]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-2.6.32.46-201109150655.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.32.46-201109150655.patch
CommitLineData
e4221604
PK		 1diff -urNp linux-2.6.32.46/arch/alpha/include/asm/elf.h linux-2.6.32.46/arch/alpha/include/asm/elf.h
2--- linux-2.6.32.46/arch/alpha/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
3+++ linux-2.6.32.46/arch/alpha/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
4@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5
6 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
7
8+#ifdef CONFIG_PAX_ASLR
9+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
10+
11+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
12+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
13+#endif
14+
15 /* $0 is set by ld.so to a pointer to a function which might be
16 registered using atexit. This provides a mean for the dynamic
17 linker to call DT_FINI functions for shared libraries that have
18diff -urNp linux-2.6.32.46/arch/alpha/include/asm/pgtable.h linux-2.6.32.46/arch/alpha/include/asm/pgtable.h
19--- linux-2.6.32.46/arch/alpha/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
20+++ linux-2.6.32.46/arch/alpha/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
21@@ -101,6 +101,17 @@ struct vm_area_struct;
22 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
23 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
24 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
25+
26+#ifdef CONFIG_PAX_PAGEEXEC
27+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
28+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
29+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
30+#else
31+# define PAGE_SHARED_NOEXEC PAGE_SHARED
32+# define PAGE_COPY_NOEXEC PAGE_COPY
33+# define PAGE_READONLY_NOEXEC PAGE_READONLY
34+#endif
35+
36 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
37
38 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
39diff -urNp linux-2.6.32.46/arch/alpha/kernel/module.c linux-2.6.32.46/arch/alpha/kernel/module.c
40--- linux-2.6.32.46/arch/alpha/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
41+++ linux-2.6.32.46/arch/alpha/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
42@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
43
44 /* The small sections were sorted to the end of the segment.
45 The following should definitely cover them. */
46- gp = (u64)me->module_core + me->core_size - 0x8000;
47+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
48 got = sechdrs[me->arch.gotsecindex].sh_addr;
49
50 for (i = 0; i < n; i++) {
51diff -urNp linux-2.6.32.46/arch/alpha/kernel/osf_sys.c linux-2.6.32.46/arch/alpha/kernel/osf_sys.c
52--- linux-2.6.32.46/arch/alpha/kernel/osf_sys.c 2011-08-09 18:35:28.000000000 -0400
53+++ linux-2.6.32.46/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:47.000000000 -0400
54@@ -1172,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
55 /* At this point: (!vma || addr < vma->vm_end). */
56 if (limit - len < addr)
57 return -ENOMEM;
58- if (!vma || addr + len <= vma->vm_start)
59+ if (check_heap_stack_gap(vma, addr, len))
60 return addr;
61 addr = vma->vm_end;
62 vma = vma->vm_next;
63@@ -1208,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
64 merely specific addresses, but regions of memory -- perhaps
65 this feature should be incorporated into all ports? */
66
67+#ifdef CONFIG_PAX_RANDMMAP
68+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
69+#endif
70+
71 if (addr) {
72 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
73 if (addr != (unsigned long) -ENOMEM)
74@@ -1215,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
75 }
76
77 /* Next, try allocating at TASK_UNMAPPED_BASE. */
78- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
79- len, limit);
80+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
81+
82 if (addr != (unsigned long) -ENOMEM)
83 return addr;
84
85diff -urNp linux-2.6.32.46/arch/alpha/mm/fault.c linux-2.6.32.46/arch/alpha/mm/fault.c
86--- linux-2.6.32.46/arch/alpha/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
87+++ linux-2.6.32.46/arch/alpha/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
88@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
89 __reload_thread(pcb);
90 }
91
92+#ifdef CONFIG_PAX_PAGEEXEC
93+/*
94+ * PaX: decide what to do with offenders (regs->pc = fault address)
95+ *
96+ * returns 1 when task should be killed
97+ * 2 when patched PLT trampoline was detected
98+ * 3 when unpatched PLT trampoline was detected
99+ */
100+static int pax_handle_fetch_fault(struct pt_regs *regs)
101+{
102+
103+#ifdef CONFIG_PAX_EMUPLT
104+ int err;
105+
106+ do { /* PaX: patched PLT emulation #1 */
107+ unsigned int ldah, ldq, jmp;
108+
109+ err = get_user(ldah, (unsigned int *)regs->pc);
110+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
111+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
112+
113+ if (err)
114+ break;
115+
116+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
117+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
118+ jmp == 0x6BFB0000U)
119+ {
120+ unsigned long r27, addr;
121+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
122+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
123+
124+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
125+ err = get_user(r27, (unsigned long *)addr);
126+ if (err)
127+ break;
128+
129+ regs->r27 = r27;
130+ regs->pc = r27;
131+ return 2;
132+ }
133+ } while (0);
134+
135+ do { /* PaX: patched PLT emulation #2 */
136+ unsigned int ldah, lda, br;
137+
138+ err = get_user(ldah, (unsigned int *)regs->pc);
139+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
140+ err |= get_user(br, (unsigned int *)(regs->pc+8));
141+
142+ if (err)
143+ break;
144+
145+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
146+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
147+ (br & 0xFFE00000U) == 0xC3E00000U)
148+ {
149+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
150+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
151+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
152+
153+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
154+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
155+ return 2;
156+ }
157+ } while (0);
158+
159+ do { /* PaX: unpatched PLT emulation */
160+ unsigned int br;
161+
162+ err = get_user(br, (unsigned int *)regs->pc);
163+
164+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
165+ unsigned int br2, ldq, nop, jmp;
166+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
167+
168+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
169+ err = get_user(br2, (unsigned int *)addr);
170+ err |= get_user(ldq, (unsigned int *)(addr+4));
171+ err |= get_user(nop, (unsigned int *)(addr+8));
172+ err |= get_user(jmp, (unsigned int *)(addr+12));
173+ err |= get_user(resolver, (unsigned long *)(addr+16));
174+
175+ if (err)
176+ break;
177+
178+ if (br2 == 0xC3600000U &&
179+ ldq == 0xA77B000CU &&
180+ nop == 0x47FF041FU &&
181+ jmp == 0x6B7B0000U)
182+ {
183+ regs->r28 = regs->pc+4;
184+ regs->r27 = addr+16;
185+ regs->pc = resolver;
186+ return 3;
187+ }
188+ }
189+ } while (0);
190+#endif
191+
192+ return 1;
193+}
194+
195+void pax_report_insns(void *pc, void *sp)
196+{
197+ unsigned long i;
198+
199+ printk(KERN_ERR "PAX: bytes at PC: ");
200+ for (i = 0; i < 5; i++) {
201+ unsigned int c;
202+ if (get_user(c, (unsigned int *)pc+i))
203+ printk(KERN_CONT "???????? ");
204+ else
205+ printk(KERN_CONT "%08x ", c);
206+ }
207+ printk("\n");
208+}
209+#endif
210
211 /*
212 * This routine handles page faults. It determines the address,
213@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
214 good_area:
215 si_code = SEGV_ACCERR;
216 if (cause < 0) {
217- if (!(vma->vm_flags & VM_EXEC))
218+ if (!(vma->vm_flags & VM_EXEC)) {
219+
220+#ifdef CONFIG_PAX_PAGEEXEC
221+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
222+ goto bad_area;
223+
224+ up_read(&mm->mmap_sem);
225+ switch (pax_handle_fetch_fault(regs)) {
226+
227+#ifdef CONFIG_PAX_EMUPLT
228+ case 2:
229+ case 3:
230+ return;
231+#endif
232+
233+ }
234+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
235+ do_group_exit(SIGKILL);
236+#else
237 goto bad_area;
238+#endif
239+
240+ }
241 } else if (!cause) {
242 /* Allow reads even for write-only mappings */
243 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
244diff -urNp linux-2.6.32.46/arch/arm/include/asm/elf.h linux-2.6.32.46/arch/arm/include/asm/elf.h
245--- linux-2.6.32.46/arch/arm/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
246+++ linux-2.6.32.46/arch/arm/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
247@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
248 the loader. We need to make sure that it is out of the way of the program
249 that it will "exec", and that there is sufficient room for the brk. */
250
251-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
252+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
253+
254+#ifdef CONFIG_PAX_ASLR
255+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
256+
257+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
258+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
259+#endif
260
261 /* When the program starts, a1 contains a pointer to a function to be
262 registered with atexit, as per the SVR4 ABI. A value of 0 means we
263diff -urNp linux-2.6.32.46/arch/arm/include/asm/kmap_types.h linux-2.6.32.46/arch/arm/include/asm/kmap_types.h
264--- linux-2.6.32.46/arch/arm/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
265+++ linux-2.6.32.46/arch/arm/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
266@@ -19,6 +19,7 @@ enum km_type {
267 KM_SOFTIRQ0,
268 KM_SOFTIRQ1,
269 KM_L2_CACHE,
270+ KM_CLEARPAGE,
271 KM_TYPE_NR
272 };
273
274diff -urNp linux-2.6.32.46/arch/arm/include/asm/uaccess.h linux-2.6.32.46/arch/arm/include/asm/uaccess.h
275--- linux-2.6.32.46/arch/arm/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
276+++ linux-2.6.32.46/arch/arm/include/asm/uaccess.h 2011-06-29 21:02:24.000000000 -0400
277@@ -22,6 +22,8 @@
278 #define VERIFY_READ 0
279 #define VERIFY_WRITE 1
280
281+extern void check_object_size(const void *ptr, unsigned long n, bool to);
282+
283 /*
284 * The exception table consists of pairs of addresses: the first is the
285 * address of an instruction that is allowed to fault, and the second is
286@@ -387,8 +389,23 @@ do { \
287
288
289 #ifdef CONFIG_MMU
290-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
291-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
292+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
293+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
294+
295+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
296+{
297+ if (!__builtin_constant_p(n))
298+ check_object_size(to, n, false);
299+ return ___copy_from_user(to, from, n);
300+}
301+
302+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
303+{
304+ if (!__builtin_constant_p(n))
305+ check_object_size(from, n, true);
306+ return ___copy_to_user(to, from, n);
307+}
308+
309 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
310 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
311 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
312@@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
313
314 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
315 {
316+ if ((long)n < 0)
317+ return n;
318+
319 if (access_ok(VERIFY_READ, from, n))
320 n = __copy_from_user(to, from, n);
321 else /* security hole - plug it */
322@@ -412,6 +432,9 @@ static inline unsigned long __must_check
323
324 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
325 {
326+ if ((long)n < 0)
327+ return n;
328+
329 if (access_ok(VERIFY_WRITE, to, n))
330 n = __copy_to_user(to, from, n);
331 return n;
332diff -urNp linux-2.6.32.46/arch/arm/kernel/armksyms.c linux-2.6.32.46/arch/arm/kernel/armksyms.c
333--- linux-2.6.32.46/arch/arm/kernel/armksyms.c 2011-03-27 14:31:47.000000000 -0400
334+++ linux-2.6.32.46/arch/arm/kernel/armksyms.c 2011-07-06 19:51:50.000000000 -0400
335@@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
336 #ifdef CONFIG_MMU
337 EXPORT_SYMBOL(copy_page);
338
339-EXPORT_SYMBOL(__copy_from_user);
340-EXPORT_SYMBOL(__copy_to_user);
341+EXPORT_SYMBOL(___copy_from_user);
342+EXPORT_SYMBOL(___copy_to_user);
343 EXPORT_SYMBOL(__clear_user);
344
345 EXPORT_SYMBOL(__get_user_1);
346diff -urNp linux-2.6.32.46/arch/arm/kernel/kgdb.c linux-2.6.32.46/arch/arm/kernel/kgdb.c
347--- linux-2.6.32.46/arch/arm/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
348+++ linux-2.6.32.46/arch/arm/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
349@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
350 * and we handle the normal undef case within the do_undefinstr
351 * handler.
352 */
353-struct kgdb_arch arch_kgdb_ops = {
354+const struct kgdb_arch arch_kgdb_ops = {
355 #ifndef __ARMEB__
356 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
357 #else /* ! __ARMEB__ */
358diff -urNp linux-2.6.32.46/arch/arm/kernel/traps.c linux-2.6.32.46/arch/arm/kernel/traps.c
359--- linux-2.6.32.46/arch/arm/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
360+++ linux-2.6.32.46/arch/arm/kernel/traps.c 2011-06-13 21:31:18.000000000 -0400
361@@ -247,6 +247,8 @@ static void __die(const char *str, int e
362
363 DEFINE_SPINLOCK(die_lock);
364
365+extern void gr_handle_kernel_exploit(void);
366+
367 /*
368 * This function is protected against re-entrancy.
369 */
370@@ -271,6 +273,8 @@ NORET_TYPE void die(const char *str, str
371 if (panic_on_oops)
372 panic("Fatal exception");
373
374+ gr_handle_kernel_exploit();
375+
376 do_exit(SIGSEGV);
377 }
378
379diff -urNp linux-2.6.32.46/arch/arm/lib/copy_from_user.S linux-2.6.32.46/arch/arm/lib/copy_from_user.S
380--- linux-2.6.32.46/arch/arm/lib/copy_from_user.S 2011-03-27 14:31:47.000000000 -0400
381+++ linux-2.6.32.46/arch/arm/lib/copy_from_user.S 2011-06-29 20:48:38.000000000 -0400
382@@ -16,7 +16,7 @@
383 /*
384 * Prototype:
385 *
386- * size_t __copy_from_user(void *to, const void *from, size_t n)
387+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
388 *
389 * Purpose:
390 *
391@@ -84,11 +84,11 @@
392
393 .text
394
395-ENTRY(__copy_from_user)
396+ENTRY(___copy_from_user)
397
398 #include "copy_template.S"
399
400-ENDPROC(__copy_from_user)
401+ENDPROC(___copy_from_user)
402
403 .section .fixup,"ax"
404 .align 0
405diff -urNp linux-2.6.32.46/arch/arm/lib/copy_to_user.S linux-2.6.32.46/arch/arm/lib/copy_to_user.S
406--- linux-2.6.32.46/arch/arm/lib/copy_to_user.S 2011-03-27 14:31:47.000000000 -0400
407+++ linux-2.6.32.46/arch/arm/lib/copy_to_user.S 2011-06-29 20:46:49.000000000 -0400
408@@ -16,7 +16,7 @@
409 /*
410 * Prototype:
411 *
412- * size_t __copy_to_user(void *to, const void *from, size_t n)
413+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
414 *
415 * Purpose:
416 *
417@@ -88,11 +88,11 @@
418 .text
419
420 ENTRY(__copy_to_user_std)
421-WEAK(__copy_to_user)
422+WEAK(___copy_to_user)
423
424 #include "copy_template.S"
425
426-ENDPROC(__copy_to_user)
427+ENDPROC(___copy_to_user)
428
429 .section .fixup,"ax"
430 .align 0
431diff -urNp linux-2.6.32.46/arch/arm/lib/uaccess.S linux-2.6.32.46/arch/arm/lib/uaccess.S
432--- linux-2.6.32.46/arch/arm/lib/uaccess.S 2011-03-27 14:31:47.000000000 -0400
433+++ linux-2.6.32.46/arch/arm/lib/uaccess.S 2011-06-29 20:48:53.000000000 -0400
434@@ -19,7 +19,7 @@
435
436 #define PAGE_SHIFT 12
437
438-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
439+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
440 * Purpose : copy a block to user memory from kernel memory
441 * Params : to - user memory
442 * : from - kernel memory
443@@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fau
444 sub r2, r2, ip
445 b .Lc2u_dest_aligned
446
447-ENTRY(__copy_to_user)
448+ENTRY(___copy_to_user)
449 stmfd sp!, {r2, r4 - r7, lr}
450 cmp r2, #4
451 blt .Lc2u_not_enough
452@@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fau
453 ldrgtb r3, [r1], #0
454 USER( strgtbt r3, [r0], #1) @ May fault
455 b .Lc2u_finished
456-ENDPROC(__copy_to_user)
457+ENDPROC(___copy_to_user)
458
459 .section .fixup,"ax"
460 .align 0
461 9001: ldmfd sp!, {r0, r4 - r7, pc}
462 .previous
463
464-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
465+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
466 * Purpose : copy a block from user memory to kernel memory
467 * Params : to - kernel memory
468 * : from - user memory
469@@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fau
470 sub r2, r2, ip
471 b .Lcfu_dest_aligned
472
473-ENTRY(__copy_from_user)
474+ENTRY(___copy_from_user)
475 stmfd sp!, {r0, r2, r4 - r7, lr}
476 cmp r2, #4
477 blt .Lcfu_not_enough
478@@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fau
479 USER( ldrgtbt r3, [r1], #1) @ May fault
480 strgtb r3, [r0], #1
481 b .Lcfu_finished
482-ENDPROC(__copy_from_user)
483+ENDPROC(___copy_from_user)
484
485 .section .fixup,"ax"
486 .align 0
487diff -urNp linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c
488--- linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c 2011-03-27 14:31:47.000000000 -0400
489+++ linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:44:35.000000000 -0400
490@@ -97,7 +97,7 @@ out:
491 }
492
493 unsigned long
494-__copy_to_user(void __user *to, const void *from, unsigned long n)
495+___copy_to_user(void __user *to, const void *from, unsigned long n)
496 {
497 /*
498 * This test is stubbed out of the main function above to keep
499diff -urNp linux-2.6.32.46/arch/arm/mach-at91/pm.c linux-2.6.32.46/arch/arm/mach-at91/pm.c
500--- linux-2.6.32.46/arch/arm/mach-at91/pm.c 2011-03-27 14:31:47.000000000 -0400
501+++ linux-2.6.32.46/arch/arm/mach-at91/pm.c 2011-04-17 15:56:45.000000000 -0400
502@@ -348,7 +348,7 @@ static void at91_pm_end(void)
503 }
504
505
506-static struct platform_suspend_ops at91_pm_ops ={
507+static const struct platform_suspend_ops at91_pm_ops ={
508 .valid = at91_pm_valid_state,
509 .begin = at91_pm_begin,
510 .enter = at91_pm_enter,
511diff -urNp linux-2.6.32.46/arch/arm/mach-omap1/pm.c linux-2.6.32.46/arch/arm/mach-omap1/pm.c
512--- linux-2.6.32.46/arch/arm/mach-omap1/pm.c 2011-03-27 14:31:47.000000000 -0400
513+++ linux-2.6.32.46/arch/arm/mach-omap1/pm.c 2011-04-17 15:56:45.000000000 -0400
514@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
515
516
517
518-static struct platform_suspend_ops omap_pm_ops ={
519+static const struct platform_suspend_ops omap_pm_ops ={
520 .prepare = omap_pm_prepare,
521 .enter = omap_pm_enter,
522 .finish = omap_pm_finish,
523diff -urNp linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c
524--- linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c 2011-03-27 14:31:47.000000000 -0400
525+++ linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c 2011-04-17 15:56:45.000000000 -0400
526@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
527 enable_hlt();
528 }
529
530-static struct platform_suspend_ops omap_pm_ops = {
531+static const struct platform_suspend_ops omap_pm_ops = {
532 .prepare = omap2_pm_prepare,
533 .enter = omap2_pm_enter,
534 .finish = omap2_pm_finish,
535diff -urNp linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c
536--- linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c 2011-03-27 14:31:47.000000000 -0400
537+++ linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c 2011-04-17 15:56:45.000000000 -0400
538@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
539 return;
540 }
541
542-static struct platform_suspend_ops omap_pm_ops = {
543+static const struct platform_suspend_ops omap_pm_ops = {
544 .begin = omap3_pm_begin,
545 .end = omap3_pm_end,
546 .prepare = omap3_pm_prepare,
547diff -urNp linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c
548--- linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c 2011-03-27 14:31:47.000000000 -0400
549+++ linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c 2011-04-17 15:56:45.000000000 -0400
550@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
551 (state == PM_SUSPEND_MEM);
552 }
553
554-static struct platform_suspend_ops pnx4008_pm_ops = {
555+static const struct platform_suspend_ops pnx4008_pm_ops = {
556 .enter = pnx4008_pm_enter,
557 .valid = pnx4008_pm_valid,
558 };
559diff -urNp linux-2.6.32.46/arch/arm/mach-pxa/pm.c linux-2.6.32.46/arch/arm/mach-pxa/pm.c
560--- linux-2.6.32.46/arch/arm/mach-pxa/pm.c 2011-03-27 14:31:47.000000000 -0400
561+++ linux-2.6.32.46/arch/arm/mach-pxa/pm.c 2011-04-17 15:56:45.000000000 -0400
562@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
563 pxa_cpu_pm_fns->finish();
564 }
565
566-static struct platform_suspend_ops pxa_pm_ops = {
567+static const struct platform_suspend_ops pxa_pm_ops = {
568 .valid = pxa_pm_valid,
569 .enter = pxa_pm_enter,
570 .prepare = pxa_pm_prepare,
571diff -urNp linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c
572--- linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c 2011-03-27 14:31:47.000000000 -0400
573+++ linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c 2011-04-17 15:56:45.000000000 -0400
574@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
575 }
576
577 #ifdef CONFIG_PM
578-static struct platform_suspend_ops sharpsl_pm_ops = {
579+static const struct platform_suspend_ops sharpsl_pm_ops = {
580 .prepare = pxa_pm_prepare,
581 .finish = pxa_pm_finish,
582 .enter = corgi_pxa_pm_enter,
583diff -urNp linux-2.6.32.46/arch/arm/mach-sa1100/pm.c linux-2.6.32.46/arch/arm/mach-sa1100/pm.c
584--- linux-2.6.32.46/arch/arm/mach-sa1100/pm.c 2011-03-27 14:31:47.000000000 -0400
585+++ linux-2.6.32.46/arch/arm/mach-sa1100/pm.c 2011-04-17 15:56:45.000000000 -0400
586@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
587 return virt_to_phys(sp);
588 }
589
590-static struct platform_suspend_ops sa11x0_pm_ops = {
591+static const struct platform_suspend_ops sa11x0_pm_ops = {
592 .enter = sa11x0_pm_enter,
593 .valid = suspend_valid_only_mem,
594 };
595diff -urNp linux-2.6.32.46/arch/arm/mm/fault.c linux-2.6.32.46/arch/arm/mm/fault.c
596--- linux-2.6.32.46/arch/arm/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
597+++ linux-2.6.32.46/arch/arm/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
598@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
599 }
600 #endif
601
602+#ifdef CONFIG_PAX_PAGEEXEC
603+ if (fsr & FSR_LNX_PF) {
604+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
605+ do_group_exit(SIGKILL);
606+ }
607+#endif
608+
609 tsk->thread.address = addr;
610 tsk->thread.error_code = fsr;
611 tsk->thread.trap_no = 14;
612@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
613 }
614 #endif /* CONFIG_MMU */
615
616+#ifdef CONFIG_PAX_PAGEEXEC
617+void pax_report_insns(void *pc, void *sp)
618+{
619+ long i;
620+
621+ printk(KERN_ERR "PAX: bytes at PC: ");
622+ for (i = 0; i < 20; i++) {
623+ unsigned char c;
624+ if (get_user(c, (__force unsigned char __user *)pc+i))
625+ printk(KERN_CONT "?? ");
626+ else
627+ printk(KERN_CONT "%02x ", c);
628+ }
629+ printk("\n");
630+
631+ printk(KERN_ERR "PAX: bytes at SP-4: ");
632+ for (i = -1; i < 20; i++) {
633+ unsigned long c;
634+ if (get_user(c, (__force unsigned long __user *)sp+i))
635+ printk(KERN_CONT "???????? ");
636+ else
637+ printk(KERN_CONT "%08lx ", c);
638+ }
639+ printk("\n");
640+}
641+#endif
642+
643 /*
644 * First Level Translation Fault Handler
645 *
646diff -urNp linux-2.6.32.46/arch/arm/mm/mmap.c linux-2.6.32.46/arch/arm/mm/mmap.c
647--- linux-2.6.32.46/arch/arm/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
648+++ linux-2.6.32.46/arch/arm/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
649@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
650 if (len > TASK_SIZE)
651 return -ENOMEM;
652
653+#ifdef CONFIG_PAX_RANDMMAP
654+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
655+#endif
656+
657 if (addr) {
658 if (do_align)
659 addr = COLOUR_ALIGN(addr, pgoff);
660@@ -70,15 +74,14 @@ arch_get_unmapped_area(struct file *filp
661 addr = PAGE_ALIGN(addr);
662
663 vma = find_vma(mm, addr);
664- if (TASK_SIZE - len >= addr &&
665- (!vma || addr + len <= vma->vm_start))
666+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
667 return addr;
668 }
669 if (len > mm->cached_hole_size) {
670- start_addr = addr = mm->free_area_cache;
671+ start_addr = addr = mm->free_area_cache;
672 } else {
673- start_addr = addr = TASK_UNMAPPED_BASE;
674- mm->cached_hole_size = 0;
675+ start_addr = addr = mm->mmap_base;
676+ mm->cached_hole_size = 0;
677 }
678
679 full_search:
680@@ -94,14 +97,14 @@ full_search:
681 * Start a new search - just in case we missed
682 * some holes.
683 */
684- if (start_addr != TASK_UNMAPPED_BASE) {
685- start_addr = addr = TASK_UNMAPPED_BASE;
686+ if (start_addr != mm->mmap_base) {
687+ start_addr = addr = mm->mmap_base;
688 mm->cached_hole_size = 0;
689 goto full_search;
690 }
691 return -ENOMEM;
692 }
693- if (!vma || addr + len <= vma->vm_start) {
694+ if (check_heap_stack_gap(vma, addr, len)) {
695 /*
696 * Remember the place where we stopped the search:
697 */
698diff -urNp linux-2.6.32.46/arch/arm/plat-s3c/pm.c linux-2.6.32.46/arch/arm/plat-s3c/pm.c
699--- linux-2.6.32.46/arch/arm/plat-s3c/pm.c 2011-03-27 14:31:47.000000000 -0400
700+++ linux-2.6.32.46/arch/arm/plat-s3c/pm.c 2011-04-17 15:56:45.000000000 -0400
701@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
702 s3c_pm_check_cleanup();
703 }
704
705-static struct platform_suspend_ops s3c_pm_ops = {
706+static const struct platform_suspend_ops s3c_pm_ops = {
707 .enter = s3c_pm_enter,
708 .prepare = s3c_pm_prepare,
709 .finish = s3c_pm_finish,
710diff -urNp linux-2.6.32.46/arch/avr32/include/asm/elf.h linux-2.6.32.46/arch/avr32/include/asm/elf.h
711--- linux-2.6.32.46/arch/avr32/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
712+++ linux-2.6.32.46/arch/avr32/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
713@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
714 the loader. We need to make sure that it is out of the way of the program
715 that it will "exec", and that there is sufficient room for the brk. */
716
717-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
718+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
719
720+#ifdef CONFIG_PAX_ASLR
721+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
722+
723+#define PAX_DELTA_MMAP_LEN 15
724+#define PAX_DELTA_STACK_LEN 15
725+#endif
726
727 /* This yields a mask that user programs can use to figure out what
728 instruction set this CPU supports. This could be done in user space,
729diff -urNp linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h
730--- linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
731+++ linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
732@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
733 D(11) KM_IRQ1,
734 D(12) KM_SOFTIRQ0,
735 D(13) KM_SOFTIRQ1,
736-D(14) KM_TYPE_NR
737+D(14) KM_CLEARPAGE,
738+D(15) KM_TYPE_NR
739 };
740
741 #undef D
742diff -urNp linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c
743--- linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c 2011-03-27 14:31:47.000000000 -0400
744+++ linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c 2011-04-17 15:56:45.000000000 -0400
745@@ -176,7 +176,7 @@ out:
746 return 0;
747 }
748
749-static struct platform_suspend_ops avr32_pm_ops = {
750+static const struct platform_suspend_ops avr32_pm_ops = {
751 .valid = avr32_pm_valid_state,
752 .enter = avr32_pm_enter,
753 };
754diff -urNp linux-2.6.32.46/arch/avr32/mm/fault.c linux-2.6.32.46/arch/avr32/mm/fault.c
755--- linux-2.6.32.46/arch/avr32/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
756+++ linux-2.6.32.46/arch/avr32/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
757@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
758
759 int exception_trace = 1;
760
761+#ifdef CONFIG_PAX_PAGEEXEC
762+void pax_report_insns(void *pc, void *sp)
763+{
764+ unsigned long i;
765+
766+ printk(KERN_ERR "PAX: bytes at PC: ");
767+ for (i = 0; i < 20; i++) {
768+ unsigned char c;
769+ if (get_user(c, (unsigned char *)pc+i))
770+ printk(KERN_CONT "???????? ");
771+ else
772+ printk(KERN_CONT "%02x ", c);
773+ }
774+ printk("\n");
775+}
776+#endif
777+
778 /*
779 * This routine handles page faults. It determines the address and the
780 * problem, and then passes it off to one of the appropriate routines.
781@@ -157,6 +174,16 @@ bad_area:
782 up_read(&mm->mmap_sem);
783
784 if (user_mode(regs)) {
785+
786+#ifdef CONFIG_PAX_PAGEEXEC
787+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
788+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
789+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
790+ do_group_exit(SIGKILL);
791+ }
792+ }
793+#endif
794+
795 if (exception_trace && printk_ratelimit())
796 printk("%s%s[%d]: segfault at %08lx pc %08lx "
797 "sp %08lx ecr %lu\n",
798diff -urNp linux-2.6.32.46/arch/blackfin/kernel/kgdb.c linux-2.6.32.46/arch/blackfin/kernel/kgdb.c
799--- linux-2.6.32.46/arch/blackfin/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
800+++ linux-2.6.32.46/arch/blackfin/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
801@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
802 return -1; /* this means that we do not want to exit from the handler */
803 }
804
805-struct kgdb_arch arch_kgdb_ops = {
806+const struct kgdb_arch arch_kgdb_ops = {
807 .gdb_bpt_instr = {0xa1},
808 #ifdef CONFIG_SMP
809 .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
810diff -urNp linux-2.6.32.46/arch/blackfin/mach-common/pm.c linux-2.6.32.46/arch/blackfin/mach-common/pm.c
811--- linux-2.6.32.46/arch/blackfin/mach-common/pm.c 2011-03-27 14:31:47.000000000 -0400
812+++ linux-2.6.32.46/arch/blackfin/mach-common/pm.c 2011-04-17 15:56:45.000000000 -0400
813@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
814 return 0;
815 }
816
817-struct platform_suspend_ops bfin_pm_ops = {
818+const struct platform_suspend_ops bfin_pm_ops = {
819 .enter = bfin_pm_enter,
820 .valid = bfin_pm_valid,
821 };
822diff -urNp linux-2.6.32.46/arch/frv/include/asm/kmap_types.h linux-2.6.32.46/arch/frv/include/asm/kmap_types.h
823--- linux-2.6.32.46/arch/frv/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
824+++ linux-2.6.32.46/arch/frv/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
825@@ -23,6 +23,7 @@ enum km_type {
826 KM_IRQ1,
827 KM_SOFTIRQ0,
828 KM_SOFTIRQ1,
829+ KM_CLEARPAGE,
830 KM_TYPE_NR
831 };
832
833diff -urNp linux-2.6.32.46/arch/frv/mm/elf-fdpic.c linux-2.6.32.46/arch/frv/mm/elf-fdpic.c
834--- linux-2.6.32.46/arch/frv/mm/elf-fdpic.c 2011-03-27 14:31:47.000000000 -0400
835+++ linux-2.6.32.46/arch/frv/mm/elf-fdpic.c 2011-04-17 15:56:45.000000000 -0400
836@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
837 if (addr) {
838 addr = PAGE_ALIGN(addr);
839 vma = find_vma(current->mm, addr);
840- if (TASK_SIZE - len >= addr &&
841- (!vma || addr + len <= vma->vm_start))
842+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
843 goto success;
844 }
845
846@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
847 for (; vma; vma = vma->vm_next) {
848 if (addr > limit)
849 break;
850- if (addr + len <= vma->vm_start)
851+ if (check_heap_stack_gap(vma, addr, len))
852 goto success;
853 addr = vma->vm_end;
854 }
855@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
856 for (; vma; vma = vma->vm_next) {
857 if (addr > limit)
858 break;
859- if (addr + len <= vma->vm_start)
860+ if (check_heap_stack_gap(vma, addr, len))
861 goto success;
862 addr = vma->vm_end;
863 }
864diff -urNp linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c
865--- linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c 2011-03-27 14:31:47.000000000 -0400
866+++ linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c 2011-04-17 15:56:45.000000000 -0400
867@@ -17,7 +17,7 @@
868 #include <linux/swiotlb.h>
869 #include <asm/machvec.h>
870
871-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
872+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
873
874 /* swiotlb declarations & definitions: */
875 extern int swiotlb_late_init_with_default_size (size_t size);
876@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
877 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
878 }
879
880-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
881+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
882 {
883 if (use_swiotlb(dev))
884 return &swiotlb_dma_ops;
885diff -urNp linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c
886--- linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c 2011-03-27 14:31:47.000000000 -0400
887+++ linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c 2011-04-17 15:56:45.000000000 -0400
888@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
889 },
890 };
891
892-extern struct dma_map_ops swiotlb_dma_ops;
893+extern const struct dma_map_ops swiotlb_dma_ops;
894
895 static int __init
896 sba_init(void)
897@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
898
899 __setup("sbapagesize=",sba_page_override);
900
901-struct dma_map_ops sba_dma_ops = {
902+const struct dma_map_ops sba_dma_ops = {
903 .alloc_coherent = sba_alloc_coherent,
904 .free_coherent = sba_free_coherent,
905 .map_page = sba_map_page,
906diff -urNp linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c
907--- linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c 2011-03-27 14:31:47.000000000 -0400
908+++ linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c 2011-04-17 15:56:45.000000000 -0400
909@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
910
911 #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
912
913+#ifdef CONFIG_PAX_ASLR
914+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
915+
916+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
917+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
918+#endif
919+
920 /* Ugly but avoids duplication */
921 #include "../../../fs/binfmt_elf.c"
922
923diff -urNp linux-2.6.32.46/arch/ia64/ia32/ia32priv.h linux-2.6.32.46/arch/ia64/ia32/ia32priv.h
924--- linux-2.6.32.46/arch/ia64/ia32/ia32priv.h 2011-03-27 14:31:47.000000000 -0400
925+++ linux-2.6.32.46/arch/ia64/ia32/ia32priv.h 2011-04-17 15:56:45.000000000 -0400
926@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
927 #define ELF_DATA ELFDATA2LSB
928 #define ELF_ARCH EM_386
929
930-#define IA32_STACK_TOP IA32_PAGE_OFFSET
931+#ifdef CONFIG_PAX_RANDUSTACK
932+#define __IA32_DELTA_STACK (current->mm->delta_stack)
933+#else
934+#define __IA32_DELTA_STACK 0UL
935+#endif
936+
937+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
938+
939 #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
940 #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
941
942diff -urNp linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h
943--- linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
944+++ linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
945@@ -12,7 +12,7 @@
946
947 #define ARCH_HAS_DMA_GET_REQUIRED_MASK
948
949-extern struct dma_map_ops *dma_ops;
950+extern const struct dma_map_ops *dma_ops;
951 extern struct ia64_machine_vector ia64_mv;
952 extern void set_iommu_machvec(void);
953
954@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
955 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
956 dma_addr_t *daddr, gfp_t gfp)
957 {
958- struct dma_map_ops *ops = platform_dma_get_ops(dev);
959+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
960 void *caddr;
961
962 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
963@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
964 static inline void dma_free_coherent(struct device *dev, size_t size,
965 void *caddr, dma_addr_t daddr)
966 {
967- struct dma_map_ops *ops = platform_dma_get_ops(dev);
968+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
969 debug_dma_free_coherent(dev, size, caddr, daddr);
970 ops->free_coherent(dev, size, caddr, daddr);
971 }
972@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
973
974 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
975 {
976- struct dma_map_ops *ops = platform_dma_get_ops(dev);
977+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
978 return ops->mapping_error(dev, daddr);
979 }
980
981 static inline int dma_supported(struct device *dev, u64 mask)
982 {
983- struct dma_map_ops *ops = platform_dma_get_ops(dev);
984+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
985 return ops->dma_supported(dev, mask);
986 }
987
988diff -urNp linux-2.6.32.46/arch/ia64/include/asm/elf.h linux-2.6.32.46/arch/ia64/include/asm/elf.h
989--- linux-2.6.32.46/arch/ia64/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
990+++ linux-2.6.32.46/arch/ia64/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
991@@ -43,6 +43,13 @@
992 */
993 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
994
995+#ifdef CONFIG_PAX_ASLR
996+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
997+
998+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
999+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1000+#endif
1001+
1002 #define PT_IA_64_UNWIND 0x70000001
1003
1004 /* IA-64 relocations: */
1005diff -urNp linux-2.6.32.46/arch/ia64/include/asm/machvec.h linux-2.6.32.46/arch/ia64/include/asm/machvec.h
1006--- linux-2.6.32.46/arch/ia64/include/asm/machvec.h 2011-03-27 14:31:47.000000000 -0400
1007+++ linux-2.6.32.46/arch/ia64/include/asm/machvec.h 2011-04-17 15:56:45.000000000 -0400
1008@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1009 /* DMA-mapping interface: */
1010 typedef void ia64_mv_dma_init (void);
1011 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1012-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1013+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1014
1015 /*
1016 * WARNING: The legacy I/O space is _architected_. Platforms are
1017@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1018 # endif /* CONFIG_IA64_GENERIC */
1019
1020 extern void swiotlb_dma_init(void);
1021-extern struct dma_map_ops *dma_get_ops(struct device *);
1022+extern const struct dma_map_ops *dma_get_ops(struct device *);
1023
1024 /*
1025 * Define default versions so we can extend machvec for new platforms without having
1026diff -urNp linux-2.6.32.46/arch/ia64/include/asm/pgtable.h linux-2.6.32.46/arch/ia64/include/asm/pgtable.h
1027--- linux-2.6.32.46/arch/ia64/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
1028+++ linux-2.6.32.46/arch/ia64/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
1029@@ -12,7 +12,7 @@
1030 * David Mosberger-Tang <davidm@hpl.hp.com>
1031 */
1032
1033-
1034+#include <linux/const.h>
1035 #include <asm/mman.h>
1036 #include <asm/page.h>
1037 #include <asm/processor.h>
1038@@ -143,6 +143,17 @@
1039 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1040 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1041 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1042+
1043+#ifdef CONFIG_PAX_PAGEEXEC
1044+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1045+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1046+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1047+#else
1048+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1049+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1050+# define PAGE_COPY_NOEXEC PAGE_COPY
1051+#endif
1052+
1053 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1054 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1055 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1056diff -urNp linux-2.6.32.46/arch/ia64/include/asm/spinlock.h linux-2.6.32.46/arch/ia64/include/asm/spinlock.h
1057--- linux-2.6.32.46/arch/ia64/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
1058+++ linux-2.6.32.46/arch/ia64/include/asm/spinlock.h 2011-04-17 15:56:45.000000000 -0400
1059@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1060 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1061
1062 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1063- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1064+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1065 }
1066
1067 static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
1068diff -urNp linux-2.6.32.46/arch/ia64/include/asm/uaccess.h linux-2.6.32.46/arch/ia64/include/asm/uaccess.h
1069--- linux-2.6.32.46/arch/ia64/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
1070+++ linux-2.6.32.46/arch/ia64/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
1071@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1072 const void *__cu_from = (from); \
1073 long __cu_len = (n); \
1074 \
1075- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1076+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1077 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1078 __cu_len; \
1079 })
1080@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1081 long __cu_len = (n); \
1082 \
1083 __chk_user_ptr(__cu_from); \
1084- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1085+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1086 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1087 __cu_len; \
1088 })
1089diff -urNp linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c
1090--- linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c 2011-03-27 14:31:47.000000000 -0400
1091+++ linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c 2011-04-17 15:56:45.000000000 -0400
1092@@ -3,7 +3,7 @@
1093 /* Set this to 1 if there is a HW IOMMU in the system */
1094 int iommu_detected __read_mostly;
1095
1096-struct dma_map_ops *dma_ops;
1097+const struct dma_map_ops *dma_ops;
1098 EXPORT_SYMBOL(dma_ops);
1099
1100 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1101@@ -16,7 +16,7 @@ static int __init dma_init(void)
1102 }
1103 fs_initcall(dma_init);
1104
1105-struct dma_map_ops *dma_get_ops(struct device *dev)
1106+const struct dma_map_ops *dma_get_ops(struct device *dev)
1107 {
1108 return dma_ops;
1109 }
1110diff -urNp linux-2.6.32.46/arch/ia64/kernel/module.c linux-2.6.32.46/arch/ia64/kernel/module.c
1111--- linux-2.6.32.46/arch/ia64/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
1112+++ linux-2.6.32.46/arch/ia64/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
1113@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1114 void
1115 module_free (struct module *mod, void *module_region)
1116 {
1117- if (mod && mod->arch.init_unw_table &&
1118- module_region == mod->module_init) {
1119+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1120 unw_remove_unwind_table(mod->arch.init_unw_table);
1121 mod->arch.init_unw_table = NULL;
1122 }
1123@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1124 }
1125
1126 static inline int
1127+in_init_rx (const struct module *mod, uint64_t addr)
1128+{
1129+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1130+}
1131+
1132+static inline int
1133+in_init_rw (const struct module *mod, uint64_t addr)
1134+{
1135+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1136+}
1137+
1138+static inline int
1139 in_init (const struct module *mod, uint64_t addr)
1140 {
1141- return addr - (uint64_t) mod->module_init < mod->init_size;
1142+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1143+}
1144+
1145+static inline int
1146+in_core_rx (const struct module *mod, uint64_t addr)
1147+{
1148+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1149+}
1150+
1151+static inline int
1152+in_core_rw (const struct module *mod, uint64_t addr)
1153+{
1154+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1155 }
1156
1157 static inline int
1158 in_core (const struct module *mod, uint64_t addr)
1159 {
1160- return addr - (uint64_t) mod->module_core < mod->core_size;
1161+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1162 }
1163
1164 static inline int
1165@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1166 break;
1167
1168 case RV_BDREL:
1169- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1170+ if (in_init_rx(mod, val))
1171+ val -= (uint64_t) mod->module_init_rx;
1172+ else if (in_init_rw(mod, val))
1173+ val -= (uint64_t) mod->module_init_rw;
1174+ else if (in_core_rx(mod, val))
1175+ val -= (uint64_t) mod->module_core_rx;
1176+ else if (in_core_rw(mod, val))
1177+ val -= (uint64_t) mod->module_core_rw;
1178 break;
1179
1180 case RV_LTV:
1181@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1182 * addresses have been selected...
1183 */
1184 uint64_t gp;
1185- if (mod->core_size > MAX_LTOFF)
1186+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1187 /*
1188 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1189 * at the end of the module.
1190 */
1191- gp = mod->core_size - MAX_LTOFF / 2;
1192+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1193 else
1194- gp = mod->core_size / 2;
1195- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1196+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1197+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1198 mod->arch.gp = gp;
1199 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1200 }
1201diff -urNp linux-2.6.32.46/arch/ia64/kernel/pci-dma.c linux-2.6.32.46/arch/ia64/kernel/pci-dma.c
1202--- linux-2.6.32.46/arch/ia64/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
1203+++ linux-2.6.32.46/arch/ia64/kernel/pci-dma.c 2011-04-17 15:56:45.000000000 -0400
1204@@ -43,7 +43,7 @@ struct device fallback_dev = {
1205 .dma_mask = &fallback_dev.coherent_dma_mask,
1206 };
1207
1208-extern struct dma_map_ops intel_dma_ops;
1209+extern const struct dma_map_ops intel_dma_ops;
1210
1211 static int __init pci_iommu_init(void)
1212 {
1213@@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *d
1214 }
1215 EXPORT_SYMBOL(iommu_dma_supported);
1216
1217+extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
1218+extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
1219+extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1220+extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1221+extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1222+extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1223+extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
1224+
1225+static const struct dma_map_ops intel_iommu_dma_ops = {
1226+ /* from drivers/pci/intel-iommu.c:intel_dma_ops */
1227+ .alloc_coherent = intel_alloc_coherent,
1228+ .free_coherent = intel_free_coherent,
1229+ .map_sg = intel_map_sg,
1230+ .unmap_sg = intel_unmap_sg,
1231+ .map_page = intel_map_page,
1232+ .unmap_page = intel_unmap_page,
1233+ .mapping_error = intel_mapping_error,
1234+
1235+ .sync_single_for_cpu = machvec_dma_sync_single,
1236+ .sync_sg_for_cpu = machvec_dma_sync_sg,
1237+ .sync_single_for_device = machvec_dma_sync_single,
1238+ .sync_sg_for_device = machvec_dma_sync_sg,
1239+ .dma_supported = iommu_dma_supported,
1240+};
1241+
1242 void __init pci_iommu_alloc(void)
1243 {
1244- dma_ops = &intel_dma_ops;
1245-
1246- dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
1247- dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
1248- dma_ops->sync_single_for_device = machvec_dma_sync_single;
1249- dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
1250- dma_ops->dma_supported = iommu_dma_supported;
1251+ dma_ops = &intel_iommu_dma_ops;
1252
1253 /*
1254 * The order of these functions is important for
1255diff -urNp linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c
1256--- linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
1257+++ linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
1258@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
1259 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1260 }
1261
1262-struct dma_map_ops swiotlb_dma_ops = {
1263+const struct dma_map_ops swiotlb_dma_ops = {
1264 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1265 .free_coherent = swiotlb_free_coherent,
1266 .map_page = swiotlb_map_page,
1267diff -urNp linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c
1268--- linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c 2011-03-27 14:31:47.000000000 -0400
1269+++ linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c 2011-04-17 15:56:45.000000000 -0400
1270@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1271 if (REGION_NUMBER(addr) == RGN_HPAGE)
1272 addr = 0;
1273 #endif
1274+
1275+#ifdef CONFIG_PAX_RANDMMAP
1276+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1277+ addr = mm->free_area_cache;
1278+ else
1279+#endif
1280+
1281 if (!addr)
1282 addr = mm->free_area_cache;
1283
1284@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1285 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1286 /* At this point: (!vma || addr < vma->vm_end). */
1287 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1288- if (start_addr != TASK_UNMAPPED_BASE) {
1289+ if (start_addr != mm->mmap_base) {
1290 /* Start a new search --- just in case we missed some holes. */
1291- addr = TASK_UNMAPPED_BASE;
1292+ addr = mm->mmap_base;
1293 goto full_search;
1294 }
1295 return -ENOMEM;
1296 }
1297- if (!vma || addr + len <= vma->vm_start) {
1298+ if (check_heap_stack_gap(vma, addr, len)) {
1299 /* Remember the address where we stopped this search: */
1300 mm->free_area_cache = addr + len;
1301 return addr;
1302diff -urNp linux-2.6.32.46/arch/ia64/kernel/topology.c linux-2.6.32.46/arch/ia64/kernel/topology.c
1303--- linux-2.6.32.46/arch/ia64/kernel/topology.c 2011-03-27 14:31:47.000000000 -0400
1304+++ linux-2.6.32.46/arch/ia64/kernel/topology.c 2011-04-17 15:56:45.000000000 -0400
1305@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
1306 return ret;
1307 }
1308
1309-static struct sysfs_ops cache_sysfs_ops = {
1310+static const struct sysfs_ops cache_sysfs_ops = {
1311 .show = cache_show
1312 };
1313
1314diff -urNp linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S
1315--- linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
1316+++ linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S 2011-04-17 15:56:45.000000000 -0400
1317@@ -190,7 +190,7 @@ SECTIONS
1318 /* Per-cpu data: */
1319 . = ALIGN(PERCPU_PAGE_SIZE);
1320 PERCPU_VADDR(PERCPU_ADDR, :percpu)
1321- __phys_per_cpu_start = __per_cpu_load;
1322+ __phys_per_cpu_start = per_cpu_load;
1323 . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
1324 * into percpu page size
1325 */
1326diff -urNp linux-2.6.32.46/arch/ia64/mm/fault.c linux-2.6.32.46/arch/ia64/mm/fault.c
1327--- linux-2.6.32.46/arch/ia64/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1328+++ linux-2.6.32.46/arch/ia64/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1329@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1330 return pte_present(pte);
1331 }
1332
1333+#ifdef CONFIG_PAX_PAGEEXEC
1334+void pax_report_insns(void *pc, void *sp)
1335+{
1336+ unsigned long i;
1337+
1338+ printk(KERN_ERR "PAX: bytes at PC: ");
1339+ for (i = 0; i < 8; i++) {
1340+ unsigned int c;
1341+ if (get_user(c, (unsigned int *)pc+i))
1342+ printk(KERN_CONT "???????? ");
1343+ else
1344+ printk(KERN_CONT "%08x ", c);
1345+ }
1346+ printk("\n");
1347+}
1348+#endif
1349+
1350 void __kprobes
1351 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1352 {
1353@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1354 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1355 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1356
1357- if ((vma->vm_flags & mask) != mask)
1358+ if ((vma->vm_flags & mask) != mask) {
1359+
1360+#ifdef CONFIG_PAX_PAGEEXEC
1361+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1362+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1363+ goto bad_area;
1364+
1365+ up_read(&mm->mmap_sem);
1366+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1367+ do_group_exit(SIGKILL);
1368+ }
1369+#endif
1370+
1371 goto bad_area;
1372
1373+ }
1374+
1375 survive:
1376 /*
1377 * If for any reason at all we couldn't handle the fault, make
1378diff -urNp linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c
1379--- linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
1380+++ linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c 2011-04-17 15:56:45.000000000 -0400
1381@@ -172,7 +172,7 @@ unsigned long hugetlb_get_unmapped_area(
1382 /* At this point: (!vmm || addr < vmm->vm_end). */
1383 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1384 return -ENOMEM;
1385- if (!vmm || (addr + len) <= vmm->vm_start)
1386+ if (check_heap_stack_gap(vmm, addr, len))
1387 return addr;
1388 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1389 }
1390diff -urNp linux-2.6.32.46/arch/ia64/mm/init.c linux-2.6.32.46/arch/ia64/mm/init.c
1391--- linux-2.6.32.46/arch/ia64/mm/init.c 2011-03-27 14:31:47.000000000 -0400
1392+++ linux-2.6.32.46/arch/ia64/mm/init.c 2011-04-17 15:56:45.000000000 -0400
1393@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1394 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1395 vma->vm_end = vma->vm_start + PAGE_SIZE;
1396 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1397+
1398+#ifdef CONFIG_PAX_PAGEEXEC
1399+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1400+ vma->vm_flags &= ~VM_EXEC;
1401+
1402+#ifdef CONFIG_PAX_MPROTECT
1403+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1404+ vma->vm_flags &= ~VM_MAYEXEC;
1405+#endif
1406+
1407+ }
1408+#endif
1409+
1410 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1411 down_write(&current->mm->mmap_sem);
1412 if (insert_vm_struct(current->mm, vma)) {
1413diff -urNp linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c
1414--- linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c 2011-03-27 14:31:47.000000000 -0400
1415+++ linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c 2011-04-17 15:56:45.000000000 -0400
1416@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
1417 return ret;
1418 }
1419
1420-static struct dma_map_ops sn_dma_ops = {
1421+static const struct dma_map_ops sn_dma_ops = {
1422 .alloc_coherent = sn_dma_alloc_coherent,
1423 .free_coherent = sn_dma_free_coherent,
1424 .map_page = sn_dma_map_page,
1425diff -urNp linux-2.6.32.46/arch/m32r/lib/usercopy.c linux-2.6.32.46/arch/m32r/lib/usercopy.c
1426--- linux-2.6.32.46/arch/m32r/lib/usercopy.c 2011-03-27 14:31:47.000000000 -0400
1427+++ linux-2.6.32.46/arch/m32r/lib/usercopy.c 2011-04-17 15:56:45.000000000 -0400
1428@@ -14,6 +14,9 @@
1429 unsigned long
1430 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1431 {
1432+ if ((long)n < 0)
1433+ return n;
1434+
1435 prefetch(from);
1436 if (access_ok(VERIFY_WRITE, to, n))
1437 __copy_user(to,from,n);
1438@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1439 unsigned long
1440 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1441 {
1442+ if ((long)n < 0)
1443+ return n;
1444+
1445 prefetchw(to);
1446 if (access_ok(VERIFY_READ, from, n))
1447 __copy_user_zeroing(to,from,n);
1448diff -urNp linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c
1449--- linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c 2011-03-27 14:31:47.000000000 -0400
1450+++ linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c 2011-04-17 15:56:45.000000000 -0400
1451@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
1452
1453 }
1454
1455-static struct platform_suspend_ops db1x_pm_ops = {
1456+static const struct platform_suspend_ops db1x_pm_ops = {
1457 .valid = suspend_valid_only_mem,
1458 .begin = db1x_pm_begin,
1459 .enter = db1x_pm_enter,
1460diff -urNp linux-2.6.32.46/arch/mips/include/asm/elf.h linux-2.6.32.46/arch/mips/include/asm/elf.h
1461--- linux-2.6.32.46/arch/mips/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
1462+++ linux-2.6.32.46/arch/mips/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
1463@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
1464 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1465 #endif
1466
1467+#ifdef CONFIG_PAX_ASLR
1468+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1469+
1470+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1471+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1472+#endif
1473+
1474 #endif /* _ASM_ELF_H */
1475diff -urNp linux-2.6.32.46/arch/mips/include/asm/page.h linux-2.6.32.46/arch/mips/include/asm/page.h
1476--- linux-2.6.32.46/arch/mips/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
1477+++ linux-2.6.32.46/arch/mips/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
1478@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1479 #ifdef CONFIG_CPU_MIPS32
1480 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1481 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1482- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1483+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1484 #else
1485 typedef struct { unsigned long long pte; } pte_t;
1486 #define pte_val(x) ((x).pte)
1487diff -urNp linux-2.6.32.46/arch/mips/include/asm/reboot.h linux-2.6.32.46/arch/mips/include/asm/reboot.h
1488--- linux-2.6.32.46/arch/mips/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
1489+++ linux-2.6.32.46/arch/mips/include/asm/reboot.h 2011-08-21 17:35:02.000000000 -0400
1490@@ -9,7 +9,7 @@
1491 #ifndef _ASM_REBOOT_H
1492 #define _ASM_REBOOT_H
1493
1494-extern void (*_machine_restart)(char *command);
1495-extern void (*_machine_halt)(void);
1496+extern void (*__noreturn _machine_restart)(char *command);
1497+extern void (*__noreturn _machine_halt)(void);
1498
1499 #endif /* _ASM_REBOOT_H */
1500diff -urNp linux-2.6.32.46/arch/mips/include/asm/system.h linux-2.6.32.46/arch/mips/include/asm/system.h
1501--- linux-2.6.32.46/arch/mips/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
1502+++ linux-2.6.32.46/arch/mips/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
1503@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1504 */
1505 #define __ARCH_WANT_UNLOCKED_CTXSW
1506
1507-extern unsigned long arch_align_stack(unsigned long sp);
1508+#define arch_align_stack(x) ((x) & ~0xfUL)
1509
1510 #endif /* _ASM_SYSTEM_H */
1511diff -urNp linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c
1512--- linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c 2011-03-27 14:31:47.000000000 -0400
1513+++ linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c 2011-04-17 15:56:45.000000000 -0400
1514@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1515 #undef ELF_ET_DYN_BASE
1516 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1517
1518+#ifdef CONFIG_PAX_ASLR
1519+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1520+
1521+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1522+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1523+#endif
1524+
1525 #include <asm/processor.h>
1526 #include <linux/module.h>
1527 #include <linux/elfcore.h>
1528diff -urNp linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c
1529--- linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c 2011-03-27 14:31:47.000000000 -0400
1530+++ linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c 2011-04-17 15:56:45.000000000 -0400
1531@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1532 #undef ELF_ET_DYN_BASE
1533 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1534
1535+#ifdef CONFIG_PAX_ASLR
1536+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1537+
1538+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1539+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1540+#endif
1541+
1542 #include <asm/processor.h>
1543
1544 /*
1545diff -urNp linux-2.6.32.46/arch/mips/kernel/kgdb.c linux-2.6.32.46/arch/mips/kernel/kgdb.c
1546--- linux-2.6.32.46/arch/mips/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
1547+++ linux-2.6.32.46/arch/mips/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
1548@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
1549 return -1;
1550 }
1551
1552+/* cannot be const */
1553 struct kgdb_arch arch_kgdb_ops;
1554
1555 /*
1556diff -urNp linux-2.6.32.46/arch/mips/kernel/process.c linux-2.6.32.46/arch/mips/kernel/process.c
1557--- linux-2.6.32.46/arch/mips/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
1558+++ linux-2.6.32.46/arch/mips/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
1559@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
1560 out:
1561 return pc;
1562 }
1563-
1564-/*
1565- * Don't forget that the stack pointer must be aligned on a 8 bytes
1566- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1567- */
1568-unsigned long arch_align_stack(unsigned long sp)
1569-{
1570- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1571- sp -= get_random_int() & ~PAGE_MASK;
1572-
1573- return sp & ALMASK;
1574-}
1575diff -urNp linux-2.6.32.46/arch/mips/kernel/reset.c linux-2.6.32.46/arch/mips/kernel/reset.c
1576--- linux-2.6.32.46/arch/mips/kernel/reset.c 2011-03-27 14:31:47.000000000 -0400
1577+++ linux-2.6.32.46/arch/mips/kernel/reset.c 2011-08-21 17:35:26.000000000 -0400
1578@@ -19,8 +19,8 @@
1579 * So handle all using function pointers to machine specific
1580 * functions.
