable.
78947 + There is a well known exploit technique that makes use of this
78948 + fact and a common programming mistake where an attacker can
78949 + introduce code of his choice somewhere in the attacked program's
78950 + memory (typically the stack or the heap) and then execute it.
78952 + If the attacked program was running with different (typically
78953 + higher) privileges than that of the attacker, then he can elevate
78954 + his own privilege level (e.g. get a root shell, write to files for
78955 + which he does not have write access to, etc).
78957 + Enabling this option will let you choose from various features
78958 + that prevent the injection and execution of 'foreign' code in
78961 + This will also break programs that rely on the old behaviour and
78962 + expect that dynamically allocated memory via the malloc() family
78963 + of functions is executable (which it is not). Notable examples
78964 + are the XFree86 4.x server, the java runtime and wine.
78966 +config PAX_PAGEEXEC
78967 + bool "Paging based non-executable pages"
78968 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
78969 + select S390_SWITCH_AMODE if S390
78970 + select S390_EXEC_PROTECT if S390
78971 + select ARCH_TRACK_EXEC_LIMIT if X86_32
78973 + This implementation is based on the paging feature of the CPU.
78974 + On i386 without hardware non-executable bit support there is a
78975 + variable but usually low performance impact, however on Intel's
78976 + P4 core based CPUs it is very high so you should not enable this
78977 + for kernels meant to be used on such CPUs.
78979 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
78980 + with hardware non-executable bit support there is no performance
78981 + impact, on ppc the impact is negligible.
78983 + Note that several architectures require various emulations due to
78984 + badly designed userland ABIs, this will cause a performance impact
78985 + but will disappear as soon as userland is fixed. For example, ppc
78986 + userland MUST have been built with secure-plt by a recent toolchain.
78988 +config PAX_SEGMEXEC
78989 + bool "Segmentation based non-executable pages"
78990 + depends on PAX_NOEXEC && X86_32
78992 + This implementation is based on the segmentation feature of the
78993 + CPU and has a very small performance impact, however applications
78994 + will be limited to a 1.5 GB address space instead of the normal
78997 +config PAX_EMUTRAMP
78998 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
78999 + default y if PARISC
79001 + There are some programs and libraries that for one reason or
79002 + another attempt to execute special small code snippets from
79003 + non-executable memory pages. Most notable examples are the
79004 + signal handler return code generated by the kernel itself and
79005 + the GCC trampolines.
79007 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
79008 + such programs will no longer work under your kernel.
79010 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
79011 + utilities to enable trampoline emulation for the affected programs
79012 + yet still have the protection provided by the non-executable pages.
79014 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
79015 + your system will not even boot.
79017 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
79018 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
79019 + for the affected files.
79021 + NOTE: enabling this feature *may* open up a loophole in the
79022 + protection provided by non-executable pages that an attacker
79023 + could abuse. Therefore the best solution is to not have any
79024 + files on your system that would require this option. This can
79025 + be achieved by not using libc5 (which relies on the kernel
79026 + signal handler return code) and not using or rewriting programs
79027 + that make use of the nested function implementation of GCC.
79028 + Skilled users can just fix GCC itself so that it implements
79029 + nested function calls in a way that does not interfere with PaX.
79031 +config PAX_EMUSIGRT
79032 + bool "Automatically emulate sigreturn trampolines"
79033 + depends on PAX_EMUTRAMP && PARISC
79036 + Enabling this option will have the kernel automatically detect
79037 + and emulate signal return trampolines executing on the stack
79038 + that would otherwise lead to task termination.
79040 + This solution is intended as a temporary one for users with
79041 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
79042 + Modula-3 runtime, etc) or executables linked to such, basically
79043 + everything that does not specify its own SA_RESTORER function in
79044 + normal executable memory like glibc 2.1+ does.
79046 + On parisc you MUST enable this option, otherwise your system will
79049 + NOTE: this feature cannot be disabled on a per executable basis
79050 + and since it *does* open up a loophole in the protection provided
79051 + by non-executable pages, the best solution is to not have any
79052 + files on your system that would require this option.
79054 +config PAX_MPROTECT
79055 + bool "Restrict mprotect()"
79056 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
79058 + Enabling this option will prevent programs from
79059 + - changing the executable status of memory pages that were
79060 + not originally created as executable,
79061 + - making read-only executable pages writable again,
79062 + - creating executable pages from anonymous memory,
79063 + - making read-only-after-relocations (RELRO) data pages writable again.
79065 + You should say Y here to complete the protection provided by
79066 + the enforcement of non-executable pages.
79068 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79069 + this feature on a per file basis.
79071 +config PAX_MPROTECT_COMPAT
79072 + bool "Use legacy/compat protection demoting (read help)"
79073 + depends on PAX_MPROTECT
79076 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
79077 + by sending the proper error code to the application. For some broken
79078 + userland, this can cause problems with Python or other applications. The
79079 + current implementation however allows for applications like clamav to
79080 + detect if JIT compilation/execution is allowed and to fall back gracefully
79081 + to an interpreter-based mode if it does not. While we encourage everyone
79082 + to use the current implementation as-is and push upstream to fix broken
79083 + userland (note that the RWX logging option can assist with this), in some
79084 + environments this may not be possible. Having to disable MPROTECT
79085 + completely on certain binaries reduces the security benefit of PaX,
79086 + so this option is provided for those environments to revert to the old
79089 +config PAX_ELFRELOCS
79090 + bool "Allow ELF text relocations (read help)"
79091 + depends on PAX_MPROTECT
79094 + Non-executable pages and mprotect() restrictions are effective
79095 + in preventing the introduction of new executable code into an
79096 + attacked task's address space. There remain only two venues
79097 + for this kind of attack: if the attacker can execute already
79098 + existing code in the attacked task then he can either have it
79099 + create and mmap() a file containing his code or have it mmap()
79100 + an already existing ELF library that does not have position
79101 + independent code in it and use mprotect() on it to make it
79102 + writable and copy his code there. While protecting against
79103 + the former approach is beyond PaX, the latter can be prevented
79104 + by having only PIC ELF libraries on one's system (which do not
79105 + need to relocate their code). If you are sure this is your case,
79106 + as is the case with all modern Linux distributions, then leave
79107 + this option disabled. You should say 'n' here.
79109 +config PAX_ETEXECRELOCS
79110 + bool "Allow ELF ET_EXEC text relocations"
79111 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
79112 + select PAX_ELFRELOCS
79115 + On some architectures there are incorrectly created applications
79116 + that require text relocations and would not work without enabling
79117 + this option. If you are an alpha, ia64 or parisc user, you should
79118 + enable this option and disable it once you have made sure that
79119 + none of your applications need it.
79122 + bool "Automatically emulate ELF PLT"
79123 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
79126 + Enabling this option will have the kernel automatically detect
79127 + and emulate the Procedure Linkage Table entries in ELF files.
79128 + On some architectures such entries are in writable memory, and
79129 + become non-executable leading to task termination. Therefore
79130 + it is mandatory that you enable this option on alpha, parisc,
79131 + sparc and sparc64, otherwise your system would not even boot.
79133 + NOTE: this feature *does* open up a loophole in the protection
79134 + provided by the non-executable pages, therefore the proper
79135 + solution is to modify the toolchain to produce a PLT that does
79136 + not need to be writable.
79138 +config PAX_DLRESOLVE
79139 + bool 'Emulate old glibc resolver stub'
79140 + depends on PAX_EMUPLT && SPARC
79143 + This option is needed if userland has an old glibc (before 2.4)
79144 + that puts a 'save' instruction into the runtime generated resolver
79145 + stub that needs special emulation.
79147 +config PAX_KERNEXEC
79148 + bool "Enforce non-executable kernel pages"
79149 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
79150 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
79151 + select PAX_KERNEXEC_PLUGIN if X86_64
79153 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
79154 + that is, enabling this option will make it harder to inject
79155 + and execute 'foreign' code in kernel memory itself.
79157 + Note that on x86_64 kernels there is a known regression when
79158 + this feature and KVM/VMX are both enabled in the host kernel.
79161 + prompt "Return Address Instrumentation Method"
79162 + default PAX_KERNEXEC_PLUGIN_METHOD_BTS
79163 + depends on PAX_KERNEXEC_PLUGIN
79165 + Select the method used to instrument function pointer dereferences.
79166 + Note that binary modules cannot be instrumented by this approach.
79168 + config PAX_KERNEXEC_PLUGIN_METHOD_BTS
79171 + This method is compatible with binary only modules but has
79172 + a higher runtime overhead.
79174 + config PAX_KERNEXEC_PLUGIN_METHOD_OR
79176 + depends on !PARAVIRT
79178 + This method is incompatible with binary only modules but has
79179 + a lower runtime overhead.
79182 +config PAX_KERNEXEC_PLUGIN_METHOD
79184 + default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
79185 + default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
79188 +config PAX_KERNEXEC_MODULE_TEXT
79189 + int "Minimum amount of memory reserved for module code"
79191 + depends on PAX_KERNEXEC && X86_32 && MODULES
79193 + Due to implementation details the kernel must reserve a fixed
79194 + amount of memory for module code at compile time that cannot be
79195 + changed at runtime. Here you can specify the minimum amount
79196 + in MB that will be reserved. Due to the same implementation
79197 + details this size will always be rounded up to the next 2/4 MB
79198 + boundary (depends on PAE) so the actually available memory for
79199 + module code will usually be more than this minimum.
79201 + The default 4 MB should be enough for most users but if you have
79202 + an excessive number of modules (e.g., most distribution configs
79203 + compile many drivers as modules) or use huge modules such as
79204 + nvidia's kernel driver, you will need to adjust this amount.
79205 + A good rule of thumb is to look at your currently loaded kernel
79206 + modules and add up their sizes.
79210 +menu "Address Space Layout Randomization"
79214 + bool "Address Space Layout Randomization"
79215 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
79217 + Many if not most exploit techniques rely on the knowledge of
79218 + certain addresses in the attacked program. The following options
79219 + will allow the kernel to apply a certain amount of randomization
79220 + to specific parts of the program thereby forcing an attacker to
79221 + guess them in most cases. Any failed guess will most likely crash
79222 + the attacked program which allows the kernel to detect such attempts
79223 + and react on them. PaX itself provides no reaction mechanisms,
79224 + instead it is strongly encouraged that you make use of Nergal's
79225 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
79226 + (http://www.grsecurity.net/) built-in crash detection features or
79227 + develop one yourself.
79229 + By saying Y here you can choose to randomize the following areas:
79230 + - top of the task's kernel stack
79231 + - top of the task's userland stack
79232 + - base address for mmap() requests that do not specify one
79233 + (this includes all libraries)
79234 + - base address of the main executable
79236 + It is strongly recommended to say Y here as address space layout
79237 + randomization has negligible impact on performance yet it provides
79238 + a very effective protection.
79240 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79241 + this feature on a per file basis.
79243 +config PAX_RANDKSTACK
79244 + bool "Randomize kernel stack base"
79245 + depends on X86_TSC && X86
79247 + By saying Y here the kernel will randomize every task's kernel
79248 + stack on every system call. This will not only force an attacker
79249 + to guess it but also prevent him from making use of possible
79250 + leaked information about it.
79252 + Since the kernel stack is a rather scarce resource, randomization
79253 + may cause unexpected stack overflows, therefore you should very
79254 + carefully test your system. Note that once enabled in the kernel
79255 + configuration, this feature cannot be disabled on a per file basis.
79257 +config PAX_RANDUSTACK
79258 + bool "Randomize user stack base"
79259 + depends on PAX_ASLR
79261 + By saying Y here the kernel will randomize every task's userland
79262 + stack. The randomization is done in two steps where the second
79263 + one may apply a big amount of shift to the top of the stack and
79264 + cause problems for programs that want to use lots of memory (more
79265 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
79266 + For this reason the second step can be controlled by 'chpax' or
79267 + 'paxctl' on a per file basis.
79269 +config PAX_RANDMMAP
79270 + bool "Randomize mmap() base"
79271 + depends on PAX_ASLR
79273 + By saying Y here the kernel will use a randomized base address for
79274 + mmap() requests that do not specify one themselves. As a result
79275 + all dynamically loaded libraries will appear at random addresses
79276 + and therefore be harder to exploit by a technique where an attacker
79277 + attempts to execute library code for his purposes (e.g. spawn a
79278 + shell from an exploited program that is running at an elevated
79279 + privilege level).
79281 + Furthermore, if a program is relinked as a dynamic ELF file, its
79282 + base address will be randomized as well, completing the full
79283 + randomization of the address space layout. Attacking such programs
79284 + becomes a guess game. You can find an example of doing this at
79285 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
79286 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
79288 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
79289 + feature on a per file basis.
79293 +menu "Miscellaneous hardening features"
79295 +config PAX_MEMORY_SANITIZE
79296 + bool "Sanitize all freed memory"
79298 + By saying Y here the kernel will erase memory pages as soon as they
79299 + are freed. This in turn reduces the lifetime of data stored in the
79300 + pages, making it less likely that sensitive information such as
79301 + passwords, cryptographic secrets, etc stay in memory for too long.
79303 + This is especially useful for programs whose runtime is short, long
79304 + lived processes and the kernel itself benefit from this as long as
79305 + they operate on whole memory pages and ensure timely freeing of pages
79306 + that may hold sensitive information.
79308 + The tradeoff is performance impact, on a single CPU system kernel
79309 + compilation sees a 3% slowdown, other systems and workloads may vary
79310 + and you are advised to test this feature on your expected workload
79311 + before deploying it.
79313 + Note that this feature does not protect data stored in live pages,
79314 + e.g., process memory swapped to disk may stay there for a long time.
79316 +config PAX_MEMORY_STACKLEAK
79317 + bool "Sanitize kernel stack"
79320 + By saying Y here the kernel will erase the kernel stack before it
79321 + returns from a system call. This in turn reduces the information
79322 + that a kernel stack leak bug can reveal.
79324 + Note that such a bug can still leak information that was put on
79325 + the stack by the current system call (the one eventually triggering
79326 + the bug) but traces of earlier system calls on the kernel stack
79327 + cannot leak anymore.
79329 + The tradeoff is performance impact: on a single CPU system kernel
79330 + compilation sees a 1% slowdown, other systems and workloads may vary
79331 + and you are advised to test this feature on your expected workload
79332 + before deploying it.
79334 + Note: full support for this feature requires gcc with plugin support
79335 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
79336 + is not supported). Using older gcc versions means that functions
79337 + with large enough stack frames may leave uninitialized memory behind
79338 + that may be exposed to a later syscall leaking the stack.
79340 +config PAX_MEMORY_UDEREF
79341 + bool "Prevent invalid userland pointer dereference"
79342 + depends on X86 && !UML_X86 && !XEN
79343 + select PAX_PER_CPU_PGD if X86_64
79345 + By saying Y here the kernel will be prevented from dereferencing
79346 + userland pointers in contexts where the kernel expects only kernel
79347 + pointers. This is both a useful runtime debugging feature and a
79348 + security measure that prevents exploiting a class of kernel bugs.
79350 + The tradeoff is that some virtualization solutions may experience
79351 + a huge slowdown and therefore you should not enable this feature
79352 + for kernels meant to run in such environments. Whether a given VM
79353 + solution is affected or not is best determined by simply trying it
79354 + out, the performance impact will be obvious right on boot as this
79355 + mechanism engages from very early on. A good rule of thumb is that
79356 + VMs running on CPUs without hardware virtualization support (i.e.,
79357 + the majority of IA-32 CPUs) will likely experience the slowdown.
79359 +config PAX_REFCOUNT
79360 + bool "Prevent various kernel object reference counter overflows"
79361 + depends on GRKERNSEC && (X86 || SPARC64)
79363 + By saying Y here the kernel will detect and prevent overflowing
79364 + various (but not all) kinds of object reference counters. Such
79365 + overflows can normally occur due to bugs only and are often, if
79366 + not always, exploitable.
79368 + The tradeoff is that data structures protected by an overflowed
79369 + refcount will never be freed and therefore will leak memory. Note
79370 + that this leak also happens even without this protection but in
79371 + that case the overflow can eventually trigger the freeing of the
79372 + data structure while it is still being used elsewhere, resulting
79373 + in the exploitable situation that this feature prevents.
79375 + Since this has a negligible performance impact, you should enable
79378 +config PAX_USERCOPY
79379 + bool "Harden heap object copies between kernel and userland"
79380 + depends on X86 || PPC || SPARC || ARM
79381 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
79383 + By saying Y here the kernel will enforce the size of heap objects
79384 + when they are copied in either direction between the kernel and
79385 + userland, even if only a part of the heap object is copied.
79387 + Specifically, this checking prevents information leaking from the
79388 + kernel heap during kernel to userland copies (if the kernel heap
79389 + object is otherwise fully initialized) and prevents kernel heap
79390 + overflows during userland to kernel copies.
79392 + Note that the current implementation provides the strictest bounds
79393 + checks for the SLUB allocator.
79395 + Enabling this option also enables per-slab cache protection against
79396 + data in a given cache being copied into/out of via userland
79397 + accessors. Though the whitelist of regions will be reduced over
79398 + time, it notably protects important data structures like task structs.
79400 + If frame pointers are enabled on x86, this option will also restrict
79401 + copies into and out of the kernel stack to local variables within a
79404 + Since this has a negligible performance impact, you should enable
79412 bool "Enable access key retention support"
79414 @@ -167,7 +747,7 @@ config INTEL_TXT
79415 config LSM_MMAP_MIN_ADDR
79416 int "Low address space for LSM to protect from user allocation"
79417 depends on SECURITY && SECURITY_SELINUX
79418 - default 32768 if ARM
79419 + default 32768 if ALPHA || ARM || PARISC || SPARC32
79422 This is the portion of low virtual memory which should be protected
79423 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
79424 index 3783202..1852837 100644
79425 --- a/security/apparmor/lsm.c
79426 +++ b/security/apparmor/lsm.c
79427 @@ -621,7 +621,7 @@ static int apparmor_task_setrlimit(struct task_struct *task,
79431 -static struct security_operations apparmor_ops = {
79432 +static struct security_operations apparmor_ops __read_only = {
79433 .name = "apparmor",
79435 .ptrace_access_check = apparmor_ptrace_access_check,
79436 diff --git a/security/commoncap.c b/security/commoncap.c
79437 index a93b3b7..4410df9 100644
79438 --- a/security/commoncap.c
79439 +++ b/security/commoncap.c
79441 #include <linux/prctl.h>
79442 #include <linux/securebits.h>
79443 #include <linux/user_namespace.h>
79444 +#include <net/sock.h>
79447 * If a non-root user executes a setuid-root binary in
79448 @@ -58,7 +59,7 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
79450 int cap_netlink_recv(struct sk_buff *skb, int cap)
79452 - if (!cap_raised(current_cap(), cap))
79453 + if (!cap_raised(current_cap(), cap) || !gr_is_capable(cap))
79457 @@ -575,6 +576,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
79459 const struct cred *cred = current_cred();
79461 + if (gr_acl_enable_at_secure())
79464 if (cred->uid != 0) {
79465 if (bprm->cap_effective)
79467 diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
79468 index 08408bd..67e6e78 100644
79469 --- a/security/integrity/ima/ima.h
79470 +++ b/security/integrity/ima/ima.h
79471 @@ -85,8 +85,8 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
79472 extern spinlock_t ima_queue_lock;
79474 struct ima_h_table {
79475 - atomic_long_t len; /* number of stored measurements in the list */
79476 - atomic_long_t violations;
79477 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
79478 + atomic_long_unchecked_t violations;
79479 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
79481 extern struct ima_h_table ima_htable;
79482 diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
79483 index da36d2c..e1e1965 100644
79484 --- a/security/integrity/ima/ima_api.c
79485 +++ b/security/integrity/ima/ima_api.c
79486 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
79489 /* can overflow, only indicator */
79490 - atomic_long_inc(&ima_htable.violations);
79491 + atomic_long_inc_unchecked(&ima_htable.violations);
79493 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
79495 diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
79496 index ef21b96..d53e674 100644
79497 --- a/security/integrity/ima/ima_fs.c
79498 +++ b/security/integrity/ima/ima_fs.c
79499 @@ -28,12 +28,12 @@
79500 static int valid_policy = 1;
79501 #define TMPBUFLEN 12
79502 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
79503 - loff_t *ppos, atomic_long_t *val)
79504 + loff_t *ppos, atomic_long_unchecked_t *val)
79506 char tmpbuf[TMPBUFLEN];
79509 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
79510 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
79511 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
79514 diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
79515 index 8e28f04..d5951b1 100644
79516 --- a/security/integrity/ima/ima_queue.c
79517 +++ b/security/integrity/ima/ima_queue.c
79518 @@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
79519 INIT_LIST_HEAD(&qe->later);
79520 list_add_tail_rcu(&qe->later, &ima_measurements);
79522 - atomic_long_inc(&ima_htable.len);
79523 + atomic_long_inc_unchecked(&ima_htable.len);
79524 key = ima_hash_key(entry->digest);
79525 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
79527 diff --git a/security/keys/compat.c b/security/keys/compat.c
79528 index 338b510..a235861 100644
79529 --- a/security/keys/compat.c
79530 +++ b/security/keys/compat.c
79531 @@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov(
79533 goto no_payload_free;
79535 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
79536 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
79538 if (iov != iovstack)
79540 diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
79541 index eca5191..da9c7f0 100644
79542 --- a/security/keys/keyctl.c
79543 +++ b/security/keys/keyctl.c
79544 @@ -921,7 +921,7 @@ static int keyctl_change_reqkey_auth(struct key *key)
79546 * Copy the iovec data from userspace
79548 -static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
79549 +static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov,
79552 for (; ioc > 0; ioc--) {
79553 @@ -943,7 +943,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
79554 * If successful, 0 will be returned.