1581 */
1582-void (*_machine_restart)(char *command);
1583-void (*_machine_halt)(void);
1584+void (*__noreturn _machine_restart)(char *command);
1585+void (*__noreturn _machine_halt)(void);
1586 void (*pm_power_off)(void);
1587
1588 EXPORT_SYMBOL(pm_power_off);
1589@@ -29,16 +29,19 @@ void machine_restart(char *command)
1590 {
1591 if (_machine_restart)
1592 _machine_restart(command);
1593+ BUG();
1594 }
1595
1596 void machine_halt(void)
1597 {
1598 if (_machine_halt)
1599 _machine_halt();
1600+ BUG();
1601 }
1602
1603 void machine_power_off(void)
1604 {
1605 if (pm_power_off)
1606 pm_power_off();
1607+ BUG();
1608 }
1609diff -urNp linux-2.6.32.46/arch/mips/kernel/syscall.c linux-2.6.32.46/arch/mips/kernel/syscall.c
1610--- linux-2.6.32.46/arch/mips/kernel/syscall.c 2011-03-27 14:31:47.000000000 -0400
1611+++ linux-2.6.32.46/arch/mips/kernel/syscall.c 2011-04-17 15:56:45.000000000 -0400
1612@@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(str
1613 do_color_align = 0;
1614 if (filp || (flags & MAP_SHARED))
1615 do_color_align = 1;
1616+
1617+#ifdef CONFIG_PAX_RANDMMAP
1618+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1619+#endif
1620+
1621 if (addr) {
1622 if (do_color_align)
1623 addr = COLOUR_ALIGN(addr, pgoff);
1624 else
1625 addr = PAGE_ALIGN(addr);
1626 vmm = find_vma(current->mm, addr);
1627- if (task_size - len >= addr &&
1628- (!vmm || addr + len <= vmm->vm_start))
1629+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
1630 return addr;
1631 }
1632- addr = TASK_UNMAPPED_BASE;
1633+ addr = current->mm->mmap_base;
1634 if (do_color_align)
1635 addr = COLOUR_ALIGN(addr, pgoff);
1636 else
1637@@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(str
1638 /* At this point: (!vmm || addr < vmm->vm_end). */
1639 if (task_size - len < addr)
1640 return -ENOMEM;
1641- if (!vmm || addr + len <= vmm->vm_start)
1642+ if (check_heap_stack_gap(vmm, addr, len))
1643 return addr;
1644 addr = vmm->vm_end;
1645 if (do_color_align)
1646diff -urNp linux-2.6.32.46/arch/mips/Makefile linux-2.6.32.46/arch/mips/Makefile
1647--- linux-2.6.32.46/arch/mips/Makefile 2011-03-27 14:31:47.000000000 -0400
1648+++ linux-2.6.32.46/arch/mips/Makefile 2011-08-21 19:26:52.000000000 -0400
1649@@ -51,6 +51,8 @@ endif
1650 cflags-y := -ffunction-sections
1651 cflags-y += $(call cc-option, -mno-check-zero-division)
1652
1653+cflags-y += -Wno-sign-compare -Wno-extra
1654+
1655 ifdef CONFIG_32BIT
1656 ld-emul = $(32bit-emul)
1657 vmlinux-32 = vmlinux
1658diff -urNp linux-2.6.32.46/arch/mips/mm/fault.c linux-2.6.32.46/arch/mips/mm/fault.c
1659--- linux-2.6.32.46/arch/mips/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1660+++ linux-2.6.32.46/arch/mips/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1661@@ -26,6 +26,23 @@
1662 #include <asm/ptrace.h>
1663 #include <asm/highmem.h> /* For VMALLOC_END */
1664
1665+#ifdef CONFIG_PAX_PAGEEXEC
1666+void pax_report_insns(void *pc, void *sp)
1667+{
1668+ unsigned long i;
1669+
1670+ printk(KERN_ERR "PAX: bytes at PC: ");
1671+ for (i = 0; i < 5; i++) {
1672+ unsigned int c;
1673+ if (get_user(c, (unsigned int *)pc+i))
1674+ printk(KERN_CONT "???????? ");
1675+ else
1676+ printk(KERN_CONT "%08x ", c);
1677+ }
1678+ printk("\n");
1679+}
1680+#endif
1681+
1682 /*
1683 * This routine handles page faults. It determines the address,
1684 * and the problem, and then passes it off to one of the appropriate
1685diff -urNp linux-2.6.32.46/arch/parisc/include/asm/elf.h linux-2.6.32.46/arch/parisc/include/asm/elf.h
1686--- linux-2.6.32.46/arch/parisc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
1687+++ linux-2.6.32.46/arch/parisc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
1688@@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration..
1689
1690 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1691
1692+#ifdef CONFIG_PAX_ASLR
1693+#define PAX_ELF_ET_DYN_BASE 0x10000UL
1694+
1695+#define PAX_DELTA_MMAP_LEN 16
1696+#define PAX_DELTA_STACK_LEN 16
1697+#endif
1698+
1699 /* This yields a mask that user programs can use to figure out what
1700 instruction set this CPU supports. This could be done in user space,
1701 but it's not easy, and we've already done it here. */
1702diff -urNp linux-2.6.32.46/arch/parisc/include/asm/pgtable.h linux-2.6.32.46/arch/parisc/include/asm/pgtable.h
1703--- linux-2.6.32.46/arch/parisc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
1704+++ linux-2.6.32.46/arch/parisc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
1705@@ -207,6 +207,17 @@
1706 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1707 #define PAGE_COPY PAGE_EXECREAD
1708 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1709+
1710+#ifdef CONFIG_PAX_PAGEEXEC
1711+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1712+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1713+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1714+#else
1715+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1716+# define PAGE_COPY_NOEXEC PAGE_COPY
1717+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1718+#endif
1719+
1720 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1721 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
1722 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
1723diff -urNp linux-2.6.32.46/arch/parisc/kernel/module.c linux-2.6.32.46/arch/parisc/kernel/module.c
1724--- linux-2.6.32.46/arch/parisc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
1725+++ linux-2.6.32.46/arch/parisc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
1726@@ -95,16 +95,38 @@
1727
1728 /* three functions to determine where in the module core
1729 * or init pieces the location is */
1730+static inline int in_init_rx(struct module *me, void *loc)
1731+{
1732+ return (loc >= me->module_init_rx &&
1733+ loc < (me->module_init_rx + me->init_size_rx));
1734+}
1735+
1736+static inline int in_init_rw(struct module *me, void *loc)
1737+{
1738+ return (loc >= me->module_init_rw &&
1739+ loc < (me->module_init_rw + me->init_size_rw));
1740+}
1741+
1742 static inline int in_init(struct module *me, void *loc)
1743 {
1744- return (loc >= me->module_init &&
1745- loc <= (me->module_init + me->init_size));
1746+ return in_init_rx(me, loc) || in_init_rw(me, loc);
1747+}
1748+
1749+static inline int in_core_rx(struct module *me, void *loc)
1750+{
1751+ return (loc >= me->module_core_rx &&
1752+ loc < (me->module_core_rx + me->core_size_rx));
1753+}
1754+
1755+static inline int in_core_rw(struct module *me, void *loc)
1756+{
1757+ return (loc >= me->module_core_rw &&
1758+ loc < (me->module_core_rw + me->core_size_rw));
1759 }
1760
1761 static inline int in_core(struct module *me, void *loc)
1762 {
1763- return (loc >= me->module_core &&
1764- loc <= (me->module_core + me->core_size));
1765+ return in_core_rx(me, loc) || in_core_rw(me, loc);
1766 }
1767
1768 static inline int in_local(struct module *me, void *loc)
1769@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
1770 }
1771
1772 /* align things a bit */
1773- me->core_size = ALIGN(me->core_size, 16);
1774- me->arch.got_offset = me->core_size;
1775- me->core_size += gots * sizeof(struct got_entry);
1776-
1777- me->core_size = ALIGN(me->core_size, 16);
1778- me->arch.fdesc_offset = me->core_size;
1779- me->core_size += fdescs * sizeof(Elf_Fdesc);
1780+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1781+ me->arch.got_offset = me->core_size_rw;
1782+ me->core_size_rw += gots * sizeof(struct got_entry);
1783+
1784+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
1785+ me->arch.fdesc_offset = me->core_size_rw;
1786+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1787
1788 me->arch.got_max = gots;
1789 me->arch.fdesc_max = fdescs;
1790@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module
1791
1792 BUG_ON(value == 0);
1793
1794- got = me->module_core + me->arch.got_offset;
1795+ got = me->module_core_rw + me->arch.got_offset;
1796 for (i = 0; got[i].addr; i++)
1797 if (got[i].addr == value)
1798 goto out;
1799@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module
1800 #ifdef CONFIG_64BIT
1801 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1802 {
1803- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1804+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1805
1806 if (!value) {
1807 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1808@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module
1809
1810 /* Create new one */
1811 fdesc->addr = value;
1812- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1813+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1814 return (Elf_Addr)fdesc;
1815 }
1816 #endif /* CONFIG_64BIT */
1817@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
1818
1819 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1820 end = table + sechdrs[me->arch.unwind_section].sh_size;
1821- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1822+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1823
1824 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1825 me->arch.unwind_section, table, end, gp);
1826diff -urNp linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c
1827--- linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c 2011-03-27 14:31:47.000000000 -0400
1828+++ linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c 2011-04-17 15:56:45.000000000 -0400
1829@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
1830 /* At this point: (!vma || addr < vma->vm_end). */
1831 if (TASK_SIZE - len < addr)
1832 return -ENOMEM;
1833- if (!vma || addr + len <= vma->vm_start)
1834+ if (check_heap_stack_gap(vma, addr, len))
1835 return addr;
1836 addr = vma->vm_end;
1837 }
1838@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
1839 /* At this point: (!vma || addr < vma->vm_end). */
1840 if (TASK_SIZE - len < addr)
1841 return -ENOMEM;
1842- if (!vma || addr + len <= vma->vm_start)
1843+ if (check_heap_stack_gap(vma, addr, len))
1844 return addr;
1845 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1846 if (addr < vma->vm_end) /* handle wraparound */
1847@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1848 if (flags & MAP_FIXED)
1849 return addr;
1850 if (!addr)
1851- addr = TASK_UNMAPPED_BASE;
1852+ addr = current->mm->mmap_base;
1853
1854 if (filp) {
1855 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1856diff -urNp linux-2.6.32.46/arch/parisc/kernel/traps.c linux-2.6.32.46/arch/parisc/kernel/traps.c
1857--- linux-2.6.32.46/arch/parisc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
1858+++ linux-2.6.32.46/arch/parisc/kernel/traps.c 2011-04-17 15:56:45.000000000 -0400
1859@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1860
1861 down_read(&current->mm->mmap_sem);
1862 vma = find_vma(current->mm,regs->iaoq[0]);
1863- if (vma && (regs->iaoq[0] >= vma->vm_start)
1864- && (vma->vm_flags & VM_EXEC)) {
1865-
1866+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1867 fault_address = regs->iaoq[0];
1868 fault_space = regs->iasq[0];
1869
1870diff -urNp linux-2.6.32.46/arch/parisc/mm/fault.c linux-2.6.32.46/arch/parisc/mm/fault.c
1871--- linux-2.6.32.46/arch/parisc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1872+++ linux-2.6.32.46/arch/parisc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1873@@ -15,6 +15,7 @@
1874 #include <linux/sched.h>
1875 #include <linux/interrupt.h>
1876 #include <linux/module.h>
1877+#include <linux/unistd.h>
1878
1879 #include <asm/uaccess.h>
1880 #include <asm/traps.h>
1881@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1882 static unsigned long
1883 parisc_acctyp(unsigned long code, unsigned int inst)
1884 {
1885- if (code == 6 || code == 16)
1886+ if (code == 6 || code == 7 || code == 16)
1887 return VM_EXEC;
1888
1889 switch (inst & 0xf0000000) {
1890@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1891 }
1892 #endif
1893
1894+#ifdef CONFIG_PAX_PAGEEXEC
1895+/*
1896+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1897+ *
1898+ * returns 1 when task should be killed
1899+ * 2 when rt_sigreturn trampoline was detected
1900+ * 3 when unpatched PLT trampoline was detected
1901+ */
1902+static int pax_handle_fetch_fault(struct pt_regs *regs)
1903+{
1904+
1905+#ifdef CONFIG_PAX_EMUPLT
1906+ int err;
1907+
1908+ do { /* PaX: unpatched PLT emulation */
1909+ unsigned int bl, depwi;
1910+
1911+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1912+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1913+
1914+ if (err)
1915+ break;
1916+
1917+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1918+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1919+
1920+ err = get_user(ldw, (unsigned int *)addr);
1921+ err |= get_user(bv, (unsigned int *)(addr+4));
1922+ err |= get_user(ldw2, (unsigned int *)(addr+8));
1923+
1924+ if (err)
1925+ break;
1926+
1927+ if (ldw == 0x0E801096U &&
1928+ bv == 0xEAC0C000U &&
1929+ ldw2 == 0x0E881095U)
1930+ {
1931+ unsigned int resolver, map;
1932+
1933+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1934+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1935+ if (err)
1936+ break;
1937+
1938+ regs->gr[20] = instruction_pointer(regs)+8;
1939+ regs->gr[21] = map;
1940+ regs->gr[22] = resolver;
1941+ regs->iaoq[0] = resolver | 3UL;
1942+ regs->iaoq[1] = regs->iaoq[0] + 4;
1943+ return 3;
1944+ }
1945+ }
1946+ } while (0);
1947+#endif
1948+
1949+#ifdef CONFIG_PAX_EMUTRAMP
1950+
1951+#ifndef CONFIG_PAX_EMUSIGRT
1952+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1953+ return 1;
1954+#endif
1955+
1956+ do { /* PaX: rt_sigreturn emulation */
1957+ unsigned int ldi1, ldi2, bel, nop;
1958+
1959+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1960+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1961+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1962+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1963+
1964+ if (err)
1965+ break;
1966+
1967+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1968+ ldi2 == 0x3414015AU &&
1969+ bel == 0xE4008200U &&
1970+ nop == 0x08000240U)
1971+ {
1972+ regs->gr[25] = (ldi1 & 2) >> 1;
1973+ regs->gr[20] = __NR_rt_sigreturn;
1974+ regs->gr[31] = regs->iaoq[1] + 16;
1975+ regs->sr[0] = regs->iasq[1];
1976+ regs->iaoq[0] = 0x100UL;
1977+ regs->iaoq[1] = regs->iaoq[0] + 4;
1978+ regs->iasq[0] = regs->sr[2];
1979+ regs->iasq[1] = regs->sr[2];
1980+ return 2;
1981+ }
1982+ } while (0);
1983+#endif
1984+
1985+ return 1;
1986+}
1987+
1988+void pax_report_insns(void *pc, void *sp)
1989+{
1990+ unsigned long i;
1991+
1992+ printk(KERN_ERR "PAX: bytes at PC: ");
1993+ for (i = 0; i < 5; i++) {
1994+ unsigned int c;
1995+ if (get_user(c, (unsigned int *)pc+i))
1996+ printk(KERN_CONT "???????? ");
1997+ else
1998+ printk(KERN_CONT "%08x ", c);
1999+ }
2000+ printk("\n");
2001+}
2002+#endif
2003+
2004 int fixup_exception(struct pt_regs *regs)
2005 {
2006 const struct exception_table_entry *fix;
2007@@ -192,8 +303,33 @@ good_area:
2008
2009 acc_type = parisc_acctyp(code,regs->iir);
2010
2011- if ((vma->vm_flags & acc_type) != acc_type)
2012+ if ((vma->vm_flags & acc_type) != acc_type) {
2013+
2014+#ifdef CONFIG_PAX_PAGEEXEC
2015+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2016+ (address & ~3UL) == instruction_pointer(regs))
2017+ {
2018+ up_read(&mm->mmap_sem);
2019+ switch (pax_handle_fetch_fault(regs)) {
2020+
2021+#ifdef CONFIG_PAX_EMUPLT
2022+ case 3:
2023+ return;
2024+#endif
2025+
2026+#ifdef CONFIG_PAX_EMUTRAMP
2027+ case 2:
2028+ return;
2029+#endif
2030+
2031+ }
2032+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2033+ do_group_exit(SIGKILL);
2034+ }
2035+#endif
2036+
2037 goto bad_area;
2038+ }
2039
2040 /*
2041 * If for any reason at all we couldn't handle the fault, make
2042diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/device.h linux-2.6.32.46/arch/powerpc/include/asm/device.h
2043--- linux-2.6.32.46/arch/powerpc/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
2044+++ linux-2.6.32.46/arch/powerpc/include/asm/device.h 2011-04-17 15:56:45.000000000 -0400
2045@@ -14,7 +14,7 @@ struct dev_archdata {
2046 struct device_node *of_node;
2047
2048 /* DMA operations on that device */
2049- struct dma_map_ops *dma_ops;
2050+ const struct dma_map_ops *dma_ops;
2051
2052 /*
2053 * When an iommu is in use, dma_data is used as a ptr to the base of the
2054diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h
2055--- linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
2056+++ linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
2057@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
2058 #ifdef CONFIG_PPC64
2059 extern struct dma_map_ops dma_iommu_ops;
2060 #endif
2061-extern struct dma_map_ops dma_direct_ops;
2062+extern const struct dma_map_ops dma_direct_ops;
2063
2064-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2065+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2066 {
2067 /* We don't handle the NULL dev case for ISA for now. We could
2068 * do it via an out of line call but it is not needed for now. The
2069@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
2070 return dev->archdata.dma_ops;
2071 }
2072
2073-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
2074+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
2075 {
2076 dev->archdata.dma_ops = ops;
2077 }
2078@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
2079
2080 static inline int dma_supported(struct device *dev, u64 mask)
2081 {
2082- struct dma_map_ops *dma_ops = get_dma_ops(dev);
2083+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2084
2085 if (unlikely(dma_ops == NULL))
2086 return 0;
2087@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
2088
2089 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
2090 {
2091- struct dma_map_ops *dma_ops = get_dma_ops(dev);
2092+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2093
2094 if (unlikely(dma_ops == NULL))
2095 return -EIO;
2096@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
2097 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
2098 dma_addr_t *dma_handle, gfp_t flag)
2099 {
2100- struct dma_map_ops *dma_ops = get_dma_ops(dev);
2101+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2102 void *cpu_addr;
2103
2104 BUG_ON(!dma_ops);
2105@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
2106 static inline void dma_free_coherent(struct device *dev, size_t size,
2107 void *cpu_addr, dma_addr_t dma_handle)
2108 {
2109- struct dma_map_ops *dma_ops = get_dma_ops(dev);
2110+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2111
2112 BUG_ON(!dma_ops);
2113
2114@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
2115
2116 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
2117 {
2118- struct dma_map_ops *dma_ops = get_dma_ops(dev);
2119+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2120
2121 if (dma_ops->mapping_error)
2122 return dma_ops->mapping_error(dev, dma_addr);
2123diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/elf.h linux-2.6.32.46/arch/powerpc/include/asm/elf.h
2124--- linux-2.6.32.46/arch/powerpc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
2125+++ linux-2.6.32.46/arch/powerpc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
2126@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
2127 the loader. We need to make sure that it is out of the way of the program
2128 that it will "exec", and that there is sufficient room for the brk. */
2129
2130-extern unsigned long randomize_et_dyn(unsigned long base);
2131-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2132+#define ELF_ET_DYN_BASE (0x20000000)
2133+
2134+#ifdef CONFIG_PAX_ASLR
2135+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2136+
2137+#ifdef __powerpc64__
2138+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2139+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2140+#else
2141+#define PAX_DELTA_MMAP_LEN 15
2142+#define PAX_DELTA_STACK_LEN 15
2143+#endif
2144+#endif
2145
2146 /*
2147 * Our registers are always unsigned longs, whether we're a 32 bit
2148@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
2149 (0x7ff >> (PAGE_SHIFT - 12)) : \
2150 (0x3ffff >> (PAGE_SHIFT - 12)))
2151
2152-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2153-#define arch_randomize_brk arch_randomize_brk
2154-
2155 #endif /* __KERNEL__ */
2156
2157 /*
2158diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/iommu.h linux-2.6.32.46/arch/powerpc/include/asm/iommu.h
2159--- linux-2.6.32.46/arch/powerpc/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
2160+++ linux-2.6.32.46/arch/powerpc/include/asm/iommu.h 2011-04-17 15:56:45.000000000 -0400
2161@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
2162 extern void iommu_init_early_dart(void);
2163 extern void iommu_init_early_pasemi(void);
2164
2165+/* dma-iommu.c */
2166+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
2167+
2168 #ifdef CONFIG_PCI
2169 extern void pci_iommu_init(void);
2170 extern void pci_direct_iommu_init(void);
2171diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h
2172--- linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
2173+++ linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
2174@@ -26,6 +26,7 @@ enum km_type {
2175 KM_SOFTIRQ1,
2176 KM_PPC_SYNC_PAGE,
2177 KM_PPC_SYNC_ICACHE,
2178+ KM_CLEARPAGE,
2179 KM_TYPE_NR
2180 };
2181
2182diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/page_64.h linux-2.6.32.46/arch/powerpc/include/asm/page_64.h
2183--- linux-2.6.32.46/arch/powerpc/include/asm/page_64.h 2011-03-27 14:31:47.000000000 -0400
2184+++ linux-2.6.32.46/arch/powerpc/include/asm/page_64.h 2011-04-17 15:56:45.000000000 -0400
2185@@ -180,15 +180,18 @@ do { \
2186 * stack by default, so in the absense of a PT_GNU_STACK program header
2187 * we turn execute permission off.
2188 */
2189-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2190- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2191+#define VM_STACK_DEFAULT_FLAGS32 \
2192+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2193+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2194
2195 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2196 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2197
2198+#ifndef CONFIG_PAX_PAGEEXEC
2199 #define VM_STACK_DEFAULT_FLAGS \
2200 (test_thread_flag(TIF_32BIT) ? \
2201 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2202+#endif
2203
2204 #include <asm-generic/getorder.h>
2205
2206diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/page.h linux-2.6.32.46/arch/powerpc/include/asm/page.h
2207--- linux-2.6.32.46/arch/powerpc/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
2208+++ linux-2.6.32.46/arch/powerpc/include/asm/page.h 2011-08-21 16:07:39.000000000 -0400
2209@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
2210 * and needs to be executable. This means the whole heap ends
2211 * up being executable.
2212 */
2213-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2214- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2215+#define VM_DATA_DEFAULT_FLAGS32 \
2216+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2217+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2218
2219 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2220 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2221@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
2222 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2223 #endif
2224
2225+#define ktla_ktva(addr) (addr)
2226+#define ktva_ktla(addr) (addr)
2227+
2228 #ifndef __ASSEMBLY__
2229
2230 #undef STRICT_MM_TYPECHECKS
2231diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pci.h linux-2.6.32.46/arch/powerpc/include/asm/pci.h
2232--- linux-2.6.32.46/arch/powerpc/include/asm/pci.h 2011-03-27 14:31:47.000000000 -0400
2233+++ linux-2.6.32.46/arch/powerpc/include/asm/pci.h 2011-04-17 15:56:45.000000000 -0400
2234@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
2235 }
2236
2237 #ifdef CONFIG_PCI
2238-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
2239-extern struct dma_map_ops *get_pci_dma_ops(void);
2240+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
2241+extern const struct dma_map_ops *get_pci_dma_ops(void);
2242 #else /* CONFIG_PCI */
2243 #define set_pci_dma_ops(d)
2244 #define get_pci_dma_ops() NULL
2245diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h
2246--- linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
2247+++ linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
2248@@ -2,6 +2,7 @@
2249 #define _ASM_POWERPC_PGTABLE_H
2250 #ifdef __KERNEL__
2251
2252+#include <linux/const.h>
2253 #ifndef __ASSEMBLY__
2254 #include <asm/processor.h> /* For TASK_SIZE */
2255 #include <asm/mmu.h>
2256diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h
2257--- linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h 2011-03-27 14:31:47.000000000 -0400
2258+++ linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h 2011-04-17 15:56:45.000000000 -0400
2259@@ -21,6 +21,7 @@
2260 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2261 #define _PAGE_USER 0x004 /* usermode access allowed */
2262 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2263+#define _PAGE_EXEC _PAGE_GUARDED
2264 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2265 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2266 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2267diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h
2268--- linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
2269+++ linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h 2011-08-21 15:53:58.000000000 -0400
2270@@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct p
2271 } while(0)
2272
2273 struct task_struct;
2274-extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
2275+extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
2276 extern int ptrace_put_reg(struct task_struct *task, int regno,
2277 unsigned long data);
2278
2279diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/reg.h linux-2.6.32.46/arch/powerpc/include/asm/reg.h
2280--- linux-2.6.32.46/arch/powerpc/include/asm/reg.h 2011-03-27 14:31:47.000000000 -0400
2281+++ linux-2.6.32.46/arch/powerpc/include/asm/reg.h 2011-04-17 15:56:45.000000000 -0400
2282@@ -191,6 +191,7 @@
2283 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2284 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2285 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2286+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2287 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2288 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2289 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2290diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h
2291--- linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h 2011-03-27 14:31:47.000000000 -0400
2292+++ linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h 2011-04-17 15:56:45.000000000 -0400
2293@@ -13,7 +13,7 @@
2294
2295 #include <linux/swiotlb.h>
2296
2297-extern struct dma_map_ops swiotlb_dma_ops;
2298+extern const struct dma_map_ops swiotlb_dma_ops;
2299
2300 static inline void dma_mark_clean(void *addr, size_t size) {}
2301
2302diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/system.h linux-2.6.32.46/arch/powerpc/include/asm/system.h
2303--- linux-2.6.32.46/arch/powerpc/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
2304+++ linux-2.6.32.46/arch/powerpc/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
2305@@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
2306 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2307 #endif
2308
2309-extern unsigned long arch_align_stack(unsigned long sp);
2310+#define arch_align_stack(x) ((x) & ~0xfUL)
2311
2312 /* Used in very early kernel initialization. */
2313 extern unsigned long reloc_offset(void);
2314diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h
2315--- linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
2316+++ linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
2317@@ -13,6 +13,8 @@
2318 #define VERIFY_READ 0
2319 #define VERIFY_WRITE 1
2320
2321+extern void check_object_size(const void *ptr, unsigned long n, bool to);
2322+
2323 /*
2324 * The fs value determines whether argument validity checking should be
2325 * performed or not. If get_fs() == USER_DS, checking is performed, with
2326@@ -327,52 +329,6 @@ do { \
2327 extern unsigned long __copy_tofrom_user(void __user *to,
2328 const void __user *from, unsigned long size);
2329
2330-#ifndef __powerpc64__
2331-
2332-static inline unsigned long copy_from_user(void *to,
2333- const void __user *from, unsigned long n)
2334-{
2335- unsigned long over;
2336-
2337- if (access_ok(VERIFY_READ, from, n))
2338- return __copy_tofrom_user((__force void __user *)to, from, n);
2339- if ((unsigned long)from < TASK_SIZE) {
2340- over = (unsigned long)from + n - TASK_SIZE;
2341- return __copy_tofrom_user((__force void __user *)to, from,
2342- n - over) + over;
2343- }
2344- return n;
2345-}
2346-
2347-static inline unsigned long copy_to_user(void __user *to,
2348- const void *from, unsigned long n)
2349-{
2350- unsigned long over;
2351-
2352- if (access_ok(VERIFY_WRITE, to, n))
2353- return __copy_tofrom_user(to, (__force void __user *)from, n);
2354- if ((unsigned long)to < TASK_SIZE) {
2355- over = (unsigned long)to + n - TASK_SIZE;
2356- return __copy_tofrom_user(to, (__force void __user *)from,
2357- n - over) + over;
2358- }
2359- return n;
2360-}
2361-
2362-#else /* __powerpc64__ */
2363-
2364-#define __copy_in_user(to, from, size) \
2365- __copy_tofrom_user((to), (from), (size))
2366-
2367-extern unsigned long copy_from_user(void *to, const void __user *from,
2368- unsigned long n);
2369-extern unsigned long copy_to_user(void __user *to, const void *from,
2370- unsigned long n);
2371-extern unsigned long copy_in_user(void __user *to, const void __user *from,
2372- unsigned long n);
2373-
2374-#endif /* __powerpc64__ */
2375-
2376 static inline unsigned long __copy_from_user_inatomic(void *to,
2377 const void __user *from, unsigned long n)
2378 {
2379@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
2380 if (ret == 0)
2381 return 0;
2382 }
2383+
2384+ if (!__builtin_constant_p(n))
2385+ check_object_size(to, n, false);
2386+
2387 return __copy_tofrom_user((__force void __user *)to, from, n);
2388 }
2389
2390@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
2391 if (ret == 0)
2392 return 0;
2393 }
2394+
2395+ if (!__builtin_constant_p(n))
2396+ check_object_size(from, n, true);
2397+
2398 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2399 }
2400
2401@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
2402 return __copy_to_user_inatomic(to, from, size);
2403 }
2404
2405+#ifndef __powerpc64__
2406+
2407+static inline unsigned long __must_check copy_from_user(void *to,
2408+ const void __user *from, unsigned long n)
2409+{
2410+ unsigned long over;
2411+
2412+ if ((long)n < 0)
2413+ return n;
2414+
2415+ if (access_ok(VERIFY_READ, from, n)) {
2416+ if (!__builtin_constant_p(n))
2417+ check_object_size(to, n, false);
2418+ return __copy_tofrom_user((__force void __user *)to, from, n);
2419+ }
2420+ if ((unsigned long)from < TASK_SIZE) {
2421+ over = (unsigned long)from + n - TASK_SIZE;
2422+ if (!__builtin_constant_p(n - over))
2423+ check_object_size(to, n - over, false);
2424+ return __copy_tofrom_user((__force void __user *)to, from,
2425+ n - over) + over;
2426+ }
2427+ return n;
2428+}
2429+
2430+static inline unsigned long __must_check copy_to_user(void __user *to,
2431+ const void *from, unsigned long n)
2432+{
2433+ unsigned long over;
2434+
2435+ if ((long)n < 0)
2436+ return n;
2437+
2438+ if (access_ok(VERIFY_WRITE, to, n)) {
2439+ if (!__builtin_constant_p(n))
2440+ check_object_size(from, n, true);
2441+ return __copy_tofrom_user(to, (__force void __user *)from, n);
2442+ }
2443+ if ((unsigned long)to < TASK_SIZE) {
2444+ over = (unsigned long)to + n - TASK_SIZE;
2445+ if (!__builtin_constant_p(n))
2446+ check_object_size(from, n - over, true);
2447+ return __copy_tofrom_user(to, (__force void __user *)from,
2448+ n - over) + over;
2449+ }
2450+ return n;
2451+}
2452+
2453+#else /* __powerpc64__ */
2454+
2455+#define __copy_in_user(to, from, size) \
2456+ __copy_tofrom_user((to), (from), (size))
2457+
2458+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2459+{
2460+ if ((long)n < 0 || n > INT_MAX)
2461+ return n;
2462+
2463+ if (!__builtin_constant_p(n))
2464+ check_object_size(to, n, false);
2465+
2466+ if (likely(access_ok(VERIFY_READ, from, n)))
2467+ n = __copy_from_user(to, from, n);
2468+ else
2469+ memset(to, 0, n);
2470+ return n;
2471+}
2472+
2473+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2474+{
2475+ if ((long)n < 0 || n > INT_MAX)
2476+ return n;
2477+
2478+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
2479+ if (!__builtin_constant_p(n))
2480+ check_object_size(from, n, true);
2481+ n = __copy_to_user(to, from, n);
2482+ }
2483+ return n;
2484+}
2485+
2486+extern unsigned long copy_in_user(void __user *to, const void __user *from,
2487+ unsigned long n);
2488+
2489+#endif /* __powerpc64__ */
2490+
2491 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2492
2493 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2494diff -urNp linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c
2495--- linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
2496+++ linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c 2011-04-17 15:56:45.000000000 -0400
2497@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
2498 &cache_assoc_attr,
2499 };
2500
2501-static struct sysfs_ops cache_index_ops = {
2502+static const struct sysfs_ops cache_index_ops = {
2503 .show = cache_index_show,
2504 };
2505
2506diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma.c linux-2.6.32.46/arch/powerpc/kernel/dma.c
2507--- linux-2.6.32.46/arch/powerpc/kernel/dma.c 2011-03-27 14:31:47.000000000 -0400
2508+++ linux-2.6.32.46/arch/powerpc/kernel/dma.c 2011-04-17 15:56:45.000000000 -0400
2509@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
2510 }
2511 #endif
2512
2513-struct dma_map_ops dma_direct_ops = {
2514+const struct dma_map_ops dma_direct_ops = {
2515 .alloc_coherent = dma_direct_alloc_coherent,
2516 .free_coherent = dma_direct_free_coherent,
2517 .map_sg = dma_direct_map_sg,
2518diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c
2519--- linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c 2011-03-27 14:31:47.000000000 -0400
2520+++ linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c 2011-04-17 15:56:45.000000000 -0400
2521@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
2522 }
2523
2524 /* We support DMA to/from any memory page via the iommu */
2525-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
2526+int dma_iommu_dma_supported(struct device *dev, u64 mask)
2527 {
2528 struct iommu_table *tbl = get_iommu_table_base(dev);
2529
2530diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c
2531--- linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
2532+++ linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
2533@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
2534 * map_page, and unmap_page on highmem, use normal dma_ops
2535 * for everything else.
2536 */
2537-struct dma_map_ops swiotlb_dma_ops = {
2538+const struct dma_map_ops swiotlb_dma_ops = {
2539 .alloc_coherent = dma_direct_alloc_coherent,
2540 .free_coherent = dma_direct_free_coherent,
2541 .map_sg = swiotlb_map_sg_attrs,
2542diff -urNp linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S
2543--- linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S 2011-03-27 14:31:47.000000000 -0400
2544+++ linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S 2011-04-17 15:56:45.000000000 -0400
2545@@ -455,6 +455,7 @@ storage_fault_common:
2546 std r14,_DAR(r1)
2547 std r15,_DSISR(r1)
2548 addi r3,r1,STACK_FRAME_OVERHEAD
2549+ bl .save_nvgprs
2550 mr r4,r14
2551 mr r5,r15
2552 ld r14,PACA_EXGEN+EX_R14(r13)
2553@@ -464,8 +465,7 @@ storage_fault_common:
2554 cmpdi r3,0
2555 bne- 1f
2556 b .ret_from_except_lite
2557-1: bl .save_nvgprs
2558- mr r5,r3
2559+1: mr r5,r3
2560 addi r3,r1,STACK_FRAME_OVERHEAD
2561 ld r4,_DAR(r1)
2562 bl .bad_page_fault
2563diff -urNp linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S
2564--- linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S 2011-03-27 14:31:47.000000000 -0400
2565+++ linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S 2011-04-17 15:56:45.000000000 -0400
2566@@ -818,10 +818,10 @@ handle_page_fault:
2567 11: ld r4,_DAR(r1)
2568 ld r5,_DSISR(r1)
2569 addi r3,r1,STACK_FRAME_OVERHEAD
2570+ bl .save_nvgprs
2571 bl .do_page_fault
2572 cmpdi r3,0
2573 beq+ 13f
2574- bl .save_nvgprs
2575 mr r5,r3
2576 addi r3,r1,STACK_FRAME_OVERHEAD
2577 lwz r4,_DAR(r1)
2578diff -urNp linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c
2579--- linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c 2011-03-27 14:31:47.000000000 -0400
2580+++ linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c 2011-04-17 15:56:45.000000000 -0400
2581@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
2582 return 1;
2583 }
2584
2585-static struct dma_map_ops ibmebus_dma_ops = {
2586+static const struct dma_map_ops ibmebus_dma_ops = {
2587 .alloc_coherent = ibmebus_alloc_coherent,
2588 .free_coherent = ibmebus_free_coherent,
2589 .map_sg = ibmebus_map_sg,
2590diff -urNp linux-2.6.32.46/arch/powerpc/kernel/kgdb.c linux-2.6.32.46/arch/powerpc/kernel/kgdb.c
2591--- linux-2.6.32.46/arch/powerpc/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
2592+++ linux-2.6.32.46/arch/powerpc/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
2593@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
2594 if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
2595 return 0;
2596
2597- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2598+ if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2599 regs->nip += 4;
2600
2601 return 1;
2602@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
2603 /*
2604 * Global data
2605 */
2606-struct kgdb_arch arch_kgdb_ops = {
2607+const struct kgdb_arch arch_kgdb_ops = {
2608 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
2609 };
2610
2611diff -urNp linux-2.6.32.46/arch/powerpc/kernel/module_32.c linux-2.6.32.46/arch/powerpc/kernel/module_32.c
2612--- linux-2.6.32.46/arch/powerpc/kernel/module_32.c 2011-03-27 14:31:47.000000000 -0400
2613+++ linux-2.6.32.46/arch/powerpc/kernel/module_32.c 2011-04-17 15:56:45.000000000 -0400
2614@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2615 me->arch.core_plt_section = i;
2616 }
2617 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2618- printk("Module doesn't contain .plt or .init.plt sections.\n");
2619+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2620 return -ENOEXEC;
2621 }
2622
2623@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2624
2625 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2626 /* Init, or core PLT? */
2627- if (location >= mod->module_core
2628- && location < mod->module_core + mod->core_size)
2629+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2630+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2631 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2632- else
2633+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2634+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2635 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2636+ else {
2637+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2638+ return ~0UL;
2639+ }
2640
2641 /* Find this entry, or if that fails, the next avail. entry */
2642 while (entry->jump[0]) {
2643diff -urNp linux-2.6.32.46/arch/powerpc/kernel/module.c linux-2.6.32.46/arch/powerpc/kernel/module.c
2644--- linux-2.6.32.46/arch/powerpc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
2645+++ linux-2.6.32.46/arch/powerpc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
2646@@ -31,11 +31,24 @@
2647
2648 LIST_HEAD(module_bug_list);
2649
2650+#ifdef CONFIG_PAX_KERNEXEC
2651 void *module_alloc(unsigned long size)
2652 {
2653 if (size == 0)
2654 return NULL;
2655
2656+ return vmalloc(size);
2657+}
2658+
2659+void *module_alloc_exec(unsigned long size)
2660+#else
2661+void *module_alloc(unsigned long size)
2662+#endif
2663+
2664+{
2665+ if (size == 0)
2666+ return NULL;
2667+
2668 return vmalloc_exec(size);
2669 }
2670
2671@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2672 vfree(module_region);
2673 }
2674
2675+#ifdef CONFIG_PAX_KERNEXEC
2676+void module_free_exec(struct module *mod, void *module_region)
2677+{
2678+ module_free(mod, module_region);
2679+}
2680+#endif
2681+
2682 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2683 const Elf_Shdr *sechdrs,
2684 const char *name)
2685diff -urNp linux-2.6.32.46/arch/powerpc/kernel/pci-common.c linux-2.6.32.46/arch/powerpc/kernel/pci-common.c
2686--- linux-2.6.32.46/arch/powerpc/kernel/pci-common.c 2011-03-27 14:31:47.000000000 -0400
2687+++ linux-2.6.32.46/arch/powerpc/kernel/pci-common.c 2011-04-17 15:56:45.000000000 -0400
2688@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
2689 unsigned int ppc_pci_flags = 0;
2690
2691
2692-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2693+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2694
2695-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
2696+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
2697 {
2698 pci_dma_ops = dma_ops;
2699 }
2700
2701-struct dma_map_ops *get_pci_dma_ops(void)
2702+const struct dma_map_ops *get_pci_dma_ops(void)
2703 {
2704 return pci_dma_ops;
2705 }
2706diff -urNp linux-2.6.32.46/arch/powerpc/kernel/process.c linux-2.6.32.46/arch/powerpc/kernel/process.c
2707--- linux-2.6.32.46/arch/powerpc/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
2708+++ linux-2.6.32.46/arch/powerpc/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
2709@@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
2710 * Lookup NIP late so we have the best change of getting the
2711 * above info out without failing
2712 */
2713- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2714- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2715+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2716+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2717 #endif
2718 show_stack(current, (unsigned long *) regs->gpr[1]);
2719 if (!user_mode(regs))
2720@@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk,
2721 newsp = stack[0];
2722 ip = stack[STACK_FRAME_LR_SAVE];
2723 if (!firstframe || ip != lr) {
2724- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2725+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2726 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2727 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2728- printk(" (%pS)",
2729+ printk(" (%pA)",
2730 (void *)current->ret_stack[curr_frame].ret);
2731 curr_frame--;
2732 }
2733@@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk,
2734 struct pt_regs *regs = (struct pt_regs *)
2735 (sp + STACK_FRAME_OVERHEAD);
2736 lr = regs->link;
2737- printk("--- Exception: %lx at %pS\n LR = %pS\n",
2738+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
2739 regs->trap, (void *)regs->nip, (void *)lr);
2740 firstframe = 1;
2741 }
2742@@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
2743 }
2744
2745 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2746-
2747-unsigned long arch_align_stack(unsigned long sp)
2748-{
2749- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2750- sp -= get_random_int() & ~PAGE_MASK;
2751- return sp & ~0xf;
2752-}
2753-
2754-static inline unsigned long brk_rnd(void)
2755-{
2756- unsigned long rnd = 0;
2757-
2758- /* 8MB for 32bit, 1GB for 64bit */
2759- if (is_32bit_task())
2760- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2761- else
2762- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2763-
2764- return rnd << PAGE_SHIFT;
2765-}
2766-
2767-unsigned long arch_randomize_brk(struct mm_struct *mm)
2768-{
2769- unsigned long base = mm->brk;
2770- unsigned long ret;
2771-
2772-#ifdef CONFIG_PPC_STD_MMU_64
2773- /*
2774- * If we are using 1TB segments and we are allowed to randomise
2775- * the heap, we can put it above 1TB so it is backed by a 1TB
2776- * segment. Otherwise the heap will be in the bottom 1TB
2777- * which always uses 256MB segments and this may result in a
2778- * performance penalty.
2779- */
2780- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2781- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2782-#endif
2783-
2784- ret = PAGE_ALIGN(base + brk_rnd());
2785-
2786- if (ret < mm->brk)
2787- return mm->brk;
2788-
2789- return ret;
2790-}
2791-
2792-unsigned long randomize_et_dyn(unsigned long base)
2793-{
2794- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2795-
2796- if (ret < base)
2797- return base;
2798-
2799- return ret;
2800-}
2801diff -urNp linux-2.6.32.46/arch/powerpc/kernel/ptrace.c linux-2.6.32.46/arch/powerpc/kernel/ptrace.c
2802--- linux-2.6.32.46/arch/powerpc/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
2803+++ linux-2.6.32.46/arch/powerpc/kernel/ptrace.c 2011-08-21 15:53:39.000000000 -0400
2804@@ -86,7 +86,7 @@ static int set_user_trap(struct task_str
2805 /*
2806 * Get contents of register REGNO in task TASK.
2807 */
2808-unsigned long ptrace_get_reg(struct task_struct *task, int regno)
2809+unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
2810 {
2811 if (task->thread.regs == NULL)
2812 return -EIO;
2813@@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *chi
2814
2815 CHECK_FULL_REGS(child->thread.regs);
2816 if (index < PT_FPR0) {
2817- tmp = ptrace_get_reg(child, (int) index);
2818+ tmp = ptrace_get_reg(child, index);
2819 } else {
2820 flush_fp_to_thread(child);
2821 tmp = ((unsigned long *)child->thread.fpr)
2822diff -urNp linux-2.6.32.46/arch/powerpc/kernel/signal_32.c linux-2.6.32.46/arch/powerpc/kernel/signal_32.c
2823--- linux-2.6.32.46/arch/powerpc/kernel/signal_32.c 2011-03-27 14:31:47.000000000 -0400
2824+++ linux-2.6.32.46/arch/powerpc/kernel/signal_32.c 2011-04-17 15:56:45.000000000 -0400
2825@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
2826 /* Save user registers on the stack */
2827 frame = &rt_sf->uc.uc_mcontext;
2828 addr = frame;
2829- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2830+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2831 if (save_user_regs(regs, frame, 0, 1))
2832 goto badframe;
2833 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2834diff -urNp linux-2.6.32.46/arch/powerpc/kernel/signal_64.c linux-2.6.32.46/arch/powerpc/kernel/signal_64.c
2835--- linux-2.6.32.46/arch/powerpc/kernel/signal_64.c 2011-03-27 14:31:47.000000000 -0400
2836+++ linux-2.6.32.46/arch/powerpc/kernel/signal_64.c 2011-04-17 15:56:45.000000000 -0400
2837@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
2838 current->thread.fpscr.val = 0;
2839
2840 /* Set up to return from userspace. */
2841- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2842+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2843 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2844 } else {
2845 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2846diff -urNp linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c
2847--- linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c 2011-03-27 14:31:47.000000000 -0400
2848+++ linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c 2011-04-17 15:56:45.000000000 -0400
2849@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
2850 if (oldlenp) {
2851 if (!error) {
2852 if (get_user(oldlen, oldlenp) ||
2853- put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
2854+ put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
2855+ copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
2856 error = -EFAULT;
2857 }
2858- copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
2859 }
2860 return error;
2861 }
2862diff -urNp linux-2.6.32.46/arch/powerpc/kernel/traps.c linux-2.6.32.46/arch/powerpc/kernel/traps.c
2863--- linux-2.6.32.46/arch/powerpc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
2864+++ linux-2.6.32.46/arch/powerpc/kernel/traps.c 2011-06-13 21:33:37.000000000 -0400
2865@@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
2866 static inline void pmac_backlight_unblank(void) { }
2867 #endif
2868
2869+extern void gr_handle_kernel_exploit(void);
2870+
2871 int die(const char *str, struct pt_regs *regs, long err)
2872 {
2873 static struct {
2874@@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs
2875 if (panic_on_oops)
2876 panic("Fatal exception");
2877
2878+ gr_handle_kernel_exploit();
2879+
2880 oops_exit();
2881 do_exit(err);
2882
2883diff -urNp linux-2.6.32.46/arch/powerpc/kernel/vdso.c linux-2.6.32.46/arch/powerpc/kernel/vdso.c
2884--- linux-2.6.32.46/arch/powerpc/kernel/vdso.c 2011-03-27 14:31:47.000000000 -0400
2885+++ linux-2.6.32.46/arch/powerpc/kernel/vdso.c 2011-04-17 15:56:45.000000000 -0400
2886@@ -36,6 +36,7 @@
2887 #include <asm/firmware.h>
2888 #include <asm/vdso.h>
2889 #include <asm/vdso_datapage.h>
2890+#include <asm/mman.h>
2891
2892 #include "setup.h"
2893
2894@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2895 vdso_base = VDSO32_MBASE;
2896 #endif
2897
2898- current->mm->context.vdso_base = 0;
2899+ current->mm->context.vdso_base = ~0UL;
2900
2901 /* vDSO has a problem and was disabled, just don't "enable" it for the
2902 * process
2903@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2904 vdso_base = get_unmapped_area(NULL, vdso_base,
2905 (vdso_pages << PAGE_SHIFT) +
2906 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2907- 0, 0);
2908+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
2909 if (IS_ERR_VALUE(vdso_base)) {
2910 rc = vdso_base;
2911 goto fail_mmapsem;
2912diff -urNp linux-2.6.32.46/arch/powerpc/kernel/vio.c linux-2.6.32.46/arch/powerpc/kernel/vio.c
2913--- linux-2.6.32.46/arch/powerpc/kernel/vio.c 2011-03-27 14:31:47.000000000 -0400
2914+++ linux-2.6.32.46/arch/powerpc/kernel/vio.c 2011-04-17 15:56:45.000000000 -0400
2915@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
2916 vio_cmo_dealloc(viodev, alloc_size);
2917 }
2918
2919-struct dma_map_ops vio_dma_mapping_ops = {
2920+static const struct dma_map_ops vio_dma_mapping_ops = {
2921 .alloc_coherent = vio_dma_iommu_alloc_coherent,
2922 .free_coherent = vio_dma_iommu_free_coherent,
2923 .map_sg = vio_dma_iommu_map_sg,
2924 .unmap_sg = vio_dma_iommu_unmap_sg,
2925+ .dma_supported = dma_iommu_dma_supported,
2926 .map_page = vio_dma_iommu_map_page,
2927 .unmap_page = vio_dma_iommu_unmap_page,
2928
2929@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
2930
2931 static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
2932 {
2933- vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
2934 viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
2935 }
2936
2937diff -urNp linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c
2938--- linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
2939+++ linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c 2011-04-17 15:56:45.000000000 -0400
2940@@ -9,22 +9,6 @@
2941 #include <linux/module.h>
2942 #include <asm/uaccess.h>
2943
2944-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2945-{
2946- if (likely(access_ok(VERIFY_READ, from, n)))
2947- n = __copy_from_user(to, from, n);
2948- else
2949- memset(to, 0, n);
2950- return n;
2951-}
2952-
2953-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2954-{
2955- if (likely(access_ok(VERIFY_WRITE, to, n)))
2956- n = __copy_to_user(to, from, n);
2957- return n;
2958-}
2959-
2960 unsigned long copy_in_user(void __user *to, const void __user *from,
2961 unsigned long n)
2962 {
2963@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2964 return n;
2965 }
2966
2967-EXPORT_SYMBOL(copy_from_user);
2968-EXPORT_SYMBOL(copy_to_user);
2969 EXPORT_SYMBOL(copy_in_user);
2970
2971diff -urNp linux-2.6.32.46/arch/powerpc/Makefile linux-2.6.32.46/arch/powerpc/Makefile
2972--- linux-2.6.32.46/arch/powerpc/Makefile 2011-03-27 14:31:47.000000000 -0400
2973+++ linux-2.6.32.46/arch/powerpc/Makefile 2011-08-21 19:27:08.000000000 -0400
2974@@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
2975 KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
2976 CPP = $(CC) -E $(KBUILD_CFLAGS)
2977
2978+cflags-y += -Wno-sign-compare -Wno-extra
2979+
2980 CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
2981
2982 ifeq ($(CONFIG_PPC64),y)
2983diff -urNp linux-2.6.32.46/arch/powerpc/mm/fault.c linux-2.6.32.46/arch/powerpc/mm/fault.c
2984--- linux-2.6.32.46/arch/powerpc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
2985+++ linux-2.6.32.46/arch/powerpc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
2986@@ -30,6 +30,10 @@
2987 #include <linux/kprobes.h>
2988 #include <linux/kdebug.h>
2989 #include <linux/perf_event.h>
2990+#include <linux/slab.h>
2991+#include <linux/pagemap.h>
2992+#include <linux/compiler.h>
2993+#include <linux/unistd.h>
2994
2995 #include <asm/firmware.h>
2996 #include <asm/page.h>
2997@@ -40,6 +44,7 @@
2998 #include <asm/uaccess.h>
2999 #include <asm/tlbflush.h>
3000 #include <asm/siginfo.h>
3001+#include <asm/ptrace.h>
3002
3003
3004 #ifdef CONFIG_KPROBES
3005@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
3006 }
3007 #endif
3008
3009+#ifdef CONFIG_PAX_PAGEEXEC
3010+/*
3011+ * PaX: decide what to do with offenders (regs->nip = fault address)
3012+ *
3013+ * returns 1 when task should be killed
3014+ */
3015+static int pax_handle_fetch_fault(struct pt_regs *regs)
3016+{
3017+ return 1;
3018+}
3019+
3020+void pax_report_insns(void *pc, void *sp)
3021+{
3022+ unsigned long i;
3023+
3024+ printk(KERN_ERR "PAX: bytes at PC: ");
3025+ for (i = 0; i < 5; i++) {
3026+ unsigned int c;
3027+ if (get_user(c, (unsigned int __user *)pc+i))
3028+ printk(KERN_CONT "???????? ");
3029+ else
3030+ printk(KERN_CONT "%08x ", c);
3031+ }
3032+ printk("\n");
3033+}
3034+#endif
3035+
3036 /*
3037 * Check whether the instruction at regs->nip is a store using
3038 * an update addressing form which will update r1.
3039@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
3040 * indicate errors in DSISR but can validly be set in SRR1.
3041 */
3042 if (trap == 0x400)
3043- error_code &= 0x48200000;
3044+ error_code &= 0x58200000;
3045 else
3046 is_write = error_code & DSISR_ISSTORE;
3047 #else
3048@@ -250,7 +282,7 @@ good_area:
3049 * "undefined". Of those that can be set, this is the only
3050 * one which seems bad.
3051 */
3052- if (error_code & 0x10000000)
3053+ if (error_code & DSISR_GUARDED)
3054 /* Guarded storage error. */
3055 goto bad_area;
3056 #endif /* CONFIG_8xx */
3057@@ -265,7 +297,7 @@ good_area:
3058 * processors use the same I/D cache coherency mechanism
3059 * as embedded.
3060 */
3061- if (error_code & DSISR_PROTFAULT)
3062+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
3063 goto bad_area;
3064 #endif /* CONFIG_PPC_STD_MMU */
3065
3066@@ -335,6 +367,23 @@ bad_area:
3067 bad_area_nosemaphore:
3068 /* User mode accesses cause a SIGSEGV */
3069 if (user_mode(regs)) {
3070+
3071+#ifdef CONFIG_PAX_PAGEEXEC
3072+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
3073+#ifdef CONFIG_PPC_STD_MMU
3074+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
3075+#else
3076+ if (is_exec && regs->nip == address) {
3077+#endif
3078+ switch (pax_handle_fetch_fault(regs)) {
3079+ }
3080+
3081+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
3082+ do_group_exit(SIGKILL);
3083+ }
3084+ }
3085+#endif
3086+
3087 _exception(SIGSEGV, regs, code, address);
3088 return 0;
3089 }
3090diff -urNp linux-2.6.32.46/arch/powerpc/mm/mem.c linux-2.6.32.46/arch/powerpc/mm/mem.c
3091--- linux-2.6.32.46/arch/powerpc/mm/mem.c 2011-03-27 14:31:47.000000000 -0400
3092+++ linux-2.6.32.46/arch/powerpc/mm/mem.c 2011-08-21 15:50:39.000000000 -0400
3093@@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(voi
3094 {
3095 unsigned long lmb_next_region_start_pfn,
3096 lmb_region_max_pfn;
3097- int i;
3098+ unsigned int i;
3099
3100 for (i = 0; i < lmb.memory.cnt - 1; i++) {
3101 lmb_region_max_pfn =
3102diff -urNp linux-2.6.32.46/arch/powerpc/mm/mmap_64.c linux-2.6.32.46/arch/powerpc/mm/mmap_64.c
3103--- linux-2.6.32.46/arch/powerpc/mm/mmap_64.c 2011-03-27 14:31:47.000000000 -0400
3104+++ linux-2.6.32.46/arch/powerpc/mm/mmap_64.c 2011-04-17 15:56:45.000000000 -0400
3105@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
3106 */
3107 if (mmap_is_legacy()) {
3108 mm->mmap_base = TASK_UNMAPPED_BASE;
3109+
3110+#ifdef CONFIG_PAX_RANDMMAP
3111+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3112+ mm->mmap_base += mm->delta_mmap;
3113+#endif
3114+
3115 mm->get_unmapped_area = arch_get_unmapped_area;
3116 mm->unmap_area = arch_unmap_area;
3117 } else {
3118 mm->mmap_base = mmap_base();
3119+
3120+#ifdef CONFIG_PAX_RANDMMAP
3121+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3122+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3123+#endif
3124+
3125 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3126 mm->unmap_area = arch_unmap_area_topdown;
3127 }
3128diff -urNp linux-2.6.32.46/arch/powerpc/mm/slice.c linux-2.6.32.46/arch/powerpc/mm/slice.c
3129--- linux-2.6.32.46/arch/powerpc/mm/slice.c 2011-03-27 14:31:47.000000000 -0400
3130+++ linux-2.6.32.46/arch/powerpc/mm/slice.c 2011-04-17 15:56:45.000000000 -0400
3131@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
3132 if ((mm->task_size - len) < addr)
3133 return 0;
3134 vma = find_vma(mm, addr);
3135- return (!vma || (addr + len) <= vma->vm_start);
3136+ return check_heap_stack_gap(vma, addr, len);
3137 }
3138
3139 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
3140@@ -256,7 +256,7 @@ full_search:
3141 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
3142 continue;
3143 }
3144- if (!vma || addr + len <= vma->vm_start) {
3145+ if (check_heap_stack_gap(vma, addr, len)) {
3146 /*
3147 * Remember the place where we stopped the search:
3148 */
3149@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
3150 }
3151 }
3152
3153- addr = mm->mmap_base;
3154- while (addr > len) {
3155+ if (mm->mmap_base < len)
3156+ addr = -ENOMEM;
3157+ else
3158+ addr = mm->mmap_base - len;
3159+
3160+ while (!IS_ERR_VALUE(addr)) {
3161 /* Go down by chunk size */
3162- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
3163+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
3164
3165 /* Check for hit with different page size */
3166 mask = slice_range_to_mask(addr, len);
3167@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
3168 * return with success:
3169 */
3170 vma = find_vma(mm, addr);
3171- if (!vma || (addr + len) <= vma->vm_start) {
3172+ if (check_heap_stack_gap(vma, addr, len)) {
3173 /* remember the address as a hint for next time */
3174 if (use_cache)
3175 mm->free_area_cache = addr;
3176@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
3177 mm->cached_hole_size = vma->vm_start - addr;
3178
3179 /* try just below the current vma->vm_start */
3180- addr = vma->vm_start;
3181+ addr = skip_heap_stack_gap(vma, len);
3182 }
3183
3184 /*
3185@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
3186 if (fixed && addr > (mm->task_size - len))
3187 return -EINVAL;
3188
3189+#ifdef CONFIG_PAX_RANDMMAP
3190+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
3191+ addr = 0;
3192+#endif
3193+
3194 /* If hint, make sure it matches our alignment restrictions */
3195 if (!fixed && addr) {
3196 addr = _ALIGN_UP(addr, 1ul << pshift);
3197diff -urNp linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c
3198--- linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-03-27 14:31:47.000000000 -0400
3199+++ linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-04-17 15:56:45.000000000 -0400
3200@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
3201 lite5200_pm_target_state = PM_SUSPEND_ON;
3202 }
3203
3204-static struct platform_suspend_ops lite5200_pm_ops = {
3205+static const struct platform_suspend_ops lite5200_pm_ops = {
3206 .valid = lite5200_pm_valid,
3207 .begin = lite5200_pm_begin,
3208 .prepare = lite5200_pm_prepare,
3209diff -urNp linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c
3210--- linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-03-27 14:31:47.000000000 -0400
3211+++ linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-04-17 15:56:45.000000000 -0400
3212@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
3213 iounmap(mbar);
3214 }
3215
3216-static struct platform_suspend_ops mpc52xx_pm_ops = {
3217+static const struct platform_suspend_ops mpc52xx_pm_ops = {
3218 .valid = mpc52xx_pm_valid,
3219 .prepare = mpc52xx_pm_prepare,
3220 .enter = mpc52xx_pm_enter,
3221diff -urNp linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c
3222--- linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c 2011-03-27 14:31:47.000000000 -0400
3223+++ linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c 2011-04-17 15:56:45.000000000 -0400
3224@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
3225 return ret;
3226 }
3227
3228-static struct platform_suspend_ops mpc83xx_suspend_ops = {
3229+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
3230 .valid = mpc83xx_suspend_valid,
3231 .begin = mpc83xx_suspend_begin,
3232 .enter = mpc83xx_suspend_enter,
3233diff -urNp linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c
3234--- linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c 2011-03-27 14:31:47.000000000 -0400
3235+++ linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c 2011-04-17 15:56:45.000000000 -0400
3236@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
3237
3238 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
3239
3240-struct dma_map_ops dma_iommu_fixed_ops = {
3241+const struct dma_map_ops dma_iommu_fixed_ops = {
3242 .alloc_coherent = dma_fixed_alloc_coherent,
3243 .free_coherent = dma_fixed_free_coherent,
3244 .map_sg = dma_fixed_map_sg,
3245diff -urNp linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c
3246--- linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c 2011-03-27 14:31:47.000000000 -0400
3247+++ linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c 2011-04-17 15:56:45.000000000 -0400
3248@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
3249 return mask >= DMA_BIT_MASK(32);
3250 }
3251
3252-static struct dma_map_ops ps3_sb_dma_ops = {
3253+static const struct dma_map_ops ps3_sb_dma_ops = {
3254 .alloc_coherent = ps3_alloc_coherent,
3255 .free_coherent = ps3_free_coherent,
3256 .map_sg = ps3_sb_map_sg,
3257@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
3258 .unmap_page = ps3_unmap_page,
3259 };
3260
3261-static struct dma_map_ops ps3_ioc0_dma_ops = {
3262+static const struct dma_map_ops ps3_ioc0_dma_ops = {
3263 .alloc_coherent = ps3_alloc_coherent,
3264 .free_coherent = ps3_free_coherent,
3265 .map_sg = ps3_ioc0_map_sg,
3266diff -urNp linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig
3267--- linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig 2011-03-27 14:31:47.000000000 -0400
3268+++ linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig 2011-04-17 15:56:45.000000000 -0400
3269@@ -2,6 +2,8 @@ config PPC_PSERIES
3270 depends on PPC64 && PPC_BOOK3S
3271 bool "IBM pSeries & new (POWER5-based) iSeries"
3272 select MPIC
3273+ select PCI_MSI
3274+ select XICS
3275 select PPC_I8259
3276 select PPC_RTAS
3277 select RTAS_ERROR_LOGGING
3278diff -urNp linux-2.6.32.46/arch/s390/include/asm/elf.h linux-2.6.32.46/arch/s390/include/asm/elf.h
3279--- linux-2.6.32.46/arch/s390/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
3280+++ linux-2.6.32.46/arch/s390/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
3281@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
3282 that it will "exec", and that there is sufficient room for the brk. */
3283 #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
3284
3285+#ifdef CONFIG_PAX_ASLR
3286+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
3287+
3288+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3289+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3290+#endif
3291+
3292 /* This yields a mask that user programs can use to figure out what
3293 instruction set this CPU supports. */
3294
3295diff -urNp linux-2.6.32.46/arch/s390/include/asm/setup.h linux-2.6.32.46/arch/s390/include/asm/setup.h
3296--- linux-2.6.32.46/arch/s390/include/asm/setup.h 2011-03-27 14:31:47.000000000 -0400
3297+++ linux-2.6.32.46/arch/s390/include/asm/setup.h 2011-04-17 15:56:45.000000000 -0400
3298@@ -50,13 +50,13 @@ extern unsigned long memory_end;
3299 void detect_memory_layout(struct mem_chunk chunk[]);
3300
3301 #ifdef CONFIG_S390_SWITCH_AMODE
3302-extern unsigned int switch_amode;
3303+#define switch_amode (1)
3304 #else
3305 #define switch_amode (0)
3306 #endif
3307
3308 #ifdef CONFIG_S390_EXEC_PROTECT
3309-extern unsigned int s390_noexec;
3310+#define s390_noexec (1)
3311 #else
3312 #define s390_noexec (0)
3313 #endif
3314diff -urNp linux-2.6.32.46/arch/s390/include/asm/uaccess.h linux-2.6.32.46/arch/s390/include/asm/uaccess.h
3315--- linux-2.6.32.46/arch/s390/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
3316+++ linux-2.6.32.46/arch/s390/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
3317@@ -232,6 +232,10 @@ static inline unsigned long __must_check
3318 copy_to_user(void __user *to, const void *from, unsigned long n)
3319 {
3320 might_fault();
3321+
3322+ if ((long)n < 0)
3323+ return n;
3324+
3325 if (access_ok(VERIFY_WRITE, to, n))
3326 n = __copy_to_user(to, from, n);
3327 return n;
3328@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
3329 static inline unsigned long __must_check
3330 __copy_from_user(void *to, const void __user *from, unsigned long n)
3331 {
3332+ if ((long)n < 0)
3333+ return n;
3334+
3335 if (__builtin_constant_p(n) && (n <= 256))
3336 return uaccess.copy_from_user_small(n, from, to);
3337 else
3338@@ -283,6 +290,10 @@ static inline unsigned long __must_check
3339 copy_from_user(void *to, const void __user *from, unsigned long n)
3340 {
3341 might_fault();
3342+
3343+ if ((long)n < 0)
3344+ return n;
3345+
3346 if (access_ok(VERIFY_READ, from, n))
3347 n = __copy_from_user(to, from, n);
3348 else
3349diff -urNp linux-2.6.32.46/arch/s390/Kconfig linux-2.6.32.46/arch/s390/Kconfig
3350--- linux-2.6.32.46/arch/s390/Kconfig 2011-03-27 14:31:47.000000000 -0400
3351+++ linux-2.6.32.46/arch/s390/Kconfig 2011-04-17 15:56:45.000000000 -0400
3352@@ -194,28 +194,26 @@ config AUDIT_ARCH
3353
3354 config S390_SWITCH_AMODE
3355 bool "Switch kernel/user addressing modes"
3356+ default y
3357 help
3358 This option allows to switch the addressing modes of kernel and user
3359- space. The kernel parameter switch_amode=on will enable this feature,
3360- default is disabled. Enabling this (via kernel parameter) on machines
3361- earlier than IBM System z9-109 EC/BC will reduce system performance.
3362+ space. Enabling this on machines earlier than IBM System z9-109 EC/BC
3363+ will reduce system performance.
3364
3365 Note that this option will also be selected by selecting the execute
3366- protection option below. Enabling the execute protection via the
3367- noexec kernel parameter will also switch the addressing modes,
3368- independent of the switch_amode kernel parameter.
3369+ protection option below. Enabling the execute protection will also
3370+ switch the addressing modes, independent of this option.
3371
3372
3373 config S390_EXEC_PROTECT
3374 bool "Data execute protection"
3375+ default y
3376 select S390_SWITCH_AMODE
3377 help
3378 This option allows to enable a buffer overflow protection for user
3379 space programs and it also selects the addressing mode option above.
3380- The kernel parameter noexec=on will enable this feature and also
3381- switch the addressing modes, default is disabled. Enabling this (via
3382- kernel parameter) on machines earlier than IBM System z9-109 EC/BC
3383- will reduce system performance.
3384+ Enabling this on machines earlier than IBM System z9-109 EC/BC will
3385+ reduce system performance.
3386
3387 comment "Code generation options"
3388
3389diff -urNp linux-2.6.32.46/arch/s390/kernel/module.c linux-2.6.32.46/arch/s390/kernel/module.c
3390--- linux-2.6.32.46/arch/s390/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
3391+++ linux-2.6.32.46/arch/s390/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
3392@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
3393
3394 /* Increase core size by size of got & plt and set start
3395 offsets for got and plt. */
3396- me->core_size = ALIGN(me->core_size, 4);
3397- me->arch.got_offset = me->core_size;
3398- me->core_size += me->arch.got_size;
3399- me->arch.plt_offset = me->core_size;
3400- me->core_size += me->arch.plt_size;
3401+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
3402+ me->arch.got_offset = me->core_size_rw;
3403+ me->core_size_rw += me->arch.got_size;
3404+ me->arch.plt_offset = me->core_size_rx;
3405+ me->core_size_rx += me->arch.plt_size;
3406 return 0;
3407 }
3408
3409@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3410 if (info->got_initialized == 0) {
3411 Elf_Addr *gotent;
3412
3413- gotent = me->module_core + me->arch.got_offset +
3414+ gotent = me->module_core_rw + me->arch.got_offset +
3415 info->got_offset;
3416 *gotent = val;
3417 info->got_initialized = 1;
3418@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3419 else if (r_type == R_390_GOTENT ||
3420 r_type == R_390_GOTPLTENT)
3421 *(unsigned int *) loc =
3422- (val + (Elf_Addr) me->module_core - loc) >> 1;
3423+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3424 else if (r_type == R_390_GOT64 ||
3425 r_type == R_390_GOTPLT64)
3426 *(unsigned long *) loc = val;
3427@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3428 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3429 if (info->plt_initialized == 0) {
3430 unsigned int *ip;
3431- ip = me->module_core + me->arch.plt_offset +
3432+ ip = me->module_core_rx + me->arch.plt_offset +
3433 info->plt_offset;
3434 #ifndef CONFIG_64BIT
3435 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3436@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3437 val - loc + 0xffffUL < 0x1ffffeUL) ||
3438 (r_type == R_390_PLT32DBL &&
3439 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3440- val = (Elf_Addr) me->module_core +
3441+ val = (Elf_Addr) me->module_core_rx +
3442 me->arch.plt_offset +
3443 info->plt_offset;
3444 val += rela->r_addend - loc;
3445@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3446 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3447 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3448 val = val + rela->r_addend -
3449- ((Elf_Addr) me->module_core + me->arch.got_offset);
3450+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3451 if (r_type == R_390_GOTOFF16)
3452 *(unsigned short *) loc = val;
3453 else if (r_type == R_390_GOTOFF32)
3454@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3455 break;
3456 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3457 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3458- val = (Elf_Addr) me->module_core + me->arch.got_offset +
3459+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3460 rela->r_addend - loc;
3461 if (r_type == R_390_GOTPC)
3462 *(unsigned int *) loc = val;
3463diff -urNp linux-2.6.32.46/arch/s390/kernel/setup.c linux-2.6.32.46/arch/s390/kernel/setup.c
3464--- linux-2.6.32.46/arch/s390/kernel/setup.c 2011-03-27 14:31:47.000000000 -0400
3465+++ linux-2.6.32.46/arch/s390/kernel/setup.c 2011-04-17 15:56:45.000000000 -0400
3466@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
3467 early_param("mem", early_parse_mem);
3468
3469 #ifdef CONFIG_S390_SWITCH_AMODE
3470-unsigned int switch_amode = 0;
3471-EXPORT_SYMBOL_GPL(switch_amode);
3472-
3473 static int set_amode_and_uaccess(unsigned long user_amode,
3474 unsigned long user32_amode)
3475 {
3476@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
3477 return 0;
3478 }
3479 }
3480-
3481-/*
3482- * Switch kernel/user addressing modes?
3483- */
3484-static int __init early_parse_switch_amode(char *p)
3485-{
3486- switch_amode = 1;
3487- return 0;
3488-}
3489-early_param("switch_amode", early_parse_switch_amode);
3490-
3491 #else /* CONFIG_S390_SWITCH_AMODE */
3492 static inline int set_amode_and_uaccess(unsigned long user_amode,
3493 unsigned long user32_amode)
3494@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
3495 }
3496 #endif /* CONFIG_S390_SWITCH_AMODE */
3497
3498-#ifdef CONFIG_S390_EXEC_PROTECT
3499-unsigned int s390_noexec = 0;
3500-EXPORT_SYMBOL_GPL(s390_noexec);
3501-
3502-/*
3503- * Enable execute protection?
3504- */
3505-static int __init early_parse_noexec(char *p)
3506-{
3507- if (!strncmp(p, "off", 3))
3508- return 0;
3509- switch_amode = 1;
3510- s390_noexec = 1;
3511- return 0;
3512-}
3513-early_param("noexec", early_parse_noexec);
3514-#endif /* CONFIG_S390_EXEC_PROTECT */
3515-
3516 static void setup_addressing_mode(void)
3517 {
3518 if (s390_noexec) {
3519diff -urNp linux-2.6.32.46/arch/s390/mm/mmap.c linux-2.6.32.46/arch/s390/mm/mmap.c
3520--- linux-2.6.32.46/arch/s390/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
3521+++ linux-2.6.32.46/arch/s390/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
3522@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
3523 */
3524 if (mmap_is_legacy()) {
3525 mm->mmap_base = TASK_UNMAPPED_BASE;
3526+
3527+#ifdef CONFIG_PAX_RANDMMAP
3528+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3529+ mm->mmap_base += mm->delta_mmap;
3530+#endif
3531+
3532 mm->get_unmapped_area = arch_get_unmapped_area;
3533 mm->unmap_area = arch_unmap_area;
3534 } else {
3535 mm->mmap_base = mmap_base();
3536+
3537+#ifdef CONFIG_PAX_RANDMMAP
3538+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3539+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3540+#endif
3541+
3542 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3543 mm->unmap_area = arch_unmap_area_topdown;
3544 }
3545@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
3546 */
3547 if (mmap_is_legacy()) {
3548 mm->mmap_base = TASK_UNMAPPED_BASE;
3549+
3550+#ifdef CONFIG_PAX_RANDMMAP
3551+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3552+ mm->mmap_base += mm->delta_mmap;
3553+#endif
3554+
3555 mm->get_unmapped_area = s390_get_unmapped_area;
3556 mm->unmap_area = arch_unmap_area;
3557 } else {
3558 mm->mmap_base = mmap_base();
3559+
3560+#ifdef CONFIG_PAX_RANDMMAP
3561+ if (mm->pax_flags & MF_PAX_RANDMMAP)
3562+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3563+#endif
3564+
3565 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3566 mm->unmap_area = arch_unmap_area_topdown;
3567 }
3568diff -urNp linux-2.6.32.46/arch/score/include/asm/system.h linux-2.6.32.46/arch/score/include/asm/system.h
3569--- linux-2.6.32.46/arch/score/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
3570+++ linux-2.6.32.46/arch/score/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
3571@@ -17,7 +17,7 @@ do { \
3572 #define finish_arch_switch(prev) do {} while (0)
3573
3574 typedef void (*vi_handler_t)(void);
3575-extern unsigned long arch_align_stack(unsigned long sp);
3576+#define arch_align_stack(x) (x)
3577
3578 #define mb() barrier()
3579 #define rmb() barrier()
3580diff -urNp linux-2.6.32.46/arch/score/kernel/process.c linux-2.6.32.46/arch/score/kernel/process.c
3581--- linux-2.6.32.46/arch/score/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
3582+++ linux-2.6.32.46/arch/score/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
3583@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
3584
3585 return task_pt_regs(task)->cp0_epc;
3586 }
3587-
3588-unsigned long arch_align_stack(unsigned long sp)
3589-{
3590- return sp;
3591-}
3592diff -urNp linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c
3593--- linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c 2011-03-27 14:31:47.000000000 -0400
3594+++ linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c 2011-04-17 15:56:45.000000000 -0400
3595@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
3596 return 0;
3597 }
3598
3599-static struct platform_suspend_ops hp6x0_pm_ops = {
3600+static const struct platform_suspend_ops hp6x0_pm_ops = {
3601 .enter = hp6x0_pm_enter,
3602 .valid = suspend_valid_only_mem,
3603 };
3604diff -urNp linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c
3605--- linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c 2011-03-27 14:31:47.000000000 -0400
3606+++ linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c 2011-04-17 15:56:46.000000000 -0400
3607@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
3608 NULL,
3609 };
3610
3611-static struct sysfs_ops sq_sysfs_ops = {
3612+static const struct sysfs_ops sq_sysfs_ops = {
3613 .show = sq_sysfs_show,
3614 .store = sq_sysfs_store,
3615 };
3616diff -urNp linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c
3617--- linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c 2011-03-27 14:31:47.000000000 -0400
3618+++ linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c 2011-04-17 15:56:46.000000000 -0400
3619@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
3620 return 0;
3621 }
3622
3623-static struct platform_suspend_ops sh_pm_ops = {
3624+static const struct platform_suspend_ops sh_pm_ops = {
3625 .enter = sh_pm_enter,
3626 .valid = suspend_valid_only_mem,
3627 };
3628diff -urNp linux-2.6.32.46/arch/sh/kernel/kgdb.c linux-2.6.32.46/arch/sh/kernel/kgdb.c
3629--- linux-2.6.32.46/arch/sh/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
3630+++ linux-2.6.32.46/arch/sh/kernel/kgdb.c 2011-04-17 15:56:46.000000000 -0400
3631@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
3632 {
3633 }
3634
3635-struct kgdb_arch arch_kgdb_ops = {
3636+const struct kgdb_arch arch_kgdb_ops = {
3637 /* Breakpoint instruction: trapa #0x3c */
3638 #ifdef CONFIG_CPU_LITTLE_ENDIAN
3639 .gdb_bpt_instr = { 0x3c, 0xc3 },
3640diff -urNp linux-2.6.32.46/arch/sh/mm/mmap.c linux-2.6.32.46/arch/sh/mm/mmap.c
3641--- linux-2.6.32.46/arch/sh/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
3642+++ linux-2.6.32.46/arch/sh/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
3643@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
3644 addr = PAGE_ALIGN(addr);
3645
3646 vma = find_vma(mm, addr);
3647- if (TASK_SIZE - len >= addr &&
3648- (!vma || addr + len <= vma->vm_start))
3649+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3650 return addr;
3651 }
3652
3653@@ -106,7 +105,7 @@ full_search:
3654 }
3655 return -ENOMEM;
3656 }
3657- if (likely(!vma || addr + len <= vma->vm_start)) {
3658+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3659 /*
3660 * Remember the place where we stopped the search:
3661 */
3662@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
3663 addr = PAGE_ALIGN(addr);
3664
3665 vma = find_vma(mm, addr);
3666- if (TASK_SIZE - len >= addr &&
3667- (!vma || addr + len <= vma->vm_start))
3668+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3669 return addr;
3670 }
3671
3672@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
3673 /* make sure it can fit in the remaining address space */
3674 if (likely(addr > len)) {
3675 vma = find_vma(mm, addr-len);
3676- if (!vma || addr <= vma->vm_start) {
3677+ if (check_heap_stack_gap(vma, addr - len, len)) {
3678 /* remember the address as a hint for next time */
3679 return (mm->free_area_cache = addr-len);
3680 }
3681@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
3682 if (unlikely(mm->mmap_base < len))
3683 goto bottomup;
3684
3685- addr = mm->mmap_base-len;
3686- if (do_colour_align)
3687- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3688+ addr = mm->mmap_base - len;
3689
3690 do {
3691+ if (do_colour_align)
3692+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3693 /*
3694 * Lookup failure means no vma is above this address,
3695 * else if new region fits below vma->vm_start,
3696 * return with success:
3697 */
3698 vma = find_vma(mm, addr);
3699- if (likely(!vma || addr+len <= vma->vm_start)) {
3700+ if (likely(check_heap_stack_gap(vma, addr, len))) {
3701 /* remember the address as a hint for next time */
3702 return (mm->free_area_cache = addr);
3703 }
3704@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
3705 mm->cached_hole_size = vma->vm_start - addr;
3706
3707 /* try just below the current vma->vm_start */
3708- addr = vma->vm_start-len;
3709- if (do_colour_align)
3710- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3711- } while (likely(len < vma->vm_start));
3712+ addr = skip_heap_stack_gap(vma, len);
3713+ } while (!IS_ERR_VALUE(addr));
3714
3715 bottomup:
3716 /*
3717diff -urNp linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h
3718--- linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
3719+++ linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h 2011-08-18 23:11:34.000000000 -0400
3720@@ -14,18 +14,40 @@
3721 #define ATOMIC64_INIT(i) { (i) }
3722
3723 #define atomic_read(v) ((v)->counter)
3724+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3725+{
3726+ return v->counter;
3727+}
3728 #define atomic64_read(v) ((v)->counter)
3729+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3730+{
3731+ return v->counter;
3732+}
3733
3734 #define atomic_set(v, i) (((v)->counter) = i)
3735+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3736+{
3737+ v->counter = i;
3738+}
3739 #define atomic64_set(v, i) (((v)->counter) = i)
3740+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3741+{
3742+ v->counter = i;
3743+}
3744
3745 extern void atomic_add(int, atomic_t *);
3746+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3747 extern void atomic64_add(long, atomic64_t *);
3748+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3749 extern void atomic_sub(int, atomic_t *);
3750+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3751 extern void atomic64_sub(long, atomic64_t *);
3752+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3753
3754 extern int atomic_add_ret(int, atomic_t *);
3755+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3756 extern long atomic64_add_ret(long, atomic64_t *);
3757+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3758 extern int atomic_sub_ret(int, atomic_t *);
3759 extern long atomic64_sub_ret(long, atomic64_t *);
3760
3761@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
3762 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3763
3764 #define atomic_inc_return(v) atomic_add_ret(1, v)
3765+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3766+{
3767+ return atomic_add_ret_unchecked(1, v);
3768+}
3769 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3770+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3771+{
3772+ return atomic64_add_ret_unchecked(1, v);
3773+}
3774
3775 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3776 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3777
3778 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3779+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3780+{
3781+ return atomic_add_ret_unchecked(i, v);
3782+}
3783 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3784+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3785+{
3786+ return atomic64_add_ret_unchecked(i, v);
3787+}
3788
3789 /*
3790 * atomic_inc_and_test - increment and test
3791@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
3792 * other cases.
3793 */
3794 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3795+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3796+{
3797+ return atomic_inc_return_unchecked(v) == 0;
3798+}
3799 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3800
3801 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3802@@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
3803 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3804
3805 #define atomic_inc(v) atomic_add(1, v)
3806+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3807+{
3808+ atomic_add_unchecked(1, v);
3809+}
3810 #define atomic64_inc(v) atomic64_add(1, v)
3811+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3812+{
3813+ atomic64_add_unchecked(1, v);
3814+}
3815
3816 #define atomic_dec(v) atomic_sub(1, v)
3817+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3818+{
3819+ atomic_sub_unchecked(1, v);
3820+}
3821 #define atomic64_dec(v) atomic64_sub(1, v)
3822+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3823+{
3824+ atomic64_sub_unchecked(1, v);
3825+}
3826
3827 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3828 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3829
3830 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3831+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3832+{
3833+ return cmpxchg(&v->counter, old, new);
3834+}
3835 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3836+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3837+{
3838+ return xchg(&v->counter, new);
3839+}
3840
3841 static inline int atomic_add_unless(atomic_t *v, int a, int u)
3842 {
3843- int c, old;
3844+ int c, old, new;
3845 c = atomic_read(v);
3846 for (;;) {
3847- if (unlikely(c == (u)))
3848+ if (unlikely(c == u))
3849 break;
3850- old = atomic_cmpxchg((v), c, c + (a));
3851+
3852+ asm volatile("addcc %2, %0, %0\n"
3853+
3854+#ifdef CONFIG_PAX_REFCOUNT
3855+ "tvs %%icc, 6\n"
3856+#endif
3857+
3858+ : "=r" (new)
3859+ : "0" (c), "ir" (a)
3860+ : "cc");
3861+
3862+ old = atomic_cmpxchg(v, c, new);
3863 if (likely(old == c))
3864 break;
3865 c = old;
3866 }
3867- return c != (u);
3868+ return c != u;
3869 }
3870
3871 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
3872@@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
3873 #define atomic64_cmpxchg(v, o, n) \
3874 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3875 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3876+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3877+{
3878+ return xchg(&v->counter, new);
3879+}
3880
3881 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3882 {
3883- long c, old;
3884+ long c, old, new;
3885 c = atomic64_read(v);
3886 for (;;) {
3887- if (unlikely(c == (u)))
3888+ if (unlikely(c == u))
3889 break;
3890- old = atomic64_cmpxchg((v), c, c + (a));
3891+
3892+ asm volatile("addcc %2, %0, %0\n"
3893+
3894+#ifdef CONFIG_PAX_REFCOUNT
3895+ "tvs %%xcc, 6\n"
3896+#endif
3897+
3898+ : "=r" (new)
3899+ : "0" (c), "ir" (a)
3900+ : "cc");
3901+
3902+ old = atomic64_cmpxchg(v, c, new);
3903 if (likely(old == c))
3904 break;
3905 c = old;
3906 }
3907- return c != (u);
3908+ return c != u;
3909 }
3910
3911 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3912diff -urNp linux-2.6.32.46/arch/sparc/include/asm/cache.h linux-2.6.32.46/arch/sparc/include/asm/cache.h
3913--- linux-2.6.32.46/arch/sparc/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
3914+++ linux-2.6.32.46/arch/sparc/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
3915@@ -8,7 +8,7 @@
3916 #define _SPARC_CACHE_H
3917
3918 #define L1_CACHE_SHIFT 5
3919-#define L1_CACHE_BYTES 32
3920+#define L1_CACHE_BYTES 32UL
3921 #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
3922
3923 #ifdef CONFIG_SPARC32
3924diff -urNp linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h
3925--- linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
3926+++ linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
3927@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
3928 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
3929 #define dma_is_consistent(d, h) (1)
3930
3931-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
3932+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
3933 extern struct bus_type pci_bus_type;
3934
3935-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3936+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3937 {
3938 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
3939 if (dev->bus == &pci_bus_type)
3940@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
3941 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3942 dma_addr_t *dma_handle, gfp_t flag)
3943 {
3944- struct dma_map_ops *ops = get_dma_ops(dev);
3945+ const struct dma_map_ops *ops = get_dma_ops(dev);
3946 void *cpu_addr;
3947
3948 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
3949@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
3950 static inline void dma_free_coherent(struct device *dev, size_t size,
3951 void *cpu_addr, dma_addr_t dma_handle)
3952 {
3953- struct dma_map_ops *ops = get_dma_ops(dev);
3954+ const struct dma_map_ops *ops = get_dma_ops(dev);
3955
3956 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
3957 ops->free_coherent(dev, size, cpu_addr, dma_handle);
3958diff -urNp linux-2.6.32.46/arch/sparc/include/asm/elf_32.h linux-2.6.32.46/arch/sparc/include/asm/elf_32.h
3959--- linux-2.6.32.46/arch/sparc/include/asm/elf_32.h 2011-03-27 14:31:47.000000000 -0400
3960+++ linux-2.6.32.46/arch/sparc/include/asm/elf_32.h 2011-04-17 15:56:46.000000000 -0400
3961@@ -116,6 +116,13 @@ typedef struct {
3962
3963 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3964
3965+#ifdef CONFIG_PAX_ASLR
3966+#define PAX_ELF_ET_DYN_BASE 0x10000UL
3967+
3968+#define PAX_DELTA_MMAP_LEN 16
3969+#define PAX_DELTA_STACK_LEN 16
3970+#endif
3971+
3972 /* This yields a mask that user programs can use to figure out what
3973 instruction set this cpu supports. This can NOT be done in userspace
3974 on Sparc. */
3975diff -urNp linux-2.6.32.46/arch/sparc/include/asm/elf_64.h linux-2.6.32.46/arch/sparc/include/asm/elf_64.h
3976--- linux-2.6.32.46/arch/sparc/include/asm/elf_64.h 2011-03-27 14:31:47.000000000 -0400
3977+++ linux-2.6.32.46/arch/sparc/include/asm/elf_64.h 2011-04-17 15:56:46.000000000 -0400
3978@@ -163,6 +163,12 @@ typedef struct {
3979 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3980 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3981
3982+#ifdef CONFIG_PAX_ASLR
3983+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3984+
3985+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3986+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3987+#endif
3988
3989 /* This yields a mask that user programs can use to figure out what
3990 instruction set this cpu supports. */
3991diff -urNp linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h
3992--- linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
3993+++ linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
3994@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3995 BTFIXUPDEF_INT(page_none)
3996 BTFIXUPDEF_INT(page_copy)
3997 BTFIXUPDEF_INT(page_readonly)
3998+
3999+#ifdef CONFIG_PAX_PAGEEXEC
4000+BTFIXUPDEF_INT(page_shared_noexec)
4001+BTFIXUPDEF_INT(page_copy_noexec)
4002+BTFIXUPDEF_INT(page_readonly_noexec)
4003+#endif
4004+
4005 BTFIXUPDEF_INT(page_kernel)
4006
4007 #define PMD_SHIFT SUN4C_PMD_SHIFT
4008@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
4009 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
4010 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
4011
4012+#ifdef CONFIG_PAX_PAGEEXEC
4013+extern pgprot_t PAGE_SHARED_NOEXEC;
4014+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
4015+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
4016+#else
4017+# define PAGE_SHARED_NOEXEC PAGE_SHARED
4018+# define PAGE_COPY_NOEXEC PAGE_COPY
4019+# define PAGE_READONLY_NOEXEC PAGE_READONLY
4020+#endif
4021+
4022 extern unsigned long page_kernel;
4023
4024 #ifdef MODULE
4025diff -urNp linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h
4026--- linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h 2011-03-27 14:31:47.000000000 -0400
4027+++ linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h 2011-04-17 15:56:46.000000000 -0400
4028@@ -115,6 +115,13 @@
4029 SRMMU_EXEC | SRMMU_REF)
4030 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
4031 SRMMU_EXEC | SRMMU_REF)
4032+
4033+#ifdef CONFIG_PAX_PAGEEXEC
4034+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
4035+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4036+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4037+#endif
4038+
4039 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
4040 SRMMU_DIRTY | SRMMU_REF)
4041
4042diff -urNp linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h
4043--- linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h 2011-03-27 14:31:47.000000000 -0400
4044+++ linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h 2011-08-18 23:19:30.000000000 -0400
4045@@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags
4046
4047 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
4048
4049-static void inline arch_read_lock(raw_rwlock_t *lock)
4050+static inline void arch_read_lock(raw_rwlock_t *lock)
4051 {
4052 unsigned long tmp1, tmp2;
4053
4054 __asm__ __volatile__ (
4055 "1: ldsw [%2], %0\n"
4056 " brlz,pn %0, 2f\n"
4057-"4: add %0, 1, %1\n"
4058+"4: addcc %0, 1, %1\n"
4059+
4060+#ifdef CONFIG_PAX_REFCOUNT
4061+" tvs %%icc, 6\n"
4062+#endif
4063+
4064 " cas [%2], %0, %1\n"
4065 " cmp %0, %1\n"
4066 " bne,pn %%icc, 1b\n"
4067@@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rw
4068 " .previous"
4069 : "=&r" (tmp1), "=&r" (tmp2)
4070 : "r" (lock)
4071- : "memory");
4072+ : "memory", "cc");
4073 }
4074
4075-static int inline arch_read_trylock(raw_rwlock_t *lock)
4076+static inline int arch_read_trylock(raw_rwlock_t *lock)
4077 {
4078 int tmp1, tmp2;
4079
4080@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
4081 "1: ldsw [%2], %0\n"
4082 " brlz,a,pn %0, 2f\n"
4083 " mov 0, %0\n"
4084-" add %0, 1, %1\n"
4085+" addcc %0, 1, %1\n"
4086+
4087+#ifdef CONFIG_PAX_REFCOUNT
4088+" tvs %%icc, 6\n"
4089+#endif
4090+
4091 " cas [%2], %0, %1\n"
4092 " cmp %0, %1\n"
4093 " bne,pn %%icc, 1b\n"
4094@@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_
4095 return tmp1;
4096 }
4097
4098-static void inline arch_read_unlock(raw_rwlock_t *lock)
4099+static inline void arch_read_unlock(raw_rwlock_t *lock)
4100 {
4101 unsigned long tmp1, tmp2;
4102
4103 __asm__ __volatile__(
4104 "1: lduw [%2], %0\n"
4105-" sub %0, 1, %1\n"
4106+" subcc %0, 1, %1\n"
4107+
4108+#ifdef CONFIG_PAX_REFCOUNT
4109+" tvs %%icc, 6\n"
4110+#endif
4111+
4112 " cas [%2], %0, %1\n"
4113 " cmp %0, %1\n"
4114 " bne,pn %%xcc, 1b\n"
4115@@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_
4116 : "memory");
4117 }
4118
4119-static void inline arch_write_lock(raw_rwlock_t *lock)
4120+static inline void arch_write_lock(raw_rwlock_t *lock)
4121 {
4122 unsigned long mask, tmp1, tmp2;
4123
4124@@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_r
4125 : "memory");
4126 }
4127
4128-static void inline arch_write_unlock(raw_rwlock_t *lock)
4129+static inline void arch_write_unlock(raw_rwlock_t *lock)
4130 {
4131 __asm__ __volatile__(
4132 " stw %%g0, [%0]"
4133@@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw
4134 : "memory");
4135 }
4136
4137-static int inline arch_write_trylock(raw_rwlock_t *lock)
4138+static inline int arch_write_trylock(raw_rwlock_t *lock)
4139 {
4140 unsigned long mask, tmp1, tmp2, result;
4141
4142diff -urNp linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h
4143--- linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h 2011-03-27 14:31:47.000000000 -0400
4144+++ linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h 2011-06-04 20:46:01.000000000 -0400
4145@@ -50,6 +50,8 @@ struct thread_info {
4146 unsigned long w_saved;
4147
4148 struct restart_block restart_block;
4149+
4150+ unsigned long lowest_stack;
4151 };
4152
4153 /*
4154diff -urNp linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h
4155--- linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h 2011-03-27 14:31:47.000000000 -0400
4156+++ linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h 2011-06-04 20:46:21.000000000 -0400
4157@@ -68,6 +68,8 @@ struct thread_info {
4158 struct pt_regs *kern_una_regs;
4159 unsigned int kern_una_insn;
4160
4161+ unsigned long lowest_stack;
4162+
4163 unsigned long fpregs[0] __attribute__ ((aligned(64)));
4164 };
4165
4166diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h
4167--- linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
4168+++ linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h 2011-04-17 15:56:46.000000000 -0400
4169@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
4170
4171 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4172 {
4173- if (n && __access_ok((unsigned long) to, n))
4174+ if ((long)n < 0)
4175+ return n;
4176+
4177+ if (n && __access_ok((unsigned long) to, n)) {
4178+ if (!__builtin_constant_p(n))
4179+ check_object_size(from, n, true);
4180 return __copy_user(to, (__force void __user *) from, n);
4181- else
4182+ } else
4183 return n;
4184 }
4185
4186 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
4187 {
4188+ if ((long)n < 0)
4189+ return n;
4190+
4191+ if (!__builtin_constant_p(n))
4192+ check_object_size(from, n, true);
4193+
4194 return __copy_user(to, (__force void __user *) from, n);
4195 }
4196
4197 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4198 {
4199- if (n && __access_ok((unsigned long) from, n))
4200+ if ((long)n < 0)
4201+ return n;
4202+
4203+ if (n && __access_ok((unsigned long) from, n)) {
4204+ if (!__builtin_constant_p(n))
4205+ check_object_size(to, n, false);
4206 return __copy_user((__force void __user *) to, from, n);
4207- else
4208+ } else
4209 return n;
4210 }
4211
4212 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
4213 {
4214+ if ((long)n < 0)
4215+ return n;
4216+
4217 return __copy_user((__force void __user *) to, from, n);
4218 }
4219
4220diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h
4221--- linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
4222+++ linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h 2011-04-17 15:56:46.000000000 -0400
4223@@ -9,6 +9,7 @@
4224 #include <linux/compiler.h>
4225 #include <linux/string.h>
4226 #include <linux/thread_info.h>
4227+#include <linux/kernel.h>
4228 #include <asm/asi.h>
4229 #include <asm/system.h>
4230 #include <asm/spitfire.h>
4231@@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixu
4232 static inline unsigned long __must_check
4233 copy_from_user(void *to, const void __user *from, unsigned long size)
4234 {
4235- unsigned long ret = ___copy_from_user(to, from, size);
4236+ unsigned long ret;
4237
4238+ if ((long)size < 0 || size > INT_MAX)
4239+ return size;
4240+
4241+ if (!__builtin_constant_p(size))
4242+ check_object_size(to, size, false);
4243+
4244+ ret = ___copy_from_user(to, from, size);
4245 if (unlikely(ret))
4246 ret = copy_from_user_fixup(to, from, size);
4247 return ret;
4248@@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(
4249 static inline unsigned long __must_check
4250 copy_to_user(void __user *to, const void *from, unsigned long size)
4251 {
4252- unsigned long ret = ___copy_to_user(to, from, size);
4253+ unsigned long ret;
4254+
4255+ if ((long)size < 0 || size > INT_MAX)
4256+ return size;
4257+
4258+ if (!__builtin_constant_p(size))
4259+ check_object_size(from, size, true);
4260
4261+ ret = ___copy_to_user(to, from, size);
4262 if (unlikely(ret))
4263 ret = copy_to_user_fixup(to, from, size);
4264 return ret;
4265diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess.h linux-2.6.32.46/arch/sparc/include/asm/uaccess.h
4266--- linux-2.6.32.46/arch/sparc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
4267+++ linux-2.6.32.46/arch/sparc/include/asm/uaccess.h 2011-04-17 15:56:46.000000000 -0400
4268@@ -1,5 +1,13 @@
4269 #ifndef ___ASM_SPARC_UACCESS_H
4270 #define ___ASM_SPARC_UACCESS_H
4271+
4272+#ifdef __KERNEL__
4273+#ifndef __ASSEMBLY__
4274+#include <linux/types.h>
4275+extern void check_object_size(const void *ptr, unsigned long n, bool to);
4276+#endif
4277+#endif
4278+
4279 #if defined(__sparc__) && defined(__arch64__)
4280 #include <asm/uaccess_64.h>
4281 #else
4282diff -urNp linux-2.6.32.46/arch/sparc/kernel/iommu.c linux-2.6.32.46/arch/sparc/kernel/iommu.c
4283--- linux-2.6.32.46/arch/sparc/kernel/iommu.c 2011-03-27 14:31:47.000000000 -0400
4284+++ linux-2.6.32.46/arch/sparc/kernel/iommu.c 2011-04-17 15:56:46.000000000 -0400
4285@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
4286 spin_unlock_irqrestore(&iommu->lock, flags);
4287 }
4288
4289-static struct dma_map_ops sun4u_dma_ops = {
4290+static const struct dma_map_ops sun4u_dma_ops = {
4291 .alloc_coherent = dma_4u_alloc_coherent,
4292 .free_coherent = dma_4u_free_coherent,
4293 .map_page = dma_4u_map_page,
4294@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops
4295 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
4296 };
4297
4298-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4299+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4300 EXPORT_SYMBOL(dma_ops);
4301
4302 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
4303diff -urNp linux-2.6.32.46/arch/sparc/kernel/ioport.c linux-2.6.32.46/arch/sparc/kernel/ioport.c
4304--- linux-2.6.32.46/arch/sparc/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
4305+++ linux-2.6.32.46/arch/sparc/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
4306@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
4307 BUG();
4308 }
4309
4310-struct dma_map_ops sbus_dma_ops = {
4311+const struct dma_map_ops sbus_dma_ops = {
4312 .alloc_coherent = sbus_alloc_coherent,
4313 .free_coherent = sbus_free_coherent,
4314 .map_page = sbus_map_page,
4315@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
4316 .sync_sg_for_device = sbus_sync_sg_for_device,
4317 };
4318
4319-struct dma_map_ops *dma_ops = &sbus_dma_ops;
4320+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
4321 EXPORT_SYMBOL(dma_ops);
4322
4323 static int __init sparc_register_ioport(void)
4324@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
4325 }
4326 }
4327
4328-struct dma_map_ops pci32_dma_ops = {
4329+const struct dma_map_ops pci32_dma_ops = {
4330 .alloc_coherent = pci32_alloc_coherent,
4331 .free_coherent = pci32_free_coherent,
4332 .map_page = pci32_map_page,
4333diff -urNp linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c
4334--- linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c 2011-03-27 14:31:47.000000000 -0400
4335+++ linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c 2011-04-17 15:56:46.000000000 -0400
4336@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
4337 {
4338 }
4339
4340-struct kgdb_arch arch_kgdb_ops = {
4341+const struct kgdb_arch arch_kgdb_ops = {
4342 /* Breakpoint instruction: ta 0x7d */
4343 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
4344 };
4345diff -urNp linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c
4346--- linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c 2011-03-27 14:31:47.000000000 -0400
4347+++ linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c 2011-04-17 15:56:46.000000000 -0400
4348@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
4349 {
4350 }
4351
4352-struct kgdb_arch arch_kgdb_ops = {
4353+const struct kgdb_arch arch_kgdb_ops = {
4354 /* Breakpoint instruction: ta 0x72 */
4355 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
4356 };
4357diff -urNp linux-2.6.32.46/arch/sparc/kernel/Makefile linux-2.6.32.46/arch/sparc/kernel/Makefile
4358--- linux-2.6.32.46/arch/sparc/kernel/Makefile 2011-03-27 14:31:47.000000000 -0400
4359+++ linux-2.6.32.46/arch/sparc/kernel/Makefile 2011-04-17 15:56:46.000000000 -0400
4360@@ -3,7 +3,7 @@
4361 #
4362
4363 asflags-y := -ansi
4364-ccflags-y := -Werror
4365+#ccflags-y := -Werror
4366
4367 extra-y := head_$(BITS).o
4368 extra-y += init_task.o
4369diff -urNp linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c
4370--- linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c 2011-03-27 14:31:47.000000000 -0400
4371+++ linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c 2011-04-17 15:56:46.000000000 -0400
4372@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
4373 spin_unlock_irqrestore(&iommu->lock, flags);
4374 }
4375
4376-static struct dma_map_ops sun4v_dma_ops = {
4377+static const struct dma_map_ops sun4v_dma_ops = {
4378 .alloc_coherent = dma_4v_alloc_coherent,
4379 .free_coherent = dma_4v_free_coherent,
4380 .map_page = dma_4v_map_page,
4381diff -urNp linux-2.6.32.46/arch/sparc/kernel/process_32.c linux-2.6.32.46/arch/sparc/kernel/process_32.c
4382--- linux-2.6.32.46/arch/sparc/kernel/process_32.c 2011-03-27 14:31:47.000000000 -0400
4383+++ linux-2.6.32.46/arch/sparc/kernel/process_32.c 2011-04-17 15:56:46.000000000 -0400
4384@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
4385 rw->ins[4], rw->ins[5],
4386 rw->ins[6],
4387 rw->ins[7]);
4388- printk("%pS\n", (void *) rw->ins[7]);
4389+ printk("%pA\n", (void *) rw->ins[7]);
4390 rw = (struct reg_window32 *) rw->ins[6];
4391 }
4392 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
4393@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
4394
4395 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
4396 r->psr, r->pc, r->npc, r->y, print_tainted());
4397- printk("PC: <%pS>\n", (void *) r->pc);
4398+ printk("PC: <%pA>\n", (void *) r->pc);
4399 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4400 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
4401 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
4402 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4403 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
4404 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
4405- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
4406+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
4407
4408 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4409 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
4410@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
4411 rw = (struct reg_window32 *) fp;
4412 pc = rw->ins[7];
4413 printk("[%08lx : ", pc);
4414- printk("%pS ] ", (void *) pc);
4415+ printk("%pA ] ", (void *) pc);
4416 fp = rw->ins[6];
4417 } while (++count < 16);
4418 printk("\n");
4419diff -urNp linux-2.6.32.46/arch/sparc/kernel/process_64.c linux-2.6.32.46/arch/sparc/kernel/process_64.c
4420--- linux-2.6.32.46/arch/sparc/kernel/process_64.c 2011-03-27 14:31:47.000000000 -0400
4421+++ linux-2.6.32.46/arch/sparc/kernel/process_64.c 2011-04-17 15:56:46.000000000 -0400
4422@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
4423 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
4424 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
4425 if (regs->tstate & TSTATE_PRIV)
4426- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
4427+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
4428 }
4429
4430 void show_regs(struct pt_regs *regs)
4431 {
4432 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
4433 regs->tpc, regs->tnpc, regs->y, print_tainted());
4434- printk("TPC: <%pS>\n", (void *) regs->tpc);
4435+ printk("TPC: <%pA>\n", (void *) regs->tpc);
4436 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
4437 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
4438 regs->u_regs[3]);
4439@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
4440 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
4441 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
4442 regs->u_regs[15]);
4443- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
4444+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
4445 show_regwindow(regs);
4446 }
4447
4448@@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void
4449 ((tp && tp->task) ? tp->task->pid : -1));
4450
4451 if (gp->tstate & TSTATE_PRIV) {
4452- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
4453+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
4454 (void *) gp->tpc,
4455 (void *) gp->o7,
4456 (void *) gp->i7,
4457diff -urNp linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c
4458--- linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c 2011-03-27 14:31:47.000000000 -0400
4459+++ linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c 2011-04-17 15:56:46.000000000 -0400
4460@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
4461 if (ARCH_SUN4C && len > 0x20000000)
4462 return -ENOMEM;
4463 if (!addr)
4464- addr = TASK_UNMAPPED_BASE;
4465+ addr = current->mm->mmap_base;
4466
4467 if (flags & MAP_SHARED)
4468 addr = COLOUR_ALIGN(addr);
4469@@ -72,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
4470 }
4471 if (TASK_SIZE - PAGE_SIZE - len < addr)
4472 return -ENOMEM;
4473- if (!vmm || addr + len <= vmm->vm_start)
4474+ if (check_heap_stack_gap(vmm, addr, len))
4475 return addr;
4476 addr = vmm->vm_end;
4477 if (flags & MAP_SHARED)
4478diff -urNp linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c
4479--- linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c 2011-03-27 14:31:47.000000000 -0400
4480+++ linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c 2011-04-17 15:56:46.000000000 -0400
4481@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
4482 /* We do not accept a shared mapping if it would violate
4483 * cache aliasing constraints.
4484 */
4485- if ((flags & MAP_SHARED) &&
4486+ if ((filp || (flags & MAP_SHARED)) &&
4487 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4488 return -EINVAL;
4489 return addr;
4490@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
4491 if (filp || (flags & MAP_SHARED))
4492 do_color_align = 1;
4493
4494+#ifdef CONFIG_PAX_RANDMMAP
4495+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4496+#endif
4497+
4498 if (addr) {
4499 if (do_color_align)
4500 addr = COLOUR_ALIGN(addr, pgoff);
4501@@ -147,15 +151,14 @@ unsigned long arch_get_unmapped_area(str
4502 addr = PAGE_ALIGN(addr);
4503
4504 vma = find_vma(mm, addr);
4505- if (task_size - len >= addr &&
4506- (!vma || addr + len <= vma->vm_start))
4507+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4508 return addr;
4509 }
4510
4511 if (len > mm->cached_hole_size) {
4512- start_addr = addr = mm->free_area_cache;
4513+ start_addr = addr = mm->free_area_cache;
4514 } else {
4515- start_addr = addr = TASK_UNMAPPED_BASE;
4516+ start_addr = addr = mm->mmap_base;
4517 mm->cached_hole_size = 0;
4518 }
4519
4520@@ -175,14 +178,14 @@ full_search:
4521 vma = find_vma(mm, VA_EXCLUDE_END);
4522 }
4523 if (unlikely(task_size < addr)) {
4524- if (start_addr != TASK_UNMAPPED_BASE) {
4525- start_addr = addr = TASK_UNMAPPED_BASE;
4526+ if (start_addr != mm->mmap_base) {
4527+ start_addr = addr = mm->mmap_base;
4528 mm->cached_hole_size = 0;
4529 goto full_search;
4530 }
4531 return -ENOMEM;
4532 }
4533- if (likely(!vma || addr + len <= vma->vm_start)) {
4534+ if (likely(check_heap_stack_gap(vma, addr, len))) {
4535 /*
4536 * Remember the place where we stopped the search:
4537 */
4538@@ -216,7 +219,7 @@ arch_get_unmapped_area_topdown(struct fi
4539 /* We do not accept a shared mapping if it would violate
4540 * cache aliasing constraints.