79556 long keyctl_instantiate_key_common(key_serial_t id,
79557 - const struct iovec *payload_iov,
79558 + const struct iovec __user *payload_iov,
79561 key_serial_t ringid)
79562 @@ -1038,7 +1038,7 @@ long keyctl_instantiate_key(key_serial_t id,
79566 - return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
79567 + return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid);
79570 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
79571 @@ -1071,7 +1071,7 @@ long keyctl_instantiate_key_iov(key_serial_t id,
79573 goto no_payload_free;
79575 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
79576 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
79578 if (iov != iovstack)
79580 diff --git a/security/keys/keyring.c b/security/keys/keyring.c
79581 index 30e242f..ec111ab 100644
79582 --- a/security/keys/keyring.c
79583 +++ b/security/keys/keyring.c
79584 @@ -214,15 +214,15 @@ static long keyring_read(const struct key *keyring,
79587 for (loop = 0; loop < klist->nkeys; loop++) {
79588 + key_serial_t serial;
79589 key = klist->keys[loop];
79590 + serial = key->serial;
79592 tmp = sizeof(key_serial_t);
79596 - if (copy_to_user(buffer,
79599 + if (copy_to_user(buffer, &serial, tmp))
79603 diff --git a/security/min_addr.c b/security/min_addr.c
79604 index f728728..6457a0c 100644
79605 --- a/security/min_addr.c
79606 +++ b/security/min_addr.c
79607 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
79609 static void update_mmap_min_addr(void)
79612 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
79613 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
79614 mmap_min_addr = dac_mmap_min_addr;
79615 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
79617 mmap_min_addr = dac_mmap_min_addr;
79623 diff --git a/security/security.c b/security/security.c
79624 index d9e1533..91427f2 100644
79625 --- a/security/security.c
79626 +++ b/security/security.c
79627 @@ -25,8 +25,8 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
79628 /* things that live in capability.c */
79629 extern void __init security_fixup_ops(struct security_operations *ops);
79631 -static struct security_operations *security_ops;
79632 -static struct security_operations default_security_ops = {
79633 +static struct security_operations *security_ops __read_only;
79634 +static struct security_operations default_security_ops __read_only = {
79638 @@ -67,7 +67,9 @@ int __init security_init(void)
79640 void reset_security_ops(void)
79642 + pax_open_kernel();
79643 security_ops = &default_security_ops;
79644 + pax_close_kernel();
79647 /* Save user chosen LSM */
79648 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
79649 index 266a229..61bd553 100644
79650 --- a/security/selinux/hooks.c
79651 +++ b/security/selinux/hooks.c
79653 #define NUM_SEL_MNT_OPTS 5
79655 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
79656 -extern struct security_operations *security_ops;
79658 /* SECMARK reference count */
79659 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
79660 @@ -5455,7 +5454,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
79664 -static struct security_operations selinux_ops = {
79665 +static struct security_operations selinux_ops __read_only = {
79668 .ptrace_access_check = selinux_ptrace_access_check,
79669 diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
79670 index b43813c..74be837 100644
79671 --- a/security/selinux/include/xfrm.h
79672 +++ b/security/selinux/include/xfrm.h
79673 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
79675 static inline void selinux_xfrm_notify_policyload(void)
79677 - atomic_inc(&flow_cache_genid);
79678 + atomic_inc_unchecked(&flow_cache_genid);
79681 static inline int selinux_xfrm_enabled(void)
79682 diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
79683 index f6917bc..8e8713e 100644
79684 --- a/security/selinux/ss/services.c
79685 +++ b/security/selinux/ss/services.c
79686 @@ -1814,6 +1814,8 @@ int security_load_policy(void *data, size_t len)
79688 struct policy_file file = { data, len }, *fp = &file;
79690 + pax_track_stack();
79692 if (!ss_initialized) {
79693 avtab_cache_init();
79694 rc = policydb_read(&policydb, fp);
79695 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
79696 index b9c5e14..20ab779 100644
79697 --- a/security/smack/smack_lsm.c
79698 +++ b/security/smack/smack_lsm.c
79699 @@ -3393,7 +3393,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
79703 -struct security_operations smack_ops = {
79704 +struct security_operations smack_ops __read_only = {
79707 .ptrace_access_check = smack_ptrace_access_check,
79708 diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
79709 index f776400..f95b158c 100644
79710 --- a/security/tomoyo/tomoyo.c
79711 +++ b/security/tomoyo/tomoyo.c
79712 @@ -446,7 +446,7 @@ static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path)
79713 * tomoyo_security_ops is a "struct security_operations" which is used for
79714 * registering TOMOYO.
79716 -static struct security_operations tomoyo_security_ops = {
79717 +static struct security_operations tomoyo_security_ops __read_only = {
79719 .cred_alloc_blank = tomoyo_cred_alloc_blank,
79720 .cred_prepare = tomoyo_cred_prepare,
79721 diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
79722 index 3687a6c..652565e 100644
79723 --- a/sound/aoa/codecs/onyx.c
79724 +++ b/sound/aoa/codecs/onyx.c
79725 @@ -54,7 +54,7 @@ struct onyx {
79730 + local_t open_count;
79731 struct codec_info *codec_info;
79733 /* mutex serializes concurrent access to the device
79734 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_item *cii,
79735 struct onyx *onyx = cii->codec_data;
79737 mutex_lock(&onyx->mutex);
79738 - onyx->open_count++;
79739 + local_inc(&onyx->open_count);
79740 mutex_unlock(&onyx->mutex);
79743 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_item *cii,
79744 struct onyx *onyx = cii->codec_data;
79746 mutex_lock(&onyx->mutex);
79747 - onyx->open_count--;
79748 - if (!onyx->open_count)
79749 + if (local_dec_and_test(&onyx->open_count))
79750 onyx->spdif_locked = onyx->analog_locked = 0;
79751 mutex_unlock(&onyx->mutex);
79753 diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
79754 index ffd2025..df062c9 100644
79755 --- a/sound/aoa/codecs/onyx.h
79756 +++ b/sound/aoa/codecs/onyx.h
79758 #include <linux/i2c.h>
79759 #include <asm/pmac_low_i2c.h>
79760 #include <asm/prom.h>
79761 +#include <asm/local.h>
79763 /* PCM3052 register definitions */
79765 diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
79766 index 23c34a0..a2673a5 100644
79767 --- a/sound/core/oss/pcm_oss.c
79768 +++ b/sound/core/oss/pcm_oss.c
79769 @@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, const
79772 fs = snd_enter_user();
79773 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
79774 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
79775 snd_leave_user(fs);
79777 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
79778 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
79780 if (ret != -EPIPE && ret != -ESTRPIPE)
79782 @@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
79785 fs = snd_enter_user();
79786 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
79787 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
79788 snd_leave_user(fs);
79790 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
79791 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
79793 if (ret == -EPIPE) {
79794 if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
79795 @@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
79796 struct snd_pcm_plugin_channel *channels;
79797 size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
79799 - if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
79800 + if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
79802 buf = runtime->oss.buffer;
79804 @@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
79807 tmp = snd_pcm_oss_write2(substream,
79808 - (const char __force *)buf,
79809 + (const char __force_kernel *)buf,
79810 runtime->oss.period_bytes, 0);
79813 @@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
79814 struct snd_pcm_runtime *runtime = substream->runtime;
79815 snd_pcm_sframes_t frames, frames1;
79816 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
79817 - char __user *final_dst = (char __force __user *)buf;
79818 + char __user *final_dst = (char __force_user *)buf;
79819 if (runtime->oss.plugin_first) {
79820 struct snd_pcm_plugin_channel *channels;
79821 size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
79822 @@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
79824 runtime->oss.buffer_used -= tmp;
79826 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
79827 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
79828 runtime->oss.period_bytes, 0);
79831 @@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
79833 size1 /= runtime->channels; /* frames */
79834 fs = snd_enter_user();
79835 - snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
79836 + snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
79837 snd_leave_user(fs);
79839 } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
79840 diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
79841 index 91cdf94..4085161 100644
79842 --- a/sound/core/pcm_compat.c
79843 +++ b/sound/core/pcm_compat.c
79844 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
79847 fs = snd_enter_user();
79848 - err = snd_pcm_delay(substream, &delay);
79849 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
79850 snd_leave_user(fs);
79853 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
79854 index 1c6be91..c761a59 100644
79855 --- a/sound/core/pcm_native.c
79856 +++ b/sound/core/pcm_native.c
79857 @@ -2770,11 +2770,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
79858 switch (substream->stream) {
79859 case SNDRV_PCM_STREAM_PLAYBACK:
79860 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
79861 - (void __user *)arg);
79862 + (void __force_user *)arg);
79864 case SNDRV_PCM_STREAM_CAPTURE:
79865 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
79866 - (void __user *)arg);
79867 + (void __force_user *)arg);
79871 diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
79872 index 1f99767..14636533 100644
79873 --- a/sound/core/seq/seq_device.c
79874 +++ b/sound/core/seq/seq_device.c
79875 @@ -63,7 +63,7 @@ struct ops_list {
79876 int argsize; /* argument size */
79879 - struct snd_seq_dev_ops ops;
79880 + struct snd_seq_dev_ops *ops;
79882 /* registred devices */
79883 struct list_head dev_list; /* list of devices */
79884 @@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
79886 mutex_lock(&ops->reg_mutex);
79887 /* copy driver operators */
79888 - ops->ops = *entry;
79889 + ops->ops = entry;
79890 ops->driver |= DRIVER_LOADED;
79891 ops->argsize = argsize;
79893 @@ -462,7 +462,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
79894 dev->name, ops->id, ops->argsize, dev->argsize);
79897 - if (ops->ops.init_device(dev) >= 0) {
79898 + if (ops->ops->init_device(dev) >= 0) {
79899 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
79900 ops->num_init_devices++;
79902 @@ -489,7 +489,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
79903 dev->name, ops->id, ops->argsize, dev->argsize);
79906 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
79907 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
79908 dev->status = SNDRV_SEQ_DEVICE_FREE;
79909 dev->driver_data = NULL;
79910 ops->num_init_devices--;
79911 diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
79912 index 8539ab0..be8a121 100644
79913 --- a/sound/drivers/mts64.c
79914 +++ b/sound/drivers/mts64.c
79916 #include <sound/initval.h>
79917 #include <sound/rawmidi.h>
79918 #include <sound/control.h>
79919 +#include <asm/local.h>
79921 #define CARD_NAME "Miditerminal 4140"
79922 #define DRIVER_NAME "MTS64"
79923 @@ -66,7 +67,7 @@ struct mts64 {
79924 struct pardevice *pardev;
79925 int pardev_claimed;
79928 + local_t open_count;
79929 int current_midi_output_port;
79930 int current_midi_input_port;
79931 u8 mode[MTS64_NUM_INPUT_PORTS];
79932 @@ -696,7 +697,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
79934 struct mts64 *mts = substream->rmidi->private_data;
79936 - if (mts->open_count == 0) {
79937 + if (local_read(&mts->open_count) == 0) {
79938 /* We don't need a spinlock here, because this is just called
79939 if the device has not been opened before.