4541 */
4542- if ((flags & MAP_SHARED) &&
4543+ if ((filp || (flags & MAP_SHARED)) &&
4544 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4545 return -EINVAL;
4546 return addr;
4547@@ -237,8 +240,7 @@ arch_get_unmapped_area_topdown(struct fi
4548 addr = PAGE_ALIGN(addr);
4549
4550 vma = find_vma(mm, addr);
4551- if (task_size - len >= addr &&
4552- (!vma || addr + len <= vma->vm_start))
4553+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4554 return addr;
4555 }
4556
4557@@ -259,7 +261,7 @@ arch_get_unmapped_area_topdown(struct fi
4558 /* make sure it can fit in the remaining address space */
4559 if (likely(addr > len)) {
4560 vma = find_vma(mm, addr-len);
4561- if (!vma || addr <= vma->vm_start) {
4562+ if (check_heap_stack_gap(vma, addr - len, len)) {
4563 /* remember the address as a hint for next time */
4564 return (mm->free_area_cache = addr-len);
4565 }
4566@@ -268,18 +270,18 @@ arch_get_unmapped_area_topdown(struct fi
4567 if (unlikely(mm->mmap_base < len))
4568 goto bottomup;
4569
4570- addr = mm->mmap_base-len;
4571- if (do_color_align)
4572- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4573+ addr = mm->mmap_base - len;
4574
4575 do {
4576+ if (do_color_align)
4577+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4578 /*
4579 * Lookup failure means no vma is above this address,
4580 * else if new region fits below vma->vm_start,
4581 * return with success:
4582 */
4583 vma = find_vma(mm, addr);
4584- if (likely(!vma || addr+len <= vma->vm_start)) {
4585+ if (likely(check_heap_stack_gap(vma, addr, len))) {
4586 /* remember the address as a hint for next time */
4587 return (mm->free_area_cache = addr);
4588 }
4589@@ -289,10 +291,8 @@ arch_get_unmapped_area_topdown(struct fi
4590 mm->cached_hole_size = vma->vm_start - addr;
4591
4592 /* try just below the current vma->vm_start */
4593- addr = vma->vm_start-len;
4594- if (do_color_align)
4595- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4596- } while (likely(len < vma->vm_start));
4597+ addr = skip_heap_stack_gap(vma, len);
4598+ } while (!IS_ERR_VALUE(addr));
4599
4600 bottomup:
4601 /*
4602@@ -384,6 +384,12 @@ void arch_pick_mmap_layout(struct mm_str
4603 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
4604 sysctl_legacy_va_layout) {
4605 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4606+
4607+#ifdef CONFIG_PAX_RANDMMAP
4608+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4609+ mm->mmap_base += mm->delta_mmap;
4610+#endif
4611+
4612 mm->get_unmapped_area = arch_get_unmapped_area;
4613 mm->unmap_area = arch_unmap_area;
4614 } else {
4615@@ -398,6 +404,12 @@ void arch_pick_mmap_layout(struct mm_str
4616 gap = (task_size / 6 * 5);
4617
4618 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4619+
4620+#ifdef CONFIG_PAX_RANDMMAP
4621+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4622+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4623+#endif
4624+
4625 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4626 mm->unmap_area = arch_unmap_area_topdown;
4627 }
4628diff -urNp linux-2.6.32.46/arch/sparc/kernel/traps_32.c linux-2.6.32.46/arch/sparc/kernel/traps_32.c
4629--- linux-2.6.32.46/arch/sparc/kernel/traps_32.c 2011-03-27 14:31:47.000000000 -0400
4630+++ linux-2.6.32.46/arch/sparc/kernel/traps_32.c 2011-06-13 21:25:39.000000000 -0400
4631@@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
4632 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4633 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4634
4635+extern void gr_handle_kernel_exploit(void);
4636+
4637 void die_if_kernel(char *str, struct pt_regs *regs)
4638 {
4639 static int die_counter;
4640@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
4641 count++ < 30 &&
4642 (((unsigned long) rw) >= PAGE_OFFSET) &&
4643 !(((unsigned long) rw) & 0x7)) {
4644- printk("Caller[%08lx]: %pS\n", rw->ins[7],
4645+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
4646 (void *) rw->ins[7]);
4647 rw = (struct reg_window32 *)rw->ins[6];
4648 }
4649 }
4650 printk("Instruction DUMP:");
4651 instruction_dump ((unsigned long *) regs->pc);
4652- if(regs->psr & PSR_PS)
4653+ if(regs->psr & PSR_PS) {
4654+ gr_handle_kernel_exploit();
4655 do_exit(SIGKILL);
4656+ }
4657 do_exit(SIGSEGV);
4658 }
4659
4660diff -urNp linux-2.6.32.46/arch/sparc/kernel/traps_64.c linux-2.6.32.46/arch/sparc/kernel/traps_64.c
4661--- linux-2.6.32.46/arch/sparc/kernel/traps_64.c 2011-03-27 14:31:47.000000000 -0400
4662+++ linux-2.6.32.46/arch/sparc/kernel/traps_64.c 2011-06-13 21:24:11.000000000 -0400
4663@@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_
4664 i + 1,
4665 p->trapstack[i].tstate, p->trapstack[i].tpc,
4666 p->trapstack[i].tnpc, p->trapstack[i].tt);
4667- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4668+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4669 }
4670 }
4671
4672@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
4673
4674 lvl -= 0x100;
4675 if (regs->tstate & TSTATE_PRIV) {
4676+
4677+#ifdef CONFIG_PAX_REFCOUNT
4678+ if (lvl == 6)
4679+ pax_report_refcount_overflow(regs);
4680+#endif
4681+
4682 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4683 die_if_kernel(buffer, regs);
4684 }
4685@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
4686 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4687 {
4688 char buffer[32];
4689-
4690+
4691 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4692 0, lvl, SIGTRAP) == NOTIFY_STOP)
4693 return;
4694
4695+#ifdef CONFIG_PAX_REFCOUNT
4696+ if (lvl == 6)
4697+ pax_report_refcount_overflow(regs);
4698+#endif
4699+
4700 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4701
4702 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4703@@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt
4704 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4705 printk("%s" "ERROR(%d): ",
4706 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4707- printk("TPC<%pS>\n", (void *) regs->tpc);
4708+ printk("TPC<%pA>\n", (void *) regs->tpc);
4709 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4710 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4711 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4712@@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type,
4713 smp_processor_id(),
4714 (type & 0x1) ? 'I' : 'D',
4715 regs->tpc);
4716- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4717+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4718 panic("Irrecoverable Cheetah+ parity error.");
4719 }
4720
4721@@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type,
4722 smp_processor_id(),
4723 (type & 0x1) ? 'I' : 'D',
4724 regs->tpc);
4725- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4726+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4727 }
4728
4729 struct sun4v_error_entry {
4730@@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_r
4731
4732 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4733 regs->tpc, tl);
4734- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4735+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4736 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4737- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4738+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4739 (void *) regs->u_regs[UREG_I7]);
4740 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4741 "pte[%lx] error[%lx]\n",
4742@@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_r
4743
4744 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4745 regs->tpc, tl);
4746- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4747+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4748 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4749- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4750+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4751 (void *) regs->u_regs[UREG_I7]);
4752 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4753 "pte[%lx] error[%lx]\n",
4754@@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk,
4755 fp = (unsigned long)sf->fp + STACK_BIAS;
4756 }
4757
4758- printk(" [%016lx] %pS\n", pc, (void *) pc);
4759+ printk(" [%016lx] %pA\n", pc, (void *) pc);
4760 } while (++count < 16);
4761 }
4762
4763@@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_
4764 return (struct reg_window *) (fp + STACK_BIAS);
4765 }
4766
4767+extern void gr_handle_kernel_exploit(void);
4768+
4769 void die_if_kernel(char *str, struct pt_regs *regs)
4770 {
4771 static int die_counter;
4772@@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_
4773 while (rw &&
4774 count++ < 30&&
4775 is_kernel_stack(current, rw)) {
4776- printk("Caller[%016lx]: %pS\n", rw->ins[7],
4777+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
4778 (void *) rw->ins[7]);
4779
4780 rw = kernel_stack_up(rw);
4781@@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_
4782 }
4783 user_instruction_dump ((unsigned int __user *) regs->tpc);
4784 }
4785- if (regs->tstate & TSTATE_PRIV)
4786+ if (regs->tstate & TSTATE_PRIV) {
4787+ gr_handle_kernel_exploit();
4788 do_exit(SIGKILL);
4789+ }
4790+
4791 do_exit(SIGSEGV);
4792 }
4793 EXPORT_SYMBOL(die_if_kernel);
4794diff -urNp linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S
4795--- linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S 2011-03-27 14:31:47.000000000 -0400
4796+++ linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S 2011-07-13 22:20:05.000000000 -0400
4797@@ -127,7 +127,7 @@ do_int_load:
4798 wr %o5, 0x0, %asi
4799 retl
4800 mov 0, %o0
4801- .size __do_int_load, .-__do_int_load
4802+ .size do_int_load, .-do_int_load
4803
4804 .section __ex_table,"a"
4805 .word 4b, __retl_efault
4806diff -urNp linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c
4807--- linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c 2011-03-27 14:31:47.000000000 -0400
4808+++ linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c 2011-04-17 15:56:46.000000000 -0400
4809@@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs
4810 if (count < 5) {
4811 last_time = jiffies;
4812 count++;
4813- printk("Kernel unaligned access at TPC[%lx] %pS\n",
4814+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
4815 regs->tpc, (void *) regs->tpc);
4816 }
4817 }
4818diff -urNp linux-2.6.32.46/arch/sparc/lib/atomic_64.S linux-2.6.32.46/arch/sparc/lib/atomic_64.S
4819--- linux-2.6.32.46/arch/sparc/lib/atomic_64.S 2011-03-27 14:31:47.000000000 -0400
4820+++ linux-2.6.32.46/arch/sparc/lib/atomic_64.S 2011-04-17 15:56:46.000000000 -0400
4821@@ -18,7 +18,12 @@
4822 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4823 BACKOFF_SETUP(%o2)
4824 1: lduw [%o1], %g1
4825- add %g1, %o0, %g7
4826+ addcc %g1, %o0, %g7
4827+
4828+#ifdef CONFIG_PAX_REFCOUNT
4829+ tvs %icc, 6
4830+#endif
4831+
4832 cas [%o1], %g1, %g7
4833 cmp %g1, %g7
4834 bne,pn %icc, 2f
4835@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
4836 2: BACKOFF_SPIN(%o2, %o3, 1b)
4837 .size atomic_add, .-atomic_add
4838
4839+ .globl atomic_add_unchecked
4840+ .type atomic_add_unchecked,#function
4841+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4842+ BACKOFF_SETUP(%o2)
4843+1: lduw [%o1], %g1
4844+ add %g1, %o0, %g7
4845+ cas [%o1], %g1, %g7
4846+ cmp %g1, %g7
4847+ bne,pn %icc, 2f
4848+ nop
4849+ retl
4850+ nop
4851+2: BACKOFF_SPIN(%o2, %o3, 1b)
4852+ .size atomic_add_unchecked, .-atomic_add_unchecked
4853+
4854 .globl atomic_sub
4855 .type atomic_sub,#function
4856 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4857 BACKOFF_SETUP(%o2)
4858 1: lduw [%o1], %g1
4859- sub %g1, %o0, %g7
4860+ subcc %g1, %o0, %g7
4861+
4862+#ifdef CONFIG_PAX_REFCOUNT
4863+ tvs %icc, 6
4864+#endif
4865+
4866 cas [%o1], %g1, %g7
4867 cmp %g1, %g7
4868 bne,pn %icc, 2f
4869@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
4870 2: BACKOFF_SPIN(%o2, %o3, 1b)
4871 .size atomic_sub, .-atomic_sub
4872
4873+ .globl atomic_sub_unchecked
4874+ .type atomic_sub_unchecked,#function
4875+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4876+ BACKOFF_SETUP(%o2)
4877+1: lduw [%o1], %g1
4878+ sub %g1, %o0, %g7
4879+ cas [%o1], %g1, %g7
4880+ cmp %g1, %g7
4881+ bne,pn %icc, 2f
4882+ nop
4883+ retl
4884+ nop
4885+2: BACKOFF_SPIN(%o2, %o3, 1b)
4886+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
4887+
4888 .globl atomic_add_ret
4889 .type atomic_add_ret,#function
4890 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4891 BACKOFF_SETUP(%o2)
4892 1: lduw [%o1], %g1
4893- add %g1, %o0, %g7
4894+ addcc %g1, %o0, %g7
4895+
4896+#ifdef CONFIG_PAX_REFCOUNT
4897+ tvs %icc, 6
4898+#endif
4899+
4900 cas [%o1], %g1, %g7
4901 cmp %g1, %g7
4902 bne,pn %icc, 2f
4903@@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1
4904 2: BACKOFF_SPIN(%o2, %o3, 1b)
4905 .size atomic_add_ret, .-atomic_add_ret
4906
4907+ .globl atomic_add_ret_unchecked
4908+ .type atomic_add_ret_unchecked,#function
4909+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4910+ BACKOFF_SETUP(%o2)
4911+1: lduw [%o1], %g1
4912+ addcc %g1, %o0, %g7
4913+ cas [%o1], %g1, %g7
4914+ cmp %g1, %g7
4915+ bne,pn %icc, 2f
4916+ add %g7, %o0, %g7
4917+ sra %g7, 0, %o0
4918+ retl
4919+ nop
4920+2: BACKOFF_SPIN(%o2, %o3, 1b)
4921+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4922+
4923 .globl atomic_sub_ret
4924 .type atomic_sub_ret,#function
4925 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4926 BACKOFF_SETUP(%o2)
4927 1: lduw [%o1], %g1
4928- sub %g1, %o0, %g7
4929+ subcc %g1, %o0, %g7
4930+
4931+#ifdef CONFIG_PAX_REFCOUNT
4932+ tvs %icc, 6
4933+#endif
4934+
4935 cas [%o1], %g1, %g7
4936 cmp %g1, %g7
4937 bne,pn %icc, 2f
4938@@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
4939 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4940 BACKOFF_SETUP(%o2)
4941 1: ldx [%o1], %g1
4942- add %g1, %o0, %g7
4943+ addcc %g1, %o0, %g7
4944+
4945+#ifdef CONFIG_PAX_REFCOUNT
4946+ tvs %xcc, 6
4947+#endif
4948+
4949 casx [%o1], %g1, %g7
4950 cmp %g1, %g7
4951 bne,pn %xcc, 2f
4952@@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 =
4953 2: BACKOFF_SPIN(%o2, %o3, 1b)
4954 .size atomic64_add, .-atomic64_add
4955
4956+ .globl atomic64_add_unchecked
4957+ .type atomic64_add_unchecked,#function
4958+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4959+ BACKOFF_SETUP(%o2)
4960+1: ldx [%o1], %g1
4961+ addcc %g1, %o0, %g7
4962+ casx [%o1], %g1, %g7
4963+ cmp %g1, %g7
4964+ bne,pn %xcc, 2f
4965+ nop
4966+ retl
4967+ nop
4968+2: BACKOFF_SPIN(%o2, %o3, 1b)
4969+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
4970+
4971 .globl atomic64_sub
4972 .type atomic64_sub,#function
4973 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4974 BACKOFF_SETUP(%o2)
4975 1: ldx [%o1], %g1
4976- sub %g1, %o0, %g7
4977+ subcc %g1, %o0, %g7
4978+
4979+#ifdef CONFIG_PAX_REFCOUNT
4980+ tvs %xcc, 6
4981+#endif
4982+
4983 casx [%o1], %g1, %g7
4984 cmp %g1, %g7
4985 bne,pn %xcc, 2f
4986@@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
4987 2: BACKOFF_SPIN(%o2, %o3, 1b)
4988 .size atomic64_sub, .-atomic64_sub
4989
4990+ .globl atomic64_sub_unchecked
4991+ .type atomic64_sub_unchecked,#function
4992+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4993+ BACKOFF_SETUP(%o2)
4994+1: ldx [%o1], %g1
4995+ subcc %g1, %o0, %g7
4996+ casx [%o1], %g1, %g7
4997+ cmp %g1, %g7
4998+ bne,pn %xcc, 2f
4999+ nop
5000+ retl
5001+ nop
5002+2: BACKOFF_SPIN(%o2, %o3, 1b)
5003+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
5004+
5005 .globl atomic64_add_ret
5006 .type atomic64_add_ret,#function
5007 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
5008 BACKOFF_SETUP(%o2)
5009 1: ldx [%o1], %g1
5010- add %g1, %o0, %g7
5011+ addcc %g1, %o0, %g7
5012+
5013+#ifdef CONFIG_PAX_REFCOUNT
5014+ tvs %xcc, 6
5015+#endif
5016+
5017 casx [%o1], %g1, %g7
5018 cmp %g1, %g7
5019 bne,pn %xcc, 2f
5020@@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o
5021 2: BACKOFF_SPIN(%o2, %o3, 1b)
5022 .size atomic64_add_ret, .-atomic64_add_ret
5023
5024+ .globl atomic64_add_ret_unchecked
5025+ .type atomic64_add_ret_unchecked,#function
5026+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
5027+ BACKOFF_SETUP(%o2)
5028+1: ldx [%o1], %g1
5029+ addcc %g1, %o0, %g7
5030+ casx [%o1], %g1, %g7
5031+ cmp %g1, %g7
5032+ bne,pn %xcc, 2f
5033+ add %g7, %o0, %g7
5034+ mov %g7, %o0
5035+ retl
5036+ nop
5037+2: BACKOFF_SPIN(%o2, %o3, 1b)
5038+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
5039+
5040 .globl atomic64_sub_ret
5041 .type atomic64_sub_ret,#function
5042 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
5043 BACKOFF_SETUP(%o2)
5044 1: ldx [%o1], %g1
5045- sub %g1, %o0, %g7
5046+ subcc %g1, %o0, %g7
5047+
5048+#ifdef CONFIG_PAX_REFCOUNT
5049+ tvs %xcc, 6
5050+#endif
5051+
5052 casx [%o1], %g1, %g7
5053 cmp %g1, %g7
5054 bne,pn %xcc, 2f
5055diff -urNp linux-2.6.32.46/arch/sparc/lib/ksyms.c linux-2.6.32.46/arch/sparc/lib/ksyms.c
5056--- linux-2.6.32.46/arch/sparc/lib/ksyms.c 2011-03-27 14:31:47.000000000 -0400
5057+++ linux-2.6.32.46/arch/sparc/lib/ksyms.c 2011-08-19 23:05:14.000000000 -0400
5058@@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
5059
5060 /* Atomic counter implementation. */
5061 EXPORT_SYMBOL(atomic_add);
5062+EXPORT_SYMBOL(atomic_add_unchecked);
5063 EXPORT_SYMBOL(atomic_add_ret);
5064+EXPORT_SYMBOL(atomic_add_ret_unchecked);
5065 EXPORT_SYMBOL(atomic_sub);
5066+EXPORT_SYMBOL(atomic_sub_unchecked);
5067 EXPORT_SYMBOL(atomic_sub_ret);
5068 EXPORT_SYMBOL(atomic64_add);
5069+EXPORT_SYMBOL(atomic64_add_unchecked);
5070 EXPORT_SYMBOL(atomic64_add_ret);
5071+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
5072 EXPORT_SYMBOL(atomic64_sub);
5073+EXPORT_SYMBOL(atomic64_sub_unchecked);
5074 EXPORT_SYMBOL(atomic64_sub_ret);
5075
5076 /* Atomic bit operations. */
5077diff -urNp linux-2.6.32.46/arch/sparc/lib/Makefile linux-2.6.32.46/arch/sparc/lib/Makefile
5078--- linux-2.6.32.46/arch/sparc/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
5079+++ linux-2.6.32.46/arch/sparc/lib/Makefile 2011-05-17 19:26:34.000000000 -0400
5080@@ -2,7 +2,7 @@
5081 #
5082
5083 asflags-y := -ansi -DST_DIV0=0x02
5084-ccflags-y := -Werror
5085+#ccflags-y := -Werror
5086
5087 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
5088 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
5089diff -urNp linux-2.6.32.46/arch/sparc/lib/rwsem_64.S linux-2.6.32.46/arch/sparc/lib/rwsem_64.S
5090--- linux-2.6.32.46/arch/sparc/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
5091+++ linux-2.6.32.46/arch/sparc/lib/rwsem_64.S 2011-04-17 15:56:46.000000000 -0400
5092@@ -11,7 +11,12 @@
5093 .globl __down_read
5094 __down_read:
5095 1: lduw [%o0], %g1
5096- add %g1, 1, %g7
5097+ addcc %g1, 1, %g7
5098+
5099+#ifdef CONFIG_PAX_REFCOUNT
5100+ tvs %icc, 6
5101+#endif
5102+
5103 cas [%o0], %g1, %g7
5104 cmp %g1, %g7
5105 bne,pn %icc, 1b
5106@@ -33,7 +38,12 @@ __down_read:
5107 .globl __down_read_trylock
5108 __down_read_trylock:
5109 1: lduw [%o0], %g1
5110- add %g1, 1, %g7
5111+ addcc %g1, 1, %g7
5112+
5113+#ifdef CONFIG_PAX_REFCOUNT
5114+ tvs %icc, 6
5115+#endif
5116+
5117 cmp %g7, 0
5118 bl,pn %icc, 2f
5119 mov 0, %o1
5120@@ -51,7 +61,12 @@ __down_write:
5121 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5122 1:
5123 lduw [%o0], %g3
5124- add %g3, %g1, %g7
5125+ addcc %g3, %g1, %g7
5126+
5127+#ifdef CONFIG_PAX_REFCOUNT
5128+ tvs %icc, 6
5129+#endif
5130+
5131 cas [%o0], %g3, %g7
5132 cmp %g3, %g7
5133 bne,pn %icc, 1b
5134@@ -77,7 +92,12 @@ __down_write_trylock:
5135 cmp %g3, 0
5136 bne,pn %icc, 2f
5137 mov 0, %o1
5138- add %g3, %g1, %g7
5139+ addcc %g3, %g1, %g7
5140+
5141+#ifdef CONFIG_PAX_REFCOUNT
5142+ tvs %icc, 6
5143+#endif
5144+
5145 cas [%o0], %g3, %g7
5146 cmp %g3, %g7
5147 bne,pn %icc, 1b
5148@@ -90,7 +110,12 @@ __down_write_trylock:
5149 __up_read:
5150 1:
5151 lduw [%o0], %g1
5152- sub %g1, 1, %g7
5153+ subcc %g1, 1, %g7
5154+
5155+#ifdef CONFIG_PAX_REFCOUNT
5156+ tvs %icc, 6
5157+#endif
5158+
5159 cas [%o0], %g1, %g7
5160 cmp %g1, %g7
5161 bne,pn %icc, 1b
5162@@ -118,7 +143,12 @@ __up_write:
5163 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5164 1:
5165 lduw [%o0], %g3
5166- sub %g3, %g1, %g7
5167+ subcc %g3, %g1, %g7
5168+
5169+#ifdef CONFIG_PAX_REFCOUNT
5170+ tvs %icc, 6
5171+#endif
5172+
5173 cas [%o0], %g3, %g7
5174 cmp %g3, %g7
5175 bne,pn %icc, 1b
5176@@ -143,7 +173,12 @@ __downgrade_write:
5177 or %g1, %lo(RWSEM_WAITING_BIAS), %g1
5178 1:
5179 lduw [%o0], %g3
5180- sub %g3, %g1, %g7
5181+ subcc %g3, %g1, %g7
5182+
5183+#ifdef CONFIG_PAX_REFCOUNT
5184+ tvs %icc, 6
5185+#endif
5186+
5187 cas [%o0], %g3, %g7
5188 cmp %g3, %g7
5189 bne,pn %icc, 1b
5190diff -urNp linux-2.6.32.46/arch/sparc/Makefile linux-2.6.32.46/arch/sparc/Makefile
5191--- linux-2.6.32.46/arch/sparc/Makefile 2011-03-27 14:31:47.000000000 -0400
5192+++ linux-2.6.32.46/arch/sparc/Makefile 2011-04-17 15:56:46.000000000 -0400
5193@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
5194 # Export what is needed by arch/sparc/boot/Makefile
5195 export VMLINUX_INIT VMLINUX_MAIN
5196 VMLINUX_INIT := $(head-y) $(init-y)
5197-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
5198+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
5199 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
5200 VMLINUX_MAIN += $(drivers-y) $(net-y)
5201
5202diff -urNp linux-2.6.32.46/arch/sparc/mm/fault_32.c linux-2.6.32.46/arch/sparc/mm/fault_32.c
5203--- linux-2.6.32.46/arch/sparc/mm/fault_32.c 2011-03-27 14:31:47.000000000 -0400
5204+++ linux-2.6.32.46/arch/sparc/mm/fault_32.c 2011-04-17 15:56:46.000000000 -0400
5205@@ -21,6 +21,9 @@
5206 #include <linux/interrupt.h>
5207 #include <linux/module.h>
5208 #include <linux/kdebug.h>
5209+#include <linux/slab.h>
5210+#include <linux/pagemap.h>
5211+#include <linux/compiler.h>
5212
5213 #include <asm/system.h>
5214 #include <asm/page.h>
5215@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
5216 return safe_compute_effective_address(regs, insn);
5217 }
5218
5219+#ifdef CONFIG_PAX_PAGEEXEC
5220+#ifdef CONFIG_PAX_DLRESOLVE
5221+static void pax_emuplt_close(struct vm_area_struct *vma)
5222+{
5223+ vma->vm_mm->call_dl_resolve = 0UL;
5224+}
5225+
5226+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5227+{
5228+ unsigned int *kaddr;
5229+
5230+ vmf->page = alloc_page(GFP_HIGHUSER);
5231+ if (!vmf->page)
5232+ return VM_FAULT_OOM;
5233+
5234+ kaddr = kmap(vmf->page);
5235+ memset(kaddr, 0, PAGE_SIZE);
5236+ kaddr[0] = 0x9DE3BFA8U; /* save */
5237+ flush_dcache_page(vmf->page);
5238+ kunmap(vmf->page);
5239+ return VM_FAULT_MAJOR;
5240+}
5241+
5242+static const struct vm_operations_struct pax_vm_ops = {
5243+ .close = pax_emuplt_close,
5244+ .fault = pax_emuplt_fault
5245+};
5246+
5247+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5248+{
5249+ int ret;
5250+
5251+ vma->vm_mm = current->mm;
5252+ vma->vm_start = addr;
5253+ vma->vm_end = addr + PAGE_SIZE;
5254+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5255+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5256+ vma->vm_ops = &pax_vm_ops;
5257+
5258+ ret = insert_vm_struct(current->mm, vma);
5259+ if (ret)
5260+ return ret;
5261+
5262+ ++current->mm->total_vm;
5263+ return 0;
5264+}
5265+#endif
5266+
5267+/*
5268+ * PaX: decide what to do with offenders (regs->pc = fault address)
5269+ *
5270+ * returns 1 when task should be killed
5271+ * 2 when patched PLT trampoline was detected
5272+ * 3 when unpatched PLT trampoline was detected
5273+ */
5274+static int pax_handle_fetch_fault(struct pt_regs *regs)
5275+{
5276+
5277+#ifdef CONFIG_PAX_EMUPLT
5278+ int err;
5279+
5280+ do { /* PaX: patched PLT emulation #1 */
5281+ unsigned int sethi1, sethi2, jmpl;
5282+
5283+ err = get_user(sethi1, (unsigned int *)regs->pc);
5284+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
5285+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
5286+
5287+ if (err)
5288+ break;
5289+
5290+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5291+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
5292+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
5293+ {
5294+ unsigned int addr;
5295+
5296+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5297+ addr = regs->u_regs[UREG_G1];
5298+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5299+ regs->pc = addr;
5300+ regs->npc = addr+4;
5301+ return 2;
5302+ }
5303+ } while (0);
5304+
5305+ { /* PaX: patched PLT emulation #2 */
5306+ unsigned int ba;
5307+
5308+ err = get_user(ba, (unsigned int *)regs->pc);
5309+
5310+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5311+ unsigned int addr;
5312+
5313+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5314+ regs->pc = addr;
5315+ regs->npc = addr+4;
5316+ return 2;
5317+ }
5318+ }
5319+
5320+ do { /* PaX: patched PLT emulation #3 */
5321+ unsigned int sethi, jmpl, nop;
5322+
5323+ err = get_user(sethi, (unsigned int *)regs->pc);
5324+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
5325+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
5326+
5327+ if (err)
5328+ break;
5329+
5330+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5331+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5332+ nop == 0x01000000U)
5333+ {
5334+ unsigned int addr;
5335+
5336+ addr = (sethi & 0x003FFFFFU) << 10;
5337+ regs->u_regs[UREG_G1] = addr;
5338+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5339+ regs->pc = addr;
5340+ regs->npc = addr+4;
5341+ return 2;
5342+ }
5343+ } while (0);
5344+
5345+ do { /* PaX: unpatched PLT emulation step 1 */
5346+ unsigned int sethi, ba, nop;
5347+
5348+ err = get_user(sethi, (unsigned int *)regs->pc);
5349+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
5350+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
5351+
5352+ if (err)
5353+ break;
5354+
5355+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5356+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5357+ nop == 0x01000000U)
5358+ {
5359+ unsigned int addr, save, call;
5360+
5361+ if ((ba & 0xFFC00000U) == 0x30800000U)
5362+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5363+ else
5364+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
5365+
5366+ err = get_user(save, (unsigned int *)addr);
5367+ err |= get_user(call, (unsigned int *)(addr+4));
5368+ err |= get_user(nop, (unsigned int *)(addr+8));
5369+ if (err)
5370+ break;
5371+
5372+#ifdef CONFIG_PAX_DLRESOLVE
5373+ if (save == 0x9DE3BFA8U &&
5374+ (call & 0xC0000000U) == 0x40000000U &&
5375+ nop == 0x01000000U)
5376+ {
5377+ struct vm_area_struct *vma;
5378+ unsigned long call_dl_resolve;
5379+
5380+ down_read(&current->mm->mmap_sem);
5381+ call_dl_resolve = current->mm->call_dl_resolve;
5382+ up_read(&current->mm->mmap_sem);
5383+ if (likely(call_dl_resolve))
5384+ goto emulate;
5385+
5386+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5387+
5388+ down_write(&current->mm->mmap_sem);
5389+ if (current->mm->call_dl_resolve) {
5390+ call_dl_resolve = current->mm->call_dl_resolve;
5391+ up_write(&current->mm->mmap_sem);
5392+ if (vma)
5393+ kmem_cache_free(vm_area_cachep, vma);
5394+ goto emulate;
5395+ }
5396+
5397+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5398+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5399+ up_write(&current->mm->mmap_sem);
5400+ if (vma)
5401+ kmem_cache_free(vm_area_cachep, vma);
5402+ return 1;
5403+ }
5404+
5405+ if (pax_insert_vma(vma, call_dl_resolve)) {
5406+ up_write(&current->mm->mmap_sem);
5407+ kmem_cache_free(vm_area_cachep, vma);
5408+ return 1;
5409+ }
5410+
5411+ current->mm->call_dl_resolve = call_dl_resolve;
5412+ up_write(&current->mm->mmap_sem);
5413+
5414+emulate:
5415+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5416+ regs->pc = call_dl_resolve;
5417+ regs->npc = addr+4;
5418+ return 3;
5419+ }
5420+#endif
5421+
5422+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5423+ if ((save & 0xFFC00000U) == 0x05000000U &&
5424+ (call & 0xFFFFE000U) == 0x85C0A000U &&
5425+ nop == 0x01000000U)
5426+ {
5427+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5428+ regs->u_regs[UREG_G2] = addr + 4;
5429+ addr = (save & 0x003FFFFFU) << 10;
5430+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5431+ regs->pc = addr;
5432+ regs->npc = addr+4;
5433+ return 3;
5434+ }
5435+ }
5436+ } while (0);
5437+
5438+ do { /* PaX: unpatched PLT emulation step 2 */
5439+ unsigned int save, call, nop;
5440+
5441+ err = get_user(save, (unsigned int *)(regs->pc-4));
5442+ err |= get_user(call, (unsigned int *)regs->pc);
5443+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
5444+ if (err)
5445+ break;
5446+
5447+ if (save == 0x9DE3BFA8U &&
5448+ (call & 0xC0000000U) == 0x40000000U &&
5449+ nop == 0x01000000U)
5450+ {
5451+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
5452+
5453+ regs->u_regs[UREG_RETPC] = regs->pc;
5454+ regs->pc = dl_resolve;
5455+ regs->npc = dl_resolve+4;
5456+ return 3;
5457+ }
5458+ } while (0);
5459+#endif
5460+
5461+ return 1;
5462+}
5463+
5464+void pax_report_insns(void *pc, void *sp)
5465+{
5466+ unsigned long i;
5467+
5468+ printk(KERN_ERR "PAX: bytes at PC: ");
5469+ for (i = 0; i < 8; i++) {
5470+ unsigned int c;
5471+ if (get_user(c, (unsigned int *)pc+i))
5472+ printk(KERN_CONT "???????? ");
5473+ else
5474+ printk(KERN_CONT "%08x ", c);
5475+ }
5476+ printk("\n");
5477+}
5478+#endif
5479+
5480 asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
5481 unsigned long address)
5482 {
5483@@ -231,6 +495,24 @@ good_area:
5484 if(!(vma->vm_flags & VM_WRITE))
5485 goto bad_area;
5486 } else {
5487+
5488+#ifdef CONFIG_PAX_PAGEEXEC
5489+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
5490+ up_read(&mm->mmap_sem);
5491+ switch (pax_handle_fetch_fault(regs)) {
5492+
5493+#ifdef CONFIG_PAX_EMUPLT
5494+ case 2:
5495+ case 3:
5496+ return;
5497+#endif
5498+
5499+ }
5500+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
5501+ do_group_exit(SIGKILL);
5502+ }
5503+#endif
5504+
5505 /* Allow reads even for write-only mappings */
5506 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
5507 goto bad_area;
5508diff -urNp linux-2.6.32.46/arch/sparc/mm/fault_64.c linux-2.6.32.46/arch/sparc/mm/fault_64.c
5509--- linux-2.6.32.46/arch/sparc/mm/fault_64.c 2011-03-27 14:31:47.000000000 -0400
5510+++ linux-2.6.32.46/arch/sparc/mm/fault_64.c 2011-04-17 15:56:46.000000000 -0400
5511@@ -20,6 +20,9 @@
5512 #include <linux/kprobes.h>
5513 #include <linux/kdebug.h>
5514 #include <linux/percpu.h>
5515+#include <linux/slab.h>
5516+#include <linux/pagemap.h>
5517+#include <linux/compiler.h>
5518
5519 #include <asm/page.h>
5520 #include <asm/pgtable.h>
5521@@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs
5522 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
5523 regs->tpc);
5524 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
5525- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
5526+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
5527 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
5528 dump_stack();
5529 unhandled_fault(regs->tpc, current, regs);
5530@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
5531 show_regs(regs);
5532 }
5533
5534+#ifdef CONFIG_PAX_PAGEEXEC
5535+#ifdef CONFIG_PAX_DLRESOLVE
5536+static void pax_emuplt_close(struct vm_area_struct *vma)
5537+{
5538+ vma->vm_mm->call_dl_resolve = 0UL;
5539+}
5540+
5541+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5542+{
5543+ unsigned int *kaddr;
5544+
5545+ vmf->page = alloc_page(GFP_HIGHUSER);
5546+ if (!vmf->page)
5547+ return VM_FAULT_OOM;
5548+
5549+ kaddr = kmap(vmf->page);
5550+ memset(kaddr, 0, PAGE_SIZE);
5551+ kaddr[0] = 0x9DE3BFA8U; /* save */
5552+ flush_dcache_page(vmf->page);
5553+ kunmap(vmf->page);
5554+ return VM_FAULT_MAJOR;
5555+}
5556+
5557+static const struct vm_operations_struct pax_vm_ops = {
5558+ .close = pax_emuplt_close,
5559+ .fault = pax_emuplt_fault
5560+};
5561+
5562+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5563+{
5564+ int ret;
5565+
5566+ vma->vm_mm = current->mm;
5567+ vma->vm_start = addr;
5568+ vma->vm_end = addr + PAGE_SIZE;
5569+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5570+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5571+ vma->vm_ops = &pax_vm_ops;
5572+
5573+ ret = insert_vm_struct(current->mm, vma);
5574+ if (ret)
5575+ return ret;
5576+
5577+ ++current->mm->total_vm;
5578+ return 0;
5579+}
5580+#endif
5581+
5582+/*
5583+ * PaX: decide what to do with offenders (regs->tpc = fault address)
5584+ *
5585+ * returns 1 when task should be killed
5586+ * 2 when patched PLT trampoline was detected
5587+ * 3 when unpatched PLT trampoline was detected
5588+ */
5589+static int pax_handle_fetch_fault(struct pt_regs *regs)
5590+{
5591+
5592+#ifdef CONFIG_PAX_EMUPLT
5593+ int err;
5594+
5595+ do { /* PaX: patched PLT emulation #1 */
5596+ unsigned int sethi1, sethi2, jmpl;
5597+
5598+ err = get_user(sethi1, (unsigned int *)regs->tpc);
5599+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
5600+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
5601+
5602+ if (err)
5603+ break;
5604+
5605+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5606+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
5607+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
5608+ {
5609+ unsigned long addr;
5610+
5611+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5612+ addr = regs->u_regs[UREG_G1];
5613+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5614+
5615+ if (test_thread_flag(TIF_32BIT))
5616+ addr &= 0xFFFFFFFFUL;
5617+
5618+ regs->tpc = addr;
5619+ regs->tnpc = addr+4;
5620+ return 2;
5621+ }
5622+ } while (0);
5623+
5624+ { /* PaX: patched PLT emulation #2 */
5625+ unsigned int ba;
5626+
5627+ err = get_user(ba, (unsigned int *)regs->tpc);
5628+
5629+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5630+ unsigned long addr;
5631+
5632+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5633+
5634+ if (test_thread_flag(TIF_32BIT))
5635+ addr &= 0xFFFFFFFFUL;
5636+
5637+ regs->tpc = addr;
5638+ regs->tnpc = addr+4;
5639+ return 2;
5640+ }
5641+ }
5642+
5643+ do { /* PaX: patched PLT emulation #3 */
5644+ unsigned int sethi, jmpl, nop;
5645+
5646+ err = get_user(sethi, (unsigned int *)regs->tpc);
5647+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5648+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5649+
5650+ if (err)
5651+ break;
5652+
5653+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5654+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5655+ nop == 0x01000000U)
5656+ {
5657+ unsigned long addr;
5658+
5659+ addr = (sethi & 0x003FFFFFU) << 10;
5660+ regs->u_regs[UREG_G1] = addr;
5661+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5662+
5663+ if (test_thread_flag(TIF_32BIT))
5664+ addr &= 0xFFFFFFFFUL;
5665+
5666+ regs->tpc = addr;
5667+ regs->tnpc = addr+4;
5668+ return 2;
5669+ }
5670+ } while (0);
5671+
5672+ do { /* PaX: patched PLT emulation #4 */
5673+ unsigned int sethi, mov1, call, mov2;
5674+
5675+ err = get_user(sethi, (unsigned int *)regs->tpc);
5676+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5677+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
5678+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5679+
5680+ if (err)
5681+ break;
5682+
5683+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5684+ mov1 == 0x8210000FU &&
5685+ (call & 0xC0000000U) == 0x40000000U &&
5686+ mov2 == 0x9E100001U)
5687+ {
5688+ unsigned long addr;
5689+
5690+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5691+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5692+
5693+ if (test_thread_flag(TIF_32BIT))
5694+ addr &= 0xFFFFFFFFUL;
5695+
5696+ regs->tpc = addr;
5697+ regs->tnpc = addr+4;
5698+ return 2;
5699+ }
5700+ } while (0);
5701+
5702+ do { /* PaX: patched PLT emulation #5 */
5703+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5704+
5705+ err = get_user(sethi, (unsigned int *)regs->tpc);
5706+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5707+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5708+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5709+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5710+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5711+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5712+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5713+
5714+ if (err)
5715+ break;
5716+
5717+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5718+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5719+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5720+ (or1 & 0xFFFFE000U) == 0x82106000U &&
5721+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5722+ sllx == 0x83287020U &&
5723+ jmpl == 0x81C04005U &&
5724+ nop == 0x01000000U)
5725+ {
5726+ unsigned long addr;
5727+
5728+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5729+ regs->u_regs[UREG_G1] <<= 32;
5730+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5731+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5732+ regs->tpc = addr;
5733+ regs->tnpc = addr+4;
5734+ return 2;
5735+ }
5736+ } while (0);
5737+
5738+ do { /* PaX: patched PLT emulation #6 */
5739+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5740+
5741+ err = get_user(sethi, (unsigned int *)regs->tpc);
5742+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5743+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5744+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5745+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
5746+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5747+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5748+
5749+ if (err)
5750+ break;
5751+
5752+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5753+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
5754+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5755+ sllx == 0x83287020U &&
5756+ (or & 0xFFFFE000U) == 0x8A116000U &&
5757+ jmpl == 0x81C04005U &&
5758+ nop == 0x01000000U)
5759+ {
5760+ unsigned long addr;
5761+
5762+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5763+ regs->u_regs[UREG_G1] <<= 32;
5764+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5765+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5766+ regs->tpc = addr;
5767+ regs->tnpc = addr+4;
5768+ return 2;
5769+ }
5770+ } while (0);
5771+
5772+ do { /* PaX: unpatched PLT emulation step 1 */
5773+ unsigned int sethi, ba, nop;
5774+
5775+ err = get_user(sethi, (unsigned int *)regs->tpc);
5776+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5777+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5778+
5779+ if (err)
5780+ break;
5781+
5782+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5783+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5784+ nop == 0x01000000U)
5785+ {
5786+ unsigned long addr;
5787+ unsigned int save, call;
5788+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5789+
5790+ if ((ba & 0xFFC00000U) == 0x30800000U)
5791+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5792+ else
5793+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5794+
5795+ if (test_thread_flag(TIF_32BIT))
5796+ addr &= 0xFFFFFFFFUL;
5797+
5798+ err = get_user(save, (unsigned int *)addr);
5799+ err |= get_user(call, (unsigned int *)(addr+4));
5800+ err |= get_user(nop, (unsigned int *)(addr+8));
5801+ if (err)
5802+ break;
5803+
5804+#ifdef CONFIG_PAX_DLRESOLVE
5805+ if (save == 0x9DE3BFA8U &&
5806+ (call & 0xC0000000U) == 0x40000000U &&
5807+ nop == 0x01000000U)
5808+ {
5809+ struct vm_area_struct *vma;
5810+ unsigned long call_dl_resolve;
5811+
5812+ down_read(&current->mm->mmap_sem);
5813+ call_dl_resolve = current->mm->call_dl_resolve;
5814+ up_read(&current->mm->mmap_sem);
5815+ if (likely(call_dl_resolve))
5816+ goto emulate;
5817+
5818+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5819+
5820+ down_write(&current->mm->mmap_sem);
5821+ if (current->mm->call_dl_resolve) {
5822+ call_dl_resolve = current->mm->call_dl_resolve;
5823+ up_write(&current->mm->mmap_sem);
5824+ if (vma)
5825+ kmem_cache_free(vm_area_cachep, vma);
5826+ goto emulate;
5827+ }
5828+
5829+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5830+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5831+ up_write(&current->mm->mmap_sem);
5832+ if (vma)
5833+ kmem_cache_free(vm_area_cachep, vma);
5834+ return 1;
5835+ }
5836+
5837+ if (pax_insert_vma(vma, call_dl_resolve)) {
5838+ up_write(&current->mm->mmap_sem);
5839+ kmem_cache_free(vm_area_cachep, vma);
5840+ return 1;
5841+ }
5842+
5843+ current->mm->call_dl_resolve = call_dl_resolve;
5844+ up_write(&current->mm->mmap_sem);
5845+
5846+emulate:
5847+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5848+ regs->tpc = call_dl_resolve;
5849+ regs->tnpc = addr+4;
5850+ return 3;
5851+ }
5852+#endif
5853+
5854+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5855+ if ((save & 0xFFC00000U) == 0x05000000U &&
5856+ (call & 0xFFFFE000U) == 0x85C0A000U &&
5857+ nop == 0x01000000U)
5858+ {
5859+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5860+ regs->u_regs[UREG_G2] = addr + 4;
5861+ addr = (save & 0x003FFFFFU) << 10;
5862+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5863+
5864+ if (test_thread_flag(TIF_32BIT))
5865+ addr &= 0xFFFFFFFFUL;
5866+
5867+ regs->tpc = addr;
5868+ regs->tnpc = addr+4;
5869+ return 3;
5870+ }
5871+
5872+ /* PaX: 64-bit PLT stub */
5873+ err = get_user(sethi1, (unsigned int *)addr);
5874+ err |= get_user(sethi2, (unsigned int *)(addr+4));
5875+ err |= get_user(or1, (unsigned int *)(addr+8));
5876+ err |= get_user(or2, (unsigned int *)(addr+12));
5877+ err |= get_user(sllx, (unsigned int *)(addr+16));
5878+ err |= get_user(add, (unsigned int *)(addr+20));
5879+ err |= get_user(jmpl, (unsigned int *)(addr+24));
5880+ err |= get_user(nop, (unsigned int *)(addr+28));
5881+ if (err)
5882+ break;
5883+
5884+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5885+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5886+ (or1 & 0xFFFFE000U) == 0x88112000U &&
5887+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
5888+ sllx == 0x89293020U &&
5889+ add == 0x8A010005U &&
5890+ jmpl == 0x89C14000U &&
5891+ nop == 0x01000000U)
5892+ {
5893+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5894+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5895+ regs->u_regs[UREG_G4] <<= 32;
5896+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5897+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5898+ regs->u_regs[UREG_G4] = addr + 24;
5899+ addr = regs->u_regs[UREG_G5];
5900+ regs->tpc = addr;
5901+ regs->tnpc = addr+4;
5902+ return 3;
5903+ }
5904+ }
5905+ } while (0);
5906+
5907+#ifdef CONFIG_PAX_DLRESOLVE
5908+ do { /* PaX: unpatched PLT emulation step 2 */
5909+ unsigned int save, call, nop;
5910+
5911+ err = get_user(save, (unsigned int *)(regs->tpc-4));
5912+ err |= get_user(call, (unsigned int *)regs->tpc);
5913+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5914+ if (err)
5915+ break;
5916+
5917+ if (save == 0x9DE3BFA8U &&
5918+ (call & 0xC0000000U) == 0x40000000U &&
5919+ nop == 0x01000000U)
5920+ {
5921+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5922+
5923+ if (test_thread_flag(TIF_32BIT))
5924+ dl_resolve &= 0xFFFFFFFFUL;
5925+
5926+ regs->u_regs[UREG_RETPC] = regs->tpc;
5927+ regs->tpc = dl_resolve;
5928+ regs->tnpc = dl_resolve+4;
5929+ return 3;
5930+ }
5931+ } while (0);
5932+#endif
5933+
5934+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5935+ unsigned int sethi, ba, nop;
5936+
5937+ err = get_user(sethi, (unsigned int *)regs->tpc);
5938+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5939+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5940+
5941+ if (err)
5942+ break;
5943+
5944+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
5945+ (ba & 0xFFF00000U) == 0x30600000U &&
5946+ nop == 0x01000000U)
5947+ {
5948+ unsigned long addr;
5949+
5950+ addr = (sethi & 0x003FFFFFU) << 10;
5951+ regs->u_regs[UREG_G1] = addr;
5952+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5953+
5954+ if (test_thread_flag(TIF_32BIT))
5955+ addr &= 0xFFFFFFFFUL;
5956+
5957+ regs->tpc = addr;
5958+ regs->tnpc = addr+4;
5959+ return 2;
5960+ }
5961+ } while (0);
5962+
5963+#endif
5964+
5965+ return 1;
5966+}
5967+
5968+void pax_report_insns(void *pc, void *sp)
5969+{
5970+ unsigned long i;
5971+
5972+ printk(KERN_ERR "PAX: bytes at PC: ");
5973+ for (i = 0; i < 8; i++) {
5974+ unsigned int c;
5975+ if (get_user(c, (unsigned int *)pc+i))
5976+ printk(KERN_CONT "???????? ");
5977+ else
5978+ printk(KERN_CONT "%08x ", c);
5979+ }
5980+ printk("\n");
5981+}
5982+#endif
5983+
5984 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5985 {
5986 struct mm_struct *mm = current->mm;
5987@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
5988 if (!vma)
5989 goto bad_area;
5990
5991+#ifdef CONFIG_PAX_PAGEEXEC
5992+ /* PaX: detect ITLB misses on non-exec pages */
5993+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5994+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5995+ {
5996+ if (address != regs->tpc)
5997+ goto good_area;
5998+
5999+ up_read(&mm->mmap_sem);
6000+ switch (pax_handle_fetch_fault(regs)) {
6001+
6002+#ifdef CONFIG_PAX_EMUPLT
6003+ case 2:
6004+ case 3:
6005+ return;
6006+#endif
6007+
6008+ }
6009+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
6010+ do_group_exit(SIGKILL);
6011+ }
6012+#endif
6013+
6014 /* Pure DTLB misses do not tell us whether the fault causing
6015 * load/store/atomic was a write or not, it only says that there
6016 * was no match. So in such a case we (carefully) read the
6017diff -urNp linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c
6018--- linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
6019+++ linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
6020@@ -69,7 +69,7 @@ full_search:
6021 }
6022 return -ENOMEM;
6023 }
6024- if (likely(!vma || addr + len <= vma->vm_start)) {
6025+ if (likely(check_heap_stack_gap(vma, addr, len))) {
6026 /*
6027 * Remember the place where we stopped the search:
6028 */
6029@@ -108,7 +108,7 @@ hugetlb_get_unmapped_area_topdown(struct
6030 /* make sure it can fit in the remaining address space */
6031 if (likely(addr > len)) {
6032 vma = find_vma(mm, addr-len);
6033- if (!vma || addr <= vma->vm_start) {
6034+ if (check_heap_stack_gap(vma, addr - len, len)) {
6035 /* remember the address as a hint for next time */
6036 return (mm->free_area_cache = addr-len);
6037 }
6038@@ -117,16 +117,17 @@ hugetlb_get_unmapped_area_topdown(struct
6039 if (unlikely(mm->mmap_base < len))
6040 goto bottomup;
6041
6042- addr = (mm->mmap_base-len) & HPAGE_MASK;
6043+ addr = mm->mmap_base - len;
6044
6045 do {
6046+ addr &= HPAGE_MASK;
6047 /*
6048 * Lookup failure means no vma is above this address,
6049 * else if new region fits below vma->vm_start,
6050 * return with success:
6051 */
6052 vma = find_vma(mm, addr);
6053- if (likely(!vma || addr+len <= vma->vm_start)) {
6054+ if (likely(check_heap_stack_gap(vma, addr, len))) {
6055 /* remember the address as a hint for next time */
6056 return (mm->free_area_cache = addr);
6057 }
6058@@ -136,8 +137,8 @@ hugetlb_get_unmapped_area_topdown(struct
6059 mm->cached_hole_size = vma->vm_start - addr;
6060
6061 /* try just below the current vma->vm_start */
6062- addr = (vma->vm_start-len) & HPAGE_MASK;
6063- } while (likely(len < vma->vm_start));
6064+ addr = skip_heap_stack_gap(vma, len);
6065+ } while (!IS_ERR_VALUE(addr));
6066
6067 bottomup:
6068 /*
6069@@ -183,8 +184,7 @@ hugetlb_get_unmapped_area(struct file *f
6070 if (addr) {
6071 addr = ALIGN(addr, HPAGE_SIZE);
6072 vma = find_vma(mm, addr);
6073- if (task_size - len >= addr &&
6074- (!vma || addr + len <= vma->vm_start))
6075+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6076 return addr;
6077 }
6078 if (mm->get_unmapped_area == arch_get_unmapped_area)
6079diff -urNp linux-2.6.32.46/arch/sparc/mm/init_32.c linux-2.6.32.46/arch/sparc/mm/init_32.c
6080--- linux-2.6.32.46/arch/sparc/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
6081+++ linux-2.6.32.46/arch/sparc/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
6082@@ -317,6 +317,9 @@ extern void device_scan(void);
6083 pgprot_t PAGE_SHARED __read_mostly;
6084 EXPORT_SYMBOL(PAGE_SHARED);
6085
6086+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
6087+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
6088+
6089 void __init paging_init(void)
6090 {
6091 switch(sparc_cpu_model) {
6092@@ -345,17 +348,17 @@ void __init paging_init(void)
6093
6094 /* Initialize the protection map with non-constant, MMU dependent values. */
6095 protection_map[0] = PAGE_NONE;
6096- protection_map[1] = PAGE_READONLY;
6097- protection_map[2] = PAGE_COPY;
6098- protection_map[3] = PAGE_COPY;
6099+ protection_map[1] = PAGE_READONLY_NOEXEC;
6100+ protection_map[2] = PAGE_COPY_NOEXEC;
6101+ protection_map[3] = PAGE_COPY_NOEXEC;
6102 protection_map[4] = PAGE_READONLY;
6103 protection_map[5] = PAGE_READONLY;
6104 protection_map[6] = PAGE_COPY;
6105 protection_map[7] = PAGE_COPY;
6106 protection_map[8] = PAGE_NONE;
6107- protection_map[9] = PAGE_READONLY;
6108- protection_map[10] = PAGE_SHARED;
6109- protection_map[11] = PAGE_SHARED;
6110+ protection_map[9] = PAGE_READONLY_NOEXEC;
6111+ protection_map[10] = PAGE_SHARED_NOEXEC;
6112+ protection_map[11] = PAGE_SHARED_NOEXEC;
6113 protection_map[12] = PAGE_READONLY;
6114 protection_map[13] = PAGE_READONLY;
6115 protection_map[14] = PAGE_SHARED;
6116diff -urNp linux-2.6.32.46/arch/sparc/mm/Makefile linux-2.6.32.46/arch/sparc/mm/Makefile
6117--- linux-2.6.32.46/arch/sparc/mm/Makefile 2011-03-27 14:31:47.000000000 -0400
6118+++ linux-2.6.32.46/arch/sparc/mm/Makefile 2011-04-17 15:56:46.000000000 -0400
6119@@ -2,7 +2,7 @@
6120 #
6121
6122 asflags-y := -ansi
6123-ccflags-y := -Werror
6124+#ccflags-y := -Werror
6125
6126 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
6127 obj-y += fault_$(BITS).o
6128diff -urNp linux-2.6.32.46/arch/sparc/mm/srmmu.c linux-2.6.32.46/arch/sparc/mm/srmmu.c
6129--- linux-2.6.32.46/arch/sparc/mm/srmmu.c 2011-03-27 14:31:47.000000000 -0400
6130+++ linux-2.6.32.46/arch/sparc/mm/srmmu.c 2011-04-17 15:56:46.000000000 -0400
6131@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
6132 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
6133 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
6134 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
6135+
6136+#ifdef CONFIG_PAX_PAGEEXEC
6137+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
6138+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
6139+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
6140+#endif
6141+
6142 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
6143 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
6144
6145diff -urNp linux-2.6.32.46/arch/um/include/asm/kmap_types.h linux-2.6.32.46/arch/um/include/asm/kmap_types.h
6146--- linux-2.6.32.46/arch/um/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
6147+++ linux-2.6.32.46/arch/um/include/asm/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
6148@@ -23,6 +23,7 @@ enum km_type {
6149 KM_IRQ1,
6150 KM_SOFTIRQ0,
6151 KM_SOFTIRQ1,
6152+ KM_CLEARPAGE,
6153 KM_TYPE_NR
6154 };
6155
6156diff -urNp linux-2.6.32.46/arch/um/include/asm/page.h linux-2.6.32.46/arch/um/include/asm/page.h
6157--- linux-2.6.32.46/arch/um/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
6158+++ linux-2.6.32.46/arch/um/include/asm/page.h 2011-04-17 15:56:46.000000000 -0400
6159@@ -14,6 +14,9 @@
6160 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
6161 #define PAGE_MASK (~(PAGE_SIZE-1))
6162
6163+#define ktla_ktva(addr) (addr)
6164+#define ktva_ktla(addr) (addr)
6165+
6166 #ifndef __ASSEMBLY__
6167
6168 struct page;
6169diff -urNp linux-2.6.32.46/arch/um/kernel/process.c linux-2.6.32.46/arch/um/kernel/process.c
6170--- linux-2.6.32.46/arch/um/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
6171+++ linux-2.6.32.46/arch/um/kernel/process.c 2011-04-17 15:56:46.000000000 -0400
6172@@ -393,22 +393,6 @@ int singlestepping(void * t)
6173 return 2;
6174 }
6175
6176-/*
6177- * Only x86 and x86_64 have an arch_align_stack().
6178- * All other arches have "#define arch_align_stack(x) (x)"
6179- * in their asm/system.h
6180- * As this is included in UML from asm-um/system-generic.h,
6181- * we can use it to behave as the subarch does.
6182- */
6183-#ifndef arch_align_stack
6184-unsigned long arch_align_stack(unsigned long sp)
6185-{
6186- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
6187- sp -= get_random_int() % 8192;
6188- return sp & ~0xf;
6189-}
6190-#endif
6191-
6192 unsigned long get_wchan(struct task_struct *p)
6193 {
6194 unsigned long stack_page, sp, ip;
6195diff -urNp linux-2.6.32.46/arch/um/sys-i386/syscalls.c linux-2.6.32.46/arch/um/sys-i386/syscalls.c
6196--- linux-2.6.32.46/arch/um/sys-i386/syscalls.c 2011-03-27 14:31:47.000000000 -0400
6197+++ linux-2.6.32.46/arch/um/sys-i386/syscalls.c 2011-04-17 15:56:46.000000000 -0400
6198@@ -11,6 +11,21 @@
6199 #include "asm/uaccess.h"
6200 #include "asm/unistd.h"
6201
6202+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
6203+{
6204+ unsigned long pax_task_size = TASK_SIZE;
6205+
6206+#ifdef CONFIG_PAX_SEGMEXEC
6207+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
6208+ pax_task_size = SEGMEXEC_TASK_SIZE;
6209+#endif
6210+
6211+ if (len > pax_task_size || addr > pax_task_size - len)
6212+ return -EINVAL;
6213+
6214+ return 0;
6215+}
6216+
6217 /*
6218 * Perform the select(nd, in, out, ex, tv) and mmap() system
6219 * calls. Linux/i386 didn't use to be able to handle more than
6220diff -urNp linux-2.6.32.46/arch/x86/boot/bitops.h linux-2.6.32.46/arch/x86/boot/bitops.h
6221--- linux-2.6.32.46/arch/x86/boot/bitops.h 2011-03-27 14:31:47.000000000 -0400
6222+++ linux-2.6.32.46/arch/x86/boot/bitops.h 2011-04-17 15:56:46.000000000 -0400
6223@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
6224 u8 v;
6225 const u32 *p = (const u32 *)addr;
6226
6227- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6228+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6229 return v;
6230 }
6231
6232@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
6233
6234 static inline void set_bit(int nr, void *addr)
6235 {
6236- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6237+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6238 }
6239
6240 #endif /* BOOT_BITOPS_H */
6241diff -urNp linux-2.6.32.46/arch/x86/boot/boot.h linux-2.6.32.46/arch/x86/boot/boot.h
6242--- linux-2.6.32.46/arch/x86/boot/boot.h 2011-03-27 14:31:47.000000000 -0400
6243+++ linux-2.6.32.46/arch/x86/boot/boot.h 2011-04-17 15:56:46.000000000 -0400
6244@@ -82,7 +82,7 @@ static inline void io_delay(void)
6245 static inline u16 ds(void)
6246 {
6247 u16 seg;
6248- asm("movw %%ds,%0" : "=rm" (seg));
6249+ asm volatile("movw %%ds,%0" : "=rm" (seg));
6250 return seg;
6251 }
6252
6253@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t
6254 static inline int memcmp(const void *s1, const void *s2, size_t len)
6255 {
6256 u8 diff;
6257- asm("repe; cmpsb; setnz %0"
6258+ asm volatile("repe; cmpsb; setnz %0"
6259 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
6260 return diff;
6261 }
6262diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/head_32.S linux-2.6.32.46/arch/x86/boot/compressed/head_32.S
6263--- linux-2.6.32.46/arch/x86/boot/compressed/head_32.S 2011-03-27 14:31:47.000000000 -0400
6264+++ linux-2.6.32.46/arch/x86/boot/compressed/head_32.S 2011-04-17 15:56:46.000000000 -0400
6265@@ -76,7 +76,7 @@ ENTRY(startup_32)
6266 notl %eax
6267 andl %eax, %ebx
6268 #else
6269- movl $LOAD_PHYSICAL_ADDR, %ebx
6270+ movl $____LOAD_PHYSICAL_ADDR, %ebx
6271 #endif
6272
6273 /* Target address to relocate to for decompression */
6274@@ -149,7 +149,7 @@ relocated:
6275 * and where it was actually loaded.