79940 So there aren't any IRQs from the device */
79941 @@ -704,7 +705,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
79945 - ++(mts->open_count);
79946 + local_inc(&mts->open_count);
79950 @@ -714,8 +715,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
79951 struct mts64 *mts = substream->rmidi->private_data;
79952 unsigned long flags;
79954 - --(mts->open_count);
79955 - if (mts->open_count == 0) {
79956 + if (local_dec_return(&mts->open_count) == 0) {
79957 /* We need the spinlock_irqsave here because we can still
79958 have IRQs at this point */
79959 spin_lock_irqsave(&mts->lock, flags);
79960 @@ -724,8 +724,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
79964 - } else if (mts->open_count < 0)
79965 - mts->open_count = 0;
79966 + } else if (local_read(&mts->open_count) < 0)
79967 + local_set(&mts->open_count, 0);
79971 diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
79972 index f07e38d..7aae69a 100644
79973 --- a/sound/drivers/opl4/opl4_lib.c
79974 +++ b/sound/drivers/opl4/opl4_lib.c
79975 @@ -28,7 +28,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
79976 MODULE_DESCRIPTION("OPL4 driver");
79977 MODULE_LICENSE("GPL");
79979 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
79980 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
79983 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
79984 diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
79985 index f2b0ba2..429efc5 100644
79986 --- a/sound/drivers/portman2x4.c
79987 +++ b/sound/drivers/portman2x4.c
79989 #include <sound/initval.h>
79990 #include <sound/rawmidi.h>
79991 #include <sound/control.h>
79992 +#include <asm/local.h>
79994 #define CARD_NAME "Portman 2x4"
79995 #define DRIVER_NAME "portman"
79996 @@ -84,7 +85,7 @@ struct portman {
79997 struct pardevice *pardev;
79998 int pardev_claimed;
80001 + local_t open_count;
80002 int mode[PORTMAN_NUM_INPUT_PORTS];
80003 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
80005 diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
80006 index 87657dd..a8268d4 100644
80007 --- a/sound/firewire/amdtp.c
80008 +++ b/sound/firewire/amdtp.c
80009 @@ -371,7 +371,7 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle)
80010 ptr = s->pcm_buffer_pointer + data_blocks;
80011 if (ptr >= pcm->runtime->buffer_size)
80012 ptr -= pcm->runtime->buffer_size;
80013 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
80014 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
80016 s->pcm_period_pointer += data_blocks;
80017 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
80018 @@ -511,7 +511,7 @@ EXPORT_SYMBOL(amdtp_out_stream_start);
80020 void amdtp_out_stream_update(struct amdtp_out_stream *s)
80022 - ACCESS_ONCE(s->source_node_id_field) =
80023 + ACCESS_ONCE_RW(s->source_node_id_field) =
80024 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
80026 EXPORT_SYMBOL(amdtp_out_stream_update);
80027 diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
80028 index 537a9cb..8e8c8e9 100644
80029 --- a/sound/firewire/amdtp.h
80030 +++ b/sound/firewire/amdtp.h
80031 @@ -146,7 +146,7 @@ static inline void amdtp_out_stream_pcm_prepare(struct amdtp_out_stream *s)
80032 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
80033 struct snd_pcm_substream *pcm)
80035 - ACCESS_ONCE(s->pcm) = pcm;
80036 + ACCESS_ONCE_RW(s->pcm) = pcm;
80040 diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
80041 index 4400308..261e9f3 100644
80042 --- a/sound/firewire/isight.c
80043 +++ b/sound/firewire/isight.c
80044 @@ -97,7 +97,7 @@ static void isight_update_pointers(struct isight *isight, unsigned int count)
80046 if (ptr >= runtime->buffer_size)
80047 ptr -= runtime->buffer_size;
80048 - ACCESS_ONCE(isight->buffer_pointer) = ptr;
80049 + ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
80051 isight->period_counter += count;
80052 if (isight->period_counter >= runtime->period_size) {
80053 @@ -308,7 +308,7 @@ static int isight_hw_params(struct snd_pcm_substream *substream,
80057 - ACCESS_ONCE(isight->pcm_active) = true;
80058 + ACCESS_ONCE_RW(isight->pcm_active) = true;
80062 @@ -341,7 +341,7 @@ static int isight_hw_free(struct snd_pcm_substream *substream)
80064 struct isight *isight = substream->private_data;
80066 - ACCESS_ONCE(isight->pcm_active) = false;
80067 + ACCESS_ONCE_RW(isight->pcm_active) = false;
80069 mutex_lock(&isight->mutex);
80070 isight_stop_streaming(isight);
80071 @@ -434,10 +434,10 @@ static int isight_trigger(struct snd_pcm_substream *substream, int cmd)
80074 case SNDRV_PCM_TRIGGER_START:
80075 - ACCESS_ONCE(isight->pcm_running) = true;
80076 + ACCESS_ONCE_RW(isight->pcm_running) = true;
80078 case SNDRV_PCM_TRIGGER_STOP:
80079 - ACCESS_ONCE(isight->pcm_running) = false;
80080 + ACCESS_ONCE_RW(isight->pcm_running) = false;
80084 diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
80085 index fe79a16..4d9714e 100644
80086 --- a/sound/isa/cmi8330.c
80087 +++ b/sound/isa/cmi8330.c
80088 @@ -172,7 +172,7 @@ struct snd_cmi8330 {
80090 struct snd_pcm *pcm;
80091 struct snd_cmi8330_stream {
80092 - struct snd_pcm_ops ops;
80093 + snd_pcm_ops_no_const ops;
80094 snd_pcm_open_callback_t open;
80095 void *private_data; /* sb or wss */
80097 diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
80098 index 733b014..56ce96f 100644
80099 --- a/sound/oss/sb_audio.c
80100 +++ b/sound/oss/sb_audio.c
80101 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
80102 buf16 = (signed short *)(localbuf + localoffs);
80105 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
80106 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
80107 if (copy_from_user(lbuf8,
80108 userbuf+useroffs + p,
80110 diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
80111 index 09d4648..cf234c7 100644
80112 --- a/sound/oss/swarm_cs4297a.c
80113 +++ b/sound/oss/swarm_cs4297a.c
80114 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
80116 struct cs4297a_state *s;
80120 #ifndef CONFIG_BCM_CS4297A_CSWARM
80122 @@ -2696,22 +2695,23 @@ static int __init cs4297a_init(void)
80124 char *sb1250_duart_present;
80131 val = SOUND_MASK_LINE;
80132 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
80133 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
80134 val = initvol[i].vol;
80135 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
80138 // cs4297a_write_ac97(s, 0x18, 0x0808);
80140 // cs4297a_write_ac97(s, 0x5e, 0x180);
80141 cs4297a_write_ac97(s, 0x02, 0x0808);
80142 cs4297a_write_ac97(s, 0x18, 0x0808);
80146 list_add(&s->list, &cs4297a_devs);
80148 diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
80149 index 755f2b0..5c12361 100644
80150 --- a/sound/pci/hda/hda_codec.h
80151 +++ b/sound/pci/hda/hda_codec.h
80152 @@ -611,7 +611,7 @@ struct hda_bus_ops {
80153 /* notify power-up/down from codec to controller */
80154 void (*pm_notify)(struct hda_bus *bus);
80159 /* template to pass to the bus constructor */
80160 struct hda_bus_template {
80161 @@ -713,6 +713,7 @@ struct hda_codec_ops {
80163 void (*reboot_notify)(struct hda_codec *codec);
80165 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
80167 /* record for amp information cache */
80168 struct hda_cache_head {
80169 @@ -743,7 +744,7 @@ struct hda_pcm_ops {
80170 struct snd_pcm_substream *substream);
80171 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
80172 struct snd_pcm_substream *substream);
80176 /* PCM information for each substream */
80177 struct hda_pcm_stream {
80178 @@ -801,7 +802,7 @@ struct hda_codec {
80179 const char *modelname; /* model name for preset */
80182 - struct hda_codec_ops patch_ops;
80183 + hda_codec_ops_no_const patch_ops;
80185 /* PCM to create, set by patch_ops.build_pcms callback */
80186 unsigned int num_pcms;
80187 diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
80188 index 0da778a..bc38b84 100644
80189 --- a/sound/pci/ice1712/ice1712.h
80190 +++ b/sound/pci/ice1712/ice1712.h
80191 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
80192 unsigned int mask_flags; /* total mask bits */
80193 struct snd_akm4xxx_ops {
80194 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
80196 + } __no_const ops;
80199 struct snd_ice1712_spdif {
80200 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
80201 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80202 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80203 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80205 + } __no_const ops;
80209 diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
80210 index f3260e6..4a285d8 100644
80211 --- a/sound/pci/ymfpci/ymfpci_main.c
80212 +++ b/sound/pci/ymfpci/ymfpci_main.c
80213 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
80214 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
80217 - if (atomic_read(&chip->interrupt_sleep_count)) {
80218 - atomic_set(&chip->interrupt_sleep_count, 0);
80219 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
80220 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80221 wake_up(&chip->interrupt_sleep);
80224 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
80226 init_waitqueue_entry(&wait, current);
80227 add_wait_queue(&chip->interrupt_sleep, &wait);
80228 - atomic_inc(&chip->interrupt_sleep_count);
80229 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
80230 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
80231 remove_wait_queue(&chip->interrupt_sleep, &wait);
80233 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
80234 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
80235 spin_unlock(&chip->reg_lock);
80237 - if (atomic_read(&chip->interrupt_sleep_count)) {
80238 - atomic_set(&chip->interrupt_sleep_count, 0);
80239 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
80240 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80241 wake_up(&chip->interrupt_sleep);
80244 @@ -2363,7 +2363,7 @@ int __devinit snd_ymfpci_create(struct snd_card *card,
80245 spin_lock_init(&chip->reg_lock);
80246 spin_lock_init(&chip->voice_lock);
80247 init_waitqueue_head(&chip->interrupt_sleep);
80248 - atomic_set(&chip->interrupt_sleep_count, 0);
80249 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80253 diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
80254 index 2879c88..224159e 100644
80255 --- a/sound/soc/soc-pcm.c
80256 +++ b/sound/soc/soc-pcm.c
80257 @@ -568,7 +568,7 @@ static snd_pcm_uframes_t soc_pcm_pointer(struct snd_pcm_substream *substream)
80260 /* ASoC PCM operations */
80261 -static struct snd_pcm_ops soc_pcm_ops = {
80262 +static snd_pcm_ops_no_const soc_pcm_ops = {
80263 .open = soc_pcm_open,
80264 .close = soc_pcm_close,
80265 .hw_params = soc_pcm_hw_params,
80266 diff --git a/sound/usb/card.h b/sound/usb/card.h
80267 index ae4251d..0961361 100644
80268 --- a/sound/usb/card.h
80269 +++ b/sound/usb/card.h
80270 @@ -44,6 +44,7 @@ struct snd_urb_ops {
80271 int (*prepare_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
80272 int (*retire_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
80274 +typedef struct snd_urb_ops __no_const snd_urb_ops_no_const;
80276 struct snd_usb_substream {
80277 struct snd_usb_stream *stream;
80278 @@ -93,7 +94,7 @@ struct snd_usb_substream {
80279 struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
80282 - struct snd_urb_ops ops; /* callbacks (must be filled at init) */
80283 + snd_urb_ops_no_const ops; /* callbacks (must be filled at init) */
80286 struct snd_usb_stream {
80287 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
80288 new file mode 100644
80289 index 0000000..b044b80
80291 +++ b/tools/gcc/Makefile
80294 +#PLUGIN_SOURCE_FILES := pax_plugin.c
80295 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
80296 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
80297 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
80299 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
80301 +hostlibs-y := constify_plugin.so
80302 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
80303 +hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
80304 +hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
80305 +hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
80307 +always := $(hostlibs-y)
80309 +constify_plugin-objs := constify_plugin.o
80310 +stackleak_plugin-objs := stackleak_plugin.o
80311 +kallocstat_plugin-objs := kallocstat_plugin.o
80312 +kernexec_plugin-objs := kernexec_plugin.o
80313 +checker_plugin-objs := checker_plugin.o
80314 diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
80315 new file mode 100644
80316 index 0000000..d41b5af
80318 +++ b/tools/gcc/checker_plugin.c
80321 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
80322 + * Licensed under the GPL v2
80324 + * Note: the choice of the license means that the compilation process is
80325 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
80326 + * but for the kernel it doesn't matter since it doesn't link against
80327 + * any of the gcc libraries
80329 + * gcc plugin to implement various sparse (source code checker) features
80332 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
80337 +#include "gcc-plugin.h"
80338 +#include "config.h"
80339 +#include "system.h"
80340 +#include "coretypes.h"
80342 +#include "tree-pass.h"
80343 +#include "flags.h"
80345 +#include "toplev.h"
80346 +#include "plugin.h"
80347 +//#include "expr.h" where are you...
80348 +#include "diagnostic.h"
80349 +#include "plugin-version.h"
80351 +#include "function.h"
80352 +#include "basic-block.h"
80353 +#include "gimple.h"
80355 +#include "emit-rtl.h"
80356 +#include "tree-flow.h"
80357 +#include "target.h"
80359 +extern void c_register_addr_space (const char *str, addr_space_t as);
80360 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
80361 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
80362 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
80363 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
80364 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
80366 +extern void print_gimple_stmt(FILE *, gimple, int, int);
80367 +extern rtx emit_move_insn(rtx x, rtx y);
80369 +int plugin_is_GPL_compatible;
80371 +static struct plugin_info checker_plugin_info = {
80372 + .version = "201111150100",
80375 +#define ADDR_SPACE_KERNEL 0
80376 +#define ADDR_SPACE_FORCE_KERNEL 1
80377 +#define ADDR_SPACE_USER 2
80378 +#define ADDR_SPACE_FORCE_USER 3
80379 +#define ADDR_SPACE_IOMEM 0
80380 +#define ADDR_SPACE_FORCE_IOMEM 0
80381 +#define ADDR_SPACE_PERCPU 0
80382 +#define ADDR_SPACE_FORCE_PERCPU 0
80383 +#define ADDR_SPACE_RCU 0
80384 +#define ADDR_SPACE_FORCE_RCU 0
80386 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
80388 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
80391 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
80393 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
80396 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
80398 + return default_addr_space_valid_pointer_mode(mode, as);
80401 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
80403 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
80406 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
80408 + return default_addr_space_legitimize_address(x, oldx, mode, as);
80411 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
80413 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
80416 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
80419 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
80422 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
80425 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
80428 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
80431 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
80434 + return subset == superset;
80437 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
80439 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
80440 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
80445 +static void register_checker_address_spaces(void *event_data, void *data)
80447 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
80448 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
80449 + c_register_addr_space("__user", ADDR_SPACE_USER);
80450 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
80451 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
80452 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
80453 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
80454 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
80455 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
80456 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
80458 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
80459 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
80460 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
80461 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
80462 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
80463 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
80464 + targetm.addr_space.convert = checker_addr_space_convert;
80467 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
80469 + const char * const plugin_name = plugin_info->base_name;
80470 + const int argc = plugin_info->argc;
80471 + const struct plugin_argument * const argv = plugin_info->argv;
80474 + if (!plugin_default_version_check(version, &gcc_version)) {
80475 + error(G_("incompatible gcc/plugin versions"));
80479 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
80481 + for (i = 0; i < argc; ++i)
80482 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
80484 + if (TARGET_64BIT == 0)
80487 + register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
80491 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
80492 new file mode 100644
80493 index 0000000..704a564
80495 +++ b/tools/gcc/constify_plugin.c
80498 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
80499 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
80500 + * Licensed under the GPL v2, or (at your option) v3
80502 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
80505 + * http://www.grsecurity.net/~ephox/const_plugin/
80508 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
80509 + * $ gcc -fplugin=constify_plugin.so test.c -O2
80512 +#include "gcc-plugin.h"
80513 +#include "config.h"
80514 +#include "system.h"
80515 +#include "coretypes.h"
80517 +#include "tree-pass.h"
80518 +#include "flags.h"
80520 +#include "toplev.h"
80521 +#include "plugin.h"
80522 +#include "diagnostic.h"
80523 +#include "plugin-version.h"
80525 +#include "function.h"
80526 +#include "basic-block.h"
80527 +#include "gimple.h"
80529 +#include "emit-rtl.h"
80530 +#include "tree-flow.h"
80532 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
80534 +int plugin_is_GPL_compatible;
80536 +static struct plugin_info const_plugin_info = {
80537 + .version = "201111150100",
80538 + .help = "no-constify\tturn off constification\n",
80541 +static void constify_type(tree type);
80542 +static bool walk_struct(tree node);
80544 +static tree deconstify_type(tree old_type)
80546 + tree new_type, field;
80548 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
80549 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
80550 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
80551 + DECL_FIELD_CONTEXT(field) = new_type;
80552 + TYPE_READONLY(new_type) = 0;
80553 + C_TYPE_FIELDS_READONLY(new_type) = 0;
80557 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
80561 + *no_add_attrs = true;
80562 + if (TREE_CODE(*node) == FUNCTION_DECL) {
80563 + error("%qE attribute does not apply to functions", name);
80564 + return NULL_TREE;
80567 + if (TREE_CODE(*node) == VAR_DECL) {
80568 + error("%qE attribute does not apply to variables", name);
80569 + return NULL_TREE;
80572 + if (TYPE_P(*node)) {
80573 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
80574 + *no_add_attrs = false;