6276 */
6277 movl %ebp, %ebx
6278- subl $LOAD_PHYSICAL_ADDR, %ebx
6279+ subl $____LOAD_PHYSICAL_ADDR, %ebx
6280 jz 2f /* Nothing to be done if loaded at compiled addr. */
6281 /*
6282 * Process relocations.
6283@@ -157,8 +157,7 @@ relocated:
6284
6285 1: subl $4, %edi
6286 movl (%edi), %ecx
6287- testl %ecx, %ecx
6288- jz 2f
6289+ jecxz 2f
6290 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
6291 jmp 1b
6292 2:
6293diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/head_64.S linux-2.6.32.46/arch/x86/boot/compressed/head_64.S
6294--- linux-2.6.32.46/arch/x86/boot/compressed/head_64.S 2011-03-27 14:31:47.000000000 -0400
6295+++ linux-2.6.32.46/arch/x86/boot/compressed/head_64.S 2011-07-01 18:53:00.000000000 -0400
6296@@ -91,7 +91,7 @@ ENTRY(startup_32)
6297 notl %eax
6298 andl %eax, %ebx
6299 #else
6300- movl $LOAD_PHYSICAL_ADDR, %ebx
6301+ movl $____LOAD_PHYSICAL_ADDR, %ebx
6302 #endif
6303
6304 /* Target address to relocate to for decompression */
6305@@ -183,7 +183,7 @@ no_longmode:
6306 hlt
6307 jmp 1b
6308
6309-#include "../../kernel/verify_cpu_64.S"
6310+#include "../../kernel/verify_cpu.S"
6311
6312 /*
6313 * Be careful here startup_64 needs to be at a predictable
6314@@ -234,7 +234,7 @@ ENTRY(startup_64)
6315 notq %rax
6316 andq %rax, %rbp
6317 #else
6318- movq $LOAD_PHYSICAL_ADDR, %rbp
6319+ movq $____LOAD_PHYSICAL_ADDR, %rbp
6320 #endif
6321
6322 /* Target address to relocate to for decompression */
6323diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/Makefile linux-2.6.32.46/arch/x86/boot/compressed/Makefile
6324--- linux-2.6.32.46/arch/x86/boot/compressed/Makefile 2011-03-27 14:31:47.000000000 -0400
6325+++ linux-2.6.32.46/arch/x86/boot/compressed/Makefile 2011-08-07 14:38:34.000000000 -0400
6326@@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
6327 KBUILD_CFLAGS += $(cflags-y)
6328 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
6329 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
6330+ifdef CONSTIFY_PLUGIN
6331+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6332+endif
6333
6334 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6335 GCOV_PROFILE := n
6336diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/misc.c linux-2.6.32.46/arch/x86/boot/compressed/misc.c
6337--- linux-2.6.32.46/arch/x86/boot/compressed/misc.c 2011-03-27 14:31:47.000000000 -0400
6338+++ linux-2.6.32.46/arch/x86/boot/compressed/misc.c 2011-04-17 15:56:46.000000000 -0400
6339@@ -288,7 +288,7 @@ static void parse_elf(void *output)
6340 case PT_LOAD:
6341 #ifdef CONFIG_RELOCATABLE
6342 dest = output;
6343- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
6344+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
6345 #else
6346 dest = (void *)(phdr->p_paddr);
6347 #endif
6348@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
6349 error("Destination address too large");
6350 #endif
6351 #ifndef CONFIG_RELOCATABLE
6352- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
6353+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
6354 error("Wrong destination address");
6355 #endif
6356
6357diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c
6358--- linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c 2011-03-27 14:31:47.000000000 -0400
6359+++ linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c 2011-04-17 15:56:46.000000000 -0400
6360@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
6361
6362 offs = (olen > ilen) ? olen - ilen : 0;
6363 offs += olen >> 12; /* Add 8 bytes for each 32K block */
6364- offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
6365+ offs += 64*1024; /* Add 64K bytes slack */
6366 offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
6367
6368 printf(".section \".rodata.compressed\",\"a\",@progbits\n");
6369diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/relocs.c linux-2.6.32.46/arch/x86/boot/compressed/relocs.c
6370--- linux-2.6.32.46/arch/x86/boot/compressed/relocs.c 2011-03-27 14:31:47.000000000 -0400
6371+++ linux-2.6.32.46/arch/x86/boot/compressed/relocs.c 2011-04-17 15:56:46.000000000 -0400
6372@@ -10,8 +10,11 @@
6373 #define USE_BSD
6374 #include <endian.h>
6375
6376+#include "../../../../include/linux/autoconf.h"
6377+
6378 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
6379 static Elf32_Ehdr ehdr;
6380+static Elf32_Phdr *phdr;
6381 static unsigned long reloc_count, reloc_idx;
6382 static unsigned long *relocs;
6383
6384@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
6385
6386 static int is_safe_abs_reloc(const char* sym_name)
6387 {
6388- int i;
6389+ unsigned int i;
6390
6391 for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
6392 if (!strcmp(sym_name, safe_abs_relocs[i]))
6393@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
6394 }
6395 }
6396
6397+static void read_phdrs(FILE *fp)
6398+{
6399+ unsigned int i;
6400+
6401+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
6402+ if (!phdr) {
6403+ die("Unable to allocate %d program headers\n",
6404+ ehdr.e_phnum);
6405+ }
6406+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
6407+ die("Seek to %d failed: %s\n",
6408+ ehdr.e_phoff, strerror(errno));
6409+ }
6410+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
6411+ die("Cannot read ELF program headers: %s\n",
6412+ strerror(errno));
6413+ }
6414+ for(i = 0; i < ehdr.e_phnum; i++) {
6415+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
6416+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
6417+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
6418+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
6419+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
6420+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
6421+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
6422+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
6423+ }
6424+
6425+}
6426+
6427 static void read_shdrs(FILE *fp)
6428 {
6429- int i;
6430+ unsigned int i;
6431 Elf32_Shdr shdr;
6432
6433 secs = calloc(ehdr.e_shnum, sizeof(struct section));
6434@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
6435
6436 static void read_strtabs(FILE *fp)
6437 {
6438- int i;
6439+ unsigned int i;
6440 for (i = 0; i < ehdr.e_shnum; i++) {
6441 struct section *sec = &secs[i];
6442 if (sec->shdr.sh_type != SHT_STRTAB) {
6443@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
6444
6445 static void read_symtabs(FILE *fp)
6446 {
6447- int i,j;
6448+ unsigned int i,j;
6449 for (i = 0; i < ehdr.e_shnum; i++) {
6450 struct section *sec = &secs[i];
6451 if (sec->shdr.sh_type != SHT_SYMTAB) {
6452@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
6453
6454 static void read_relocs(FILE *fp)
6455 {
6456- int i,j;
6457+ unsigned int i,j;
6458+ uint32_t base;
6459+
6460 for (i = 0; i < ehdr.e_shnum; i++) {
6461 struct section *sec = &secs[i];
6462 if (sec->shdr.sh_type != SHT_REL) {
6463@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
6464 die("Cannot read symbol table: %s\n",
6465 strerror(errno));
6466 }
6467+ base = 0;
6468+ for (j = 0; j < ehdr.e_phnum; j++) {
6469+ if (phdr[j].p_type != PT_LOAD )
6470+ continue;
6471+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6472+ continue;
6473+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6474+ break;
6475+ }
6476 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6477 Elf32_Rel *rel = &sec->reltab[j];
6478- rel->r_offset = elf32_to_cpu(rel->r_offset);
6479+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6480 rel->r_info = elf32_to_cpu(rel->r_info);
6481 }
6482 }
6483@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
6484
6485 static void print_absolute_symbols(void)
6486 {
6487- int i;
6488+ unsigned int i;
6489 printf("Absolute symbols\n");
6490 printf(" Num: Value Size Type Bind Visibility Name\n");
6491 for (i = 0; i < ehdr.e_shnum; i++) {
6492 struct section *sec = &secs[i];
6493 char *sym_strtab;
6494 Elf32_Sym *sh_symtab;
6495- int j;
6496+ unsigned int j;
6497
6498 if (sec->shdr.sh_type != SHT_SYMTAB) {
6499 continue;
6500@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
6501
6502 static void print_absolute_relocs(void)
6503 {
6504- int i, printed = 0;
6505+ unsigned int i, printed = 0;
6506
6507 for (i = 0; i < ehdr.e_shnum; i++) {
6508 struct section *sec = &secs[i];
6509 struct section *sec_applies, *sec_symtab;
6510 char *sym_strtab;
6511 Elf32_Sym *sh_symtab;
6512- int j;
6513+ unsigned int j;
6514 if (sec->shdr.sh_type != SHT_REL) {
6515 continue;
6516 }
6517@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
6518
6519 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6520 {
6521- int i;
6522+ unsigned int i;
6523 /* Walk through the relocations */
6524 for (i = 0; i < ehdr.e_shnum; i++) {
6525 char *sym_strtab;
6526 Elf32_Sym *sh_symtab;
6527 struct section *sec_applies, *sec_symtab;
6528- int j;
6529+ unsigned int j;
6530 struct section *sec = &secs[i];
6531
6532 if (sec->shdr.sh_type != SHT_REL) {
6533@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
6534 if (sym->st_shndx == SHN_ABS) {
6535 continue;
6536 }
6537+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6538+ if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6539+ continue;
6540+
6541+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6542+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6543+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6544+ continue;
6545+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6546+ continue;
6547+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6548+ continue;
6549+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6550+ continue;
6551+#endif
6552 if (r_type == R_386_NONE || r_type == R_386_PC32) {
6553 /*
6554 * NONE can be ignored and and PC relative
6555@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
6556
6557 static void emit_relocs(int as_text)
6558 {
6559- int i;
6560+ unsigned int i;
6561 /* Count how many relocations I have and allocate space for them. */
6562 reloc_count = 0;
6563 walk_relocs(count_reloc);
6564@@ -634,6 +693,7 @@ int main(int argc, char **argv)
6565 fname, strerror(errno));
6566 }
6567 read_ehdr(fp);
6568+ read_phdrs(fp);
6569 read_shdrs(fp);
6570 read_strtabs(fp);
6571 read_symtabs(fp);
6572diff -urNp linux-2.6.32.46/arch/x86/boot/cpucheck.c linux-2.6.32.46/arch/x86/boot/cpucheck.c
6573--- linux-2.6.32.46/arch/x86/boot/cpucheck.c 2011-03-27 14:31:47.000000000 -0400
6574+++ linux-2.6.32.46/arch/x86/boot/cpucheck.c 2011-04-17 15:56:46.000000000 -0400
6575@@ -74,7 +74,7 @@ static int has_fpu(void)
6576 u16 fcw = -1, fsw = -1;
6577 u32 cr0;
6578
6579- asm("movl %%cr0,%0" : "=r" (cr0));
6580+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
6581 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6582 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6583 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6584@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6585 {
6586 u32 f0, f1;
6587
6588- asm("pushfl ; "
6589+ asm volatile("pushfl ; "
6590 "pushfl ; "
6591 "popl %0 ; "
6592 "movl %0,%1 ; "
6593@@ -115,7 +115,7 @@ static void get_flags(void)
6594 set_bit(X86_FEATURE_FPU, cpu.flags);
6595
6596 if (has_eflag(X86_EFLAGS_ID)) {
6597- asm("cpuid"
6598+ asm volatile("cpuid"
6599 : "=a" (max_intel_level),
6600 "=b" (cpu_vendor[0]),
6601 "=d" (cpu_vendor[1]),
6602@@ -124,7 +124,7 @@ static void get_flags(void)
6603
6604 if (max_intel_level >= 0x00000001 &&
6605 max_intel_level <= 0x0000ffff) {
6606- asm("cpuid"
6607+ asm volatile("cpuid"
6608 : "=a" (tfms),
6609 "=c" (cpu.flags[4]),
6610 "=d" (cpu.flags[0])
6611@@ -136,7 +136,7 @@ static void get_flags(void)
6612 cpu.model += ((tfms >> 16) & 0xf) << 4;
6613 }
6614
6615- asm("cpuid"
6616+ asm volatile("cpuid"
6617 : "=a" (max_amd_level)
6618 : "a" (0x80000000)
6619 : "ebx", "ecx", "edx");
6620@@ -144,7 +144,7 @@ static void get_flags(void)
6621 if (max_amd_level >= 0x80000001 &&
6622 max_amd_level <= 0x8000ffff) {
6623 u32 eax = 0x80000001;
6624- asm("cpuid"
6625+ asm volatile("cpuid"
6626 : "+a" (eax),
6627 "=c" (cpu.flags[6]),
6628 "=d" (cpu.flags[1])
6629@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6630 u32 ecx = MSR_K7_HWCR;
6631 u32 eax, edx;
6632
6633- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6634+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6635 eax &= ~(1 << 15);
6636- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6637+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6638
6639 get_flags(); /* Make sure it really did something */
6640 err = check_flags();
6641@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6642 u32 ecx = MSR_VIA_FCR;
6643 u32 eax, edx;
6644
6645- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6646+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6647 eax |= (1<<1)|(1<<7);
6648- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6649+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6650
6651 set_bit(X86_FEATURE_CX8, cpu.flags);
6652 err = check_flags();
6653@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
6654 u32 eax, edx;
6655 u32 level = 1;
6656
6657- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6658- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6659- asm("cpuid"
6660+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6661+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6662+ asm volatile("cpuid"
6663 : "+a" (level), "=d" (cpu.flags[0])
6664 : : "ecx", "ebx");
6665- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6666+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6667
6668 err = check_flags();
6669 }
6670diff -urNp linux-2.6.32.46/arch/x86/boot/header.S linux-2.6.32.46/arch/x86/boot/header.S
6671--- linux-2.6.32.46/arch/x86/boot/header.S 2011-03-27 14:31:47.000000000 -0400
6672+++ linux-2.6.32.46/arch/x86/boot/header.S 2011-04-17 15:56:46.000000000 -0400
6673@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
6674 # single linked list of
6675 # struct setup_data
6676
6677-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6678+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6679
6680 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6681 #define VO_INIT_SIZE (VO__end - VO__text)
6682diff -urNp linux-2.6.32.46/arch/x86/boot/Makefile linux-2.6.32.46/arch/x86/boot/Makefile
6683--- linux-2.6.32.46/arch/x86/boot/Makefile 2011-03-27 14:31:47.000000000 -0400
6684+++ linux-2.6.32.46/arch/x86/boot/Makefile 2011-08-07 14:38:13.000000000 -0400
6685@@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
6686 $(call cc-option, -fno-stack-protector) \
6687 $(call cc-option, -mpreferred-stack-boundary=2)
6688 KBUILD_CFLAGS += $(call cc-option, -m32)
6689+ifdef CONSTIFY_PLUGIN
6690+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6691+endif
6692 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6693 GCOV_PROFILE := n
6694
6695diff -urNp linux-2.6.32.46/arch/x86/boot/memory.c linux-2.6.32.46/arch/x86/boot/memory.c
6696--- linux-2.6.32.46/arch/x86/boot/memory.c 2011-03-27 14:31:47.000000000 -0400
6697+++ linux-2.6.32.46/arch/x86/boot/memory.c 2011-04-17 15:56:46.000000000 -0400
6698@@ -19,7 +19,7 @@
6699
6700 static int detect_memory_e820(void)
6701 {
6702- int count = 0;
6703+ unsigned int count = 0;
6704 struct biosregs ireg, oreg;
6705 struct e820entry *desc = boot_params.e820_map;
6706 static struct e820entry buf; /* static so it is zeroed */
6707diff -urNp linux-2.6.32.46/arch/x86/boot/video.c linux-2.6.32.46/arch/x86/boot/video.c
6708--- linux-2.6.32.46/arch/x86/boot/video.c 2011-03-27 14:31:47.000000000 -0400
6709+++ linux-2.6.32.46/arch/x86/boot/video.c 2011-04-17 15:56:46.000000000 -0400
6710@@ -90,7 +90,7 @@ static void store_mode_params(void)
6711 static unsigned int get_entry(void)
6712 {
6713 char entry_buf[4];
6714- int i, len = 0;
6715+ unsigned int i, len = 0;
6716 int key;
6717 unsigned int v;
6718
6719diff -urNp linux-2.6.32.46/arch/x86/boot/video-vesa.c linux-2.6.32.46/arch/x86/boot/video-vesa.c
6720--- linux-2.6.32.46/arch/x86/boot/video-vesa.c 2011-03-27 14:31:47.000000000 -0400
6721+++ linux-2.6.32.46/arch/x86/boot/video-vesa.c 2011-04-17 15:56:46.000000000 -0400
6722@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6723
6724 boot_params.screen_info.vesapm_seg = oreg.es;
6725 boot_params.screen_info.vesapm_off = oreg.di;
6726+ boot_params.screen_info.vesapm_size = oreg.cx;
6727 }
6728
6729 /*
6730diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_aout.c linux-2.6.32.46/arch/x86/ia32/ia32_aout.c
6731--- linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400
6732+++ linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400
6733@@ -169,6 +169,8 @@ static int aout_core_dump(long signr, st
6734 unsigned long dump_start, dump_size;
6735 struct user32 dump;
6736
6737+ memset(&dump, 0, sizeof(dump));
6738+
6739 fs = get_fs();
6740 set_fs(KERNEL_DS);
6741 has_dumped = 1;
6742@@ -218,12 +220,6 @@ static int aout_core_dump(long signr, st
6743 dump_size = dump.u_ssize << PAGE_SHIFT;
6744 DUMP_WRITE(dump_start, dump_size);
6745 }
6746- /*
6747- * Finally dump the task struct. Not be used by gdb, but
6748- * could be useful
6749- */
6750- set_fs(KERNEL_DS);
6751- DUMP_WRITE(current, sizeof(*current));
6752 end_coredump:
6753 set_fs(fs);
6754 return has_dumped;
6755diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32entry.S linux-2.6.32.46/arch/x86/ia32/ia32entry.S
6756--- linux-2.6.32.46/arch/x86/ia32/ia32entry.S 2011-03-27 14:31:47.000000000 -0400
6757+++ linux-2.6.32.46/arch/x86/ia32/ia32entry.S 2011-08-25 17:42:18.000000000 -0400
6758@@ -13,6 +13,7 @@
6759 #include <asm/thread_info.h>
6760 #include <asm/segment.h>
6761 #include <asm/irqflags.h>
6762+#include <asm/pgtable.h>
6763 #include <linux/linkage.h>
6764
6765 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6766@@ -93,6 +94,29 @@ ENTRY(native_irq_enable_sysexit)
6767 ENDPROC(native_irq_enable_sysexit)
6768 #endif
6769
6770+ .macro pax_enter_kernel_user
6771+#ifdef CONFIG_PAX_MEMORY_UDEREF
6772+ call pax_enter_kernel_user
6773+#endif
6774+ .endm
6775+
6776+ .macro pax_exit_kernel_user
6777+#ifdef CONFIG_PAX_MEMORY_UDEREF
6778+ call pax_exit_kernel_user
6779+#endif
6780+#ifdef CONFIG_PAX_RANDKSTACK
6781+ pushq %rax
6782+ call pax_randomize_kstack
6783+ popq %rax
6784+#endif
6785+ .endm
6786+
6787+.macro pax_erase_kstack
6788+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6789+ call pax_erase_kstack
6790+#endif
6791+.endm
6792+
6793 /*
6794 * 32bit SYSENTER instruction entry.
6795 *
6796@@ -119,7 +143,7 @@ ENTRY(ia32_sysenter_target)
6797 CFI_REGISTER rsp,rbp
6798 SWAPGS_UNSAFE_STACK
6799 movq PER_CPU_VAR(kernel_stack), %rsp
6800- addq $(KERNEL_STACK_OFFSET),%rsp
6801+ pax_enter_kernel_user
6802 /*
6803 * No need to follow this irqs on/off section: the syscall
6804 * disabled irqs, here we enable it straight after entry:
6805@@ -135,7 +159,8 @@ ENTRY(ia32_sysenter_target)
6806 pushfq
6807 CFI_ADJUST_CFA_OFFSET 8
6808 /*CFI_REL_OFFSET rflags,0*/
6809- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6810+ GET_THREAD_INFO(%r10)
6811+ movl TI_sysenter_return(%r10), %r10d
6812 CFI_REGISTER rip,r10
6813 pushq $__USER32_CS
6814 CFI_ADJUST_CFA_OFFSET 8
6815@@ -150,6 +175,12 @@ ENTRY(ia32_sysenter_target)
6816 SAVE_ARGS 0,0,1
6817 /* no need to do an access_ok check here because rbp has been
6818 32bit zero extended */
6819+
6820+#ifdef CONFIG_PAX_MEMORY_UDEREF
6821+ mov $PAX_USER_SHADOW_BASE,%r10
6822+ add %r10,%rbp
6823+#endif
6824+
6825 1: movl (%rbp),%ebp
6826 .section __ex_table,"a"
6827 .quad 1b,ia32_badarg
6828@@ -172,6 +203,8 @@ sysenter_dispatch:
6829 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6830 jnz sysexit_audit
6831 sysexit_from_sys_call:
6832+ pax_exit_kernel_user
6833+ pax_erase_kstack
6834 andl $~TS_COMPAT,TI_status(%r10)
6835 /* clear IF, that popfq doesn't enable interrupts early */
6836 andl $~0x200,EFLAGS-R11(%rsp)
6837@@ -200,6 +233,9 @@ sysexit_from_sys_call:
6838 movl %eax,%esi /* 2nd arg: syscall number */
6839 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6840 call audit_syscall_entry
6841+
6842+ pax_erase_kstack
6843+
6844 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6845 cmpq $(IA32_NR_syscalls-1),%rax
6846 ja ia32_badsys
6847@@ -252,6 +288,9 @@ sysenter_tracesys:
6848 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6849 movq %rsp,%rdi /* &pt_regs -> arg1 */
6850 call syscall_trace_enter
6851+
6852+ pax_erase_kstack
6853+
6854 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6855 RESTORE_REST
6856 cmpq $(IA32_NR_syscalls-1),%rax
6857@@ -283,19 +322,24 @@ ENDPROC(ia32_sysenter_target)
6858 ENTRY(ia32_cstar_target)
6859 CFI_STARTPROC32 simple
6860 CFI_SIGNAL_FRAME
6861- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6862+ CFI_DEF_CFA rsp,0
6863 CFI_REGISTER rip,rcx
6864 /*CFI_REGISTER rflags,r11*/
6865 SWAPGS_UNSAFE_STACK
6866 movl %esp,%r8d
6867 CFI_REGISTER rsp,r8
6868 movq PER_CPU_VAR(kernel_stack),%rsp
6869+
6870+#ifdef CONFIG_PAX_MEMORY_UDEREF
6871+ pax_enter_kernel_user
6872+#endif
6873+
6874 /*
6875 * No need to follow this irqs on/off section: the syscall
6876 * disabled irqs and here we enable it straight after entry:
6877 */
6878 ENABLE_INTERRUPTS(CLBR_NONE)
6879- SAVE_ARGS 8,1,1
6880+ SAVE_ARGS 8*6,1,1
6881 movl %eax,%eax /* zero extension */
6882 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6883 movq %rcx,RIP-ARGOFFSET(%rsp)
6884@@ -311,6 +355,12 @@ ENTRY(ia32_cstar_target)
6885 /* no need to do an access_ok check here because r8 has been
6886 32bit zero extended */
6887 /* hardware stack frame is complete now */
6888+
6889+#ifdef CONFIG_PAX_MEMORY_UDEREF
6890+ mov $PAX_USER_SHADOW_BASE,%r10
6891+ add %r10,%r8
6892+#endif
6893+
6894 1: movl (%r8),%r9d
6895 .section __ex_table,"a"
6896 .quad 1b,ia32_badarg
6897@@ -333,6 +383,8 @@ cstar_dispatch:
6898 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6899 jnz sysretl_audit
6900 sysretl_from_sys_call:
6901+ pax_exit_kernel_user
6902+ pax_erase_kstack
6903 andl $~TS_COMPAT,TI_status(%r10)
6904 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
6905 movl RIP-ARGOFFSET(%rsp),%ecx
6906@@ -370,6 +422,9 @@ cstar_tracesys:
6907 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6908 movq %rsp,%rdi /* &pt_regs -> arg1 */
6909 call syscall_trace_enter
6910+
6911+ pax_erase_kstack
6912+
6913 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6914 RESTORE_REST
6915 xchgl %ebp,%r9d
6916@@ -415,6 +470,7 @@ ENTRY(ia32_syscall)
6917 CFI_REL_OFFSET rip,RIP-RIP
6918 PARAVIRT_ADJUST_EXCEPTION_FRAME
6919 SWAPGS
6920+ pax_enter_kernel_user
6921 /*
6922 * No need to follow this irqs on/off section: the syscall
6923 * disabled irqs and here we enable it straight after entry:
6924@@ -448,6 +504,9 @@ ia32_tracesys:
6925 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6926 movq %rsp,%rdi /* &pt_regs -> arg1 */
6927 call syscall_trace_enter
6928+
6929+ pax_erase_kstack
6930+
6931 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6932 RESTORE_REST
6933 cmpq $(IA32_NR_syscalls-1),%rax
6934diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_signal.c linux-2.6.32.46/arch/x86/ia32/ia32_signal.c
6935--- linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400
6936+++ linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-04-17 15:56:46.000000000 -0400
6937@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
6938 sp -= frame_size;
6939 /* Align the stack pointer according to the i386 ABI,
6940 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
6941- sp = ((sp + 4) & -16ul) - 4;
6942+ sp = ((sp - 12) & -16ul) - 4;
6943 return (void __user *) sp;
6944 }
6945
6946@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
6947 * These are actually not used anymore, but left because some
6948 * gdb versions depend on them as a marker.
6949 */
6950- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6951+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
6952 } put_user_catch(err);
6953
6954 if (err)
6955@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
6956 0xb8,
6957 __NR_ia32_rt_sigreturn,
6958 0x80cd,
6959- 0,
6960+ 0
6961 };
6962
6963 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
6964@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
6965
6966 if (ka->sa.sa_flags & SA_RESTORER)
6967 restorer = ka->sa.sa_restorer;
6968+ else if (current->mm->context.vdso)
6969+ /* Return stub is in 32bit vsyscall page */
6970+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
6971 else
6972- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
6973- rt_sigreturn);
6974+ restorer = &frame->retcode;
6975 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
6976
6977 /*
6978 * Not actually used anymore, but left because some gdb
6979 * versions need it.
6980 */
6981- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
6982+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
6983 } put_user_catch(err);
6984
6985 if (err)
6986diff -urNp linux-2.6.32.46/arch/x86/include/asm/alternative.h linux-2.6.32.46/arch/x86/include/asm/alternative.h
6987--- linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400
6988+++ linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400
6989@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
6990 " .byte 662b-661b\n" /* sourcelen */ \
6991 " .byte 664f-663f\n" /* replacementlen */ \
6992 ".previous\n" \
6993- ".section .altinstr_replacement, \"ax\"\n" \
6994+ ".section .altinstr_replacement, \"a\"\n" \
6995 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
6996 ".previous"
6997
6998diff -urNp linux-2.6.32.46/arch/x86/include/asm/apic.h linux-2.6.32.46/arch/x86/include/asm/apic.h
6999--- linux-2.6.32.46/arch/x86/include/asm/apic.h 2011-03-27 14:31:47.000000000 -0400
7000+++ linux-2.6.32.46/arch/x86/include/asm/apic.h 2011-08-17 20:01:15.000000000 -0400
7001@@ -46,7 +46,7 @@ static inline void generic_apic_probe(vo
7002
7003 #ifdef CONFIG_X86_LOCAL_APIC
7004
7005-extern unsigned int apic_verbosity;
7006+extern int apic_verbosity;
7007 extern int local_apic_timer_c2_ok;
7008
7009 extern int disable_apic;
7010diff -urNp linux-2.6.32.46/arch/x86/include/asm/apm.h linux-2.6.32.46/arch/x86/include/asm/apm.h
7011--- linux-2.6.32.46/arch/x86/include/asm/apm.h 2011-03-27 14:31:47.000000000 -0400
7012+++ linux-2.6.32.46/arch/x86/include/asm/apm.h 2011-04-17 15:56:46.000000000 -0400
7013@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
7014 __asm__ __volatile__(APM_DO_ZERO_SEGS
7015 "pushl %%edi\n\t"
7016 "pushl %%ebp\n\t"
7017- "lcall *%%cs:apm_bios_entry\n\t"
7018+ "lcall *%%ss:apm_bios_entry\n\t"
7019 "setc %%al\n\t"
7020 "popl %%ebp\n\t"
7021 "popl %%edi\n\t"
7022@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
7023 __asm__ __volatile__(APM_DO_ZERO_SEGS
7024 "pushl %%edi\n\t"
7025 "pushl %%ebp\n\t"
7026- "lcall *%%cs:apm_bios_entry\n\t"
7027+ "lcall *%%ss:apm_bios_entry\n\t"
7028 "setc %%bl\n\t"
7029 "popl %%ebp\n\t"
7030 "popl %%edi\n\t"
7031diff -urNp linux-2.6.32.46/arch/x86/include/asm/atomic_32.h linux-2.6.32.46/arch/x86/include/asm/atomic_32.h
7032--- linux-2.6.32.46/arch/x86/include/asm/atomic_32.h 2011-03-27 14:31:47.000000000 -0400
7033+++ linux-2.6.32.46/arch/x86/include/asm/atomic_32.h 2011-05-04 17:56:20.000000000 -0400
7034@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
7035 }
7036
7037 /**
7038+ * atomic_read_unchecked - read atomic variable
7039+ * @v: pointer of type atomic_unchecked_t
7040+ *
7041+ * Atomically reads the value of @v.
7042+ */
7043+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7044+{
7045+ return v->counter;
7046+}
7047+
7048+/**
7049 * atomic_set - set atomic variable
7050 * @v: pointer of type atomic_t
7051 * @i: required value
7052@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
7053 }
7054
7055 /**
7056+ * atomic_set_unchecked - set atomic variable
7057+ * @v: pointer of type atomic_unchecked_t
7058+ * @i: required value
7059+ *
7060+ * Atomically sets the value of @v to @i.
7061+ */
7062+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7063+{
7064+ v->counter = i;
7065+}
7066+
7067+/**
7068 * atomic_add - add integer to atomic variable
7069 * @i: integer value to add
7070 * @v: pointer of type atomic_t
7071@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
7072 */
7073 static inline void atomic_add(int i, atomic_t *v)
7074 {
7075- asm volatile(LOCK_PREFIX "addl %1,%0"
7076+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7077+
7078+#ifdef CONFIG_PAX_REFCOUNT
7079+ "jno 0f\n"
7080+ LOCK_PREFIX "subl %1,%0\n"
7081+ "int $4\n0:\n"
7082+ _ASM_EXTABLE(0b, 0b)
7083+#endif
7084+
7085+ : "+m" (v->counter)
7086+ : "ir" (i));
7087+}
7088+
7089+/**
7090+ * atomic_add_unchecked - add integer to atomic variable
7091+ * @i: integer value to add
7092+ * @v: pointer of type atomic_unchecked_t
7093+ *
7094+ * Atomically adds @i to @v.
7095+ */
7096+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7097+{
7098+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7099 : "+m" (v->counter)
7100 : "ir" (i));
7101 }
7102@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
7103 */
7104 static inline void atomic_sub(int i, atomic_t *v)
7105 {
7106- asm volatile(LOCK_PREFIX "subl %1,%0"
7107+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7108+
7109+#ifdef CONFIG_PAX_REFCOUNT
7110+ "jno 0f\n"
7111+ LOCK_PREFIX "addl %1,%0\n"
7112+ "int $4\n0:\n"
7113+ _ASM_EXTABLE(0b, 0b)
7114+#endif
7115+
7116+ : "+m" (v->counter)
7117+ : "ir" (i));
7118+}
7119+
7120+/**
7121+ * atomic_sub_unchecked - subtract integer from atomic variable
7122+ * @i: integer value to subtract
7123+ * @v: pointer of type atomic_unchecked_t
7124+ *
7125+ * Atomically subtracts @i from @v.
7126+ */
7127+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7128+{
7129+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7130 : "+m" (v->counter)
7131 : "ir" (i));
7132 }
7133@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
7134 {
7135 unsigned char c;
7136
7137- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7138+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
7139+
7140+#ifdef CONFIG_PAX_REFCOUNT
7141+ "jno 0f\n"
7142+ LOCK_PREFIX "addl %2,%0\n"
7143+ "int $4\n0:\n"
7144+ _ASM_EXTABLE(0b, 0b)
7145+#endif
7146+
7147+ "sete %1\n"
7148 : "+m" (v->counter), "=qm" (c)
7149 : "ir" (i) : "memory");
7150 return c;
7151@@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(in
7152 */
7153 static inline void atomic_inc(atomic_t *v)
7154 {
7155- asm volatile(LOCK_PREFIX "incl %0"
7156+ asm volatile(LOCK_PREFIX "incl %0\n"
7157+
7158+#ifdef CONFIG_PAX_REFCOUNT
7159+ "jno 0f\n"
7160+ LOCK_PREFIX "decl %0\n"
7161+ "int $4\n0:\n"
7162+ _ASM_EXTABLE(0b, 0b)
7163+#endif
7164+
7165+ : "+m" (v->counter));
7166+}
7167+
7168+/**
7169+ * atomic_inc_unchecked - increment atomic variable
7170+ * @v: pointer of type atomic_unchecked_t
7171+ *
7172+ * Atomically increments @v by 1.
7173+ */
7174+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7175+{
7176+ asm volatile(LOCK_PREFIX "incl %0\n"
7177 : "+m" (v->counter));
7178 }
7179
7180@@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *
7181 */
7182 static inline void atomic_dec(atomic_t *v)
7183 {
7184- asm volatile(LOCK_PREFIX "decl %0"
7185+ asm volatile(LOCK_PREFIX "decl %0\n"
7186+
7187+#ifdef CONFIG_PAX_REFCOUNT
7188+ "jno 0f\n"
7189+ LOCK_PREFIX "incl %0\n"
7190+ "int $4\n0:\n"
7191+ _ASM_EXTABLE(0b, 0b)
7192+#endif
7193+
7194+ : "+m" (v->counter));
7195+}
7196+
7197+/**
7198+ * atomic_dec_unchecked - decrement atomic variable
7199+ * @v: pointer of type atomic_unchecked_t
7200+ *
7201+ * Atomically decrements @v by 1.
7202+ */
7203+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7204+{
7205+ asm volatile(LOCK_PREFIX "decl %0\n"
7206 : "+m" (v->counter));
7207 }
7208
7209@@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(at
7210 {
7211 unsigned char c;
7212
7213- asm volatile(LOCK_PREFIX "decl %0; sete %1"
7214+ asm volatile(LOCK_PREFIX "decl %0\n"
7215+
7216+#ifdef CONFIG_PAX_REFCOUNT
7217+ "jno 0f\n"
7218+ LOCK_PREFIX "incl %0\n"
7219+ "int $4\n0:\n"
7220+ _ASM_EXTABLE(0b, 0b)
7221+#endif
7222+
7223+ "sete %1\n"
7224 : "+m" (v->counter), "=qm" (c)
7225 : : "memory");
7226 return c != 0;
7227@@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(at
7228 {
7229 unsigned char c;
7230
7231- asm volatile(LOCK_PREFIX "incl %0; sete %1"
7232+ asm volatile(LOCK_PREFIX "incl %0\n"
7233+
7234+#ifdef CONFIG_PAX_REFCOUNT
7235+ "jno 0f\n"
7236+ LOCK_PREFIX "decl %0\n"
7237+ "into\n0:\n"
7238+ _ASM_EXTABLE(0b, 0b)
7239+#endif
7240+
7241+ "sete %1\n"
7242+ : "+m" (v->counter), "=qm" (c)
7243+ : : "memory");
7244+ return c != 0;
7245+}
7246+
7247+/**
7248+ * atomic_inc_and_test_unchecked - increment and test
7249+ * @v: pointer of type atomic_unchecked_t
7250+ *
7251+ * Atomically increments @v by 1
7252+ * and returns true if the result is zero, or false for all
7253+ * other cases.
7254+ */
7255+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7256+{
7257+ unsigned char c;
7258+
7259+ asm volatile(LOCK_PREFIX "incl %0\n"
7260+ "sete %1\n"
7261 : "+m" (v->counter), "=qm" (c)
7262 : : "memory");
7263 return c != 0;
7264@@ -156,7 +309,16 @@ static inline int atomic_add_negative(in
7265 {
7266 unsigned char c;
7267
7268- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7269+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
7270+
7271+#ifdef CONFIG_PAX_REFCOUNT
7272+ "jno 0f\n"
7273+ LOCK_PREFIX "subl %2,%0\n"
7274+ "int $4\n0:\n"
7275+ _ASM_EXTABLE(0b, 0b)
7276+#endif
7277+
7278+ "sets %1\n"
7279 : "+m" (v->counter), "=qm" (c)
7280 : "ir" (i) : "memory");
7281 return c;
7282@@ -179,6 +341,46 @@ static inline int atomic_add_return(int
7283 #endif
7284 /* Modern 486+ processor */
7285 __i = i;
7286+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7287+
7288+#ifdef CONFIG_PAX_REFCOUNT
7289+ "jno 0f\n"
7290+ "movl %0, %1\n"
7291+ "int $4\n0:\n"
7292+ _ASM_EXTABLE(0b, 0b)
7293+#endif
7294+
7295+ : "+r" (i), "+m" (v->counter)
7296+ : : "memory");
7297+ return i + __i;
7298+
7299+#ifdef CONFIG_M386
7300+no_xadd: /* Legacy 386 processor */
7301+ local_irq_save(flags);
7302+ __i = atomic_read(v);
7303+ atomic_set(v, i + __i);
7304+ local_irq_restore(flags);
7305+ return i + __i;
7306+#endif
7307+}
7308+
7309+/**
7310+ * atomic_add_return_unchecked - add integer and return
7311+ * @v: pointer of type atomic_unchecked_t
7312+ * @i: integer value to add
7313+ *
7314+ * Atomically adds @i to @v and returns @i + @v
7315+ */
7316+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7317+{
7318+ int __i;
7319+#ifdef CONFIG_M386
7320+ unsigned long flags;
7321+ if (unlikely(boot_cpu_data.x86 <= 3))
7322+ goto no_xadd;
7323+#endif
7324+ /* Modern 486+ processor */
7325+ __i = i;
7326 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7327 : "+r" (i), "+m" (v->counter)
7328 : : "memory");
7329@@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_
7330 return cmpxchg(&v->counter, old, new);
7331 }
7332
7333+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7334+{
7335+ return cmpxchg(&v->counter, old, new);
7336+}
7337+
7338 static inline int atomic_xchg(atomic_t *v, int new)
7339 {
7340 return xchg(&v->counter, new);
7341 }
7342
7343+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7344+{
7345+ return xchg(&v->counter, new);
7346+}
7347+
7348 /**
7349 * atomic_add_unless - add unless the number is already a given value
7350 * @v: pointer of type atomic_t
7351@@ -227,22 +439,39 @@ static inline int atomic_xchg(atomic_t *
7352 */
7353 static inline int atomic_add_unless(atomic_t *v, int a, int u)
7354 {
7355- int c, old;
7356+ int c, old, new;
7357 c = atomic_read(v);
7358 for (;;) {
7359- if (unlikely(c == (u)))
7360+ if (unlikely(c == u))
7361 break;
7362- old = atomic_cmpxchg((v), c, c + (a));
7363+
7364+ asm volatile("addl %2,%0\n"
7365+
7366+#ifdef CONFIG_PAX_REFCOUNT
7367+ "jno 0f\n"
7368+ "subl %2,%0\n"
7369+ "int $4\n0:\n"
7370+ _ASM_EXTABLE(0b, 0b)
7371+#endif
7372+
7373+ : "=r" (new)
7374+ : "0" (c), "ir" (a));
7375+
7376+ old = atomic_cmpxchg(v, c, new);
7377 if (likely(old == c))
7378 break;
7379 c = old;
7380 }
7381- return c != (u);
7382+ return c != u;
7383 }
7384
7385 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
7386
7387 #define atomic_inc_return(v) (atomic_add_return(1, v))
7388+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7389+{
7390+ return atomic_add_return_unchecked(1, v);
7391+}
7392 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7393
7394 /* These are x86-specific, used by some header files */
7395@@ -266,9 +495,18 @@ typedef struct {
7396 u64 __aligned(8) counter;
7397 } atomic64_t;
7398
7399+#ifdef CONFIG_PAX_REFCOUNT
7400+typedef struct {
7401+ u64 __aligned(8) counter;
7402+} atomic64_unchecked_t;
7403+#else
7404+typedef atomic64_t atomic64_unchecked_t;
7405+#endif
7406+
7407 #define ATOMIC64_INIT(val) { (val) }
7408
7409 extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
7410+extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
7411
7412 /**
7413 * atomic64_xchg - xchg atomic64 variable
7414@@ -279,6 +517,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *
7415 * the old value.
7416 */
7417 extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
7418+extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7419
7420 /**
7421 * atomic64_set - set atomic64 variable
7422@@ -290,6 +529,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr
7423 extern void atomic64_set(atomic64_t *ptr, u64 new_val);
7424
7425 /**
7426+ * atomic64_unchecked_set - set atomic64 variable
7427+ * @ptr: pointer to type atomic64_unchecked_t
7428+ * @new_val: value to assign
7429+ *
7430+ * Atomically sets the value of @ptr to @new_val.
7431+ */
7432+extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7433+
7434+/**
7435 * atomic64_read - read atomic64 variable
7436 * @ptr: pointer to type atomic64_t
7437 *
7438@@ -317,7 +565,33 @@ static inline u64 atomic64_read(atomic64
7439 return res;
7440 }
7441
7442-extern u64 atomic64_read(atomic64_t *ptr);
7443+/**
7444+ * atomic64_read_unchecked - read atomic64 variable
7445+ * @ptr: pointer to type atomic64_unchecked_t
7446+ *
7447+ * Atomically reads the value of @ptr and returns it.
7448+ */
7449+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
7450+{
7451+ u64 res;
7452+
7453+ /*
7454+ * Note, we inline this atomic64_unchecked_t primitive because
7455+ * it only clobbers EAX/EDX and leaves the others
7456+ * untouched. We also (somewhat subtly) rely on the
7457+ * fact that cmpxchg8b returns the current 64-bit value
7458+ * of the memory location we are touching:
7459+ */
7460+ asm volatile(
7461+ "mov %%ebx, %%eax\n\t"
7462+ "mov %%ecx, %%edx\n\t"
7463+ LOCK_PREFIX "cmpxchg8b %1\n"
7464+ : "=&A" (res)
7465+ : "m" (*ptr)
7466+ );
7467+
7468+ return res;
7469+}
7470
7471 /**
7472 * atomic64_add_return - add and return
7473@@ -332,8 +606,11 @@ extern u64 atomic64_add_return(u64 delta
7474 * Other variants with different arithmetic operators:
7475 */
7476 extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
7477+extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7478 extern u64 atomic64_inc_return(atomic64_t *ptr);
7479+extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
7480 extern u64 atomic64_dec_return(atomic64_t *ptr);
7481+extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
7482
7483 /**
7484 * atomic64_add - add integer to atomic64 variable
7485@@ -345,6 +622,15 @@ extern u64 atomic64_dec_return(atomic64_
7486 extern void atomic64_add(u64 delta, atomic64_t *ptr);
7487
7488 /**
7489+ * atomic64_add_unchecked - add integer to atomic64 variable
7490+ * @delta: integer value to add
7491+ * @ptr: pointer to type atomic64_unchecked_t
7492+ *
7493+ * Atomically adds @delta to @ptr.
7494+ */
7495+extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7496+
7497+/**
7498 * atomic64_sub - subtract the atomic64 variable
7499 * @delta: integer value to subtract
7500 * @ptr: pointer to type atomic64_t
7501@@ -354,6 +640,15 @@ extern void atomic64_add(u64 delta, atom
7502 extern void atomic64_sub(u64 delta, atomic64_t *ptr);
7503
7504 /**
7505+ * atomic64_sub_unchecked - subtract the atomic64 variable
7506+ * @delta: integer value to subtract
7507+ * @ptr: pointer to type atomic64_unchecked_t
7508+ *
7509+ * Atomically subtracts @delta from @ptr.
7510+ */
7511+extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7512+
7513+/**
7514 * atomic64_sub_and_test - subtract value from variable and test result
7515 * @delta: integer value to subtract
7516 * @ptr: pointer to type atomic64_t
7517@@ -373,6 +668,14 @@ extern int atomic64_sub_and_test(u64 del
7518 extern void atomic64_inc(atomic64_t *ptr);
7519
7520 /**
7521+ * atomic64_inc_unchecked - increment atomic64 variable
7522+ * @ptr: pointer to type atomic64_unchecked_t
7523+ *
7524+ * Atomically increments @ptr by 1.
7525+ */
7526+extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
7527+
7528+/**
7529 * atomic64_dec - decrement atomic64 variable
7530 * @ptr: pointer to type atomic64_t
7531 *
7532@@ -381,6 +684,14 @@ extern void atomic64_inc(atomic64_t *ptr
7533 extern void atomic64_dec(atomic64_t *ptr);
7534
7535 /**
7536+ * atomic64_dec_unchecked - decrement atomic64 variable
7537+ * @ptr: pointer to type atomic64_unchecked_t
7538+ *
7539+ * Atomically decrements @ptr by 1.
7540+ */
7541+extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
7542+
7543+/**
7544 * atomic64_dec_and_test - decrement and test
7545 * @ptr: pointer to type atomic64_t
7546 *
7547diff -urNp linux-2.6.32.46/arch/x86/include/asm/atomic_64.h linux-2.6.32.46/arch/x86/include/asm/atomic_64.h
7548--- linux-2.6.32.46/arch/x86/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
7549+++ linux-2.6.32.46/arch/x86/include/asm/atomic_64.h 2011-05-04 18:35:31.000000000 -0400
7550@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
7551 }
7552
7553 /**
7554+ * atomic_read_unchecked - read atomic variable
7555+ * @v: pointer of type atomic_unchecked_t
7556+ *
7557+ * Atomically reads the value of @v.
7558+ */
7559+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7560+{
7561+ return v->counter;
7562+}
7563+
7564+/**
7565 * atomic_set - set atomic variable
7566 * @v: pointer of type atomic_t
7567 * @i: required value
7568@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
7569 }
7570
7571 /**
7572+ * atomic_set_unchecked - set atomic variable
7573+ * @v: pointer of type atomic_unchecked_t
7574+ * @i: required value
7575+ *
7576+ * Atomically sets the value of @v to @i.
7577+ */
7578+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7579+{
7580+ v->counter = i;
7581+}
7582+
7583+/**
7584 * atomic_add - add integer to atomic variable
7585 * @i: integer value to add
7586 * @v: pointer of type atomic_t
7587@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
7588 */
7589 static inline void atomic_add(int i, atomic_t *v)
7590 {
7591- asm volatile(LOCK_PREFIX "addl %1,%0"
7592+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7593+
7594+#ifdef CONFIG_PAX_REFCOUNT
7595+ "jno 0f\n"
7596+ LOCK_PREFIX "subl %1,%0\n"
7597+ "int $4\n0:\n"
7598+ _ASM_EXTABLE(0b, 0b)
7599+#endif
7600+
7601+ : "=m" (v->counter)
7602+ : "ir" (i), "m" (v->counter));
7603+}
7604+
7605+/**
7606+ * atomic_add_unchecked - add integer to atomic variable
7607+ * @i: integer value to add
7608+ * @v: pointer of type atomic_unchecked_t
7609+ *
7610+ * Atomically adds @i to @v.
7611+ */
7612+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7613+{
7614+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
7615 : "=m" (v->counter)
7616 : "ir" (i), "m" (v->counter));
7617 }
7618@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
7619 */
7620 static inline void atomic_sub(int i, atomic_t *v)
7621 {
7622- asm volatile(LOCK_PREFIX "subl %1,%0"
7623+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7624+
7625+#ifdef CONFIG_PAX_REFCOUNT
7626+ "jno 0f\n"
7627+ LOCK_PREFIX "addl %1,%0\n"
7628+ "int $4\n0:\n"
7629+ _ASM_EXTABLE(0b, 0b)
7630+#endif
7631+
7632+ : "=m" (v->counter)
7633+ : "ir" (i), "m" (v->counter));
7634+}
7635+
7636+/**
7637+ * atomic_sub_unchecked - subtract the atomic variable
7638+ * @i: integer value to subtract
7639+ * @v: pointer of type atomic_unchecked_t
7640+ *
7641+ * Atomically subtracts @i from @v.
7642+ */
7643+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7644+{
7645+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
7646 : "=m" (v->counter)
7647 : "ir" (i), "m" (v->counter));
7648 }
7649@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
7650 {
7651 unsigned char c;
7652
7653- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7654+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
7655+
7656+#ifdef CONFIG_PAX_REFCOUNT
7657+ "jno 0f\n"
7658+ LOCK_PREFIX "addl %2,%0\n"
7659+ "int $4\n0:\n"
7660+ _ASM_EXTABLE(0b, 0b)
7661+#endif
7662+
7663+ "sete %1\n"
7664 : "=m" (v->counter), "=qm" (c)
7665 : "ir" (i), "m" (v->counter) : "memory");
7666 return c;
7667@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
7668 */
7669 static inline void atomic_inc(atomic_t *v)
7670 {
7671- asm volatile(LOCK_PREFIX "incl %0"
7672+ asm volatile(LOCK_PREFIX "incl %0\n"
7673+
7674+#ifdef CONFIG_PAX_REFCOUNT
7675+ "jno 0f\n"
7676+ LOCK_PREFIX "decl %0\n"
7677+ "int $4\n0:\n"
7678+ _ASM_EXTABLE(0b, 0b)
7679+#endif
7680+
7681+ : "=m" (v->counter)
7682+ : "m" (v->counter));
7683+}
7684+
7685+/**
7686+ * atomic_inc_unchecked - increment atomic variable
7687+ * @v: pointer of type atomic_unchecked_t
7688+ *
7689+ * Atomically increments @v by 1.
7690+ */
7691+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7692+{
7693+ asm volatile(LOCK_PREFIX "incl %0\n"
7694 : "=m" (v->counter)
7695 : "m" (v->counter));
7696 }
7697@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
7698 */
7699 static inline void atomic_dec(atomic_t *v)
7700 {
7701- asm volatile(LOCK_PREFIX "decl %0"
7702+ asm volatile(LOCK_PREFIX "decl %0\n"
7703+
7704+#ifdef CONFIG_PAX_REFCOUNT
7705+ "jno 0f\n"
7706+ LOCK_PREFIX "incl %0\n"
7707+ "int $4\n0:\n"
7708+ _ASM_EXTABLE(0b, 0b)
7709+#endif
7710+
7711+ : "=m" (v->counter)
7712+ : "m" (v->counter));
7713+}
7714+
7715+/**
7716+ * atomic_dec_unchecked - decrement atomic variable
7717+ * @v: pointer of type atomic_unchecked_t
7718+ *
7719+ * Atomically decrements @v by 1.
7720+ */
7721+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7722+{
7723+ asm volatile(LOCK_PREFIX "decl %0\n"
7724 : "=m" (v->counter)
7725 : "m" (v->counter));
7726 }
7727@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
7728 {
7729 unsigned char c;
7730
7731- asm volatile(LOCK_PREFIX "decl %0; sete %1"
7732+ asm volatile(LOCK_PREFIX "decl %0\n"
7733+
7734+#ifdef CONFIG_PAX_REFCOUNT
7735+ "jno 0f\n"
7736+ LOCK_PREFIX "incl %0\n"
7737+ "int $4\n0:\n"
7738+ _ASM_EXTABLE(0b, 0b)
7739+#endif
7740+
7741+ "sete %1\n"
7742 : "=m" (v->counter), "=qm" (c)
7743 : "m" (v->counter) : "memory");
7744 return c != 0;
7745@@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(at
7746 {
7747 unsigned char c;
7748
7749- asm volatile(LOCK_PREFIX "incl %0; sete %1"
7750+ asm volatile(LOCK_PREFIX "incl %0\n"
7751+
7752+#ifdef CONFIG_PAX_REFCOUNT
7753+ "jno 0f\n"
7754+ LOCK_PREFIX "decl %0\n"
7755+ "int $4\n0:\n"
7756+ _ASM_EXTABLE(0b, 0b)
7757+#endif
7758+
7759+ "sete %1\n"
7760+ : "=m" (v->counter), "=qm" (c)
7761+ : "m" (v->counter) : "memory");
7762+ return c != 0;
7763+}
7764+
7765+/**
7766+ * atomic_inc_and_test_unchecked - increment and test
7767+ * @v: pointer of type atomic_unchecked_t
7768+ *
7769+ * Atomically increments @v by 1
7770+ * and returns true if the result is zero, or false for all
7771+ * other cases.
7772+ */
7773+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7774+{
7775+ unsigned char c;
7776+
7777+ asm volatile(LOCK_PREFIX "incl %0\n"
7778+ "sete %1\n"
7779 : "=m" (v->counter), "=qm" (c)
7780 : "m" (v->counter) : "memory");
7781 return c != 0;
7782@@ -157,7 +312,16 @@ static inline int atomic_add_negative(in
7783 {
7784 unsigned char c;
7785
7786- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7787+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
7788+
7789+#ifdef CONFIG_PAX_REFCOUNT
7790+ "jno 0f\n"
7791+ LOCK_PREFIX "subl %2,%0\n"
7792+ "int $4\n0:\n"
7793+ _ASM_EXTABLE(0b, 0b)
7794+#endif
7795+
7796+ "sets %1\n"
7797 : "=m" (v->counter), "=qm" (c)
7798 : "ir" (i), "m" (v->counter) : "memory");
7799 return c;
7800@@ -173,7 +337,31 @@ static inline int atomic_add_negative(in
7801 static inline int atomic_add_return(int i, atomic_t *v)
7802 {
7803 int __i = i;
7804- asm volatile(LOCK_PREFIX "xaddl %0, %1"
7805+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7806+
7807+#ifdef CONFIG_PAX_REFCOUNT
7808+ "jno 0f\n"
7809+ "movl %0, %1\n"
7810+ "int $4\n0:\n"
7811+ _ASM_EXTABLE(0b, 0b)
7812+#endif
7813+
7814+ : "+r" (i), "+m" (v->counter)
7815+ : : "memory");
7816+ return i + __i;
7817+}
7818+
7819+/**
7820+ * atomic_add_return_unchecked - add and return
7821+ * @i: integer value to add
7822+ * @v: pointer of type atomic_unchecked_t
7823+ *
7824+ * Atomically adds @i to @v and returns @i + @v
7825+ */
7826+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7827+{
7828+ int __i = i;
7829+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7830 : "+r" (i), "+m" (v->counter)
7831 : : "memory");
7832 return i + __i;
7833@@ -185,6 +373,10 @@ static inline int atomic_sub_return(int
7834 }
7835
7836 #define atomic_inc_return(v) (atomic_add_return(1, v))
7837+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7838+{
7839+ return atomic_add_return_unchecked(1, v);
7840+}
7841 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7842
7843 /* The 64-bit atomic type */
7844@@ -204,6 +396,18 @@ static inline long atomic64_read(const a
7845 }
7846
7847 /**
7848+ * atomic64_read_unchecked - read atomic64 variable
7849+ * @v: pointer of type atomic64_unchecked_t
7850+ *
7851+ * Atomically reads the value of @v.