80576 + error("%qE attribute applies to struct and union types only", name);
80577 + return NULL_TREE;
80580 + type = TREE_TYPE(*node);
80582 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
80583 + error("%qE attribute applies to struct and union types only", name);
80584 + return NULL_TREE;
80587 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
80588 + error("%qE attribute is already applied to the type", name);
80589 + return NULL_TREE;
80592 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
80593 + error("%qE attribute used on type that is not constified", name);
80594 + return NULL_TREE;
80597 + if (TREE_CODE(*node) == TYPE_DECL) {
80598 + TREE_TYPE(*node) = deconstify_type(type);
80599 + TREE_READONLY(*node) = 0;
80600 + return NULL_TREE;
80603 + return NULL_TREE;
80606 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
80608 + *no_add_attrs = true;
80609 + if (!TYPE_P(*node)) {
80610 + error("%qE attribute applies to types only", name);
80611 + return NULL_TREE;
80614 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
80615 + error("%qE attribute applies to struct and union types only", name);
80616 + return NULL_TREE;
80619 + *no_add_attrs = false;
80620 + constify_type(*node);
80621 + return NULL_TREE;
80624 +static struct attribute_spec no_const_attr = {
80625 + .name = "no_const",
80628 + .decl_required = false,
80629 + .type_required = false,
80630 + .function_type_required = false,
80631 + .handler = handle_no_const_attribute,
80632 +#if BUILDING_GCC_VERSION >= 4007
80633 + .affects_type_identity = true
80637 +static struct attribute_spec do_const_attr = {
80638 + .name = "do_const",
80641 + .decl_required = false,
80642 + .type_required = false,
80643 + .function_type_required = false,
80644 + .handler = handle_do_const_attribute,
80645 +#if BUILDING_GCC_VERSION >= 4007
80646 + .affects_type_identity = true
80650 +static void register_attributes(void *event_data, void *data)
80652 + register_attribute(&no_const_attr);
80653 + register_attribute(&do_const_attr);
80656 +static void constify_type(tree type)
80658 + TYPE_READONLY(type) = 1;
80659 + C_TYPE_FIELDS_READONLY(type) = 1;
80662 +static bool is_fptr(tree field)
80664 + tree ptr = TREE_TYPE(field);
80666 + if (TREE_CODE(ptr) != POINTER_TYPE)
80669 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
80672 +static bool walk_struct(tree node)
80676 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
80679 + if (TYPE_FIELDS(node) == NULL_TREE)
80682 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
80683 + tree type = TREE_TYPE(field);
80684 + enum tree_code code = TREE_CODE(type);
80685 + if (code == RECORD_TYPE || code == UNION_TYPE) {
80686 + if (!(walk_struct(type)))
80688 + } else if (!is_fptr(field) && !TREE_READONLY(field))
80694 +static void finish_type(void *event_data, void *data)
80696 + tree type = (tree)event_data;
80698 + if (type == NULL_TREE)
80701 + if (TYPE_READONLY(type))
80704 + if (walk_struct(type))
80705 + constify_type(type);
80708 +static unsigned int check_local_variables(void);
80710 +struct gimple_opt_pass pass_local_variable = {
80712 + .type = GIMPLE_PASS,
80713 + .name = "check_local_variables",
80715 + .execute = check_local_variables,
80718 + .static_pass_number = 0,
80719 + .tv_id = TV_NONE,
80720 + .properties_required = 0,
80721 + .properties_provided = 0,
80722 + .properties_destroyed = 0,
80723 + .todo_flags_start = 0,
80724 + .todo_flags_finish = 0
80728 +static unsigned int check_local_variables(void)
80731 + referenced_var_iterator rvi;
80733 +#if BUILDING_GCC_VERSION == 4005
80734 + FOR_EACH_REFERENCED_VAR(var, rvi) {
80736 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
80738 + tree type = TREE_TYPE(var);
80740 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
80743 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
80746 + if (!TYPE_READONLY(type))
80749 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
80752 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
80755 + if (walk_struct(type)) {
80756 + error("constified variable %qE cannot be local", var);
80763 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
80765 + const char * const plugin_name = plugin_info->base_name;
80766 + const int argc = plugin_info->argc;
80767 + const struct plugin_argument * const argv = plugin_info->argv;
80769 + bool constify = true;
80771 + struct register_pass_info local_variable_pass_info = {
80772 + .pass = &pass_local_variable.pass,
80773 + .reference_pass_name = "*referenced_vars",
80774 + .ref_pass_instance_number = 0,
80775 + .pos_op = PASS_POS_INSERT_AFTER
80778 + if (!plugin_default_version_check(version, &gcc_version)) {
80779 + error(G_("incompatible gcc/plugin versions"));
80783 + for (i = 0; i < argc; ++i) {
80784 + if (!(strcmp(argv[i].key, "no-constify"))) {
80785 + constify = false;
80788 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
80791 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
80793 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
80794 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
80796 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
80800 diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
80801 new file mode 100644
80802 index 0000000..a5eabce
80804 +++ b/tools/gcc/kallocstat_plugin.c
80807 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
80808 + * Licensed under the GPL v2
80810 + * Note: the choice of the license means that the compilation process is
80811 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
80812 + * but for the kernel it doesn't matter since it doesn't link against
80813 + * any of the gcc libraries
80815 + * gcc plugin to find the distribution of k*alloc sizes
80822 +#include "gcc-plugin.h"
80823 +#include "config.h"
80824 +#include "system.h"
80825 +#include "coretypes.h"
80827 +#include "tree-pass.h"
80828 +#include "flags.h"
80830 +#include "toplev.h"
80831 +#include "plugin.h"
80832 +//#include "expr.h" where are you...
80833 +#include "diagnostic.h"
80834 +#include "plugin-version.h"
80836 +#include "function.h"
80837 +#include "basic-block.h"
80838 +#include "gimple.h"
80840 +#include "emit-rtl.h"
80842 +extern void print_gimple_stmt(FILE *, gimple, int, int);
80844 +int plugin_is_GPL_compatible;
80846 +static const char * const kalloc_functions[] = {
80852 + "kmalloc_order_trace",
80858 +static struct plugin_info kallocstat_plugin_info = {
80859 + .version = "201111150100",
80862 +static unsigned int execute_kallocstat(void);
80864 +static struct gimple_opt_pass kallocstat_pass = {
80866 + .type = GIMPLE_PASS,
80867 + .name = "kallocstat",
80869 + .execute = execute_kallocstat,
80872 + .static_pass_number = 0,
80873 + .tv_id = TV_NONE,
80874 + .properties_required = 0,
80875 + .properties_provided = 0,
80876 + .properties_destroyed = 0,
80877 + .todo_flags_start = 0,
80878 + .todo_flags_finish = 0
80882 +static bool is_kalloc(const char *fnname)
80886 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
80887 + if (!strcmp(fnname, kalloc_functions[i]))
80892 +static unsigned int execute_kallocstat(void)
80896 + // 1. loop through BBs and GIMPLE statements
80897 + FOR_EACH_BB(bb) {
80898 + gimple_stmt_iterator gsi;
80899 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
80901 + tree fndecl, size;
80902 + gimple call_stmt;
80903 + const char *fnname;
80906 + call_stmt = gsi_stmt(gsi);
80907 + if (!is_gimple_call(call_stmt))
80909 + fndecl = gimple_call_fndecl(call_stmt);
80910 + if (fndecl == NULL_TREE)
80912 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
80915 + // is it a call to k*alloc
80916 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
80917 + if (!is_kalloc(fnname))
80920 + // is the size arg the result of a simple const assignment
80921 + size = gimple_call_arg(call_stmt, 0);
80924 + expanded_location xloc;
80927 + if (TREE_CODE(size) != SSA_NAME)
80929 + def_stmt = SSA_NAME_DEF_STMT(size);
80930 + if (!def_stmt || !is_gimple_assign(def_stmt))
80932 + if (gimple_num_ops(def_stmt) != 2)
80934 + size = gimple_assign_rhs1(def_stmt);
80935 + if (!TREE_CONSTANT(size))
80937 + xloc = expand_location(gimple_location(def_stmt));
80939 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
80940 + size_val = TREE_INT_CST_LOW(size);
80941 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
80944 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
80945 +//debug_tree(gimple_call_fn(call_stmt));
80946 +//print_node(stderr, "pax", fndecl, 4);
80953 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
80955 + const char * const plugin_name = plugin_info->base_name;
80956 + struct register_pass_info kallocstat_pass_info = {
80957 + .pass = &kallocstat_pass.pass,
80958 + .reference_pass_name = "ssa",
80959 + .ref_pass_instance_number = 0,
80960 + .pos_op = PASS_POS_INSERT_AFTER
80963 + if (!plugin_default_version_check(version, &gcc_version)) {
80964 + error(G_("incompatible gcc/plugin versions"));
80968 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
80969 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
80973 diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
80974 new file mode 100644
80975 index 0000000..51f747e
80977 +++ b/tools/gcc/kernexec_plugin.c
80980 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
80981 + * Licensed under the GPL v2
80983 + * Note: the choice of the license means that the compilation process is
80984 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
80985 + * but for the kernel it doesn't matter since it doesn't link against
80986 + * any of the gcc libraries
80988 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
80995 +#include "gcc-plugin.h"
80996 +#include "config.h"
80997 +#include "system.h"
80998 +#include "coretypes.h"
81000 +#include "tree-pass.h"
81001 +#include "flags.h"
81003 +#include "toplev.h"
81004 +#include "plugin.h"
81005 +//#include "expr.h" where are you...