7852+ * Doesn't imply a read memory barrier.
7853+ */
7854+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
7855+{
7856+ return v->counter;
7857+}
7858+
7859+/**
7860 * atomic64_set - set atomic64 variable
7861 * @v: pointer to type atomic64_t
7862 * @i: required value
7863@@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64
7864 }
7865
7866 /**
7867+ * atomic64_set_unchecked - set atomic64 variable
7868+ * @v: pointer to type atomic64_unchecked_t
7869+ * @i: required value
7870+ *
7871+ * Atomically sets the value of @v to @i.
7872+ */
7873+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
7874+{
7875+ v->counter = i;
7876+}
7877+
7878+/**
7879 * atomic64_add - add integer to atomic64 variable
7880 * @i: integer value to add
7881 * @v: pointer to type atomic64_t
7882@@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64
7883 */
7884 static inline void atomic64_add(long i, atomic64_t *v)
7885 {
7886+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
7887+
7888+#ifdef CONFIG_PAX_REFCOUNT
7889+ "jno 0f\n"
7890+ LOCK_PREFIX "subq %1,%0\n"
7891+ "int $4\n0:\n"
7892+ _ASM_EXTABLE(0b, 0b)
7893+#endif
7894+
7895+ : "=m" (v->counter)
7896+ : "er" (i), "m" (v->counter));
7897+}
7898+
7899+/**
7900+ * atomic64_add_unchecked - add integer to atomic64 variable
7901+ * @i: integer value to add
7902+ * @v: pointer to type atomic64_unchecked_t
7903+ *
7904+ * Atomically adds @i to @v.
7905+ */
7906+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
7907+{
7908 asm volatile(LOCK_PREFIX "addq %1,%0"
7909 : "=m" (v->counter)
7910 : "er" (i), "m" (v->counter));
7911@@ -238,7 +476,15 @@ static inline void atomic64_add(long i,
7912 */
7913 static inline void atomic64_sub(long i, atomic64_t *v)
7914 {
7915- asm volatile(LOCK_PREFIX "subq %1,%0"
7916+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
7917+
7918+#ifdef CONFIG_PAX_REFCOUNT
7919+ "jno 0f\n"
7920+ LOCK_PREFIX "addq %1,%0\n"
7921+ "int $4\n0:\n"
7922+ _ASM_EXTABLE(0b, 0b)
7923+#endif
7924+
7925 : "=m" (v->counter)
7926 : "er" (i), "m" (v->counter));
7927 }
7928@@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(
7929 {
7930 unsigned char c;
7931
7932- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
7933+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
7934+
7935+#ifdef CONFIG_PAX_REFCOUNT
7936+ "jno 0f\n"
7937+ LOCK_PREFIX "addq %2,%0\n"
7938+ "int $4\n0:\n"
7939+ _ASM_EXTABLE(0b, 0b)
7940+#endif
7941+
7942+ "sete %1\n"
7943 : "=m" (v->counter), "=qm" (c)
7944 : "er" (i), "m" (v->counter) : "memory");
7945 return c;
7946@@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(
7947 */
7948 static inline void atomic64_inc(atomic64_t *v)
7949 {
7950+ asm volatile(LOCK_PREFIX "incq %0\n"
7951+
7952+#ifdef CONFIG_PAX_REFCOUNT
7953+ "jno 0f\n"
7954+ LOCK_PREFIX "decq %0\n"
7955+ "int $4\n0:\n"
7956+ _ASM_EXTABLE(0b, 0b)
7957+#endif
7958+
7959+ : "=m" (v->counter)
7960+ : "m" (v->counter));
7961+}
7962+
7963+/**
7964+ * atomic64_inc_unchecked - increment atomic64 variable
7965+ * @v: pointer to type atomic64_unchecked_t
7966+ *
7967+ * Atomically increments @v by 1.
7968+ */
7969+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
7970+{
7971 asm volatile(LOCK_PREFIX "incq %0"
7972 : "=m" (v->counter)
7973 : "m" (v->counter));
7974@@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64
7975 */
7976 static inline void atomic64_dec(atomic64_t *v)
7977 {
7978- asm volatile(LOCK_PREFIX "decq %0"
7979+ asm volatile(LOCK_PREFIX "decq %0\n"
7980+
7981+#ifdef CONFIG_PAX_REFCOUNT
7982+ "jno 0f\n"
7983+ LOCK_PREFIX "incq %0\n"
7984+ "int $4\n0:\n"
7985+ _ASM_EXTABLE(0b, 0b)
7986+#endif
7987+
7988+ : "=m" (v->counter)
7989+ : "m" (v->counter));
7990+}
7991+
7992+/**
7993+ * atomic64_dec_unchecked - decrement atomic64 variable
7994+ * @v: pointer to type atomic64_t
7995+ *
7996+ * Atomically decrements @v by 1.
7997+ */
7998+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
7999+{
8000+ asm volatile(LOCK_PREFIX "decq %0\n"
8001 : "=m" (v->counter)
8002 : "m" (v->counter));
8003 }
8004@@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(
8005 {
8006 unsigned char c;
8007
8008- asm volatile(LOCK_PREFIX "decq %0; sete %1"
8009+ asm volatile(LOCK_PREFIX "decq %0\n"
8010+
8011+#ifdef CONFIG_PAX_REFCOUNT
8012+ "jno 0f\n"
8013+ LOCK_PREFIX "incq %0\n"
8014+ "int $4\n0:\n"
8015+ _ASM_EXTABLE(0b, 0b)
8016+#endif
8017+
8018+ "sete %1\n"
8019 : "=m" (v->counter), "=qm" (c)
8020 : "m" (v->counter) : "memory");
8021 return c != 0;
8022@@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(
8023 {
8024 unsigned char c;
8025
8026- asm volatile(LOCK_PREFIX "incq %0; sete %1"
8027+ asm volatile(LOCK_PREFIX "incq %0\n"
8028+
8029+#ifdef CONFIG_PAX_REFCOUNT
8030+ "jno 0f\n"
8031+ LOCK_PREFIX "decq %0\n"
8032+ "int $4\n0:\n"
8033+ _ASM_EXTABLE(0b, 0b)
8034+#endif
8035+
8036+ "sete %1\n"
8037 : "=m" (v->counter), "=qm" (c)
8038 : "m" (v->counter) : "memory");
8039 return c != 0;
8040@@ -337,7 +652,16 @@ static inline int atomic64_add_negative(
8041 {
8042 unsigned char c;
8043
8044- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8045+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
8046+
8047+#ifdef CONFIG_PAX_REFCOUNT
8048+ "jno 0f\n"
8049+ LOCK_PREFIX "subq %2,%0\n"
8050+ "int $4\n0:\n"
8051+ _ASM_EXTABLE(0b, 0b)
8052+#endif
8053+
8054+ "sets %1\n"
8055 : "=m" (v->counter), "=qm" (c)
8056 : "er" (i), "m" (v->counter) : "memory");
8057 return c;
8058@@ -353,7 +677,31 @@ static inline int atomic64_add_negative(
8059 static inline long atomic64_add_return(long i, atomic64_t *v)
8060 {
8061 long __i = i;
8062- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8063+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8064+
8065+#ifdef CONFIG_PAX_REFCOUNT
8066+ "jno 0f\n"
8067+ "movq %0, %1\n"
8068+ "int $4\n0:\n"
8069+ _ASM_EXTABLE(0b, 0b)
8070+#endif
8071+
8072+ : "+r" (i), "+m" (v->counter)
8073+ : : "memory");
8074+ return i + __i;
8075+}
8076+
8077+/**
8078+ * atomic64_add_return_unchecked - add and return
8079+ * @i: integer value to add
8080+ * @v: pointer to type atomic64_unchecked_t
8081+ *
8082+ * Atomically adds @i to @v and returns @i + @v
8083+ */
8084+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8085+{
8086+ long __i = i;
8087+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
8088 : "+r" (i), "+m" (v->counter)
8089 : : "memory");
8090 return i + __i;
8091@@ -365,6 +713,10 @@ static inline long atomic64_sub_return(l
8092 }
8093
8094 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8095+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8096+{
8097+ return atomic64_add_return_unchecked(1, v);
8098+}
8099 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8100
8101 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8102@@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atom
8103 return cmpxchg(&v->counter, old, new);
8104 }
8105
8106+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8107+{
8108+ return cmpxchg(&v->counter, old, new);
8109+}
8110+
8111 static inline long atomic64_xchg(atomic64_t *v, long new)
8112 {
8113 return xchg(&v->counter, new);
8114 }
8115
8116+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
8117+{
8118+ return xchg(&v->counter, new);
8119+}
8120+
8121 static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
8122 {
8123 return cmpxchg(&v->counter, old, new);
8124 }
8125
8126+static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8127+{
8128+ return cmpxchg(&v->counter, old, new);
8129+}
8130+
8131 static inline long atomic_xchg(atomic_t *v, int new)
8132 {
8133 return xchg(&v->counter, new);
8134 }
8135
8136+static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8137+{
8138+ return xchg(&v->counter, new);
8139+}
8140+
8141 /**
8142 * atomic_add_unless - add unless the number is a given value
8143 * @v: pointer of type atomic_t
8144@@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t
8145 */
8146 static inline int atomic_add_unless(atomic_t *v, int a, int u)
8147 {
8148- int c, old;
8149+ int c, old, new;
8150 c = atomic_read(v);
8151 for (;;) {
8152- if (unlikely(c == (u)))
8153+ if (unlikely(c == u))
8154 break;
8155- old = atomic_cmpxchg((v), c, c + (a));
8156+
8157+ asm volatile("addl %2,%0\n"
8158+
8159+#ifdef CONFIG_PAX_REFCOUNT
8160+ "jno 0f\n"
8161+ "subl %2,%0\n"
8162+ "int $4\n0:\n"
8163+ _ASM_EXTABLE(0b, 0b)
8164+#endif
8165+
8166+ : "=r" (new)
8167+ : "0" (c), "ir" (a));
8168+
8169+ old = atomic_cmpxchg(v, c, new);
8170 if (likely(old == c))
8171 break;
8172 c = old;
8173 }
8174- return c != (u);
8175+ return c != u;
8176 }
8177
8178 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
8179@@ -424,17 +809,30 @@ static inline int atomic_add_unless(atom
8180 */
8181 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8182 {
8183- long c, old;
8184+ long c, old, new;
8185 c = atomic64_read(v);
8186 for (;;) {
8187- if (unlikely(c == (u)))
8188+ if (unlikely(c == u))
8189 break;
8190- old = atomic64_cmpxchg((v), c, c + (a));
8191+
8192+ asm volatile("addq %2,%0\n"
8193+
8194+#ifdef CONFIG_PAX_REFCOUNT
8195+ "jno 0f\n"
8196+ "subq %2,%0\n"
8197+ "int $4\n0:\n"
8198+ _ASM_EXTABLE(0b, 0b)
8199+#endif
8200+
8201+ : "=r" (new)
8202+ : "0" (c), "er" (a));
8203+
8204+ old = atomic64_cmpxchg(v, c, new);
8205 if (likely(old == c))
8206 break;
8207 c = old;
8208 }
8209- return c != (u);
8210+ return c != u;
8211 }
8212
8213 /**
8214diff -urNp linux-2.6.32.46/arch/x86/include/asm/bitops.h linux-2.6.32.46/arch/x86/include/asm/bitops.h
8215--- linux-2.6.32.46/arch/x86/include/asm/bitops.h 2011-03-27 14:31:47.000000000 -0400
8216+++ linux-2.6.32.46/arch/x86/include/asm/bitops.h 2011-04-17 15:56:46.000000000 -0400
8217@@ -38,7 +38,7 @@
8218 * a mask operation on a byte.
8219 */
8220 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8221-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8222+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8223 #define CONST_MASK(nr) (1 << ((nr) & 7))
8224
8225 /**
8226diff -urNp linux-2.6.32.46/arch/x86/include/asm/boot.h linux-2.6.32.46/arch/x86/include/asm/boot.h
8227--- linux-2.6.32.46/arch/x86/include/asm/boot.h 2011-03-27 14:31:47.000000000 -0400
8228+++ linux-2.6.32.46/arch/x86/include/asm/boot.h 2011-04-17 15:56:46.000000000 -0400
8229@@ -11,10 +11,15 @@
8230 #include <asm/pgtable_types.h>
8231
8232 /* Physical address where kernel should be loaded. */
8233-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8234+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8235 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8236 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8237
8238+#ifndef __ASSEMBLY__
8239+extern unsigned char __LOAD_PHYSICAL_ADDR[];
8240+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8241+#endif
8242+
8243 /* Minimum kernel alignment, as a power of two */
8244 #ifdef CONFIG_X86_64
8245 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8246diff -urNp linux-2.6.32.46/arch/x86/include/asm/cacheflush.h linux-2.6.32.46/arch/x86/include/asm/cacheflush.h
8247--- linux-2.6.32.46/arch/x86/include/asm/cacheflush.h 2011-03-27 14:31:47.000000000 -0400
8248+++ linux-2.6.32.46/arch/x86/include/asm/cacheflush.h 2011-04-17 15:56:46.000000000 -0400
8249@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
8250 static inline unsigned long get_page_memtype(struct page *pg)
8251 {
8252 if (!PageUncached(pg) && !PageWC(pg))
8253- return -1;
8254+ return ~0UL;
8255 else if (!PageUncached(pg) && PageWC(pg))
8256 return _PAGE_CACHE_WC;
8257 else if (PageUncached(pg) && !PageWC(pg))
8258@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
8259 SetPageWC(pg);
8260 break;
8261 default:
8262- case -1:
8263+ case ~0UL:
8264 ClearPageUncached(pg);
8265 ClearPageWC(pg);
8266 break;
8267diff -urNp linux-2.6.32.46/arch/x86/include/asm/cache.h linux-2.6.32.46/arch/x86/include/asm/cache.h
8268--- linux-2.6.32.46/arch/x86/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
8269+++ linux-2.6.32.46/arch/x86/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
8270@@ -5,9 +5,10 @@
8271
8272 /* L1 cache line size */
8273 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8274-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8275+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8276
8277 #define __read_mostly __attribute__((__section__(".data.read_mostly")))
8278+#define __read_only __attribute__((__section__(".data.read_only")))
8279
8280 #ifdef CONFIG_X86_VSMP
8281 /* vSMP Internode cacheline shift */
8282diff -urNp linux-2.6.32.46/arch/x86/include/asm/checksum_32.h linux-2.6.32.46/arch/x86/include/asm/checksum_32.h
8283--- linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400
8284+++ linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400
8285@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
8286 int len, __wsum sum,
8287 int *src_err_ptr, int *dst_err_ptr);
8288
8289+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8290+ int len, __wsum sum,
8291+ int *src_err_ptr, int *dst_err_ptr);
8292+
8293+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8294+ int len, __wsum sum,
8295+ int *src_err_ptr, int *dst_err_ptr);
8296+
8297 /*
8298 * Note: when you get a NULL pointer exception here this means someone
8299 * passed in an incorrect kernel address to one of these functions.
8300@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
8301 int *err_ptr)
8302 {
8303 might_sleep();
8304- return csum_partial_copy_generic((__force void *)src, dst,
8305+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
8306 len, sum, err_ptr, NULL);
8307 }
8308
8309@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
8310 {
8311 might_sleep();
8312 if (access_ok(VERIFY_WRITE, dst, len))
8313- return csum_partial_copy_generic(src, (__force void *)dst,
8314+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8315 len, sum, NULL, err_ptr);
8316
8317 if (len)
8318diff -urNp linux-2.6.32.46/arch/x86/include/asm/desc_defs.h linux-2.6.32.46/arch/x86/include/asm/desc_defs.h
8319--- linux-2.6.32.46/arch/x86/include/asm/desc_defs.h 2011-03-27 14:31:47.000000000 -0400
8320+++ linux-2.6.32.46/arch/x86/include/asm/desc_defs.h 2011-04-17 15:56:46.000000000 -0400
8321@@ -31,6 +31,12 @@ struct desc_struct {
8322 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8323 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8324 };
8325+ struct {
8326+ u16 offset_low;
8327+ u16 seg;
8328+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8329+ unsigned offset_high: 16;
8330+ } gate;
8331 };
8332 } __attribute__((packed));
8333
8334diff -urNp linux-2.6.32.46/arch/x86/include/asm/desc.h linux-2.6.32.46/arch/x86/include/asm/desc.h
8335--- linux-2.6.32.46/arch/x86/include/asm/desc.h 2011-03-27 14:31:47.000000000 -0400
8336+++ linux-2.6.32.46/arch/x86/include/asm/desc.h 2011-04-23 12:56:10.000000000 -0400
8337@@ -4,6 +4,7 @@
8338 #include <asm/desc_defs.h>
8339 #include <asm/ldt.h>
8340 #include <asm/mmu.h>
8341+#include <asm/pgtable.h>
8342 #include <linux/smp.h>
8343
8344 static inline void fill_ldt(struct desc_struct *desc,
8345@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
8346 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
8347 desc->type = (info->read_exec_only ^ 1) << 1;
8348 desc->type |= info->contents << 2;
8349+ desc->type |= info->seg_not_present ^ 1;
8350 desc->s = 1;
8351 desc->dpl = 0x3;
8352 desc->p = info->seg_not_present ^ 1;
8353@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
8354 }
8355
8356 extern struct desc_ptr idt_descr;
8357-extern gate_desc idt_table[];
8358-
8359-struct gdt_page {
8360- struct desc_struct gdt[GDT_ENTRIES];
8361-} __attribute__((aligned(PAGE_SIZE)));
8362-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8363+extern gate_desc idt_table[256];
8364
8365+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8366 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8367 {
8368- return per_cpu(gdt_page, cpu).gdt;
8369+ return cpu_gdt_table[cpu];
8370 }
8371
8372 #ifdef CONFIG_X86_64
8373@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
8374 unsigned long base, unsigned dpl, unsigned flags,
8375 unsigned short seg)
8376 {
8377- gate->a = (seg << 16) | (base & 0xffff);
8378- gate->b = (base & 0xffff0000) |
8379- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8380+ gate->gate.offset_low = base;
8381+ gate->gate.seg = seg;
8382+ gate->gate.reserved = 0;
8383+ gate->gate.type = type;
8384+ gate->gate.s = 0;
8385+ gate->gate.dpl = dpl;
8386+ gate->gate.p = 1;
8387+ gate->gate.offset_high = base >> 16;
8388 }
8389
8390 #endif
8391@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
8392 static inline void native_write_idt_entry(gate_desc *idt, int entry,
8393 const gate_desc *gate)
8394 {
8395+ pax_open_kernel();
8396 memcpy(&idt[entry], gate, sizeof(*gate));
8397+ pax_close_kernel();
8398 }
8399
8400 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
8401 const void *desc)
8402 {
8403+ pax_open_kernel();
8404 memcpy(&ldt[entry], desc, 8);
8405+ pax_close_kernel();
8406 }
8407
8408 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
8409@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
8410 size = sizeof(struct desc_struct);
8411 break;
8412 }
8413+
8414+ pax_open_kernel();
8415 memcpy(&gdt[entry], desc, size);
8416+ pax_close_kernel();
8417 }
8418
8419 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8420@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
8421
8422 static inline void native_load_tr_desc(void)
8423 {
8424+ pax_open_kernel();
8425 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8426+ pax_close_kernel();
8427 }
8428
8429 static inline void native_load_gdt(const struct desc_ptr *dtr)
8430@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
8431 unsigned int i;
8432 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8433
8434+ pax_open_kernel();
8435 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8436 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8437+ pax_close_kernel();
8438 }
8439
8440 #define _LDT_empty(info) \
8441@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
8442 desc->limit = (limit >> 16) & 0xf;
8443 }
8444
8445-static inline void _set_gate(int gate, unsigned type, void *addr,
8446+static inline void _set_gate(int gate, unsigned type, const void *addr,
8447 unsigned dpl, unsigned ist, unsigned seg)
8448 {
8449 gate_desc s;
8450@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
8451 * Pentium F0 0F bugfix can have resulted in the mapped
8452 * IDT being write-protected.
8453 */
8454-static inline void set_intr_gate(unsigned int n, void *addr)
8455+static inline void set_intr_gate(unsigned int n, const void *addr)
8456 {
8457 BUG_ON((unsigned)n > 0xFF);
8458 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8459@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
8460 /*
8461 * This routine sets up an interrupt gate at directory privilege level 3.
8462 */
8463-static inline void set_system_intr_gate(unsigned int n, void *addr)
8464+static inline void set_system_intr_gate(unsigned int n, const void *addr)
8465 {
8466 BUG_ON((unsigned)n > 0xFF);
8467 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8468 }
8469
8470-static inline void set_system_trap_gate(unsigned int n, void *addr)
8471+static inline void set_system_trap_gate(unsigned int n, const void *addr)
8472 {
8473 BUG_ON((unsigned)n > 0xFF);
8474 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8475 }
8476
8477-static inline void set_trap_gate(unsigned int n, void *addr)
8478+static inline void set_trap_gate(unsigned int n, const void *addr)
8479 {
8480 BUG_ON((unsigned)n > 0xFF);
8481 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8482@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
8483 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8484 {
8485 BUG_ON((unsigned)n > 0xFF);
8486- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8487+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8488 }
8489
8490-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8491+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8492 {
8493 BUG_ON((unsigned)n > 0xFF);
8494 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8495 }
8496
8497-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8498+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8499 {
8500 BUG_ON((unsigned)n > 0xFF);
8501 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8502 }
8503
8504+#ifdef CONFIG_X86_32
8505+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8506+{
8507+ struct desc_struct d;
8508+
8509+ if (likely(limit))
8510+ limit = (limit - 1UL) >> PAGE_SHIFT;
8511+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
8512+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8513+}
8514+#endif
8515+
8516 #endif /* _ASM_X86_DESC_H */
8517diff -urNp linux-2.6.32.46/arch/x86/include/asm/device.h linux-2.6.32.46/arch/x86/include/asm/device.h
8518--- linux-2.6.32.46/arch/x86/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
8519+++ linux-2.6.32.46/arch/x86/include/asm/device.h 2011-04-17 15:56:46.000000000 -0400
8520@@ -6,7 +6,7 @@ struct dev_archdata {
8521 void *acpi_handle;
8522 #endif
8523 #ifdef CONFIG_X86_64
8524-struct dma_map_ops *dma_ops;
8525+ const struct dma_map_ops *dma_ops;
8526 #endif
8527 #ifdef CONFIG_DMAR
8528 void *iommu; /* hook for IOMMU specific extension */
8529diff -urNp linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h
8530--- linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
8531+++ linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
8532@@ -25,9 +25,9 @@ extern int iommu_merge;
8533 extern struct device x86_dma_fallback_dev;
8534 extern int panic_on_overflow;
8535
8536-extern struct dma_map_ops *dma_ops;
8537+extern const struct dma_map_ops *dma_ops;
8538
8539-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
8540+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
8541 {
8542 #ifdef CONFIG_X86_32
8543 return dma_ops;
8544@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
8545 /* Make sure we keep the same behaviour */
8546 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
8547 {
8548- struct dma_map_ops *ops = get_dma_ops(dev);
8549+ const struct dma_map_ops *ops = get_dma_ops(dev);
8550 if (ops->mapping_error)
8551 return ops->mapping_error(dev, dma_addr);
8552
8553@@ -122,7 +122,7 @@ static inline void *
8554 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
8555 gfp_t gfp)
8556 {
8557- struct dma_map_ops *ops = get_dma_ops(dev);
8558+ const struct dma_map_ops *ops = get_dma_ops(dev);
8559 void *memory;
8560
8561 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
8562@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
8563 static inline void dma_free_coherent(struct device *dev, size_t size,
8564 void *vaddr, dma_addr_t bus)
8565 {
8566- struct dma_map_ops *ops = get_dma_ops(dev);
8567+ const struct dma_map_ops *ops = get_dma_ops(dev);
8568
8569 WARN_ON(irqs_disabled()); /* for portability */
8570
8571diff -urNp linux-2.6.32.46/arch/x86/include/asm/e820.h linux-2.6.32.46/arch/x86/include/asm/e820.h
8572--- linux-2.6.32.46/arch/x86/include/asm/e820.h 2011-03-27 14:31:47.000000000 -0400
8573+++ linux-2.6.32.46/arch/x86/include/asm/e820.h 2011-04-17 15:56:46.000000000 -0400
8574@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
8575 #define ISA_END_ADDRESS 0x100000
8576 #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
8577
8578-#define BIOS_BEGIN 0x000a0000
8579+#define BIOS_BEGIN 0x000c0000
8580 #define BIOS_END 0x00100000
8581
8582 #ifdef __KERNEL__
8583diff -urNp linux-2.6.32.46/arch/x86/include/asm/elf.h linux-2.6.32.46/arch/x86/include/asm/elf.h
8584--- linux-2.6.32.46/arch/x86/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
8585+++ linux-2.6.32.46/arch/x86/include/asm/elf.h 2011-08-23 20:24:19.000000000 -0400
8586@@ -257,7 +257,25 @@ extern int force_personality32;
8587 the loader. We need to make sure that it is out of the way of the program
8588 that it will "exec", and that there is sufficient room for the brk. */
8589
8590+#ifdef CONFIG_PAX_SEGMEXEC
8591+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8592+#else
8593 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8594+#endif
8595+
8596+#ifdef CONFIG_PAX_ASLR
8597+#ifdef CONFIG_X86_32
8598+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8599+
8600+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8601+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8602+#else
8603+#define PAX_ELF_ET_DYN_BASE 0x400000UL
8604+
8605+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8606+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8607+#endif
8608+#endif
8609
8610 /* This yields a mask that user programs can use to figure out what
8611 instruction set this CPU supports. This could be done in user space,
8612@@ -310,9 +328,7 @@ do { \
8613
8614 #define ARCH_DLINFO \
8615 do { \
8616- if (vdso_enabled) \
8617- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8618- (unsigned long)current->mm->context.vdso); \
8619+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8620 } while (0)
8621
8622 #define AT_SYSINFO 32
8623@@ -323,7 +339,7 @@ do { \
8624
8625 #endif /* !CONFIG_X86_32 */
8626
8627-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8628+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8629
8630 #define VDSO_ENTRY \
8631 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8632@@ -337,7 +353,4 @@ extern int arch_setup_additional_pages(s
8633 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8634 #define compat_arch_setup_additional_pages syscall32_setup_pages
8635
8636-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8637-#define arch_randomize_brk arch_randomize_brk
8638-
8639 #endif /* _ASM_X86_ELF_H */
8640diff -urNp linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h
8641--- linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
8642+++ linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h 2011-05-22 23:02:06.000000000 -0400
8643@@ -15,6 +15,6 @@ enum reboot_type {
8644
8645 extern enum reboot_type reboot_type;
8646
8647-extern void machine_emergency_restart(void);
8648+extern void machine_emergency_restart(void) __noreturn;
8649
8650 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8651diff -urNp linux-2.6.32.46/arch/x86/include/asm/futex.h linux-2.6.32.46/arch/x86/include/asm/futex.h
8652--- linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400
8653+++ linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-04-17 15:56:46.000000000 -0400
8654@@ -12,16 +12,18 @@
8655 #include <asm/system.h>
8656
8657 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8658+ typecheck(u32 *, uaddr); \
8659 asm volatile("1:\t" insn "\n" \
8660 "2:\t.section .fixup,\"ax\"\n" \
8661 "3:\tmov\t%3, %1\n" \
8662 "\tjmp\t2b\n" \
8663 "\t.previous\n" \
8664 _ASM_EXTABLE(1b, 3b) \
8665- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8666+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
8667 : "i" (-EFAULT), "0" (oparg), "1" (0))
8668
8669 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8670+ typecheck(u32 *, uaddr); \
8671 asm volatile("1:\tmovl %2, %0\n" \
8672 "\tmovl\t%0, %3\n" \
8673 "\t" insn "\n" \
8674@@ -34,10 +36,10 @@
8675 _ASM_EXTABLE(1b, 4b) \
8676 _ASM_EXTABLE(2b, 4b) \
8677 : "=&a" (oldval), "=&r" (ret), \
8678- "+m" (*uaddr), "=&r" (tem) \
8679+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
8680 : "r" (oparg), "i" (-EFAULT), "1" (0))
8681
8682-static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
8683+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8684 {
8685 int op = (encoded_op >> 28) & 7;
8686 int cmp = (encoded_op >> 24) & 15;
8687@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
8688
8689 switch (op) {
8690 case FUTEX_OP_SET:
8691- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8692+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8693 break;
8694 case FUTEX_OP_ADD:
8695- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8696+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8697 uaddr, oparg);
8698 break;
8699 case FUTEX_OP_OR:
8700@@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser
8701 return ret;
8702 }
8703
8704-static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
8705+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
8706 int newval)
8707 {
8708
8709@@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_i
8710 return -ENOSYS;
8711 #endif
8712
8713- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
8714+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8715 return -EFAULT;
8716
8717- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
8718+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
8719 "2:\t.section .fixup, \"ax\"\n"
8720 "3:\tmov %2, %0\n"
8721 "\tjmp 2b\n"
8722 "\t.previous\n"
8723 _ASM_EXTABLE(1b, 3b)
8724- : "=a" (oldval), "+m" (*uaddr)
8725+ : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
8726 : "i" (-EFAULT), "r" (newval), "0" (oldval)
8727 : "memory"
8728 );
8729diff -urNp linux-2.6.32.46/arch/x86/include/asm/hw_irq.h linux-2.6.32.46/arch/x86/include/asm/hw_irq.h
8730--- linux-2.6.32.46/arch/x86/include/asm/hw_irq.h 2011-03-27 14:31:47.000000000 -0400
8731+++ linux-2.6.32.46/arch/x86/include/asm/hw_irq.h 2011-05-04 17:56:28.000000000 -0400
8732@@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
8733 extern void enable_IO_APIC(void);
8734
8735 /* Statistics */
8736-extern atomic_t irq_err_count;
8737-extern atomic_t irq_mis_count;
8738+extern atomic_unchecked_t irq_err_count;
8739+extern atomic_unchecked_t irq_mis_count;
8740
8741 /* EISA */
8742 extern void eisa_set_level_irq(unsigned int irq);
8743diff -urNp linux-2.6.32.46/arch/x86/include/asm/i387.h linux-2.6.32.46/arch/x86/include/asm/i387.h
8744--- linux-2.6.32.46/arch/x86/include/asm/i387.h 2011-03-27 14:31:47.000000000 -0400
8745+++ linux-2.6.32.46/arch/x86/include/asm/i387.h 2011-04-17 15:56:46.000000000 -0400
8746@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
8747 {
8748 int err;
8749
8750+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8751+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8752+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
8753+#endif
8754+
8755 asm volatile("1: rex64/fxrstor (%[fx])\n\t"
8756 "2:\n"
8757 ".section .fixup,\"ax\"\n"
8758@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
8759 {
8760 int err;
8761
8762+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8763+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8764+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
8765+#endif
8766+
8767 asm volatile("1: rex64/fxsave (%[fx])\n\t"
8768 "2:\n"
8769 ".section .fixup,\"ax\"\n"
8770@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
8771 }
8772
8773 /* We need a safe address that is cheap to find and that is already
8774- in L1 during context switch. The best choices are unfortunately
8775- different for UP and SMP */
8776-#ifdef CONFIG_SMP
8777-#define safe_address (__per_cpu_offset[0])
8778-#else
8779-#define safe_address (kstat_cpu(0).cpustat.user)
8780-#endif
8781+ in L1 during context switch. */
8782+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
8783
8784 /*
8785 * These must be called with preempt disabled
8786@@ -291,7 +296,7 @@ static inline void kernel_fpu_begin(void
8787 struct thread_info *me = current_thread_info();
8788 preempt_disable();
8789 if (me->status & TS_USEDFPU)
8790- __save_init_fpu(me->task);
8791+ __save_init_fpu(current);
8792 else
8793 clts();
8794 }
8795diff -urNp linux-2.6.32.46/arch/x86/include/asm/io_32.h linux-2.6.32.46/arch/x86/include/asm/io_32.h
8796--- linux-2.6.32.46/arch/x86/include/asm/io_32.h 2011-03-27 14:31:47.000000000 -0400
8797+++ linux-2.6.32.46/arch/x86/include/asm/io_32.h 2011-04-17 15:56:46.000000000 -0400
8798@@ -3,6 +3,7 @@
8799
8800 #include <linux/string.h>
8801 #include <linux/compiler.h>
8802+#include <asm/processor.h>
8803
8804 /*
8805 * This file contains the definitions for the x86 IO instructions
8806@@ -42,6 +43,17 @@
8807
8808 #ifdef __KERNEL__
8809
8810+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8811+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8812+{
8813+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8814+}
8815+
8816+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8817+{
8818+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8819+}
8820+
8821 #include <asm-generic/iomap.h>
8822
8823 #include <linux/vmalloc.h>
8824diff -urNp linux-2.6.32.46/arch/x86/include/asm/io_64.h linux-2.6.32.46/arch/x86/include/asm/io_64.h
8825--- linux-2.6.32.46/arch/x86/include/asm/io_64.h 2011-03-27 14:31:47.000000000 -0400
8826+++ linux-2.6.32.46/arch/x86/include/asm/io_64.h 2011-04-17 15:56:46.000000000 -0400
8827@@ -140,6 +140,17 @@ __OUTS(l)
8828
8829 #include <linux/vmalloc.h>
8830
8831+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
8832+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
8833+{
8834+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8835+}
8836+
8837+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
8838+{
8839+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
8840+}
8841+
8842 #include <asm-generic/iomap.h>
8843
8844 void __memcpy_fromio(void *, unsigned long, unsigned);
8845diff -urNp linux-2.6.32.46/arch/x86/include/asm/iommu.h linux-2.6.32.46/arch/x86/include/asm/iommu.h
8846--- linux-2.6.32.46/arch/x86/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
8847+++ linux-2.6.32.46/arch/x86/include/asm/iommu.h 2011-04-17 15:56:46.000000000 -0400
8848@@ -3,7 +3,7 @@
8849
8850 extern void pci_iommu_shutdown(void);
8851 extern void no_iommu_init(void);
8852-extern struct dma_map_ops nommu_dma_ops;
8853+extern const struct dma_map_ops nommu_dma_ops;
8854 extern int force_iommu, no_iommu;
8855 extern int iommu_detected;
8856 extern int iommu_pass_through;
8857diff -urNp linux-2.6.32.46/arch/x86/include/asm/irqflags.h linux-2.6.32.46/arch/x86/include/asm/irqflags.h
8858--- linux-2.6.32.46/arch/x86/include/asm/irqflags.h 2011-03-27 14:31:47.000000000 -0400
8859+++ linux-2.6.32.46/arch/x86/include/asm/irqflags.h 2011-04-17 15:56:46.000000000 -0400
8860@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
8861 sti; \
8862 sysexit
8863
8864+#define GET_CR0_INTO_RDI mov %cr0, %rdi
8865+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
8866+#define GET_CR3_INTO_RDI mov %cr3, %rdi
8867+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
8868+
8869 #else
8870 #define INTERRUPT_RETURN iret
8871 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
8872diff -urNp linux-2.6.32.46/arch/x86/include/asm/kprobes.h linux-2.6.32.46/arch/x86/include/asm/kprobes.h
8873--- linux-2.6.32.46/arch/x86/include/asm/kprobes.h 2011-03-27 14:31:47.000000000 -0400
8874+++ linux-2.6.32.46/arch/x86/include/asm/kprobes.h 2011-04-23 12:56:12.000000000 -0400
8875@@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
8876 #define BREAKPOINT_INSTRUCTION 0xcc
8877 #define RELATIVEJUMP_INSTRUCTION 0xe9
8878 #define MAX_INSN_SIZE 16
8879-#define MAX_STACK_SIZE 64
8880-#define MIN_STACK_SIZE(ADDR) \
8881- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
8882- THREAD_SIZE - (unsigned long)(ADDR))) \
8883- ? (MAX_STACK_SIZE) \
8884- : (((unsigned long)current_thread_info()) + \
8885- THREAD_SIZE - (unsigned long)(ADDR)))
8886+#define MAX_STACK_SIZE 64UL
8887+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
8888
8889 #define flush_insn_slot(p) do { } while (0)
8890
8891diff -urNp linux-2.6.32.46/arch/x86/include/asm/kvm_host.h linux-2.6.32.46/arch/x86/include/asm/kvm_host.h
8892--- linux-2.6.32.46/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:01.000000000 -0400
8893+++ linux-2.6.32.46/arch/x86/include/asm/kvm_host.h 2011-08-26 20:19:09.000000000 -0400
8894@@ -534,9 +534,9 @@ struct kvm_x86_ops {
8895 bool (*gb_page_enable)(void);
8896
8897 const struct trace_print_flags *exit_reasons_str;
8898-};
8899+} __do_const;
8900
8901-extern struct kvm_x86_ops *kvm_x86_ops;
8902+extern const struct kvm_x86_ops *kvm_x86_ops;
8903
8904 int kvm_mmu_module_init(void);
8905 void kvm_mmu_module_exit(void);
8906diff -urNp linux-2.6.32.46/arch/x86/include/asm/local.h linux-2.6.32.46/arch/x86/include/asm/local.h
8907--- linux-2.6.32.46/arch/x86/include/asm/local.h 2011-03-27 14:31:47.000000000 -0400
8908+++ linux-2.6.32.46/arch/x86/include/asm/local.h 2011-04-17 15:56:46.000000000 -0400
8909@@ -18,26 +18,58 @@ typedef struct {
8910
8911 static inline void local_inc(local_t *l)
8912 {
8913- asm volatile(_ASM_INC "%0"
8914+ asm volatile(_ASM_INC "%0\n"
8915+
8916+#ifdef CONFIG_PAX_REFCOUNT
8917+ "jno 0f\n"
8918+ _ASM_DEC "%0\n"
8919+ "int $4\n0:\n"
8920+ _ASM_EXTABLE(0b, 0b)
8921+#endif
8922+
8923 : "+m" (l->a.counter));
8924 }
8925
8926 static inline void local_dec(local_t *l)
8927 {
8928- asm volatile(_ASM_DEC "%0"
8929+ asm volatile(_ASM_DEC "%0\n"
8930+
8931+#ifdef CONFIG_PAX_REFCOUNT
8932+ "jno 0f\n"
8933+ _ASM_INC "%0\n"
8934+ "int $4\n0:\n"
8935+ _ASM_EXTABLE(0b, 0b)
8936+#endif
8937+
8938 : "+m" (l->a.counter));
8939 }
8940
8941 static inline void local_add(long i, local_t *l)
8942 {
8943- asm volatile(_ASM_ADD "%1,%0"
8944+ asm volatile(_ASM_ADD "%1,%0\n"
8945+
8946+#ifdef CONFIG_PAX_REFCOUNT
8947+ "jno 0f\n"
8948+ _ASM_SUB "%1,%0\n"
8949+ "int $4\n0:\n"
8950+ _ASM_EXTABLE(0b, 0b)
8951+#endif
8952+
8953 : "+m" (l->a.counter)
8954 : "ir" (i));
8955 }
8956
8957 static inline void local_sub(long i, local_t *l)
8958 {
8959- asm volatile(_ASM_SUB "%1,%0"
8960+ asm volatile(_ASM_SUB "%1,%0\n"
8961+
8962+#ifdef CONFIG_PAX_REFCOUNT
8963+ "jno 0f\n"
8964+ _ASM_ADD "%1,%0\n"
8965+ "int $4\n0:\n"
8966+ _ASM_EXTABLE(0b, 0b)
8967+#endif
8968+
8969 : "+m" (l->a.counter)
8970 : "ir" (i));
8971 }
8972@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
8973 {
8974 unsigned char c;
8975
8976- asm volatile(_ASM_SUB "%2,%0; sete %1"
8977+ asm volatile(_ASM_SUB "%2,%0\n"
8978+
8979+#ifdef CONFIG_PAX_REFCOUNT
8980+ "jno 0f\n"
8981+ _ASM_ADD "%2,%0\n"
8982+ "int $4\n0:\n"
8983+ _ASM_EXTABLE(0b, 0b)
8984+#endif
8985+
8986+ "sete %1\n"
8987 : "+m" (l->a.counter), "=qm" (c)
8988 : "ir" (i) : "memory");
8989 return c;
8990@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
8991 {
8992 unsigned char c;
8993
8994- asm volatile(_ASM_DEC "%0; sete %1"
8995+ asm volatile(_ASM_DEC "%0\n"
8996+
8997+#ifdef CONFIG_PAX_REFCOUNT
8998+ "jno 0f\n"
8999+ _ASM_INC "%0\n"
9000+ "int $4\n0:\n"
9001+ _ASM_EXTABLE(0b, 0b)
9002+#endif
9003+
9004+ "sete %1\n"
9005 : "+m" (l->a.counter), "=qm" (c)
9006 : : "memory");
9007 return c != 0;
9008@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9009 {
9010 unsigned char c;
9011
9012- asm volatile(_ASM_INC "%0; sete %1"
9013+ asm volatile(_ASM_INC "%0\n"
9014+
9015+#ifdef CONFIG_PAX_REFCOUNT
9016+ "jno 0f\n"
9017+ _ASM_DEC "%0\n"
9018+ "int $4\n0:\n"
9019+ _ASM_EXTABLE(0b, 0b)
9020+#endif
9021+
9022+ "sete %1\n"
9023 : "+m" (l->a.counter), "=qm" (c)
9024 : : "memory");
9025 return c != 0;
9026@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
9027 {
9028 unsigned char c;
9029
9030- asm volatile(_ASM_ADD "%2,%0; sets %1"
9031+ asm volatile(_ASM_ADD "%2,%0\n"
9032+
9033+#ifdef CONFIG_PAX_REFCOUNT
9034+ "jno 0f\n"
9035+ _ASM_SUB "%2,%0\n"
9036+ "int $4\n0:\n"
9037+ _ASM_EXTABLE(0b, 0b)
9038+#endif
9039+
9040+ "sets %1\n"
9041 : "+m" (l->a.counter), "=qm" (c)
9042 : "ir" (i) : "memory");
9043 return c;
9044@@ -133,7 +201,15 @@ static inline long local_add_return(long
9045 #endif
9046 /* Modern 486+ processor */
9047 __i = i;
9048- asm volatile(_ASM_XADD "%0, %1;"
9049+ asm volatile(_ASM_XADD "%0, %1\n"
9050+
9051+#ifdef CONFIG_PAX_REFCOUNT
9052+ "jno 0f\n"
9053+ _ASM_MOV "%0,%1\n"
9054+ "int $4\n0:\n"
9055+ _ASM_EXTABLE(0b, 0b)
9056+#endif
9057+
9058 : "+r" (i), "+m" (l->a.counter)
9059 : : "memory");
9060 return i + __i;
9061diff -urNp linux-2.6.32.46/arch/x86/include/asm/microcode.h linux-2.6.32.46/arch/x86/include/asm/microcode.h
9062--- linux-2.6.32.46/arch/x86/include/asm/microcode.h 2011-03-27 14:31:47.000000000 -0400
9063+++ linux-2.6.32.46/arch/x86/include/asm/microcode.h 2011-04-17 15:56:46.000000000 -0400
9064@@ -12,13 +12,13 @@ struct device;
9065 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9066
9067 struct microcode_ops {
9068- enum ucode_state (*request_microcode_user) (int cpu,
9069+ enum ucode_state (* const request_microcode_user) (int cpu,
9070 const void __user *buf, size_t size);
9071
9072- enum ucode_state (*request_microcode_fw) (int cpu,
9073+ enum ucode_state (* const request_microcode_fw) (int cpu,
9074 struct device *device);
9075
9076- void (*microcode_fini_cpu) (int cpu);
9077+ void (* const microcode_fini_cpu) (int cpu);
9078
9079 /*
9080 * The generic 'microcode_core' part guarantees that
9081@@ -38,18 +38,18 @@ struct ucode_cpu_info {
9082 extern struct ucode_cpu_info ucode_cpu_info[];
9083
9084 #ifdef CONFIG_MICROCODE_INTEL
9085-extern struct microcode_ops * __init init_intel_microcode(void);
9086+extern const struct microcode_ops * __init init_intel_microcode(void);
9087 #else
9088-static inline struct microcode_ops * __init init_intel_microcode(void)
9089+static inline const struct microcode_ops * __init init_intel_microcode(void)
9090 {
9091 return NULL;
9092 }
9093 #endif /* CONFIG_MICROCODE_INTEL */
9094
9095 #ifdef CONFIG_MICROCODE_AMD
9096-extern struct microcode_ops * __init init_amd_microcode(void);
9097+extern const struct microcode_ops * __init init_amd_microcode(void);
9098 #else
9099-static inline struct microcode_ops * __init init_amd_microcode(void)
9100+static inline const struct microcode_ops * __init init_amd_microcode(void)
9101 {
9102 return NULL;
9103 }
9104diff -urNp linux-2.6.32.46/arch/x86/include/asm/mman.h linux-2.6.32.46/arch/x86/include/asm/mman.h
9105--- linux-2.6.32.46/arch/x86/include/asm/mman.h 2011-03-27 14:31:47.000000000 -0400
9106+++ linux-2.6.32.46/arch/x86/include/asm/mman.h 2011-04-17 15:56:46.000000000 -0400
9107@@ -5,4 +5,14 @@
9108
9109 #include <asm-generic/mman.h>
9110
9111+#ifdef __KERNEL__
9112+#ifndef __ASSEMBLY__
9113+#ifdef CONFIG_X86_32
9114+#define arch_mmap_check i386_mmap_check
9115+int i386_mmap_check(unsigned long addr, unsigned long len,
9116+ unsigned long flags);
9117+#endif
9118+#endif
9119+#endif
9120+
9121 #endif /* _ASM_X86_MMAN_H */
9122diff -urNp linux-2.6.32.46/arch/x86/include/asm/mmu_context.h linux-2.6.32.46/arch/x86/include/asm/mmu_context.h
9123--- linux-2.6.32.46/arch/x86/include/asm/mmu_context.h 2011-03-27 14:31:47.000000000 -0400
9124+++ linux-2.6.32.46/arch/x86/include/asm/mmu_context.h 2011-08-23 20:24:19.000000000 -0400
9125@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m
9126
9127 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9128 {
9129+
9130+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9131+ unsigned int i;
9132+ pgd_t *pgd;
9133+
9134+ pax_open_kernel();
9135+ pgd = get_cpu_pgd(smp_processor_id());
9136+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
9137+ set_pgd_batched(pgd+i, native_make_pgd(0));
9138+ pax_close_kernel();
9139+#endif
9140+
9141 #ifdef CONFIG_SMP
9142 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
9143 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
9144@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s
9145 struct task_struct *tsk)
9146 {
9147 unsigned cpu = smp_processor_id();
9148+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
9149+ int tlbstate = TLBSTATE_OK;
9150+#endif
9151
9152 if (likely(prev != next)) {
9153 #ifdef CONFIG_SMP
9154+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9155+ tlbstate = percpu_read(cpu_tlbstate.state);
9156+#endif
9157 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9158 percpu_write(cpu_tlbstate.active_mm, next);
9159 #endif
9160 cpumask_set_cpu(cpu, mm_cpumask(next));
9161
9162 /* Re-load page tables */
9163+#ifdef CONFIG_PAX_PER_CPU_PGD
9164+ pax_open_kernel();
9165+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9166+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9167+ pax_close_kernel();
9168+ load_cr3(get_cpu_pgd(cpu));
9169+#else
9170 load_cr3(next->pgd);
9171+#endif
9172
9173 /* stop flush ipis for the previous mm */
9174 cpumask_clear_cpu(cpu, mm_cpumask(prev));
9175@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s
9176 */
9177 if (unlikely(prev->context.ldt != next->context.ldt))
9178 load_LDT_nolock(&next->context);
9179- }
9180+
9181+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9182+ if (!nx_enabled) {
9183+ smp_mb__before_clear_bit();
9184+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
9185+ smp_mb__after_clear_bit();
9186+ cpu_set(cpu, next->context.cpu_user_cs_mask);
9187+ }
9188+#endif
9189+
9190+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9191+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
9192+ prev->context.user_cs_limit != next->context.user_cs_limit))
9193+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9194 #ifdef CONFIG_SMP
9195+ else if (unlikely(tlbstate != TLBSTATE_OK))
9196+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9197+#endif
9198+#endif
9199+
9200+ }
9201 else {
9202+
9203+#ifdef CONFIG_PAX_PER_CPU_PGD
9204+ pax_open_kernel();
9205+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9206+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9207+ pax_close_kernel();
9208+ load_cr3(get_cpu_pgd(cpu));
9209+#endif
9210+
9211+#ifdef CONFIG_SMP
9212 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9213 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
9214
9215@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s
9216 * tlb flush IPI delivery. We must reload CR3
9217 * to make sure to use no freed page tables.
9218 */
9219+
9220+#ifndef CONFIG_PAX_PER_CPU_PGD
9221 load_cr3(next->pgd);
9222+#endif
9223+
9224 load_LDT_nolock(&next->context);
9225+
9226+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
9227+ if (!nx_enabled)
9228+ cpu_set(cpu, next->context.cpu_user_cs_mask);
9229+#endif
9230+
9231+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9232+#ifdef CONFIG_PAX_PAGEEXEC
9233+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
9234+#endif
9235+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9236+#endif
9237+
9238 }
9239- }
9240 #endif
9241+ }
9242 }
9243
9244 #define activate_mm(prev, next) \
9245diff -urNp linux-2.6.32.46/arch/x86/include/asm/mmu.h linux-2.6.32.46/arch/x86/include/asm/mmu.h
9246--- linux-2.6.32.46/arch/x86/include/asm/mmu.h 2011-03-27 14:31:47.000000000 -0400
9247+++ linux-2.6.32.46/arch/x86/include/asm/mmu.h 2011-04-17 15:56:46.000000000 -0400
9248@@ -9,10 +9,23 @@
9249 * we put the segment information here.
9250 */
9251 typedef struct {
9252- void *ldt;
9253+ struct desc_struct *ldt;
9254 int size;
9255 struct mutex lock;
9256- void *vdso;
9257+ unsigned long vdso;
9258+
9259+#ifdef CONFIG_X86_32
9260+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
9261+ unsigned long user_cs_base;
9262+ unsigned long user_cs_limit;
9263+
9264+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9265+ cpumask_t cpu_user_cs_mask;
9266+#endif
9267+
9268+#endif
9269+#endif
9270+
9271 } mm_context_t;
9272
9273 #ifdef CONFIG_SMP
9274diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x86/include/asm/module.h
9275--- linux-2.6.32.46/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400
9276+++ linux-2.6.32.46/arch/x86/include/asm/module.h 2011-04-23 13:18:57.000000000 -0400
9277@@ -5,6 +5,7 @@
9278
9279 #ifdef CONFIG_X86_64
9280 /* X86_64 does not define MODULE_PROC_FAMILY */
9281+#define MODULE_PROC_FAMILY ""
9282 #elif defined CONFIG_M386
9283 #define MODULE_PROC_FAMILY "386 "
9284 #elif defined CONFIG_M486
9285@@ -59,13 +60,36 @@
9286 #error unknown processor family
9287 #endif
9288
9289-#ifdef CONFIG_X86_32
9290-# ifdef CONFIG_4KSTACKS
9291-# define MODULE_STACKSIZE "4KSTACKS "
9292-# else
9293-# define MODULE_STACKSIZE ""
9294-# endif
9295-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
9296+#ifdef CONFIG_PAX_MEMORY_UDEREF
9297+#define MODULE_PAX_UDEREF "UDEREF "
9298+#else
9299+#define MODULE_PAX_UDEREF ""
9300+#endif
9301+
9302+#ifdef CONFIG_PAX_KERNEXEC
9303+#define MODULE_PAX_KERNEXEC "KERNEXEC "
9304+#else
9305+#define MODULE_PAX_KERNEXEC ""
9306+#endif
9307+
9308+#ifdef CONFIG_PAX_REFCOUNT
9309+#define MODULE_PAX_REFCOUNT "REFCOUNT "
9310+#else
9311+#define MODULE_PAX_REFCOUNT ""
9312 #endif
9313
9314+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
9315+#define MODULE_STACKSIZE "4KSTACKS "
9316+#else
9317+#define MODULE_STACKSIZE ""
9318+#endif
9319+
9320+#ifdef CONFIG_GRKERNSEC
9321+#define MODULE_GRSEC "GRSECURITY "
9322+#else
9323+#define MODULE_GRSEC ""
9324+#endif
9325+
9326+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
9327+
9328 #endif /* _ASM_X86_MODULE_H */
9329diff -urNp linux-2.6.32.46/arch/x86/include/asm/page_64_types.h linux-2.6.32.46/arch/x86/include/asm/page_64_types.h
9330--- linux-2.6.32.46/arch/x86/include/asm/page_64_types.h 2011-03-27 14:31:47.000000000 -0400
9331+++ linux-2.6.32.46/arch/x86/include/asm/page_64_types.h 2011-04-17 15:56:46.000000000 -0400
9332@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
9333
9334 /* duplicated to the one in bootmem.h */
9335 extern unsigned long max_pfn;
9336-extern unsigned long phys_base;
9337+extern const unsigned long phys_base;
9338
9339 extern unsigned long __phys_addr(unsigned long);
9340 #define __phys_reloc_hide(x) (x)
9341diff -urNp linux-2.6.32.46/arch/x86/include/asm/paravirt.h linux-2.6.32.46/arch/x86/include/asm/paravirt.h
9342--- linux-2.6.32.46/arch/x86/include/asm/paravirt.h 2011-03-27 14:31:47.000000000 -0400
9343+++ linux-2.6.32.46/arch/x86/include/asm/paravirt.h 2011-08-23 21:36:48.000000000 -0400
9344@@ -648,6 +648,18 @@ static inline void set_pgd(pgd_t *pgdp,
9345 val);
9346 }
9347
9348+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9349+{
9350+ pgdval_t val = native_pgd_val(pgd);
9351+
9352+ if (sizeof(pgdval_t) > sizeof(long))
9353+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9354+ val, (u64)val >> 32);
9355+ else
9356+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9357+ val);
9358+}
9359+
9360 static inline void pgd_clear(pgd_t *pgdp)
9361 {
9362 set_pgd(pgdp, __pgd(0));
9363@@ -729,6 +741,21 @@ static inline void __set_fixmap(unsigned
9364 pv_mmu_ops.set_fixmap(idx, phys, flags);
9365 }
9366
9367+#ifdef CONFIG_PAX_KERNEXEC
9368+static inline unsigned long pax_open_kernel(void)
9369+{
9370+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9371+}
9372+
9373+static inline unsigned long pax_close_kernel(void)
9374+{
9375+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9376+}
9377+#else
9378+static inline unsigned long pax_open_kernel(void) { return 0; }
9379+static inline unsigned long pax_close_kernel(void) { return 0; }
9380+#endif
9381+
9382 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9383
9384 static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
9385@@ -945,7 +972,7 @@ extern void default_banner(void);
9386
9387 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9388 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9389-#define PARA_INDIRECT(addr) *%cs:addr
9390+#define PARA_INDIRECT(addr) *%ss:addr
9391 #endif
9392
9393 #define INTERRUPT_RETURN \
9394@@ -1022,6 +1049,21 @@ extern void default_banner(void);
9395 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9396 CLBR_NONE, \
9397 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9398+
9399+#define GET_CR0_INTO_RDI \
9400+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9401+ mov %rax,%rdi
9402+
9403+#define SET_RDI_INTO_CR0 \
9404+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9405+
9406+#define GET_CR3_INTO_RDI \
9407+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9408+ mov %rax,%rdi
9409+
9410+#define SET_RDI_INTO_CR3 \
9411+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9412+
9413 #endif /* CONFIG_X86_32 */
9414
9415 #endif /* __ASSEMBLY__ */
9416diff -urNp linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h
9417--- linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h 2011-03-27 14:31:47.000000000 -0400
9418+++ linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h 2011-08-23 20:24:19.000000000 -0400
9419@@ -78,19 +78,19 @@ struct pv_init_ops {
9420 */
9421 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9422 unsigned long addr, unsigned len);
9423-};
9424+} __no_const;
9425
9426
9427 struct pv_lazy_ops {
9428 /* Set deferred update mode, used for batching operations. */
9429 void (*enter)(void);
9430 void (*leave)(void);
9431-};
9432+} __no_const;
9433
9434 struct pv_time_ops {
9435 unsigned long long (*sched_clock)(void);
9436 unsigned long (*get_tsc_khz)(void);
9437-};
9438+} __no_const;
9439
9440 struct pv_cpu_ops {
9441 /* hooks for various privileged instructions */
9442@@ -186,7 +186,7 @@ struct pv_cpu_ops {
9443
9444 void (*start_context_switch)(struct task_struct *prev);
9445 void (*end_context_switch)(struct task_struct *next);
9446-};
9447+} __no_const;
9448
9449 struct pv_irq_ops {
9450 /*
9451@@ -217,7 +217,7 @@ struct pv_apic_ops {
9452 unsigned long start_eip,
9453 unsigned long start_esp);
9454 #endif
9455-};
9456+} __no_const;
9457
9458 struct pv_mmu_ops {
9459 unsigned long (*read_cr2)(void);
9460@@ -301,6 +301,7 @@ struct pv_mmu_ops {
9461 struct paravirt_callee_save make_pud;
9462
9463 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9464+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9465 #endif /* PAGETABLE_LEVELS == 4 */
9466 #endif /* PAGETABLE_LEVELS >= 3 */
9467
9468@@ -316,6 +317,12 @@ struct pv_mmu_ops {
9469 an mfn. We can tell which is which from the index. */
9470 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9471 phys_addr_t phys, pgprot_t flags);
9472+
9473+#ifdef CONFIG_PAX_KERNEXEC
9474+ unsigned long (*pax_open_kernel)(void);
9475+ unsigned long (*pax_close_kernel)(void);
9476+#endif
9477+
9478 };
9479
9480 struct raw_spinlock;
9481@@ -326,7 +333,7 @@ struct pv_lock_ops {
9482 void (*spin_lock_flags)(struct raw_spinlock *lock, unsigned long flags);
9483 int (*spin_trylock)(struct raw_spinlock *lock);
9484 void (*spin_unlock)(struct raw_spinlock *lock);
9485-};
9486+} __no_const;
9487
9488 /* This contains all the paravirt structures: we get a convenient
9489 * number for each function using the offset which we use to indicate
9490diff -urNp linux-2.6.32.46/arch/x86/include/asm/pci_x86.h linux-2.6.32.46/arch/x86/include/asm/pci_x86.h
9491--- linux-2.6.32.46/arch/x86/include/asm/pci_x86.h 2011-03-27 14:31:47.000000000 -0400
9492+++ linux-2.6.32.46/arch/x86/include/asm/pci_x86.h 2011-04-17 15:56:46.000000000 -0400
9493@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
9494 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
9495
9496 struct pci_raw_ops {
9497- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9498+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9499 int reg, int len, u32 *val);
9500- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9501+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9502 int reg, int len, u32 val);
9503 };
9504
9505-extern struct pci_raw_ops *raw_pci_ops;
9506-extern struct pci_raw_ops *raw_pci_ext_ops;
9507+extern const struct pci_raw_ops *raw_pci_ops;
9508+extern const struct pci_raw_ops *raw_pci_ext_ops;
9509
9510-extern struct pci_raw_ops pci_direct_conf1;
9511+extern const struct pci_raw_ops pci_direct_conf1;
9512 extern bool port_cf9_safe;
9513
9514 /* arch_initcall level */
9515diff -urNp linux-2.6.32.46/arch/x86/include/asm/percpu.h linux-2.6.32.46/arch/x86/include/asm/percpu.h
9516--- linux-2.6.32.46/arch/x86/include/asm/percpu.h 2011-03-27 14:31:47.000000000 -0400
9517+++ linux-2.6.32.46/arch/x86/include/asm/percpu.h 2011-08-17 19:33:59.000000000 -0400
9518@@ -78,6 +78,7 @@ do { \
9519 if (0) { \
9520 T__ tmp__; \
9521 tmp__ = (val); \
9522+ (void)tmp__; \
9523 } \
9524 switch (sizeof(var)) { \
9525 case 1: \
9526diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgalloc.h linux-2.6.32.46/arch/x86/include/asm/pgalloc.h
9527--- linux-2.6.32.46/arch/x86/include/asm/pgalloc.h 2011-03-27 14:31:47.000000000 -0400
9528+++ linux-2.6.32.46/arch/x86/include/asm/pgalloc.h 2011-04-17 15:56:46.000000000 -0400
9529@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
9530 pmd_t *pmd, pte_t *pte)
9531 {
9532 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9533+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9534+}
9535+
9536+static inline void pmd_populate_user(struct mm_struct *mm,
9537+ pmd_t *pmd, pte_t *pte)
9538+{
9539+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9540 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9541 }
9542
9543diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h
9544--- linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h 2011-03-27 14:31:47.000000000 -0400
9545+++ linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h 2011-04-17 15:56:46.000000000 -0400
9546@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
9547
9548 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9549 {
9550+ pax_open_kernel();
9551 *pmdp = pmd;
9552+ pax_close_kernel();
9553 }
9554
9555 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9556diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h
9557--- linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
9558+++ linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
9559@@ -26,9 +26,6 @@
9560 struct mm_struct;
9561 struct vm_area_struct;
9562
9563-extern pgd_t swapper_pg_dir[1024];
9564-extern pgd_t trampoline_pg_dir[1024];
9565-
9566 static inline void pgtable_cache_init(void) { }
9567 static inline void check_pgt_cache(void) { }
9568 void paging_init(void);
9569@@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, u
9570 # include <asm/pgtable-2level.h>
9571 #endif
9572
9573+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9574+extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
9575+#ifdef CONFIG_X86_PAE
9576+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9577+#endif
9578+
9579 #if defined(CONFIG_HIGHPTE)
9580 #define __KM_PTE \
9581 (in_nmi() ? KM_NMI_PTE : \
9582@@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, u
9583 /* Clear a kernel PTE and flush it from the TLB */
9584 #define kpte_clear_flush(ptep, vaddr) \
9585 do { \
9586+ pax_open_kernel(); \
9587 pte_clear(&init_mm, (vaddr), (ptep)); \
9588+ pax_close_kernel(); \
9589 __flush_tlb_one((vaddr)); \
9590 } while (0)
9591
9592@@ -85,6 +90,9 @@ do { \
9593
9594 #endif /* !__ASSEMBLY__ */
9595
9596+#define HAVE_ARCH_UNMAPPED_AREA
9597+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9598+
9599 /*
9600 * kern_addr_valid() is (1) for FLATMEM and (0) for
9601 * SPARSEMEM and DISCONTIGMEM
9602diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h
9603--- linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h 2011-03-27 14:31:47.000000000 -0400
9604+++ linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h 2011-04-17 15:56:46.000000000 -0400
9605@@ -8,7 +8,7 @@
9606 */
9607 #ifdef CONFIG_X86_PAE
9608 # include <asm/pgtable-3level_types.h>
9609-# define PMD_SIZE (1UL << PMD_SHIFT)
9610+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9611 # define PMD_MASK (~(PMD_SIZE - 1))
9612 #else
9613 # include <asm/pgtable-2level_types.h>
9614@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
9615 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9616 #endif
9617
9618+#ifdef CONFIG_PAX_KERNEXEC
9619+#ifndef __ASSEMBLY__
9620+extern unsigned char MODULES_EXEC_VADDR[];
9621+extern unsigned char MODULES_EXEC_END[];
9622+#endif
9623+#include <asm/boot.h>
9624+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9625+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9626+#else
9627+#define ktla_ktva(addr) (addr)
9628+#define ktva_ktla(addr) (addr)
9629+#endif
9630+
9631 #define MODULES_VADDR VMALLOC_START
9632 #define MODULES_END VMALLOC_END
9633 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9634diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h
9635--- linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h 2011-03-27 14:31:47.000000000 -0400
9636+++ linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h 2011-04-17 15:56:46.000000000 -0400
9637@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
9638
9639 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9640 {
9641+ pax_open_kernel();
9642 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9643+ pax_close_kernel();
9644 }
9645
9646 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9647 {
9648+ pax_open_kernel();
9649 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9650+ pax_close_kernel();
9651 }
9652
9653 /*
9654diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h
9655--- linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h 2011-03-27 14:31:47.000000000 -0400
9656+++ linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h 2011-08-23 20:24:19.000000000 -0400
9657@@ -16,10 +16,13 @@
9658
9659 extern pud_t level3_kernel_pgt[512];
9660 extern pud_t level3_ident_pgt[512];
9661+extern pud_t level3_vmalloc_pgt[512];
9662+extern pud_t level3_vmemmap_pgt[512];
9663+extern pud_t level2_vmemmap_pgt[512];
9664 extern pmd_t level2_kernel_pgt[512];
9665 extern pmd_t level2_fixmap_pgt[512];
9666-extern pmd_t level2_ident_pgt[512];
9667-extern pgd_t init_level4_pgt[];
9668+extern pmd_t level2_ident_pgt[512*2];
9669+extern pgd_t init_level4_pgt[512];
9670
9671 #define swapper_pg_dir init_level4_pgt
9672
9673@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
9674
9675 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9676 {
9677+ pax_open_kernel();
9678 *pmdp = pmd;
9679+ pax_close_kernel();
9680 }
9681
9682 static inline void native_pmd_clear(pmd_t *pmd)
9683@@ -94,6 +99,13 @@ static inline void native_pud_clear(pud_
9684
9685 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9686 {
9687+ pax_open_kernel();
9688+ *pgdp = pgd;
9689+ pax_close_kernel();
9690+}
9691+
9692+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9693+{
9694 *pgdp = pgd;
9695 }
9696
9697diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h
9698--- linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h 2011-03-27 14:31:47.000000000 -0400
9699+++ linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h 2011-04-17 15:56:46.000000000 -0400
9700@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9701 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9702 #define MODULES_END _AC(0xffffffffff000000, UL)
9703 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9704+#define MODULES_EXEC_VADDR MODULES_VADDR
9705+#define MODULES_EXEC_END MODULES_END
9706+
9707+#define ktla_ktva(addr) (addr)
9708+#define ktva_ktla(addr) (addr)
9709
9710 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9711diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable.h linux-2.6.32.46/arch/x86/include/asm/pgtable.h
9712--- linux-2.6.32.46/arch/x86/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
9713+++ linux-2.6.32.46/arch/x86/include/asm/pgtable.h 2011-08-23 20:24:19.000000000 -0400
9714@@ -39,6 +39,7 @@ extern struct list_head pgd_list;
9715
9716 #ifndef __PAGETABLE_PUD_FOLDED
9717 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9718+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9719 #define pgd_clear(pgd) native_pgd_clear(pgd)
9720 #endif
9721
9722@@ -74,12 +75,51 @@ extern struct list_head pgd_list;
9723
9724 #define arch_end_context_switch(prev) do {} while(0)
9725
9726+#define pax_open_kernel() native_pax_open_kernel()
9727+#define pax_close_kernel() native_pax_close_kernel()
9728 #endif /* CONFIG_PARAVIRT */
9729
9730+#define __HAVE_ARCH_PAX_OPEN_KERNEL
9731+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9732+
9733+#ifdef CONFIG_PAX_KERNEXEC
9734+static inline unsigned long native_pax_open_kernel(void)
9735+{
9736+ unsigned long cr0;
9737+
9738+ preempt_disable();
9739+ barrier();
9740+ cr0 = read_cr0() ^ X86_CR0_WP;
9741+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
9742+ write_cr0(cr0);
9743+ return cr0 ^ X86_CR0_WP;
9744+}
9745+
9746+static inline unsigned long native_pax_close_kernel(void)
9747+{
9748+ unsigned long cr0;
9749+
9750+ cr0 = read_cr0() ^ X86_CR0_WP;
9751+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9752+ write_cr0(cr0);
9753+ barrier();
9754+ preempt_enable_no_resched();
9755+ return cr0 ^ X86_CR0_WP;
9756+}
9757+#else
9758+static inline unsigned long native_pax_open_kernel(void) { return 0; }
9759+static inline unsigned long native_pax_close_kernel(void) { return 0; }
9760+#endif
9761+
9762 /*
9763 * The following only work if pte_present() is true.
9764 * Undefined behaviour if not..
9765 */
9766+static inline int pte_user(pte_t pte)
9767+{
9768+ return pte_val(pte) & _PAGE_USER;
9769+}
9770+
9771 static inline int pte_dirty(pte_t pte)
9772 {
9773 return pte_flags(pte) & _PAGE_DIRTY;
9774@@ -167,9 +207,29 @@ static inline pte_t pte_wrprotect(pte_t
9775 return pte_clear_flags(pte, _PAGE_RW);
9776 }
9777
9778+static inline pte_t pte_mkread(pte_t pte)
9779+{
9780+ return __pte(pte_val(pte) | _PAGE_USER);
9781+}
9782+
9783 static inline pte_t pte_mkexec(pte_t pte)
9784 {
9785- return pte_clear_flags(pte, _PAGE_NX);
9786+#ifdef CONFIG_X86_PAE
9787+ if (__supported_pte_mask & _PAGE_NX)
9788+ return pte_clear_flags(pte, _PAGE_NX);
9789+ else
9790+#endif
9791+ return pte_set_flags(pte, _PAGE_USER);
9792+}
9793+
9794+static inline pte_t pte_exprotect(pte_t pte)
9795+{
9796+#ifdef CONFIG_X86_PAE
9797+ if (__supported_pte_mask & _PAGE_NX)
9798+ return pte_set_flags(pte, _PAGE_NX);
9799+ else
9800+#endif
9801+ return pte_clear_flags(pte, _PAGE_USER);
9802 }
9803
9804 static inline pte_t pte_mkdirty(pte_t pte)
9805@@ -302,6 +362,15 @@ pte_t *populate_extra_pte(unsigned long
9806 #endif
9807
9808 #ifndef __ASSEMBLY__
9809+
9810+#ifdef CONFIG_PAX_PER_CPU_PGD
9811+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
9812+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
9813+{
9814+ return cpu_pgd[cpu];
9815+}
9816+#endif
9817+
9818 #include <linux/mm_types.h>
9819
9820 static inline int pte_none(pte_t pte)
9821@@ -472,7 +541,7 @@ static inline pud_t *pud_offset(pgd_t *p
9822
9823 static inline int pgd_bad(pgd_t pgd)
9824 {
9825- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
9826+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
9827 }
9828
9829 static inline int pgd_none(pgd_t pgd)
9830@@ -495,7 +564,12 @@ static inline int pgd_none(pgd_t pgd)
9831 * pgd_offset() returns a (pgd_t *)
9832 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
9833 */
9834-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
9835+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
9836+
9837+#ifdef CONFIG_PAX_PER_CPU_PGD
9838+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
9839+#endif
9840+
9841 /*
9842 * a shortcut which implies the use of the kernel's pgd, instead
9843 * of a process's
9844@@ -506,6 +580,20 @@ static inline int pgd_none(pgd_t pgd)
9845 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
9846 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
9847
9848+#ifdef CONFIG_X86_32
9849+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
9850+#else
9851+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
9852+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
9853+
9854+#ifdef CONFIG_PAX_MEMORY_UDEREF
9855+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
9856+#else
9857+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
9858+#endif
9859+
9860+#endif
9861+
9862 #ifndef __ASSEMBLY__
9863
9864 extern int direct_gbpages;
9865@@ -611,11 +699,23 @@ static inline void ptep_set_wrprotect(st
9866 * dst and src can be on the same page, but the range must not overlap,
9867 * and must not cross a page boundary.
9868 */
9869-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
9870+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
9871 {
9872- memcpy(dst, src, count * sizeof(pgd_t));
9873+ pax_open_kernel();
9874+ while (count--)
9875+ *dst++ = *src++;
9876+ pax_close_kernel();
9877 }
9878
9879+#ifdef CONFIG_PAX_PER_CPU_PGD
9880+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9881+#endif
9882+
9883+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9884+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
9885+#else
9886+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
9887+#endif
9888
9889 #include <asm-generic/pgtable.h>
9890 #endif /* __ASSEMBLY__ */
9891diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h
9892--- linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h 2011-03-27 14:31:47.000000000 -0400
9893+++ linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h 2011-04-17 15:56:46.000000000 -0400
9894@@ -16,12 +16,11 @@
9895 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
9896 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
9897 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
9898-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
9899+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
9900 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
9901 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
9902 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
9903-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
9904-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
9905+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
9906 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
9907
9908 /* If _PAGE_BIT_PRESENT is clear, we use these: */
9909@@ -39,7 +38,6 @@
9910 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
9911 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
9912 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
9913-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
9914 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
9915 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
9916 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
9917@@ -55,8 +53,10 @@
9918
9919 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
9920 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
9921-#else
9922+#elif defined(CONFIG_KMEMCHECK)
9923 #define _PAGE_NX (_AT(pteval_t, 0))
9924+#else
9925+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
9926 #endif
9927
9928 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
9929@@ -93,6 +93,9 @@
9930 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
9931 _PAGE_ACCESSED)
9932
9933+#define PAGE_READONLY_NOEXEC PAGE_READONLY
9934+#define PAGE_SHARED_NOEXEC PAGE_SHARED
9935+
9936 #define __PAGE_KERNEL_EXEC \
9937 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
9938 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
9939@@ -103,8 +106,8 @@
9940 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
9941 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
9942 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
9943-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
9944-#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
9945+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
9946+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
9947 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
9948 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
9949 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
9950@@ -163,8 +166,8 @@
9951 * bits are combined, this will alow user to access the high address mapped
9952 * VDSO in the presence of CONFIG_COMPAT_VDSO
9953 */
9954-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
9955-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
9956+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9957+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
9958 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
9959 #endif
9960
9961@@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t p
9962 {
9963 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
9964 }
9965+#endif
9966
9967+#if PAGETABLE_LEVELS == 3
9968+#include <asm-generic/pgtable-nopud.h>
9969+#endif
9970+
9971+#if PAGETABLE_LEVELS == 2
9972+#include <asm-generic/pgtable-nopmd.h>
9973+#endif
9974+
9975+#ifndef __ASSEMBLY__
9976 #if PAGETABLE_LEVELS > 3
9977 typedef struct { pudval_t pud; } pud_t;
9978
9979@@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pu
9980 return pud.pud;
9981 }
9982 #else
9983-#include <asm-generic/pgtable-nopud.h>
9984-
9985 static inline pudval_t native_pud_val(pud_t pud)
9986 {
9987 return native_pgd_val(pud.pgd);
9988@@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pm
9989 return pmd.pmd;
9990 }
9991 #else
9992-#include <asm-generic/pgtable-nopmd.h>
9993-
9994 static inline pmdval_t native_pmd_val(pmd_t pmd)
9995 {
9996 return native_pgd_val(pmd.pud.pgd);
9997@@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
9998
9999 extern pteval_t __supported_pte_mask;
10000 extern void set_nx(void);
10001+
10002+#ifdef CONFIG_X86_32
10003+#ifdef CONFIG_X86_PAE
10004 extern int nx_enabled;
10005+#else
10006+#define nx_enabled (0)
10007+#endif
10008+#else
10009+#define nx_enabled (1)
10010+#endif
10011
10012 #define pgprot_writecombine pgprot_writecombine
10013 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10014diff -urNp linux-2.6.32.46/arch/x86/include/asm/processor.h linux-2.6.32.46/arch/x86/include/asm/processor.h
10015--- linux-2.6.32.46/arch/x86/include/asm/processor.h 2011-04-22 19:16:29.000000000 -0400
10016+++ linux-2.6.32.46/arch/x86/include/asm/processor.h 2011-05-11 18:25:15.000000000 -0400
10017@@ -272,7 +272,7 @@ struct tss_struct {
10018
10019 } ____cacheline_aligned;
10020
10021-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10022+extern struct tss_struct init_tss[NR_CPUS];
10023
10024 /*
10025 * Save the original ist values for checking stack pointers during debugging
10026@@ -888,11 +888,18 @@ static inline void spin_lock_prefetch(co
10027 */
10028 #define TASK_SIZE PAGE_OFFSET
10029 #define TASK_SIZE_MAX TASK_SIZE
10030+
10031+#ifdef CONFIG_PAX_SEGMEXEC
10032+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10033+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10034+#else
10035 #define STACK_TOP TASK_SIZE
10036-#define STACK_TOP_MAX STACK_TOP
10037+#endif
10038+
10039+#define STACK_TOP_MAX TASK_SIZE
10040
10041 #define INIT_THREAD { \
10042- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10043+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10044 .vm86_info = NULL, \
10045 .sysenter_cs = __KERNEL_CS, \
10046 .io_bitmap_ptr = NULL, \
10047@@ -906,7 +913,7 @@ static inline void spin_lock_prefetch(co
10048 */
10049 #define INIT_TSS { \
10050 .x86_tss = { \
10051- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10052+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10053 .ss0 = __KERNEL_DS, \
10054 .ss1 = __KERNEL_CS, \
10055 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10056@@ -917,11 +924,7 @@ static inline void spin_lock_prefetch(co
10057 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10058
10059 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10060-#define KSTK_TOP(info) \
10061-({ \
10062- unsigned long *__ptr = (unsigned long *)(info); \
10063- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10064-})
10065+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10066
10067 /*
10068 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10069@@ -936,7 +939,7 @@ extern unsigned long thread_saved_pc(str
10070 #define task_pt_regs(task) \
10071 ({ \
10072 struct pt_regs *__regs__; \
10073- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10074+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10075 __regs__ - 1; \
10076 })
10077
10078@@ -946,13 +949,13 @@ extern unsigned long thread_saved_pc(str
10079 /*
10080 * User space process size. 47bits minus one guard page.
10081 */
10082-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10083+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10084
10085 /* This decides where the kernel will search for a free chunk of vm
10086 * space during mmap's.
10087 */
10088 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10089- 0xc0000000 : 0xFFFFe000)
10090+ 0xc0000000 : 0xFFFFf000)
10091
10092 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10093 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10094@@ -963,11 +966,11 @@ extern unsigned long thread_saved_pc(str
10095 #define STACK_TOP_MAX TASK_SIZE_MAX
10096
10097 #define INIT_THREAD { \
10098- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10099+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10100 }
10101
10102 #define INIT_TSS { \
10103- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10104+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10105 }
10106
10107 /*
10108@@ -989,6 +992,10 @@ extern void start_thread(struct pt_regs
10109 */
10110 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10111
10112+#ifdef CONFIG_PAX_SEGMEXEC
10113+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10114+#endif
10115+
10116 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10117
10118 /* Get/set a process' ability to use the timestamp counter instruction */
10119diff -urNp linux-2.6.32.46/arch/x86/include/asm/ptrace.h linux-2.6.32.46/arch/x86/include/asm/ptrace.h
10120--- linux-2.6.32.46/arch/x86/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
10121+++ linux-2.6.32.46/arch/x86/include/asm/ptrace.h 2011-04-17 15:56:46.000000000 -0400
10122@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
10123 }
10124
10125 /*
10126- * user_mode_vm(regs) determines whether a register set came from user mode.
10127+ * user_mode(regs) determines whether a register set came from user mode.
10128 * This is true if V8086 mode was enabled OR if the register set was from
10129 * protected mode with RPL-3 CS value. This tricky test checks that with
10130 * one comparison. Many places in the kernel can bypass this full check
10131- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10132+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10133+ * be used.
10134 */
10135-static inline int user_mode(struct pt_regs *regs)
10136+static inline int user_mode_novm(struct pt_regs *regs)
10137 {
10138 #ifdef CONFIG_X86_32
10139 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10140 #else
10141- return !!(regs->cs & 3);
10142+ return !!(regs->cs & SEGMENT_RPL_MASK);
10143 #endif
10144 }
10145
10146-static inline int user_mode_vm(struct pt_regs *regs)
10147+static inline int user_mode(struct pt_regs *regs)
10148 {
10149 #ifdef CONFIG_X86_32
10150 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10151 USER_RPL;
10152 #else
10153- return user_mode(regs);
10154+ return user_mode_novm(regs);
10155 #endif
10156 }
10157
10158diff -urNp linux-2.6.32.46/arch/x86/include/asm/reboot.h linux-2.6.32.46/arch/x86/include/asm/reboot.h
10159--- linux-2.6.32.46/arch/x86/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
10160+++ linux-2.6.32.46/arch/x86/include/asm/reboot.h 2011-08-05 20:33:55.000000000 -0400
10161@@ -6,19 +6,19 @@
10162 struct pt_regs;
10163
10164 struct machine_ops {
10165- void (*restart)(char *cmd);
10166- void (*halt)(void);
10167- void (*power_off)(void);
10168+ void (* __noreturn restart)(char *cmd);
10169+ void (* __noreturn halt)(void);
10170+ void (* __noreturn power_off)(void);
10171 void (*shutdown)(void);
10172 void (*crash_shutdown)(struct pt_regs *);
10173- void (*emergency_restart)(void);
10174-};
10175+ void (* __noreturn emergency_restart)(void);
10176+} __no_const;
10177
10178 extern struct machine_ops machine_ops;
10179
10180 void native_machine_crash_shutdown(struct pt_regs *regs);
10181 void native_machine_shutdown(void);
10182-void machine_real_restart(const unsigned char *code, int length);
10183+void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
10184
10185 typedef void (*nmi_shootdown_cb)(int, struct die_args*);
10186 void nmi_shootdown_cpus(nmi_shootdown_cb callback);
10187diff -urNp linux-2.6.32.46/arch/x86/include/asm/rwsem.h linux-2.6.32.46/arch/x86/include/asm/rwsem.h
10188--- linux-2.6.32.46/arch/x86/include/asm/rwsem.h 2011-03-27 14:31:47.000000000 -0400
10189+++ linux-2.6.32.46/arch/x86/include/asm/rwsem.h 2011-04-17 15:56:46.000000000 -0400
10190@@ -118,6 +118,14 @@ static inline void __down_read(struct rw
10191 {
10192 asm volatile("# beginning down_read\n\t"
10193 LOCK_PREFIX _ASM_INC "(%1)\n\t"
10194+
10195+#ifdef CONFIG_PAX_REFCOUNT
10196+ "jno 0f\n"
10197+ LOCK_PREFIX _ASM_DEC "(%1)\n\t"
10198+ "int $4\n0:\n"
10199+ _ASM_EXTABLE(0b, 0b)
10200+#endif
10201+
10202 /* adds 0x00000001, returns the old value */
10203 " jns 1f\n"
10204 " call call_rwsem_down_read_failed\n"
10205@@ -139,6 +147,14 @@ static inline int __down_read_trylock(st
10206 "1:\n\t"
10207 " mov %1,%2\n\t"
10208 " add %3,%2\n\t"
10209+
10210+#ifdef CONFIG_PAX_REFCOUNT
10211+ "jno 0f\n"
10212+ "sub %3,%2\n"
10213+ "int $4\n0:\n"
10214+ _ASM_EXTABLE(0b, 0b)
10215+#endif
10216+
10217 " jle 2f\n\t"
10218 LOCK_PREFIX " cmpxchg %2,%0\n\t"
10219 " jnz 1b\n\t"
10220@@ -160,6 +176,14 @@ static inline void __down_write_nested(s
10221 tmp = RWSEM_ACTIVE_WRITE_BIAS;
10222 asm volatile("# beginning down_write\n\t"
10223 LOCK_PREFIX " xadd %1,(%2)\n\t"
10224+
10225+#ifdef CONFIG_PAX_REFCOUNT
10226+ "jno 0f\n"
10227+ "mov %1,(%2)\n"
10228+ "int $4\n0:\n"
10229+ _ASM_EXTABLE(0b, 0b)
10230+#endif
10231+
10232 /* subtract 0x0000ffff, returns the old value */
10233 " test %1,%1\n\t"
10234 /* was the count 0 before? */
10235@@ -198,6 +222,14 @@ static inline void __up_read(struct rw_s
10236 rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
10237 asm volatile("# beginning __up_read\n\t"
10238 LOCK_PREFIX " xadd %1,(%2)\n\t"
10239+
10240+#ifdef CONFIG_PAX_REFCOUNT
10241+ "jno 0f\n"
10242+ "mov %1,(%2)\n"
10243+ "int $4\n0:\n"
10244+ _ASM_EXTABLE(0b, 0b)
10245+#endif
10246+
10247 /* subtracts 1, returns the old value */
10248 " jns 1f\n\t"
10249 " call call_rwsem_wake\n"
10250@@ -216,6 +248,14 @@ static inline void __up_write(struct rw_
10251 rwsem_count_t tmp;
10252 asm volatile("# beginning __up_write\n\t"
10253 LOCK_PREFIX " xadd %1,(%2)\n\t"
10254+
10255+#ifdef CONFIG_PAX_REFCOUNT
10256+ "jno 0f\n"
10257+ "mov %1,(%2)\n"
10258+ "int $4\n0:\n"
10259+ _ASM_EXTABLE(0b, 0b)
10260+#endif
10261+
10262 /* tries to transition
10263 0xffff0001 -> 0x00000000 */
10264 " jz 1f\n"
10265@@ -234,6 +274,14 @@ static inline void __downgrade_write(str
10266 {
10267 asm volatile("# beginning __downgrade_write\n\t"
10268 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
10269+
10270+#ifdef CONFIG_PAX_REFCOUNT
10271+ "jno 0f\n"
10272+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
10273+ "int $4\n0:\n"
10274+ _ASM_EXTABLE(0b, 0b)
10275+#endif
10276+
10277 /*
10278 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
10279 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
10280@@ -253,7 +301,15 @@ static inline void __downgrade_write(str
10281 static inline void rwsem_atomic_add(rwsem_count_t delta,
10282 struct rw_semaphore *sem)
10283 {
10284- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
10285+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
10286+
10287+#ifdef CONFIG_PAX_REFCOUNT
10288+ "jno 0f\n"
10289+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
10290+ "int $4\n0:\n"
10291+ _ASM_EXTABLE(0b, 0b)
10292+#endif
10293+
10294 : "+m" (sem->count)
10295 : "er" (delta));
10296 }
10297@@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic
10298 {
10299 rwsem_count_t tmp = delta;
10300
10301- asm volatile(LOCK_PREFIX "xadd %0,%1"
10302+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
10303+
10304+#ifdef CONFIG_PAX_REFCOUNT
10305+ "jno 0f\n"
10306+ "mov %0,%1\n"
10307+ "int $4\n0:\n"
10308+ _ASM_EXTABLE(0b, 0b)
10309+#endif
10310+
10311 : "+r" (tmp), "+m" (sem->count)
10312 : : "memory");
10313
10314diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x86/include/asm/segment.h
10315--- linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400
10316+++ linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-04-17 15:56:46.000000000 -0400
10317@@ -62,8 +62,8 @@
10318 * 26 - ESPFIX small SS
10319 * 27 - per-cpu [ offset to per-cpu data area ]
10320 * 28 - stack_canary-20 [ for stack protector ]
10321- * 29 - unused
10322- * 30 - unused
10323+ * 29 - PCI BIOS CS
10324+ * 30 - PCI BIOS DS
10325 * 31 - TSS for double fault handler
10326 */
10327 #define GDT_ENTRY_TLS_MIN 6
10328@@ -77,6 +77,8 @@
10329
10330 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
10331
10332+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
10333+
10334 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
10335
10336 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
10337@@ -88,7 +90,7 @@
10338 #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
10339 #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
10340
10341-#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10342+#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10343 #ifdef CONFIG_SMP
10344 #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
10345 #else
10346@@ -102,6 +104,12 @@
10347 #define __KERNEL_STACK_CANARY 0
10348 #endif
10349
10350+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
10351+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
10352+
10353+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
10354+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
10355+
10356 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
10357
10358 /*
10359@@ -139,7 +147,7 @@
10360 */
10361
10362 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
10363-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10364+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10365
10366
10367 #else
10368@@ -163,6 +171,8 @@
10369 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
10370 #define __USER32_DS __USER_DS
10371
10372+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10373+
10374 #define GDT_ENTRY_TSS 8 /* needs two entries */
10375 #define GDT_ENTRY_LDT 10 /* needs two entries */
10376 #define GDT_ENTRY_TLS_MIN 12
10377@@ -183,6 +193,7 @@
10378 #endif
10379
10380 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
10381+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
10382 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
10383 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
10384 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
10385diff -urNp linux-2.6.32.46/arch/x86/include/asm/smp.h linux-2.6.32.46/arch/x86/include/asm/smp.h
10386--- linux-2.6.32.46/arch/x86/include/asm/smp.h 2011-03-27 14:31:47.000000000 -0400
10387+++ linux-2.6.32.46/arch/x86/include/asm/smp.h 2011-08-05 20:33:55.000000000 -0400
10388@@ -24,7 +24,7 @@ extern unsigned int num_processors;
10389 DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
10390 DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10391 DECLARE_PER_CPU(u16, cpu_llc_id);
10392-DECLARE_PER_CPU(int, cpu_number);
10393+DECLARE_PER_CPU(unsigned int, cpu_number);
10394
10395 static inline struct cpumask *cpu_sibling_mask(int cpu)
10396 {
10397@@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_ap
10398 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
10399
10400 /* Static state in head.S used to set up a CPU */
10401-extern struct {
10402- void *sp;
10403- unsigned short ss;
10404-} stack_start;
10405+extern unsigned long stack_start; /* Initial stack pointer address */
10406
10407 struct smp_ops {
10408 void (*smp_prepare_boot_cpu)(void);
10409@@ -60,7 +57,7 @@ struct smp_ops {
10410
10411 void (*send_call_func_ipi)(const struct cpumask *mask);
10412 void (*send_call_func_single_ipi)(int cpu);
10413-};
10414+} __no_const;
10415
10416 /* Globals due to paravirt */
10417 extern void set_cpu_sibling_map(int cpu);
10418@@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitd
10419 extern int safe_smp_processor_id(void);
10420
10421 #elif defined(CONFIG_X86_64_SMP)
10422-#define raw_smp_processor_id() (percpu_read(cpu_number))
10423-
10424-#define stack_smp_processor_id() \
10425-({ \
10426- struct thread_info *ti; \
10427- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10428- ti->cpu; \
10429-})
10430+#define raw_smp_processor_id() (percpu_read(cpu_number))
10431+#define stack_smp_processor_id() raw_smp_processor_id()
10432 #define safe_smp_processor_id() smp_processor_id()
10433
10434 #endif
10435diff -urNp linux-2.6.32.46/arch/x86/include/asm/spinlock.h linux-2.6.32.46/arch/x86/include/asm/spinlock.h
10436--- linux-2.6.32.46/arch/x86/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
10437+++ linux-2.6.32.46/arch/x86/include/asm/spinlock.h 2011-04-17 15:56:46.000000000 -0400
10438@@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(r
10439 static inline void __raw_read_lock(raw_rwlock_t *rw)
10440 {
10441 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
10442+
10443+#ifdef CONFIG_PAX_REFCOUNT
10444+ "jno 0f\n"
10445+ LOCK_PREFIX " addl $1,(%0)\n"
10446+ "int $4\n0:\n"
10447+ _ASM_EXTABLE(0b, 0b)
10448+#endif
10449+
10450 "jns 1f\n"
10451 "call __read_lock_failed\n\t"
10452 "1:\n"
10453@@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_r
10454 static inline void __raw_write_lock(raw_rwlock_t *rw)
10455 {
10456 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
10457+
10458+#ifdef CONFIG_PAX_REFCOUNT
10459+ "jno 0f\n"
10460+ LOCK_PREFIX " addl %1,(%0)\n"
10461+ "int $4\n0:\n"
10462+ _ASM_EXTABLE(0b, 0b)
10463+#endif
10464+
10465 "jz 1f\n"
10466 "call __write_lock_failed\n\t"
10467 "1:\n"
10468@@ -286,12 +302,29 @@ static inline int __raw_write_trylock(ra
10469
10470 static inline void __raw_read_unlock(raw_rwlock_t *rw)
10471 {
10472- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
10473+ asm volatile(LOCK_PREFIX "incl %0\n"
10474+
10475+#ifdef CONFIG_PAX_REFCOUNT
10476+ "jno 0f\n"
10477+ LOCK_PREFIX "decl %0\n"
10478+ "int $4\n0:\n"
10479+ _ASM_EXTABLE(0b, 0b)
10480+#endif
10481+
10482+ :"+m" (rw->lock) : : "memory");
10483 }
10484
10485 static inline void __raw_write_unlock(raw_rwlock_t *rw)
10486 {
10487- asm volatile(LOCK_PREFIX "addl %1, %0"
10488+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
10489+
10490+#ifdef CONFIG_PAX_REFCOUNT
10491+ "jno 0f\n"
10492+ LOCK_PREFIX "subl %1, %0\n"
10493+ "int $4\n0:\n"
10494+ _ASM_EXTABLE(0b, 0b)
10495+#endif
10496+
10497 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
10498 }
10499
10500diff -urNp linux-2.6.32.46/arch/x86/include/asm/stackprotector.h linux-2.6.32.46/arch/x86/include/asm/stackprotector.h
10501--- linux-2.6.32.46/arch/x86/include/asm/stackprotector.h 2011-03-27 14:31:47.000000000 -0400
10502+++ linux-2.6.32.46/arch/x86/include/asm/stackprotector.h 2011-07-06 19:53:33.000000000 -0400
10503@@ -48,7 +48,7 @@
10504 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10505 */
10506 #define GDT_STACK_CANARY_INIT \
10507- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10508+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10509
10510 /*
10511 * Initialize the stackprotector canary value.
10512@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
10513
10514 static inline void load_stack_canary_segment(void)
10515 {
10516-#ifdef CONFIG_X86_32
10517+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10518 asm volatile ("mov %0, %%gs" : : "r" (0));
10519 #endif
10520 }
10521diff -urNp linux-2.6.32.46/arch/x86/include/asm/system.h linux-2.6.32.46/arch/x86/include/asm/system.h
10522--- linux-2.6.32.46/arch/x86/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
10523+++ linux-2.6.32.46/arch/x86/include/asm/system.h 2011-05-22 23:02:03.000000000 -0400
10524@@ -132,7 +132,7 @@ do { \
10525 "thread_return:\n\t" \
10526 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10527 __switch_canary \
10528- "movq %P[thread_info](%%rsi),%%r8\n\t" \
10529+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10530 "movq %%rax,%%rdi\n\t" \
10531 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10532 "jnz ret_from_fork\n\t" \
10533@@ -143,7 +143,7 @@ do { \
10534 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10535 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10536 [_tif_fork] "i" (_TIF_FORK), \
10537- [thread_info] "i" (offsetof(struct task_struct, stack)), \
10538+ [thread_info] "m" (per_cpu_var(current_tinfo)), \
10539 [current_task] "m" (per_cpu_var(current_task)) \
10540 __switch_canary_iparam \
10541 : "memory", "cc" __EXTRA_CLOBBER)
10542@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
10543 {
10544 unsigned long __limit;
10545 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10546- return __limit + 1;
10547+ return __limit;
10548 }
10549
10550 static inline void native_clts(void)
10551@@ -340,12 +340,12 @@ void enable_hlt(void);
10552
10553 void cpu_idle_wait(void);
10554
10555-extern unsigned long arch_align_stack(unsigned long sp);
10556+#define arch_align_stack(x) ((x) & ~0xfUL)
10557 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10558
10559 void default_idle(void);
10560
10561-void stop_this_cpu(void *dummy);
10562+void stop_this_cpu(void *dummy) __noreturn;
10563
10564 /*
10565 * Force strict CPU ordering.
10566diff -urNp linux-2.6.32.46/arch/x86/include/asm/thread_info.h linux-2.6.32.46/arch/x86/include/asm/thread_info.h
10567--- linux-2.6.32.46/arch/x86/include/asm/thread_info.h 2011-03-27 14:31:47.000000000 -0400
10568+++ linux-2.6.32.46/arch/x86/include/asm/thread_info.h 2011-05-17 19:26:34.000000000 -0400
10569@@ -10,6 +10,7 @@
10570 #include <linux/compiler.h>
10571 #include <asm/page.h>
10572 #include <asm/types.h>
10573+#include <asm/percpu.h>
10574
10575 /*
10576 * low level task data that entry.S needs immediate access to
10577@@ -24,7 +25,6 @@ struct exec_domain;
10578 #include <asm/atomic.h>
10579
10580 struct thread_info {
10581- struct task_struct *task; /* main task structure */
10582 struct exec_domain *exec_domain; /* execution domain */
10583 __u32 flags; /* low level flags */
10584 __u32 status; /* thread synchronous flags */
10585@@ -34,18 +34,12 @@ struct thread_info {
10586 mm_segment_t addr_limit;
10587 struct restart_block restart_block;
10588 void __user *sysenter_return;
10589-#ifdef CONFIG_X86_32
10590- unsigned long previous_esp; /* ESP of the previous stack in
10591- case of nested (IRQ) stacks
10592- */
10593- __u8 supervisor_stack[0];
10594-#endif
10595+ unsigned long lowest_stack;
10596 int uaccess_err;
10597 };
10598
10599-#define INIT_THREAD_INFO(tsk) \
10600+#define INIT_THREAD_INFO \
10601 { \
10602- .task = &tsk, \
10603 .exec_domain = &default_exec_domain, \
10604 .flags = 0, \
10605 .cpu = 0, \
10606@@ -56,7 +50,7 @@ struct thread_info {
10607 }, \
10608 }
10609
10610-#define init_thread_info (init_thread_union.thread_info)
10611+#define init_thread_info (init_thread_union.stack)
10612 #define init_stack (init_thread_union.stack)
10613
10614 #else /* !__ASSEMBLY__ */
10615@@ -163,6 +157,23 @@ struct thread_info {
10616 #define alloc_thread_info(tsk) \
10617 ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
10618
10619+#ifdef __ASSEMBLY__
10620+/* how to get the thread information struct from ASM */
10621+#define GET_THREAD_INFO(reg) \
10622+ mov PER_CPU_VAR(current_tinfo), reg
10623+
10624+/* use this one if reg already contains %esp */
10625+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10626+#else
10627+/* how to get the thread information struct from C */
10628+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10629+
10630+static __always_inline struct thread_info *current_thread_info(void)
10631+{
10632+ return percpu_read_stable(current_tinfo);
10633+}
10634+#endif
10635+
10636 #ifdef CONFIG_X86_32
10637
10638 #define STACK_WARN (THREAD_SIZE/8)
10639@@ -173,35 +184,13 @@ struct thread_info {
10640 */
10641 #ifndef __ASSEMBLY__
10642
10643-
10644 /* how to get the current stack pointer from C */
10645 register unsigned long current_stack_pointer asm("esp") __used;
10646
10647-/* how to get the thread information struct from C */
10648-static inline struct thread_info *current_thread_info(void)
10649-{
10650- return (struct thread_info *)
10651- (current_stack_pointer & ~(THREAD_SIZE - 1));
10652-}
10653-
10654-#else /* !__ASSEMBLY__ */
10655-
10656-/* how to get the thread information struct from ASM */
10657-#define GET_THREAD_INFO(reg) \
10658- movl $-THREAD_SIZE, reg; \
10659- andl %esp, reg
10660-
10661-/* use this one if reg already contains %esp */
10662-#define GET_THREAD_INFO_WITH_ESP(reg) \
10663- andl $-THREAD_SIZE, reg
10664-
10665 #endif
10666
10667 #else /* X86_32 */
10668
10669-#include <asm/percpu.h>
10670-#define KERNEL_STACK_OFFSET (5*8)
10671-
10672 /*
10673 * macros/functions for gaining access to the thread information structure
10674 * preempt_count needs to be 1 initially, until the scheduler is functional.
10675@@ -209,21 +198,8 @@ static inline struct thread_info *curren
10676 #ifndef __ASSEMBLY__
10677 DECLARE_PER_CPU(unsigned long, kernel_stack);
10678
10679-static inline struct thread_info *current_thread_info(void)
10680-{
10681- struct thread_info *ti;
10682- ti = (void *)(percpu_read_stable(kernel_stack) +
10683- KERNEL_STACK_OFFSET - THREAD_SIZE);
10684- return ti;
10685-}
10686-
10687-#else /* !__ASSEMBLY__ */
10688-
10689-/* how to get the thread information struct from ASM */
10690-#define GET_THREAD_INFO(reg) \
10691- movq PER_CPU_VAR(kernel_stack),reg ; \
10692- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10693-
10694+/* how to get the current stack pointer from C */
10695+register unsigned long current_stack_pointer asm("rsp") __used;
10696 #endif
10697
10698 #endif /* !X86_32 */
10699@@ -260,5 +236,16 @@ extern void arch_task_cache_init(void);
10700 extern void free_thread_info(struct thread_info *ti);
10701 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10702 #define arch_task_cache_init arch_task_cache_init
10703+
10704+#define __HAVE_THREAD_FUNCTIONS
10705+#define task_thread_info(task) (&(task)->tinfo)
10706+#define task_stack_page(task) ((task)->stack)
10707+#define setup_thread_stack(p, org) do {} while (0)
10708+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10709+
10710+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10711+extern struct task_struct *alloc_task_struct(void);
10712+extern void free_task_struct(struct task_struct *);
10713+
10714 #endif
10715 #endif /* _ASM_X86_THREAD_INFO_H */
10716diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h
10717--- linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
10718+++ linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h 2011-05-16 21:46:57.000000000 -0400
10719@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
10720 static __always_inline unsigned long __must_check
10721 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10722 {
10723+ pax_track_stack();
10724+
10725+ if ((long)n < 0)
10726+ return n;
10727+
10728 if (__builtin_constant_p(n)) {
10729 unsigned long ret;
10730
10731@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
10732 return ret;
10733 }
10734 }
10735+ if (!__builtin_constant_p(n))
10736+ check_object_size(from, n, true);
10737 return __copy_to_user_ll(to, from, n);
10738 }
10739
10740@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
10741 __copy_to_user(void __user *to, const void *from, unsigned long n)
10742 {
10743 might_fault();
10744+
10745 return __copy_to_user_inatomic(to, from, n);
10746 }
10747
10748 static __always_inline unsigned long
10749 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10750 {
10751+ if ((long)n < 0)
10752+ return n;
10753+
10754 /* Avoid zeroing the tail if the copy fails..
10755 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10756 * but as the zeroing behaviour is only significant when n is not
10757@@ -138,6 +149,12 @@ static __always_inline unsigned long
10758 __copy_from_user(void *to, const void __user *from, unsigned long n)
10759 {
10760 might_fault();
10761+
10762+ pax_track_stack();
10763+
10764+ if ((long)n < 0)
10765+ return n;
10766+
10767 if (__builtin_constant_p(n)) {
10768 unsigned long ret;
10769
10770@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
10771 return ret;
10772 }
10773 }
10774+ if (!__builtin_constant_p(n))
10775+ check_object_size(to, n, false);
10776 return __copy_from_user_ll(to, from, n);
10777 }
10778
10779@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
10780 const void __user *from, unsigned long n)
10781 {
10782 might_fault();
10783+
10784+ if ((long)n < 0)
10785+ return n;
10786+
10787 if (__builtin_constant_p(n)) {
10788 unsigned long ret;
10789
10790@@ -182,14 +205,62 @@ static __always_inline unsigned long
10791 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
10792 unsigned long n)
10793 {
10794- return __copy_from_user_ll_nocache_nozero(to, from, n);
10795+ if ((long)n < 0)
10796+ return n;
10797+
10798+ return __copy_from_user_ll_nocache_nozero(to, from, n);
10799+}
10800+
10801+/**
10802+ * copy_to_user: - Copy a block of data into user space.
10803+ * @to: Destination address, in user space.
10804+ * @from: Source address, in kernel space.
10805+ * @n: Number of bytes to copy.
10806+ *
10807+ * Context: User context only. This function may sleep.
10808+ *
10809+ * Copy data from kernel space to user space.
10810+ *
10811+ * Returns number of bytes that could not be copied.
10812+ * On success, this will be zero.
10813+ */
10814+static __always_inline unsigned long __must_check
10815+copy_to_user(void __user *to, const void *from, unsigned long n)
10816+{
10817+ if (access_ok(VERIFY_WRITE, to, n))
10818+ n = __copy_to_user(to, from, n);
10819+ return n;
10820+}
10821+
10822+/**
10823+ * copy_from_user: - Copy a block of data from user space.
10824+ * @to: Destination address, in kernel space.
10825+ * @from: Source address, in user space.
10826+ * @n: Number of bytes to copy.
10827+ *
10828+ * Context: User context only. This function may sleep.
10829+ *
10830+ * Copy data from user space to kernel space.
10831+ *
10832+ * Returns number of bytes that could not be copied.
10833+ * On success, this will be zero.
10834+ *
10835+ * If some data could not be copied, this function will pad the copied
10836+ * data to the requested size using zero bytes.
10837+ */
10838+static __always_inline unsigned long __must_check
10839+copy_from_user(void *to, const void __user *from, unsigned long n)
10840+{
10841+ if (access_ok(VERIFY_READ, from, n))
10842+ n = __copy_from_user(to, from, n);
10843+ else if ((long)n > 0) {
10844+ if (!__builtin_constant_p(n))
10845+ check_object_size(to, n, false);
10846+ memset(to, 0, n);
10847+ }
10848+ return n;
10849 }
10850
10851-unsigned long __must_check copy_to_user(void __user *to,
10852- const void *from, unsigned long n);
10853-unsigned long __must_check copy_from_user(void *to,
10854- const void __user *from,
10855- unsigned long n);
10856 long __must_check strncpy_from_user(char *dst, const char __user *src,
10857 long count);
10858 long __must_check __strncpy_from_user(char *dst,
10859diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h
10860--- linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
10861+++ linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-05-16 21:46:57.000000000 -0400
10862@@ -9,6 +9,9 @@
10863 #include <linux/prefetch.h>
10864 #include <linux/lockdep.h>
10865 #include <asm/page.h>
10866+#include <asm/pgtable.h>
10867+
10868+#define set_fs(x) (current_thread_info()->addr_limit = (x))
10869
10870 /*
10871 * Copy To/From Userspace
10872@@ -19,113 +22,203 @@ __must_check unsigned long
10873 copy_user_generic(void *to, const void *from, unsigned len);
10874
10875 __must_check unsigned long
10876-copy_to_user(void __user *to, const void *from, unsigned len);
10877-__must_check unsigned long
10878-copy_from_user(void *to, const void __user *from, unsigned len);
10879-__must_check unsigned long
10880 copy_in_user(void __user *to, const void __user *from, unsigned len);
10881
10882 static __always_inline __must_check
10883-int __copy_from_user(void *dst, const void __user *src, unsigned size)
10884+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
10885 {
10886- int ret = 0;
10887+ unsigned ret = 0;
10888
10889 might_fault();
10890- if (!__builtin_constant_p(size))
10891- return copy_user_generic(dst, (__force void *)src, size);
10892+
10893+ if ((int)size < 0)
10894+ return size;
10895+
10896+#ifdef CONFIG_PAX_MEMORY_UDEREF
10897+ if (!__access_ok(VERIFY_READ, src, size))
10898+ return size;
10899+#endif
10900+
10901+ if (!__builtin_constant_p(size)) {
10902+ check_object_size(dst, size, false);
10903+
10904+#ifdef CONFIG_PAX_MEMORY_UDEREF
10905+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10906+ src += PAX_USER_SHADOW_BASE;
10907+#endif
10908+
10909+ return copy_user_generic(dst, (__force const void *)src, size);
10910+ }
10911 switch (size) {
10912- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
10913+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
10914 ret, "b", "b", "=q", 1);
10915 return ret;
10916- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
10917+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
10918 ret, "w", "w", "=r", 2);
10919 return ret;
10920- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
10921+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
10922 ret, "l", "k", "=r", 4);
10923 return ret;
10924- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
10925+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10926 ret, "q", "", "=r", 8);
10927 return ret;
10928 case 10:
10929- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10930+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10931 ret, "q", "", "=r", 10);
10932 if (unlikely(ret))
10933 return ret;
10934 __get_user_asm(*(u16 *)(8 + (char *)dst),
10935- (u16 __user *)(8 + (char __user *)src),
10936+ (const u16 __user *)(8 + (const char __user *)src),
10937 ret, "w", "w", "=r", 2);
10938 return ret;
10939 case 16:
10940- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
10941+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
10942 ret, "q", "", "=r", 16);
10943 if (unlikely(ret))
10944 return ret;
10945 __get_user_asm(*(u64 *)(8 + (char *)dst),
10946- (u64 __user *)(8 + (char __user *)src),
10947+ (const u64 __user *)(8 + (const char __user *)src),
10948 ret, "q", "", "=r", 8);
10949 return ret;
10950 default:
10951- return copy_user_generic(dst, (__force void *)src, size);
10952+
10953+#ifdef CONFIG_PAX_MEMORY_UDEREF
10954+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
10955+ src += PAX_USER_SHADOW_BASE;
10956+#endif
10957+
10958+ return copy_user_generic(dst, (__force const void *)src, size);
10959 }
10960 }
10961
10962 static __always_inline __must_check
10963-int __copy_to_user(void __user *dst, const void *src, unsigned size)
10964+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
10965 {
10966- int ret = 0;
10967+ unsigned ret = 0;
10968
10969 might_fault();
10970- if (!__builtin_constant_p(size))
10971+
10972+ pax_track_stack();
10973+
10974+ if ((int)size < 0)
10975+ return size;
10976+
10977+#ifdef CONFIG_PAX_MEMORY_UDEREF
10978+ if (!__access_ok(VERIFY_WRITE, dst, size))
10979+ return size;
10980+#endif
10981+
10982+ if (!__builtin_constant_p(size)) {
10983+ check_object_size(src, size, true);
10984+
10985+#ifdef CONFIG_PAX_MEMORY_UDEREF
10986+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
10987+ dst += PAX_USER_SHADOW_BASE;
10988+#endif
10989+
10990 return copy_user_generic((__force void *)dst, src, size);
10991+ }
10992 switch (size) {
10993- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
10994+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
10995 ret, "b", "b", "iq", 1);
10996 return ret;
10997- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
10998+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
10999 ret, "w", "w", "ir", 2);
11000 return ret;
11001- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11002+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11003 ret, "l", "k", "ir", 4);
11004 return ret;
11005- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11006+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11007 ret, "q", "", "er", 8);
11008 return ret;
11009 case 10:
11010- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11011+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11012 ret, "q", "", "er", 10);
11013 if (unlikely(ret))
11014 return ret;
11015 asm("":::"memory");
11016- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11017+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11018 ret, "w", "w", "ir", 2);
11019 return ret;
11020 case 16:
11021- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11022+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11023 ret, "q", "", "er", 16);
11024 if (unlikely(ret))
11025 return ret;
11026 asm("":::"memory");
11027- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11028+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11029 ret, "q", "", "er", 8);
11030 return ret;
11031 default:
11032+
11033+#ifdef CONFIG_PAX_MEMORY_UDEREF
11034+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11035+ dst += PAX_USER_SHADOW_BASE;
11036+#endif
11037+
11038 return copy_user_generic((__force void *)dst, src, size);
11039 }
11040 }
11041
11042 static __always_inline __must_check
11043-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11044+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
11045+{
11046+ if (access_ok(VERIFY_WRITE, to, len))
11047+ len = __copy_to_user(to, from, len);
11048+ return len;
11049+}
11050+
11051+static __always_inline __must_check
11052+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
11053+{
11054+ if ((int)len < 0)
11055+ return len;
11056+
11057+ if (access_ok(VERIFY_READ, from, len))
11058+ len = __copy_from_user(to, from, len);
11059+ else if ((int)len > 0) {
11060+ if (!__builtin_constant_p(len))
11061+ check_object_size(to, len, false);
11062+ memset(to, 0, len);
11063+ }
11064+ return len;
11065+}
11066+
11067+static __always_inline __must_check
11068+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11069 {
11070- int ret = 0;
11071+ unsigned ret = 0;
11072
11073 might_fault();
11074- if (!__builtin_constant_p(size))
11075+
11076+ pax_track_stack();
11077+
11078+ if ((int)size < 0)
11079+ return size;
11080+
11081+#ifdef CONFIG_PAX_MEMORY_UDEREF
11082+ if (!__access_ok(VERIFY_READ, src, size))
11083+ return size;
11084+ if (!__access_ok(VERIFY_WRITE, dst, size))
11085+ return size;
11086+#endif
11087+
11088+ if (!__builtin_constant_p(size)) {
11089+
11090+#ifdef CONFIG_PAX_MEMORY_UDEREF
11091+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11092+ src += PAX_USER_SHADOW_BASE;
11093+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11094+ dst += PAX_USER_SHADOW_BASE;
11095+#endif
11096+
11097 return copy_user_generic((__force void *)dst,
11098- (__force void *)src, size);
11099+ (__force const void *)src, size);
11100+ }
11101 switch (size) {
11102 case 1: {
11103 u8 tmp;
11104- __get_user_asm(tmp, (u8 __user *)src,
11105+ __get_user_asm(tmp, (const u8 __user *)src,
11106 ret, "b", "b", "=q", 1);
11107 if (likely(!ret))
11108 __put_user_asm(tmp, (u8 __user *)dst,
11109@@ -134,7 +227,7 @@ int __copy_in_user(void __user *dst, con
11110 }
11111 case 2: {
11112 u16 tmp;
11113- __get_user_asm(tmp, (u16 __user *)src,
11114+ __get_user_asm(tmp, (const u16 __user *)src,
11115 ret, "w", "w", "=r", 2);
11116 if (likely(!ret))
11117 __put_user_asm(tmp, (u16 __user *)dst,
11118@@ -144,7 +237,7 @@ int __copy_in_user(void __user *dst, con
11119
11120 case 4: {
11121 u32 tmp;
11122- __get_user_asm(tmp, (u32 __user *)src,
11123+ __get_user_asm(tmp, (const u32 __user *)src,
11124 ret, "l", "k", "=r", 4);
11125 if (likely(!ret))
11126 __put_user_asm(tmp, (u32 __user *)dst,
11127@@ -153,7 +246,7 @@ int __copy_in_user(void __user *dst, con
11128 }
11129 case 8: {
11130 u64 tmp;
11131- __get_user_asm(tmp, (u64 __user *)src,
11132+ __get_user_asm(tmp, (const u64 __user *)src,
11133 ret, "q", "", "=r", 8);
11134 if (likely(!ret))
11135 __put_user_asm(tmp, (u64 __user *)dst,
11136@@ -161,8 +254,16 @@ int __copy_in_user(void __user *dst, con
11137 return ret;
11138 }
11139 default:
11140+
11141+#ifdef CONFIG_PAX_MEMORY_UDEREF
11142+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11143+ src += PAX_USER_SHADOW_BASE;
11144+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11145+ dst += PAX_USER_SHADOW_BASE;
11146+#endif
11147+
11148 return copy_user_generic((__force void *)dst,
11149- (__force void *)src, size);
11150+ (__force const void *)src, size);
11151 }
11152 }
11153
11154@@ -176,33 +277,75 @@ __must_check long strlen_user(const char
11155 __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11156 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11157
11158-__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
11159- unsigned size);
11160+static __must_check __always_inline unsigned long
11161+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11162+{
11163+ pax_track_stack();
11164+
11165+ if ((int)size < 0)
11166+ return size;
11167
11168-static __must_check __always_inline int
11169+#ifdef CONFIG_PAX_MEMORY_UDEREF
11170+ if (!__access_ok(VERIFY_READ, src, size))
11171+ return size;
11172+
11173+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11174+ src += PAX_USER_SHADOW_BASE;
11175+#endif
11176+
11177+ return copy_user_generic(dst, (__force const void *)src, size);
11178+}
11179+
11180+static __must_check __always_inline unsigned long
11181 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11182 {
11183+ if ((int)size < 0)
11184+ return size;
11185+
11186+#ifdef CONFIG_PAX_MEMORY_UDEREF
11187+ if (!__access_ok(VERIFY_WRITE, dst, size))
11188+ return size;
11189+
11190+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11191+ dst += PAX_USER_SHADOW_BASE;
11192+#endif
11193+
11194 return copy_user_generic((__force void *)dst, src, size);
11195 }
11196
11197-extern long __copy_user_nocache(void *dst, const void __user *src,
11198+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11199 unsigned size, int zerorest);
11200
11201-static inline int
11202-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11203+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11204 {
11205 might_sleep();
11206+
11207+ if ((int)size < 0)
11208+ return size;
11209+
11210+#ifdef CONFIG_PAX_MEMORY_UDEREF
11211+ if (!__access_ok(VERIFY_READ, src, size))
11212+ return size;
11213+#endif
11214+
11215 return __copy_user_nocache(dst, src, size, 1);
11216 }
11217
11218-static inline int
11219-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11220+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11221 unsigned size)
11222 {
11223+ if ((int)size < 0)
11224+ return size;
11225+
11226+#ifdef CONFIG_PAX_MEMORY_UDEREF
11227+ if (!__access_ok(VERIFY_READ, src, size))
11228+ return size;
11229+#endif
11230+
11231 return __copy_user_nocache(dst, src, size, 0);
11232 }
11233
11234-unsigned long
11235+extern unsigned long
11236 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11237
11238 #endif /* _ASM_X86_UACCESS_64_H */
11239diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess.h linux-2.6.32.46/arch/x86/include/asm/uaccess.h
11240--- linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400
11241+++ linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-06-25 12:56:37.000000000 -0400
11242@@ -8,12 +8,15 @@
11243 #include <linux/thread_info.h>
11244 #include <linux/prefetch.h>
11245 #include <linux/string.h>
11246+#include <linux/sched.h>
11247 #include <asm/asm.h>
11248 #include <asm/page.h>
11249
11250 #define VERIFY_READ 0
11251 #define VERIFY_WRITE 1
11252
11253+extern void check_object_size(const void *ptr, unsigned long n, bool to);
11254+
11255 /*
11256 * The fs value determines whether argument validity checking should be
11257 * performed or not. If get_fs() == USER_DS, checking is performed, with
11258@@ -29,7 +32,12 @@
11259
11260 #define get_ds() (KERNEL_DS)
11261 #define get_fs() (current_thread_info()->addr_limit)
11262+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11263+void __set_fs(mm_segment_t x);
11264+void set_fs(mm_segment_t x);
11265+#else
11266 #define set_fs(x) (current_thread_info()->addr_limit = (x))
11267+#endif
11268
11269 #define segment_eq(a, b) ((a).seg == (b).seg)
11270
11271@@ -77,7 +85,33 @@
11272 * checks that the pointer is in the user space range - after calling
11273 * this function, memory access functions may still return -EFAULT.