81006 +#include "diagnostic.h"
81007 +#include "plugin-version.h"
81009 +#include "function.h"
81010 +#include "basic-block.h"
81011 +#include "gimple.h"
81013 +#include "emit-rtl.h"
81014 +#include "tree-flow.h"
81016 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81017 +extern rtx emit_move_insn(rtx x, rtx y);
81019 +int plugin_is_GPL_compatible;
81021 +static struct plugin_info kernexec_plugin_info = {
81022 + .version = "201111291120",
81023 + .help = "method=[bts|or]\tinstrumentation method\n"
81026 +static unsigned int execute_kernexec_fptr(void);
81027 +static unsigned int execute_kernexec_retaddr(void);
81028 +static bool kernexec_cmodel_check(void);
81030 +static void (*kernexec_instrument_fptr)(gimple_stmt_iterator);
81031 +static void (*kernexec_instrument_retaddr)(rtx);
81033 +static struct gimple_opt_pass kernexec_fptr_pass = {
81035 + .type = GIMPLE_PASS,
81036 + .name = "kernexec_fptr",
81037 + .gate = kernexec_cmodel_check,
81038 + .execute = execute_kernexec_fptr,
81041 + .static_pass_number = 0,
81042 + .tv_id = TV_NONE,
81043 + .properties_required = 0,
81044 + .properties_provided = 0,
81045 + .properties_destroyed = 0,
81046 + .todo_flags_start = 0,
81047 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
81051 +static struct rtl_opt_pass kernexec_retaddr_pass = {
81053 + .type = RTL_PASS,
81054 + .name = "kernexec_retaddr",
81055 + .gate = kernexec_cmodel_check,
81056 + .execute = execute_kernexec_retaddr,
81059 + .static_pass_number = 0,
81060 + .tv_id = TV_NONE,
81061 + .properties_required = 0,
81062 + .properties_provided = 0,
81063 + .properties_destroyed = 0,
81064 + .todo_flags_start = 0,
81065 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
81069 +static bool kernexec_cmodel_check(void)
81073 + if (ix86_cmodel != CM_KERNEL)
81076 + section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
81077 + if (!section || !TREE_VALUE(section))
81080 + section = TREE_VALUE(TREE_VALUE(section));
81081 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
81088 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
81089 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
81091 +static void kernexec_instrument_fptr_bts(gimple_stmt_iterator gsi)
81093 + gimple assign_intptr, assign_new_fptr, call_stmt;
81094 + tree intptr, old_fptr, new_fptr, kernexec_mask;
81096 + call_stmt = gsi_stmt(gsi);
81097 + old_fptr = gimple_call_fn(call_stmt);
81099 + // create temporary unsigned long variable used for bitops and cast fptr to it
81100 + intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
81101 + add_referenced_var(intptr);
81102 + mark_sym_for_renaming(intptr);
81103 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
81104 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
81105 + update_stmt(assign_intptr);
81107 + // apply logical or to temporary unsigned long and bitmask
81108 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
81109 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
81110 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
81111 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
81112 + update_stmt(assign_intptr);
81114 + // cast temporary unsigned long back to a temporary fptr variable
81115 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec");
81116 + add_referenced_var(new_fptr);
81117 + mark_sym_for_renaming(new_fptr);
81118 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
81119 + gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
81120 + update_stmt(assign_new_fptr);
81122 + // replace call stmt fn with the new fptr
81123 + gimple_call_set_fn(call_stmt, new_fptr);
81124 + update_stmt(call_stmt);
81127 +static void kernexec_instrument_fptr_or(gimple_stmt_iterator gsi)
81129 + gimple asm_or_stmt, call_stmt;
81130 + tree old_fptr, new_fptr, input, output;
81131 + VEC(tree, gc) *inputs = NULL;
81132 + VEC(tree, gc) *outputs = NULL;
81134 + call_stmt = gsi_stmt(gsi);
81135 + old_fptr = gimple_call_fn(call_stmt);
81137 + // create temporary fptr variable
81138 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
81139 + add_referenced_var(new_fptr);
81140 + mark_sym_for_renaming(new_fptr);
81142 + // build asm volatile("orq %%r10, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
81143 + input = build_tree_list(NULL_TREE, build_string(2, "0"));
81144 + input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
81145 + output = build_tree_list(NULL_TREE, build_string(3, "=r"));
81146 + output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
81147 + VEC_safe_push(tree, gc, inputs, input);
81148 + VEC_safe_push(tree, gc, outputs, output);
81149 + asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
81150 + gimple_asm_set_volatile(asm_or_stmt, true);
81151 + gsi_insert_before(&gsi, asm_or_stmt, GSI_SAME_STMT);
81152 + update_stmt(asm_or_stmt);
81154 + // replace call stmt fn with the new fptr
81155 + gimple_call_set_fn(call_stmt, new_fptr);
81156 + update_stmt(call_stmt);
81160 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
81162 +static unsigned int execute_kernexec_fptr(void)
81165 + gimple_stmt_iterator gsi;
81167 + // 1. loop through BBs and GIMPLE statements
81168 + FOR_EACH_BB(bb) {
81169 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
81170 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
81172 + gimple call_stmt;
81174 + // is it a call ...
81175 + call_stmt = gsi_stmt(gsi);
81176 + if (!is_gimple_call(call_stmt))
81178 + fn = gimple_call_fn(call_stmt);
81179 + if (TREE_CODE(fn) == ADDR_EXPR)
81181 + if (TREE_CODE(fn) != SSA_NAME)
81182 + gcc_unreachable();
81184 + // ... through a function pointer
81185 + fn = SSA_NAME_VAR(fn);
81186 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
81188 + fn = TREE_TYPE(fn);
81189 + if (TREE_CODE(fn) != POINTER_TYPE)
81191 + fn = TREE_TYPE(fn);
81192 + if (TREE_CODE(fn) != FUNCTION_TYPE)
81195 + kernexec_instrument_fptr(gsi);
81197 +//debug_tree(gimple_call_fn(call_stmt));
81198 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
81205 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
81206 +static void kernexec_instrument_retaddr_bts(rtx insn)
81209 + rtvec argvec, constraintvec, labelvec;
81212 + // create asm volatile("btsq $63,(%%rsp)":::)
81213 + argvec = rtvec_alloc(0);
81214 + constraintvec = rtvec_alloc(0);
81215 + labelvec = rtvec_alloc(0);
81216 + line = expand_location(RTL_LOCATION(insn)).line;
81217 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
81218 + MEM_VOLATILE_P(btsq) = 1;
81219 +// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
81220 + emit_insn_before(btsq, insn);
81223 +// add special KERNEXEC instrumentation: orq %r10,(%rsp) just before retn
81224 +static void kernexec_instrument_retaddr_or(rtx insn)
81227 + rtvec argvec, constraintvec, labelvec;
81230 + // create asm volatile("orq %%r10,(%%rsp)":::)
81231 + argvec = rtvec_alloc(0);
81232 + constraintvec = rtvec_alloc(0);
81233 + labelvec = rtvec_alloc(0);
81234 + line = expand_location(RTL_LOCATION(insn)).line;
81235 + orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r10,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
81236 + MEM_VOLATILE_P(orq) = 1;
81237 +// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
81238 + emit_insn_before(orq, insn);
81242 + * find all asm level function returns and forcibly set the highest bit of the return address
81244 +static unsigned int execute_kernexec_retaddr(void)
81248 + // 1. find function returns
81249 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
81250 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
81251 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
81255 + if (!JUMP_P(insn))
81257 + body = PATTERN(insn);
81258 + if (GET_CODE(body) == PARALLEL)
81259 + body = XVECEXP(body, 0, 0);
81260 + if (GET_CODE(body) != RETURN)
81262 + kernexec_instrument_retaddr(insn);
81265 +// print_simple_rtl(stderr, get_insns());
81266 +// print_rtl(stderr, get_insns());
81271 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81273 + const char * const plugin_name = plugin_info->base_name;
81274 + const int argc = plugin_info->argc;
81275 + const struct plugin_argument * const argv = plugin_info->argv;
81277 + struct register_pass_info kernexec_fptr_pass_info = {
81278 + .pass = &kernexec_fptr_pass.pass,
81279 + .reference_pass_name = "ssa",
81280 + .ref_pass_instance_number = 0,
81281 + .pos_op = PASS_POS_INSERT_AFTER
81283 + struct register_pass_info kernexec_retaddr_pass_info = {
81284 + .pass = &kernexec_retaddr_pass.pass,
81285 + .reference_pass_name = "pro_and_epilogue",
81286 + .ref_pass_instance_number = 0,
81287 + .pos_op = PASS_POS_INSERT_AFTER
81290 + if (!plugin_default_version_check(version, &gcc_version)) {
81291 + error(G_("incompatible gcc/plugin versions"));
81295 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
81297 + if (TARGET_64BIT == 0)
81300 + for (i = 0; i < argc; ++i) {
81301 + if (!strcmp(argv[i].key, "method")) {
81302 + if (!argv[i].value) {
81303 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81306 + if (!strcmp(argv[i].value, "bts")) {
81307 + kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
81308 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
81309 + } else if (!strcmp(argv[i].value, "or")) {
81310 + kernexec_instrument_fptr = kernexec_instrument_fptr_or;
81311 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
81312 + fix_register("r10", 1, 1);
81314 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
81317 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81319 + if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
81320 + error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
81322 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
81323 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
81327 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
81328 new file mode 100644
81329 index 0000000..d44f37c
81331 +++ b/tools/gcc/stackleak_plugin.c
81334 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81335 + * Licensed under the GPL v2
81337 + * Note: the choice of the license means that the compilation process is
81338 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81339 + * but for the kernel it doesn't matter since it doesn't link against
81340 + * any of the gcc libraries
81342 + * gcc plugin to help implement various PaX features
81344 + * - track lowest stack pointer
81347 + * - initialize all local variables
81352 +#include "gcc-plugin.h"
81353 +#include "config.h"
81354 +#include "system.h"
81355 +#include "coretypes.h"
81357 +#include "tree-pass.h"
81358 +#include "flags.h"
81360 +#include "toplev.h"
81361 +#include "plugin.h"
81362 +//#include "expr.h" where are you...
81363 +#include "diagnostic.h"
81364 +#include "plugin-version.h"
81366 +#include "function.h"
81367 +#include "basic-block.h"
81368 +#include "gimple.h"
81370 +#include "emit-rtl.h"
81372 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81374 +int plugin_is_GPL_compatible;
81376 +static int track_frame_size = -1;
81377 +static const char track_function[] = "pax_track_stack";
81378 +static const char check_function[] = "pax_check_alloca";
81379 +static bool init_locals;
81381 +static struct plugin_info stackleak_plugin_info = {
81382 + .version = "201111150100",
81383 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
81384 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
81387 +static bool gate_stackleak_track_stack(void);
81388 +static unsigned int execute_stackleak_tree_instrument(void);
81389 +static unsigned int execute_stackleak_final(void);
81391 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
81393 + .type = GIMPLE_PASS,
81394 + .name = "stackleak_tree_instrument",
81395 + .gate = gate_stackleak_track_stack,
81396 + .execute = execute_stackleak_tree_instrument,
81399 + .static_pass_number = 0,
81400 + .tv_id = TV_NONE,
81401 + .properties_required = PROP_gimple_leh | PROP_cfg,
81402 + .properties_provided = 0,
81403 + .properties_destroyed = 0,
81404 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
81405 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
81409 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
81411 + .type = RTL_PASS,
81412 + .name = "stackleak_final",
81413 + .gate = gate_stackleak_track_stack,
81414 + .execute = execute_stackleak_final,
81417 + .static_pass_number = 0,
81418 + .tv_id = TV_NONE,
81419 + .properties_required = 0,
81420 + .properties_provided = 0,
81421 + .properties_destroyed = 0,
81422 + .todo_flags_start = 0,
81423 + .todo_flags_finish = TODO_dump_func
81427 +static bool gate_stackleak_track_stack(void)
81429 + return track_frame_size >= 0;
81432 +static void stackleak_check_alloca(gimple_stmt_iterator gsi)
81434 + gimple check_alloca;
81435 + tree fndecl, fntype, alloca_size;
81437 + // insert call to void pax_check_alloca(unsigned long size)
81438 + fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
81439 + fndecl = build_fn_decl(check_function, fntype);
81440 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
81441 + alloca_size = gimple_call_arg(gsi_stmt(gsi), 0);
81442 + check_alloca = gimple_build_call(fndecl, 1, alloca_size);
81443 + gsi_insert_before(&gsi, check_alloca, GSI_CONTINUE_LINKING);
81446 +static void stackleak_add_instrumentation(gimple_stmt_iterator gsi)
81448 + gimple track_stack;
81449 + tree fndecl, fntype;
81451 + // insert call to void pax_track_stack(void)
81452 + fntype = build_function_type_list(void_type_node, NULL_TREE);
81453 + fndecl = build_fn_decl(track_function, fntype);
81454 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
81455 + track_stack = gimple_build_call(fndecl, 0);
81456 + gsi_insert_after(&gsi, track_stack, GSI_CONTINUE_LINKING);
81459 +#if BUILDING_GCC_VERSION == 4005
81460 +static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
81464 + if (!is_gimple_call(stmt))
81466 + fndecl = gimple_call_fndecl(stmt);
81469 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
81471 +// print_node(stderr, "pax", fndecl, 4);
81472 + return DECL_FUNCTION_CODE(fndecl) == code;
81476 +static bool is_alloca(gimple stmt)
81478 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
81481 +#if BUILDING_GCC_VERSION >= 4007
81482 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
81489 +static unsigned int execute_stackleak_tree_instrument(void)
81491 + basic_block bb, entry_bb;
81492 + bool prologue_instrumented = false;
81494 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
81496 + // 1. loop through BBs and GIMPLE statements
81497 + FOR_EACH_BB(bb) {
81498 + gimple_stmt_iterator gsi;
81499 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
81500 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
81501 + if (!is_alloca(gsi_stmt(gsi)))
81504 + // 2. insert stack overflow check before each __builtin_alloca call
81505 + stackleak_check_alloca(gsi);
81507 + // 3. insert track call after each __builtin_alloca call
81508 + stackleak_add_instrumentation(gsi);
81509 + if (bb == entry_bb)
81510 + prologue_instrumented = true;
81514 + // 4. insert track call at the beginning
81515 + if (!prologue_instrumented) {
81516 + bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
81517 + if (dom_info_available_p(CDI_DOMINATORS))
81518 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
81519 + stackleak_add_instrumentation(gsi_start_bb(bb));
81525 +static unsigned int execute_stackleak_final(void)
81529 + if (cfun->calls_alloca)
81532 + // keep calls only if function frame is big enough
81533 + if (get_frame_size() >= track_frame_size)
81536 + // 1. find pax_track_stack calls
81537 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
81538 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
81541 + if (!CALL_P(insn))
81543 + body = PATTERN(insn);
81544 + if (GET_CODE(body) != CALL)
81546 + body = XEXP(body, 0);
81547 + if (GET_CODE(body) != MEM)
81549 + body = XEXP(body, 0);
81550 + if (GET_CODE(body) != SYMBOL_REF)
81552 + if (strcmp(XSTR(body, 0), track_function))
81554 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
81555 + // 2. delete call
81556 + insn = delete_insn_and_edges(insn);
81557 +#if BUILDING_GCC_VERSION >= 4007
81558 + if (GET_CODE(insn) == NOTE && NOTE_KIND(insn) == NOTE_INSN_CALL_ARG_LOCATION)
81559 + insn = delete_insn_and_edges(insn);
81563 +// print_simple_rtl(stderr, get_insns());
81564 +// print_rtl(stderr, get_insns());
81565 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
81570 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81572 + const char * const plugin_name = plugin_info->base_name;
81573 + const int argc = plugin_info->argc;
81574 + const struct plugin_argument * const argv = plugin_info->argv;
81576 + struct register_pass_info stackleak_tree_instrument_pass_info = {
81577 + .pass = &stackleak_tree_instrument_pass.pass,
81578 +// .reference_pass_name = "tree_profile",
81579 + .reference_pass_name = "optimized",
81580 + .ref_pass_instance_number = 0,
81581 + .pos_op = PASS_POS_INSERT_AFTER
81583 + struct register_pass_info stackleak_final_pass_info = {
81584 + .pass = &stackleak_final_rtl_opt_pass.pass,
81585 + .reference_pass_name = "final",
81586 + .ref_pass_instance_number = 0,
81587 + .pos_op = PASS_POS_INSERT_BEFORE
81590 + if (!plugin_default_version_check(version, &gcc_version)) {
81591 + error(G_("incompatible gcc/plugin versions"));
81595 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
81597 + for (i = 0; i < argc; ++i) {
81598 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
81599 + if (!argv[i].value) {
81600 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81603 + track_frame_size = atoi(argv[i].value);
81604 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
81605 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
81608 + if (!strcmp(argv[i].key, "initialize-locals")) {
81609 + if (argv[i].value) {
81610 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
81613 + init_locals = true;
81616 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81619 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
81620 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
81624 diff --git a/tools/perf/util/include/asm/alternative-asm.h b/tools/perf/util/include/asm/alternative-asm.h
81625 index 6789d78..4afd019 100644
81626 --- a/tools/perf/util/include/asm/alternative-asm.h
81627 +++ b/tools/perf/util/include/asm/alternative-asm.h
81630 #define altinstruction_entry #
81632 + .macro pax_force_retaddr rip=0, reload=0
81636 diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
81637 index af0f22f..9a7d479 100644
81638 --- a/usr/gen_init_cpio.c
81639 +++ b/usr/gen_init_cpio.c
81640 @@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
81649 @@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_location)
81650 *env_var = *expanded = '\0';
81651 strncat(env_var, start + 2, end - start - 2);
81652 strncat(expanded, new_location, start - new_location);
81653 - strncat(expanded, getenv(env_var), PATH_MAX);
81654 - strncat(expanded, end + 1, PATH_MAX);
81655 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
81656 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
81657 strncpy(new_location, expanded, PATH_MAX);
81658 + new_location[PATH_MAX] = 0;
81662 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
81663 index aefdda3..8e8fbb9 100644
81664 --- a/virt/kvm/kvm_main.c
81665 +++ b/virt/kvm/kvm_main.c
81666 @@ -73,7 +73,7 @@ LIST_HEAD(vm_list);
81668 static cpumask_var_t cpus_hardware_enabled;
81669 static int kvm_usage_count = 0;
81670 -static atomic_t hardware_enable_failed;
81671 +static atomic_unchecked_t hardware_enable_failed;
81673 struct kmem_cache *kvm_vcpu_cache;
81674 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
81675 @@ -2266,7 +2266,7 @@ static void hardware_enable_nolock(void *junk)
81678 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
81679 - atomic_inc(&hardware_enable_failed);
81680 + atomic_inc_unchecked(&hardware_enable_failed);
81681 printk(KERN_INFO "kvm: enabling virtualization on "
81682 "CPU%d failed\n", cpu);
81684 @@ -2320,10 +2320,10 @@ static int hardware_enable_all(void)
81687 if (kvm_usage_count == 1) {
81688 - atomic_set(&hardware_enable_failed, 0);
81689 + atomic_set_unchecked(&hardware_enable_failed, 0);
81690 on_each_cpu(hardware_enable_nolock, NULL, 1);
81692 - if (atomic_read(&hardware_enable_failed)) {
81693 + if (atomic_read_unchecked(&hardware_enable_failed)) {
81694 hardware_disable_all_nolock();
81697 @@ -2588,7 +2588,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
81698 kvm_arch_vcpu_put(vcpu);
81701 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
81702 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
81703 struct module *module)
81706 @@ -2651,7 +2651,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
81708 vcpu_align = __alignof__(struct kvm_vcpu);
81709 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
81711 + SLAB_USERCOPY, NULL);
81712 if (!kvm_vcpu_cache) {
81715 @@ -2661,9 +2661,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
81719 - kvm_chardev_ops.owner = module;
81720 - kvm_vm_fops.owner = module;
81721 - kvm_vcpu_fops.owner = module;
81722 + pax_open_kernel();
81723 + *(void **)&kvm_chardev_ops.owner = module;
81724 + *(void **)&kvm_vm_fops.owner = module;
81725 + *(void **)&kvm_vcpu_fops.owner = module;
81726 + pax_close_kernel();
81728 r = misc_register(&kvm_dev);