11274 */
11275-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11276+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11277+#define access_ok(type, addr, size) \
11278+({ \
11279+ long __size = size; \
11280+ unsigned long __addr = (unsigned long)addr; \
11281+ unsigned long __addr_ao = __addr & PAGE_MASK; \
11282+ unsigned long __end_ao = __addr + __size - 1; \
11283+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
11284+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
11285+ while(__addr_ao <= __end_ao) { \
11286+ char __c_ao; \
11287+ __addr_ao += PAGE_SIZE; \
11288+ if (__size > PAGE_SIZE) \
11289+ cond_resched(); \
11290+ if (__get_user(__c_ao, (char __user *)__addr)) \
11291+ break; \
11292+ if (type != VERIFY_WRITE) { \
11293+ __addr = __addr_ao; \
11294+ continue; \
11295+ } \
11296+ if (__put_user(__c_ao, (char __user *)__addr)) \
11297+ break; \
11298+ __addr = __addr_ao; \
11299+ } \
11300+ } \
11301+ __ret_ao; \
11302+})
11303
11304 /*
11305 * The exception table consists of pairs of addresses: the first is the
11306@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
11307 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
11308 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
11309
11310-
11311+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11312+#define __copyuser_seg "gs;"
11313+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
11314+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
11315+#else
11316+#define __copyuser_seg
11317+#define __COPYUSER_SET_ES
11318+#define __COPYUSER_RESTORE_ES
11319+#endif
11320
11321 #ifdef CONFIG_X86_32
11322 #define __put_user_asm_u64(x, addr, err, errret) \
11323- asm volatile("1: movl %%eax,0(%2)\n" \
11324- "2: movl %%edx,4(%2)\n" \
11325+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
11326+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
11327 "3:\n" \
11328 ".section .fixup,\"ax\"\n" \
11329 "4: movl %3,%0\n" \
11330@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
11331 : "A" (x), "r" (addr), "i" (errret), "0" (err))
11332
11333 #define __put_user_asm_ex_u64(x, addr) \
11334- asm volatile("1: movl %%eax,0(%1)\n" \
11335- "2: movl %%edx,4(%1)\n" \
11336+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
11337+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
11338 "3:\n" \
11339 _ASM_EXTABLE(1b, 2b - 1b) \
11340 _ASM_EXTABLE(2b, 3b - 2b) \
11341@@ -374,7 +416,7 @@ do { \
11342 } while (0)
11343
11344 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11345- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
11346+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
11347 "2:\n" \
11348 ".section .fixup,\"ax\"\n" \
11349 "3: mov %3,%0\n" \
11350@@ -382,7 +424,7 @@ do { \
11351 " jmp 2b\n" \
11352 ".previous\n" \
11353 _ASM_EXTABLE(1b, 3b) \
11354- : "=r" (err), ltype(x) \
11355+ : "=r" (err), ltype (x) \
11356 : "m" (__m(addr)), "i" (errret), "0" (err))
11357
11358 #define __get_user_size_ex(x, ptr, size) \
11359@@ -407,7 +449,7 @@ do { \
11360 } while (0)
11361
11362 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
11363- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
11364+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
11365 "2:\n" \
11366 _ASM_EXTABLE(1b, 2b - 1b) \
11367 : ltype(x) : "m" (__m(addr)))
11368@@ -424,13 +466,24 @@ do { \
11369 int __gu_err; \
11370 unsigned long __gu_val; \
11371 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
11372- (x) = (__force __typeof__(*(ptr)))__gu_val; \
11373+ (x) = (__typeof__(*(ptr)))__gu_val; \
11374 __gu_err; \
11375 })
11376
11377 /* FIXME: this hack is definitely wrong -AK */
11378 struct __large_struct { unsigned long buf[100]; };
11379-#define __m(x) (*(struct __large_struct __user *)(x))
11380+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11381+#define ____m(x) \
11382+({ \
11383+ unsigned long ____x = (unsigned long)(x); \
11384+ if (____x < PAX_USER_SHADOW_BASE) \
11385+ ____x += PAX_USER_SHADOW_BASE; \
11386+ (void __user *)____x; \
11387+})
11388+#else
11389+#define ____m(x) (x)
11390+#endif
11391+#define __m(x) (*(struct __large_struct __user *)____m(x))
11392
11393 /*
11394 * Tell gcc we read from memory instead of writing: this is because
11395@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
11396 * aliasing issues.
11397 */
11398 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11399- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
11400+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
11401 "2:\n" \
11402 ".section .fixup,\"ax\"\n" \
11403 "3: mov %3,%0\n" \
11404@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
11405 ".previous\n" \
11406 _ASM_EXTABLE(1b, 3b) \
11407 : "=r"(err) \
11408- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
11409+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
11410
11411 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
11412- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
11413+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
11414 "2:\n" \
11415 _ASM_EXTABLE(1b, 2b - 1b) \
11416 : : ltype(x), "m" (__m(addr)))
11417@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
11418 * On error, the variable @x is set to zero.
11419 */
11420
11421+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11422+#define __get_user(x, ptr) get_user((x), (ptr))
11423+#else
11424 #define __get_user(x, ptr) \
11425 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
11426+#endif
11427
11428 /**
11429 * __put_user: - Write a simple value into user space, with less checking.
11430@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
11431 * Returns zero on success, or -EFAULT on error.
11432 */
11433
11434+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11435+#define __put_user(x, ptr) put_user((x), (ptr))
11436+#else
11437 #define __put_user(x, ptr) \
11438 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
11439+#endif
11440
11441 #define __get_user_unaligned __get_user
11442 #define __put_user_unaligned __put_user
11443@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
11444 #define get_user_ex(x, ptr) do { \
11445 unsigned long __gue_val; \
11446 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
11447- (x) = (__force __typeof__(*(ptr)))__gue_val; \
11448+ (x) = (__typeof__(*(ptr)))__gue_val; \
11449 } while (0)
11450
11451 #ifdef CONFIG_X86_WP_WORKS_OK
11452@@ -567,6 +628,7 @@ extern struct movsl_mask {
11453
11454 #define ARCH_HAS_NOCACHE_UACCESS 1
11455
11456+#define ARCH_HAS_SORT_EXTABLE
11457 #ifdef CONFIG_X86_32
11458 # include "uaccess_32.h"
11459 #else
11460diff -urNp linux-2.6.32.46/arch/x86/include/asm/vgtod.h linux-2.6.32.46/arch/x86/include/asm/vgtod.h
11461--- linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400
11462+++ linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400
11463@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
11464 int sysctl_enabled;
11465 struct timezone sys_tz;
11466 struct { /* extract of a clocksource struct */
11467+ char name[8];
11468 cycle_t (*vread)(void);
11469 cycle_t cycle_last;
11470 cycle_t mask;
11471diff -urNp linux-2.6.32.46/arch/x86/include/asm/vmi.h linux-2.6.32.46/arch/x86/include/asm/vmi.h
11472--- linux-2.6.32.46/arch/x86/include/asm/vmi.h 2011-03-27 14:31:47.000000000 -0400
11473+++ linux-2.6.32.46/arch/x86/include/asm/vmi.h 2011-04-17 15:56:46.000000000 -0400
11474@@ -191,6 +191,7 @@ struct vrom_header {
11475 u8 reserved[96]; /* Reserved for headers */
11476 char vmi_init[8]; /* VMI_Init jump point */
11477 char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
11478+ char rom_data[8048]; /* rest of the option ROM */
11479 } __attribute__((packed));
11480
11481 struct pnp_header {
11482diff -urNp linux-2.6.32.46/arch/x86/include/asm/vmi_time.h linux-2.6.32.46/arch/x86/include/asm/vmi_time.h
11483--- linux-2.6.32.46/arch/x86/include/asm/vmi_time.h 2011-03-27 14:31:47.000000000 -0400
11484+++ linux-2.6.32.46/arch/x86/include/asm/vmi_time.h 2011-08-05 20:33:55.000000000 -0400
11485@@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
11486 int (*wallclock_updated)(void);
11487 void (*set_alarm)(u32 flags, u64 expiry, u64 period);
11488 void (*cancel_alarm)(u32 flags);
11489-} vmi_timer_ops;
11490+} __no_const vmi_timer_ops;
11491
11492 /* Prototypes */
11493 extern void __init vmi_time_init(void);
11494diff -urNp linux-2.6.32.46/arch/x86/include/asm/vsyscall.h linux-2.6.32.46/arch/x86/include/asm/vsyscall.h
11495--- linux-2.6.32.46/arch/x86/include/asm/vsyscall.h 2011-03-27 14:31:47.000000000 -0400
11496+++ linux-2.6.32.46/arch/x86/include/asm/vsyscall.h 2011-04-17 15:56:46.000000000 -0400
11497@@ -15,9 +15,10 @@ enum vsyscall_num {
11498
11499 #ifdef __KERNEL__
11500 #include <linux/seqlock.h>
11501+#include <linux/getcpu.h>
11502+#include <linux/time.h>
11503
11504 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
11505-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
11506
11507 /* Definitions for CONFIG_GENERIC_TIME definitions */
11508 #define __section_vsyscall_gtod_data __attribute__ \
11509@@ -31,7 +32,6 @@ enum vsyscall_num {
11510 #define VGETCPU_LSL 2
11511
11512 extern int __vgetcpu_mode;
11513-extern volatile unsigned long __jiffies;
11514
11515 /* kernel space (writeable) */
11516 extern int vgetcpu_mode;
11517@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
11518
11519 extern void map_vsyscall(void);
11520
11521+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
11522+extern time_t vtime(time_t *t);
11523+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
11524 #endif /* __KERNEL__ */
11525
11526 #endif /* _ASM_X86_VSYSCALL_H */
11527diff -urNp linux-2.6.32.46/arch/x86/include/asm/x86_init.h linux-2.6.32.46/arch/x86/include/asm/x86_init.h
11528--- linux-2.6.32.46/arch/x86/include/asm/x86_init.h 2011-03-27 14:31:47.000000000 -0400
11529+++ linux-2.6.32.46/arch/x86/include/asm/x86_init.h 2011-08-05 20:33:55.000000000 -0400
11530@@ -28,7 +28,7 @@ struct x86_init_mpparse {
11531 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11532 void (*find_smp_config)(unsigned int reserve);
11533 void (*get_smp_config)(unsigned int early);
11534-};
11535+} __no_const;
11536
11537 /**
11538 * struct x86_init_resources - platform specific resource related ops
11539@@ -42,7 +42,7 @@ struct x86_init_resources {
11540 void (*probe_roms)(void);
11541 void (*reserve_resources)(void);
11542 char *(*memory_setup)(void);
11543-};
11544+} __no_const;
11545
11546 /**
11547 * struct x86_init_irqs - platform specific interrupt setup
11548@@ -55,7 +55,7 @@ struct x86_init_irqs {
11549 void (*pre_vector_init)(void);
11550 void (*intr_init)(void);
11551 void (*trap_init)(void);
11552-};
11553+} __no_const;
11554
11555 /**
11556 * struct x86_init_oem - oem platform specific customizing functions
11557@@ -65,7 +65,7 @@ struct x86_init_irqs {
11558 struct x86_init_oem {
11559 void (*arch_setup)(void);
11560 void (*banner)(void);
11561-};
11562+} __no_const;
11563
11564 /**
11565 * struct x86_init_paging - platform specific paging functions
11566@@ -75,7 +75,7 @@ struct x86_init_oem {
11567 struct x86_init_paging {
11568 void (*pagetable_setup_start)(pgd_t *base);
11569 void (*pagetable_setup_done)(pgd_t *base);
11570-};
11571+} __no_const;
11572
11573 /**
11574 * struct x86_init_timers - platform specific timer setup
11575@@ -88,7 +88,7 @@ struct x86_init_timers {
11576 void (*setup_percpu_clockev)(void);
11577 void (*tsc_pre_init)(void);
11578 void (*timer_init)(void);
11579-};
11580+} __no_const;
11581
11582 /**
11583 * struct x86_init_ops - functions for platform specific setup
11584@@ -101,7 +101,7 @@ struct x86_init_ops {
11585 struct x86_init_oem oem;
11586 struct x86_init_paging paging;
11587 struct x86_init_timers timers;
11588-};
11589+} __no_const;
11590
11591 /**
11592 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11593@@ -109,7 +109,7 @@ struct x86_init_ops {
11594 */
11595 struct x86_cpuinit_ops {
11596 void (*setup_percpu_clockev)(void);
11597-};
11598+} __no_const;
11599
11600 /**
11601 * struct x86_platform_ops - platform specific runtime functions
11602@@ -121,7 +121,7 @@ struct x86_platform_ops {
11603 unsigned long (*calibrate_tsc)(void);
11604 unsigned long (*get_wallclock)(void);
11605 int (*set_wallclock)(unsigned long nowtime);
11606-};
11607+} __no_const;
11608
11609 extern struct x86_init_ops x86_init;
11610 extern struct x86_cpuinit_ops x86_cpuinit;
11611diff -urNp linux-2.6.32.46/arch/x86/include/asm/xsave.h linux-2.6.32.46/arch/x86/include/asm/xsave.h
11612--- linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400
11613+++ linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-04-17 15:56:46.000000000 -0400
11614@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
11615 static inline int xsave_user(struct xsave_struct __user *buf)
11616 {
11617 int err;
11618+
11619+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11620+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11621+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11622+#endif
11623+
11624 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
11625 "2:\n"
11626 ".section .fixup,\"ax\"\n"
11627@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
11628 u32 lmask = mask;
11629 u32 hmask = mask >> 32;
11630
11631+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11632+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11633+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11634+#endif
11635+
11636 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11637 "2:\n"
11638 ".section .fixup,\"ax\"\n"
11639diff -urNp linux-2.6.32.46/arch/x86/Kconfig linux-2.6.32.46/arch/x86/Kconfig
11640--- linux-2.6.32.46/arch/x86/Kconfig 2011-03-27 14:31:47.000000000 -0400
11641+++ linux-2.6.32.46/arch/x86/Kconfig 2011-04-17 15:56:46.000000000 -0400
11642@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
11643
11644 config X86_32_LAZY_GS
11645 def_bool y
11646- depends on X86_32 && !CC_STACKPROTECTOR
11647+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
11648
11649 config KTIME_SCALAR
11650 def_bool X86_32
11651@@ -1008,7 +1008,7 @@ choice
11652
11653 config NOHIGHMEM
11654 bool "off"
11655- depends on !X86_NUMAQ
11656+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11657 ---help---
11658 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
11659 However, the address space of 32-bit x86 processors is only 4
11660@@ -1045,7 +1045,7 @@ config NOHIGHMEM
11661
11662 config HIGHMEM4G
11663 bool "4GB"
11664- depends on !X86_NUMAQ
11665+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11666 ---help---
11667 Select this if you have a 32-bit processor and between 1 and 4
11668 gigabytes of physical RAM.
11669@@ -1099,7 +1099,7 @@ config PAGE_OFFSET
11670 hex
11671 default 0xB0000000 if VMSPLIT_3G_OPT
11672 default 0x80000000 if VMSPLIT_2G
11673- default 0x78000000 if VMSPLIT_2G_OPT
11674+ default 0x70000000 if VMSPLIT_2G_OPT
11675 default 0x40000000 if VMSPLIT_1G
11676 default 0xC0000000
11677 depends on X86_32
11678@@ -1430,7 +1430,7 @@ config ARCH_USES_PG_UNCACHED
11679
11680 config EFI
11681 bool "EFI runtime service support"
11682- depends on ACPI
11683+ depends on ACPI && !PAX_KERNEXEC
11684 ---help---
11685 This enables the kernel to use EFI runtime services that are
11686 available (such as the EFI variable services).
11687@@ -1460,6 +1460,7 @@ config SECCOMP
11688
11689 config CC_STACKPROTECTOR
11690 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
11691+ depends on X86_64 || !PAX_MEMORY_UDEREF
11692 ---help---
11693 This option turns on the -fstack-protector GCC feature. This
11694 feature puts, at the beginning of functions, a canary value on
11695@@ -1517,6 +1518,7 @@ config KEXEC_JUMP
11696 config PHYSICAL_START
11697 hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
11698 default "0x1000000"
11699+ range 0x400000 0x40000000
11700 ---help---
11701 This gives the physical address where the kernel is loaded.
11702
11703@@ -1581,6 +1583,7 @@ config PHYSICAL_ALIGN
11704 hex
11705 prompt "Alignment value to which kernel should be aligned" if X86_32
11706 default "0x1000000"
11707+ range 0x400000 0x1000000 if PAX_KERNEXEC
11708 range 0x2000 0x1000000
11709 ---help---
11710 This value puts the alignment restrictions on physical address
11711@@ -1612,9 +1615,10 @@ config HOTPLUG_CPU
11712 Say N if you want to disable CPU hotplug.
11713
11714 config COMPAT_VDSO
11715- def_bool y
11716+ def_bool n
11717 prompt "Compat VDSO support"
11718 depends on X86_32 || IA32_EMULATION
11719+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
11720 ---help---
11721 Map the 32-bit VDSO to the predictable old-style address too.
11722 ---help---
11723diff -urNp linux-2.6.32.46/arch/x86/Kconfig.cpu linux-2.6.32.46/arch/x86/Kconfig.cpu
11724--- linux-2.6.32.46/arch/x86/Kconfig.cpu 2011-03-27 14:31:47.000000000 -0400
11725+++ linux-2.6.32.46/arch/x86/Kconfig.cpu 2011-04-17 15:56:46.000000000 -0400
11726@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
11727
11728 config X86_F00F_BUG
11729 def_bool y
11730- depends on M586MMX || M586TSC || M586 || M486 || M386
11731+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
11732
11733 config X86_WP_WORKS_OK
11734 def_bool y
11735@@ -360,7 +360,7 @@ config X86_POPAD_OK
11736
11737 config X86_ALIGNMENT_16
11738 def_bool y
11739- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
11740+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
11741
11742 config X86_INTEL_USERCOPY
11743 def_bool y
11744@@ -406,7 +406,7 @@ config X86_CMPXCHG64
11745 # generates cmov.
11746 config X86_CMOV
11747 def_bool y
11748- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
11749+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
11750
11751 config X86_MINIMUM_CPU_FAMILY
11752 int
11753diff -urNp linux-2.6.32.46/arch/x86/Kconfig.debug linux-2.6.32.46/arch/x86/Kconfig.debug
11754--- linux-2.6.32.46/arch/x86/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
11755+++ linux-2.6.32.46/arch/x86/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
11756@@ -99,7 +99,7 @@ config X86_PTDUMP
11757 config DEBUG_RODATA
11758 bool "Write protect kernel read-only data structures"
11759 default y
11760- depends on DEBUG_KERNEL
11761+ depends on DEBUG_KERNEL && BROKEN
11762 ---help---
11763 Mark the kernel read-only data as write-protected in the pagetables,
11764 in order to catch accidental (and incorrect) writes to such const
11765diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile
11766--- linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile 2011-03-27 14:31:47.000000000 -0400
11767+++ linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile 2011-08-07 14:38:58.000000000 -0400
11768@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
11769 $(call cc-option, -fno-stack-protector) \
11770 $(call cc-option, -mpreferred-stack-boundary=2)
11771 KBUILD_CFLAGS += $(call cc-option, -m32)
11772+ifdef CONSTIFY_PLUGIN
11773+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
11774+endif
11775 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
11776 GCOV_PROFILE := n
11777
11778diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S
11779--- linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S 2011-03-27 14:31:47.000000000 -0400
11780+++ linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:53:40.000000000 -0400
11781@@ -91,6 +91,9 @@ _start:
11782 /* Do any other stuff... */
11783
11784 #ifndef CONFIG_64BIT
11785+ /* Recheck NX bit overrides (64bit path does this in trampoline) */
11786+ call verify_cpu
11787+
11788 /* This could also be done in C code... */
11789 movl pmode_cr3, %eax
11790 movl %eax, %cr3
11791@@ -104,7 +107,7 @@ _start:
11792 movl %eax, %ecx
11793 orl %edx, %ecx
11794 jz 1f
11795- movl $0xc0000080, %ecx
11796+ mov $MSR_EFER, %ecx
11797 wrmsr
11798 1:
11799
11800@@ -114,6 +117,7 @@ _start:
11801 movl pmode_cr0, %eax
11802 movl %eax, %cr0
11803 jmp pmode_return
11804+# include "../../verify_cpu.S"
11805 #else
11806 pushw $0
11807 pushw trampoline_segment
11808diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c
11809--- linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
11810+++ linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c 2011-07-01 19:01:34.000000000 -0400
11811@@ -11,11 +11,12 @@
11812 #include <linux/cpumask.h>
11813 #include <asm/segment.h>
11814 #include <asm/desc.h>
11815+#include <asm/e820.h>
11816
11817 #include "realmode/wakeup.h"
11818 #include "sleep.h"
11819
11820-unsigned long acpi_wakeup_address;
11821+unsigned long acpi_wakeup_address = 0x2000;
11822 unsigned long acpi_realmode_flags;
11823
11824 /* address in low memory of the wakeup routine. */
11825@@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
11826 #else /* CONFIG_64BIT */
11827 header->trampoline_segment = setup_trampoline() >> 4;
11828 #ifdef CONFIG_SMP
11829- stack_start.sp = temp_stack + sizeof(temp_stack);
11830+ stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
11831+
11832+ pax_open_kernel();
11833 early_gdt_descr.address =
11834 (unsigned long)get_cpu_gdt_table(smp_processor_id());
11835+ pax_close_kernel();
11836+
11837 initial_gs = per_cpu_offset(smp_processor_id());
11838 #endif
11839 initial_code = (unsigned long)wakeup_long64;
11840@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
11841 return;
11842 }
11843
11844- acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
11845-
11846- if (!acpi_realmode) {
11847- printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
11848- return;
11849- }
11850-
11851- acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
11852+ reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
11853+ acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
11854 }
11855
11856
11857diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S
11858--- linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S 2011-03-27 14:31:47.000000000 -0400
11859+++ linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S 2011-04-17 15:56:46.000000000 -0400
11860@@ -30,13 +30,11 @@ wakeup_pmode_return:
11861 # and restore the stack ... but you need gdt for this to work
11862 movl saved_context_esp, %esp
11863
11864- movl %cs:saved_magic, %eax
11865- cmpl $0x12345678, %eax
11866+ cmpl $0x12345678, saved_magic
11867 jne bogus_magic
11868
11869 # jump to place where we left off
11870- movl saved_eip, %eax
11871- jmp *%eax
11872+ jmp *(saved_eip)
11873
11874 bogus_magic:
11875 jmp bogus_magic
11876diff -urNp linux-2.6.32.46/arch/x86/kernel/alternative.c linux-2.6.32.46/arch/x86/kernel/alternative.c
11877--- linux-2.6.32.46/arch/x86/kernel/alternative.c 2011-03-27 14:31:47.000000000 -0400
11878+++ linux-2.6.32.46/arch/x86/kernel/alternative.c 2011-04-17 15:56:46.000000000 -0400
11879@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
11880
11881 BUG_ON(p->len > MAX_PATCH_LEN);
11882 /* prep the buffer with the original instructions */
11883- memcpy(insnbuf, p->instr, p->len);
11884+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
11885 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
11886 (unsigned long)p->instr, p->len);
11887
11888@@ -475,7 +475,7 @@ void __init alternative_instructions(voi
11889 if (smp_alt_once)
11890 free_init_pages("SMP alternatives",
11891 (unsigned long)__smp_locks,
11892- (unsigned long)__smp_locks_end);
11893+ PAGE_ALIGN((unsigned long)__smp_locks_end));
11894
11895 restart_nmi();
11896 }
11897@@ -492,13 +492,17 @@ void __init alternative_instructions(voi
11898 * instructions. And on the local CPU you need to be protected again NMI or MCE
11899 * handlers seeing an inconsistent instruction while you patch.
11900 */
11901-static void *__init_or_module text_poke_early(void *addr, const void *opcode,
11902+static void *__kprobes text_poke_early(void *addr, const void *opcode,
11903 size_t len)
11904 {
11905 unsigned long flags;
11906 local_irq_save(flags);
11907- memcpy(addr, opcode, len);
11908+
11909+ pax_open_kernel();
11910+ memcpy(ktla_ktva(addr), opcode, len);
11911 sync_core();
11912+ pax_close_kernel();
11913+
11914 local_irq_restore(flags);
11915 /* Could also do a CLFLUSH here to speed up CPU recovery; but
11916 that causes hangs on some VIA CPUs. */
11917@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
11918 */
11919 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
11920 {
11921- unsigned long flags;
11922- char *vaddr;
11923+ unsigned char *vaddr = ktla_ktva(addr);
11924 struct page *pages[2];
11925- int i;
11926+ size_t i;
11927
11928 if (!core_kernel_text((unsigned long)addr)) {
11929- pages[0] = vmalloc_to_page(addr);
11930- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
11931+ pages[0] = vmalloc_to_page(vaddr);
11932+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
11933 } else {
11934- pages[0] = virt_to_page(addr);
11935+ pages[0] = virt_to_page(vaddr);
11936 WARN_ON(!PageReserved(pages[0]));
11937- pages[1] = virt_to_page(addr + PAGE_SIZE);
11938+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
11939 }
11940 BUG_ON(!pages[0]);
11941- local_irq_save(flags);
11942- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
11943- if (pages[1])
11944- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
11945- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
11946- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
11947- clear_fixmap(FIX_TEXT_POKE0);
11948- if (pages[1])
11949- clear_fixmap(FIX_TEXT_POKE1);
11950- local_flush_tlb();
11951- sync_core();
11952- /* Could also do a CLFLUSH here to speed up CPU recovery; but
11953- that causes hangs on some VIA CPUs. */
11954+ text_poke_early(addr, opcode, len);
11955 for (i = 0; i < len; i++)
11956- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
11957- local_irq_restore(flags);
11958+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
11959 return addr;
11960 }
11961diff -urNp linux-2.6.32.46/arch/x86/kernel/amd_iommu.c linux-2.6.32.46/arch/x86/kernel/amd_iommu.c
11962--- linux-2.6.32.46/arch/x86/kernel/amd_iommu.c 2011-03-27 14:31:47.000000000 -0400
11963+++ linux-2.6.32.46/arch/x86/kernel/amd_iommu.c 2011-04-17 15:56:46.000000000 -0400
11964@@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(
11965 }
11966 }
11967
11968-static struct dma_map_ops amd_iommu_dma_ops = {
11969+static const struct dma_map_ops amd_iommu_dma_ops = {
11970 .alloc_coherent = alloc_coherent,
11971 .free_coherent = free_coherent,
11972 .map_page = map_page,
11973diff -urNp linux-2.6.32.46/arch/x86/kernel/apic/apic.c linux-2.6.32.46/arch/x86/kernel/apic/apic.c
11974--- linux-2.6.32.46/arch/x86/kernel/apic/apic.c 2011-03-27 14:31:47.000000000 -0400
11975+++ linux-2.6.32.46/arch/x86/kernel/apic/apic.c 2011-08-17 20:00:16.000000000 -0400
11976@@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
11977 /*
11978 * Debug level, exported for io_apic.c
11979 */
11980-unsigned int apic_verbosity;
11981+int apic_verbosity;
11982
11983 int pic_mode;
11984
11985@@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs
11986 apic_write(APIC_ESR, 0);
11987 v1 = apic_read(APIC_ESR);
11988 ack_APIC_irq();
11989- atomic_inc(&irq_err_count);
11990+ atomic_inc_unchecked(&irq_err_count);
11991
11992 /*
11993 * Here is what the APIC error bits mean:
11994@@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(vo
11995 u16 *bios_cpu_apicid;
11996 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
11997
11998+ pax_track_stack();
11999+
12000 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12001 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12002
12003diff -urNp linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c
12004--- linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c 2011-03-27 14:31:47.000000000 -0400
12005+++ linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c 2011-05-04 17:56:20.000000000 -0400
12006@@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12007 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12008 GFP_ATOMIC);
12009 if (!ioapic_entries)
12010- return 0;
12011+ return NULL;
12012
12013 for (apic = 0; apic < nr_ioapics; apic++) {
12014 ioapic_entries[apic] =
12015@@ -733,7 +733,7 @@ nomem:
12016 kfree(ioapic_entries[apic]);
12017 kfree(ioapic_entries);
12018
12019- return 0;
12020+ return NULL;
12021 }
12022
12023 /*
12024@@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12025 }
12026 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12027
12028-void lock_vector_lock(void)
12029+void lock_vector_lock(void) __acquires(vector_lock)
12030 {
12031 /* Used to the online set of cpus does not change
12032 * during assign_irq_vector.
12033@@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
12034 spin_lock(&vector_lock);
12035 }
12036
12037-void unlock_vector_lock(void)
12038+void unlock_vector_lock(void) __releases(vector_lock)
12039 {
12040 spin_unlock(&vector_lock);
12041 }
12042@@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int i
12043 ack_APIC_irq();
12044 }
12045
12046-atomic_t irq_mis_count;
12047+atomic_unchecked_t irq_mis_count;
12048
12049 static void ack_apic_level(unsigned int irq)
12050 {
12051@@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int
12052
12053 /* Tail end of version 0x11 I/O APIC bug workaround */
12054 if (!(v & (1 << (i & 0x1f)))) {
12055- atomic_inc(&irq_mis_count);
12056+ atomic_inc_unchecked(&irq_mis_count);
12057 spin_lock(&ioapic_lock);
12058 __mask_and_edge_IO_APIC_irq(cfg);
12059 __unmask_and_level_IO_APIC_irq(cfg);
12060diff -urNp linux-2.6.32.46/arch/x86/kernel/apm_32.c linux-2.6.32.46/arch/x86/kernel/apm_32.c
12061--- linux-2.6.32.46/arch/x86/kernel/apm_32.c 2011-03-27 14:31:47.000000000 -0400
12062+++ linux-2.6.32.46/arch/x86/kernel/apm_32.c 2011-04-23 12:56:10.000000000 -0400
12063@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
12064 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12065 * even though they are called in protected mode.
12066 */
12067-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12068+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12069 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12070
12071 static const char driver_version[] = "1.16ac"; /* no spaces */
12072@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
12073 BUG_ON(cpu != 0);
12074 gdt = get_cpu_gdt_table(cpu);
12075 save_desc_40 = gdt[0x40 / 8];
12076+
12077+ pax_open_kernel();
12078 gdt[0x40 / 8] = bad_bios_desc;
12079+ pax_close_kernel();
12080
12081 apm_irq_save(flags);
12082 APM_DO_SAVE_SEGS;
12083@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
12084 &call->esi);
12085 APM_DO_RESTORE_SEGS;
12086 apm_irq_restore(flags);
12087+
12088+ pax_open_kernel();
12089 gdt[0x40 / 8] = save_desc_40;
12090+ pax_close_kernel();
12091+
12092 put_cpu();
12093
12094 return call->eax & 0xff;
12095@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void
12096 BUG_ON(cpu != 0);
12097 gdt = get_cpu_gdt_table(cpu);
12098 save_desc_40 = gdt[0x40 / 8];
12099+
12100+ pax_open_kernel();
12101 gdt[0x40 / 8] = bad_bios_desc;
12102+ pax_close_kernel();
12103
12104 apm_irq_save(flags);
12105 APM_DO_SAVE_SEGS;
12106@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void
12107 &call->eax);
12108 APM_DO_RESTORE_SEGS;
12109 apm_irq_restore(flags);
12110+
12111+ pax_open_kernel();
12112 gdt[0x40 / 8] = save_desc_40;
12113+ pax_close_kernel();
12114+
12115 put_cpu();
12116 return error;
12117 }
12118@@ -975,7 +989,7 @@ recalc:
12119
12120 static void apm_power_off(void)
12121 {
12122- unsigned char po_bios_call[] = {
12123+ const unsigned char po_bios_call[] = {
12124 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
12125 0x8e, 0xd0, /* movw ax,ss */
12126 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
12127@@ -2357,12 +2371,15 @@ static int __init apm_init(void)
12128 * code to that CPU.
12129 */
12130 gdt = get_cpu_gdt_table(0);
12131+
12132+ pax_open_kernel();
12133 set_desc_base(&gdt[APM_CS >> 3],
12134 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12135 set_desc_base(&gdt[APM_CS_16 >> 3],
12136 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12137 set_desc_base(&gdt[APM_DS >> 3],
12138 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12139+ pax_close_kernel();
12140
12141 proc_create("apm", 0, NULL, &apm_file_ops);
12142
12143diff -urNp linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c
12144--- linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c 2011-03-27 14:31:47.000000000 -0400
12145+++ linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c 2011-05-16 21:46:57.000000000 -0400
12146@@ -51,7 +51,6 @@ void foo(void)
12147 OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
12148 BLANK();
12149
12150- OFFSET(TI_task, thread_info, task);
12151 OFFSET(TI_exec_domain, thread_info, exec_domain);
12152 OFFSET(TI_flags, thread_info, flags);
12153 OFFSET(TI_status, thread_info, status);
12154@@ -60,6 +59,8 @@ void foo(void)
12155 OFFSET(TI_restart_block, thread_info, restart_block);
12156 OFFSET(TI_sysenter_return, thread_info, sysenter_return);
12157 OFFSET(TI_cpu, thread_info, cpu);
12158+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12159+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12160 BLANK();
12161
12162 OFFSET(GDS_size, desc_ptr, size);
12163@@ -99,6 +100,7 @@ void foo(void)
12164
12165 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12166 DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
12167+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12168 DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
12169 DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
12170 DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
12171@@ -115,6 +117,11 @@ void foo(void)
12172 OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
12173 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12174 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12175+
12176+#ifdef CONFIG_PAX_KERNEXEC
12177+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12178+#endif
12179+
12180 #endif
12181
12182 #ifdef CONFIG_XEN
12183diff -urNp linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c
12184--- linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c 2011-03-27 14:31:47.000000000 -0400
12185+++ linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c 2011-08-23 20:24:19.000000000 -0400
12186@@ -44,6 +44,8 @@ int main(void)
12187 ENTRY(addr_limit);
12188 ENTRY(preempt_count);
12189 ENTRY(status);
12190+ ENTRY(lowest_stack);
12191+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12192 #ifdef CONFIG_IA32_EMULATION
12193 ENTRY(sysenter_return);
12194 #endif
12195@@ -63,6 +65,18 @@ int main(void)
12196 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12197 OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
12198 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12199+
12200+#ifdef CONFIG_PAX_KERNEXEC
12201+ OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12202+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12203+#endif
12204+
12205+#ifdef CONFIG_PAX_MEMORY_UDEREF
12206+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12207+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12208+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
12209+#endif
12210+
12211 #endif
12212
12213
12214@@ -115,6 +129,7 @@ int main(void)
12215 ENTRY(cr8);
12216 BLANK();
12217 #undef ENTRY
12218+ DEFINE(TSS_size, sizeof(struct tss_struct));
12219 DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
12220 BLANK();
12221 DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
12222@@ -130,6 +145,7 @@ int main(void)
12223
12224 BLANK();
12225 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12226+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12227 #ifdef CONFIG_XEN
12228 BLANK();
12229 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
12230diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/amd.c linux-2.6.32.46/arch/x86/kernel/cpu/amd.c
12231--- linux-2.6.32.46/arch/x86/kernel/cpu/amd.c 2011-06-25 12:55:34.000000000 -0400
12232+++ linux-2.6.32.46/arch/x86/kernel/cpu/amd.c 2011-06-25 12:56:37.000000000 -0400
12233@@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_c
12234 unsigned int size)
12235 {
12236 /* AMD errata T13 (order #21922) */
12237- if ((c->x86 == 6)) {
12238+ if (c->x86 == 6) {
12239 /* Duron Rev A0 */
12240 if (c->x86_model == 3 && c->x86_mask == 0)
12241 size = 64;
12242diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/common.c linux-2.6.32.46/arch/x86/kernel/cpu/common.c
12243--- linux-2.6.32.46/arch/x86/kernel/cpu/common.c 2011-03-27 14:31:47.000000000 -0400
12244+++ linux-2.6.32.46/arch/x86/kernel/cpu/common.c 2011-05-11 18:25:15.000000000 -0400
12245@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
12246
12247 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12248
12249-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12250-#ifdef CONFIG_X86_64
12251- /*
12252- * We need valid kernel segments for data and code in long mode too
12253- * IRET will check the segment types kkeil 2000/10/28
12254- * Also sysret mandates a special GDT layout
12255- *
12256- * TLS descriptors are currently at a different place compared to i386.
12257- * Hopefully nobody expects them at a fixed place (Wine?)
12258- */
12259- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12260- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12261- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12262- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12263- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12264- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
12265-#else
12266- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12267- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12268- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12269- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
12270- /*
12271- * Segments used for calling PnP BIOS have byte granularity.
12272- * They code segments and data segments have fixed 64k limits,
12273- * the transfer segment sizes are set at run time.
12274- */
12275- /* 32-bit code */
12276- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12277- /* 16-bit code */
12278- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12279- /* 16-bit data */
12280- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
12281- /* 16-bit data */
12282- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
12283- /* 16-bit data */
12284- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
12285- /*
12286- * The APM segments have byte granularity and their bases
12287- * are set at run time. All have 64k limits.
12288- */
12289- /* 32-bit code */
12290- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12291- /* 16-bit code */
12292- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12293- /* data */
12294- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
12295-
12296- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12297- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12298- GDT_STACK_CANARY_INIT
12299-#endif
12300-} };
12301-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12302-
12303 static int __init x86_xsave_setup(char *s)
12304 {
12305 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
12306@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
12307 {
12308 struct desc_ptr gdt_descr;
12309
12310- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12311+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12312 gdt_descr.size = GDT_SIZE - 1;
12313 load_gdt(&gdt_descr);
12314 /* Reload the per-cpu base */
12315@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
12316 /* Filter out anything that depends on CPUID levels we don't have */
12317 filter_cpuid_features(c, true);
12318
12319+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
12320+ setup_clear_cpu_cap(X86_FEATURE_SEP);
12321+#endif
12322+
12323 /* If the model name is still unset, do table lookup. */
12324 if (!c->x86_model_id[0]) {
12325 const char *p;
12326@@ -980,6 +930,9 @@ static __init int setup_disablecpuid(cha
12327 }
12328 __setup("clearcpuid=", setup_disablecpuid);
12329
12330+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12331+EXPORT_PER_CPU_SYMBOL(current_tinfo);
12332+
12333 #ifdef CONFIG_X86_64
12334 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12335
12336@@ -995,7 +948,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12337 EXPORT_PER_CPU_SYMBOL(current_task);
12338
12339 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12340- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
12341+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
12342 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12343
12344 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12345@@ -1060,7 +1013,7 @@ struct pt_regs * __cpuinit idle_regs(str
12346 {
12347 memset(regs, 0, sizeof(struct pt_regs));
12348 regs->fs = __KERNEL_PERCPU;
12349- regs->gs = __KERNEL_STACK_CANARY;
12350+ savesegment(gs, regs->gs);
12351
12352 return regs;
12353 }
12354@@ -1101,7 +1054,7 @@ void __cpuinit cpu_init(void)
12355 int i;
12356
12357 cpu = stack_smp_processor_id();
12358- t = &per_cpu(init_tss, cpu);
12359+ t = init_tss + cpu;
12360 orig_ist = &per_cpu(orig_ist, cpu);
12361
12362 #ifdef CONFIG_NUMA
12363@@ -1127,7 +1080,7 @@ void __cpuinit cpu_init(void)
12364 switch_to_new_gdt(cpu);
12365 loadsegment(fs, 0);
12366
12367- load_idt((const struct desc_ptr *)&idt_descr);
12368+ load_idt(&idt_descr);
12369
12370 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
12371 syscall_init();
12372@@ -1136,7 +1089,6 @@ void __cpuinit cpu_init(void)
12373 wrmsrl(MSR_KERNEL_GS_BASE, 0);
12374 barrier();
12375
12376- check_efer();
12377 if (cpu != 0)
12378 enable_x2apic();
12379
12380@@ -1199,7 +1151,7 @@ void __cpuinit cpu_init(void)
12381 {
12382 int cpu = smp_processor_id();
12383 struct task_struct *curr = current;
12384- struct tss_struct *t = &per_cpu(init_tss, cpu);
12385+ struct tss_struct *t = init_tss + cpu;
12386 struct thread_struct *thread = &curr->thread;
12387
12388 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12389diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/intel.c linux-2.6.32.46/arch/x86/kernel/cpu/intel.c
12390--- linux-2.6.32.46/arch/x86/kernel/cpu/intel.c 2011-03-27 14:31:47.000000000 -0400
12391+++ linux-2.6.32.46/arch/x86/kernel/cpu/intel.c 2011-04-17 15:56:46.000000000 -0400
12392@@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug
12393 * Update the IDT descriptor and reload the IDT so that
12394 * it uses the read-only mapped virtual address.
12395 */
12396- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12397+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12398 load_idt(&idt_descr);
12399 }
12400 #endif
12401diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c
12402--- linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
12403+++ linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-04-17 15:56:46.000000000 -0400
12404@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
12405 return ret;
12406 }
12407
12408-static struct sysfs_ops sysfs_ops = {
12409+static const struct sysfs_ops sysfs_ops = {
12410 .show = show,
12411 .store = store,
12412 };
12413diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/Makefile linux-2.6.32.46/arch/x86/kernel/cpu/Makefile
12414--- linux-2.6.32.46/arch/x86/kernel/cpu/Makefile 2011-03-27 14:31:47.000000000 -0400
12415+++ linux-2.6.32.46/arch/x86/kernel/cpu/Makefile 2011-04-17 15:56:46.000000000 -0400
12416@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
12417 CFLAGS_REMOVE_common.o = -pg
12418 endif
12419
12420-# Make sure load_percpu_segment has no stackprotector
12421-nostackp := $(call cc-option, -fno-stack-protector)
12422-CFLAGS_common.o := $(nostackp)
12423-
12424 obj-y := intel_cacheinfo.o addon_cpuid_features.o
12425 obj-y += proc.o capflags.o powerflags.o common.o
12426 obj-y += vmware.o hypervisor.o sched.o
12427diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c
12428--- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:56:59.000000000 -0400
12429+++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:57:13.000000000 -0400
12430@@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kob
12431 return ret;
12432 }
12433
12434-static struct sysfs_ops threshold_ops = {
12435+static const struct sysfs_ops threshold_ops = {
12436 .show = show,
12437 .store = store,
12438 };
12439diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c
12440--- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c 2011-03-27 14:31:47.000000000 -0400
12441+++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-04 17:56:20.000000000 -0400
12442@@ -43,6 +43,7 @@
12443 #include <asm/ipi.h>
12444 #include <asm/mce.h>
12445 #include <asm/msr.h>
12446+#include <asm/local.h>
12447
12448 #include "mce-internal.h"
12449
12450@@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
12451 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12452 m->cs, m->ip);
12453
12454- if (m->cs == __KERNEL_CS)
12455+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12456 print_symbol("{%s}", m->ip);
12457 pr_cont("\n");
12458 }
12459@@ -221,10 +222,10 @@ static void print_mce_tail(void)
12460
12461 #define PANIC_TIMEOUT 5 /* 5 seconds */
12462
12463-static atomic_t mce_paniced;
12464+static atomic_unchecked_t mce_paniced;
12465
12466 static int fake_panic;
12467-static atomic_t mce_fake_paniced;
12468+static atomic_unchecked_t mce_fake_paniced;
12469
12470 /* Panic in progress. Enable interrupts and wait for final IPI */
12471 static void wait_for_panic(void)
12472@@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct
12473 /*
12474 * Make sure only one CPU runs in machine check panic
12475 */
12476- if (atomic_inc_return(&mce_paniced) > 1)
12477+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12478 wait_for_panic();
12479 barrier();
12480
12481@@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct
12482 console_verbose();
12483 } else {
12484 /* Don't log too much for fake panic */
12485- if (atomic_inc_return(&mce_fake_paniced) > 1)
12486+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12487 return;
12488 }
12489 print_mce_head();
12490@@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t)
12491 * might have been modified by someone else.
12492 */
12493 rmb();
12494- if (atomic_read(&mce_paniced))
12495+ if (atomic_read_unchecked(&mce_paniced))
12496 wait_for_panic();
12497 if (!monarch_timeout)
12498 goto out;
12499@@ -1429,14 +1430,14 @@ void __cpuinit mcheck_init(struct cpuinf
12500 */
12501
12502 static DEFINE_SPINLOCK(mce_state_lock);
12503-static int open_count; /* #times opened */
12504+static local_t open_count; /* #times opened */
12505 static int open_exclu; /* already open exclusive? */
12506
12507 static int mce_open(struct inode *inode, struct file *file)
12508 {
12509 spin_lock(&mce_state_lock);
12510
12511- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
12512+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
12513 spin_unlock(&mce_state_lock);
12514
12515 return -EBUSY;
12516@@ -1444,7 +1445,7 @@ static int mce_open(struct inode *inode,
12517
12518 if (file->f_flags & O_EXCL)
12519 open_exclu = 1;
12520- open_count++;
12521+ local_inc(&open_count);
12522
12523 spin_unlock(&mce_state_lock);
12524
12525@@ -1455,7 +1456,7 @@ static int mce_release(struct inode *ino
12526 {
12527 spin_lock(&mce_state_lock);
12528
12529- open_count--;
12530+ local_dec(&open_count);
12531 open_exclu = 0;
12532
12533 spin_unlock(&mce_state_lock);
12534@@ -2082,7 +2083,7 @@ struct dentry *mce_get_debugfs_dir(void)
12535 static void mce_reset(void)
12536 {
12537 cpu_missing = 0;
12538- atomic_set(&mce_fake_paniced, 0);
12539+ atomic_set_unchecked(&mce_fake_paniced, 0);
12540 atomic_set(&mce_executing, 0);
12541 atomic_set(&mce_callin, 0);
12542 atomic_set(&global_nwo, 0);
12543diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c
12544--- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-03-27 14:31:47.000000000 -0400
12545+++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-05 20:33:55.000000000 -0400
12546@@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *fi
12547 static int inject_init(void)
12548 {
12549 printk(KERN_INFO "Machine check injector initialized\n");
12550- mce_chrdev_ops.write = mce_write;
12551+ pax_open_kernel();
12552+ *(void **)&mce_chrdev_ops.write = mce_write;
12553+ pax_close_kernel();
12554 register_die_notifier(&mce_raise_nb);
12555 return 0;
12556 }
12557diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c
12558--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c 2011-03-27 14:31:47.000000000 -0400
12559+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c 2011-04-17 15:56:46.000000000 -0400
12560@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
12561 return 0;
12562 }
12563
12564-static struct mtrr_ops amd_mtrr_ops = {
12565+static const struct mtrr_ops amd_mtrr_ops = {
12566 .vendor = X86_VENDOR_AMD,
12567 .set = amd_set_mtrr,
12568 .get = amd_get_mtrr,
12569diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c
12570--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c 2011-03-27 14:31:47.000000000 -0400
12571+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c 2011-04-17 15:56:46.000000000 -0400
12572@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
12573 return 0;
12574 }
12575
12576-static struct mtrr_ops centaur_mtrr_ops = {
12577+static const struct mtrr_ops centaur_mtrr_ops = {
12578 .vendor = X86_VENDOR_CENTAUR,
12579 .set = centaur_set_mcr,
12580 .get = centaur_get_mcr,
12581diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c
12582--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-03-27 14:31:47.000000000 -0400
12583+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-04-17 15:56:46.000000000 -0400
12584@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
12585 post_set();
12586 }
12587
12588-static struct mtrr_ops cyrix_mtrr_ops = {
12589+static const struct mtrr_ops cyrix_mtrr_ops = {
12590 .vendor = X86_VENDOR_CYRIX,
12591 .set_all = cyrix_set_all,
12592 .set = cyrix_set_arr,
12593diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c
12594--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c 2011-03-27 14:31:47.000000000 -0400
12595+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c 2011-04-23 12:56:10.000000000 -0400
12596@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
12597 /*
12598 * Generic structure...
12599 */
12600-struct mtrr_ops generic_mtrr_ops = {
12601+const struct mtrr_ops generic_mtrr_ops = {
12602 .use_intel_if = 1,
12603 .set_all = generic_set_all,
12604 .get = generic_get_mtrr,
12605diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c
12606--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:00:52.000000000 -0400
12607+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:03:05.000000000 -0400
12608@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
12609 u64 size_or_mask, size_and_mask;
12610 static bool mtrr_aps_delayed_init;
12611
12612-static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12613+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12614
12615-struct mtrr_ops *mtrr_if;
12616+const struct mtrr_ops *mtrr_if;
12617
12618 static void set_mtrr(unsigned int reg, unsigned long base,
12619 unsigned long size, mtrr_type type);
12620
12621-void set_mtrr_ops(struct mtrr_ops *ops)
12622+void set_mtrr_ops(const struct mtrr_ops *ops)
12623 {
12624 if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
12625 mtrr_ops[ops->vendor] = ops;
12626diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h
12627--- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-03-27 14:31:47.000000000 -0400
12628+++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-08-26 20:23:57.000000000 -0400
12629@@ -25,14 +25,14 @@ struct mtrr_ops {
12630 int (*validate_add_page)(unsigned long base, unsigned long size,
12631 unsigned int type);
12632 int (*have_wrcomb)(void);
12633-};
12634+} __do_const;
12635
12636 extern int generic_get_free_region(unsigned long base, unsigned long size,
12637 int replace_reg);
12638 extern int generic_validate_add_page(unsigned long base, unsigned long size,
12639 unsigned int type);
12640
12641-extern struct mtrr_ops generic_mtrr_ops;
12642+extern const struct mtrr_ops generic_mtrr_ops;
12643
12644 extern int positive_have_wrcomb(void);
12645
12646@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
12647 u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
12648 void get_mtrr_state(void);
12649
12650-extern void set_mtrr_ops(struct mtrr_ops *ops);
12651+extern void set_mtrr_ops(const struct mtrr_ops *ops);
12652
12653 extern u64 size_or_mask, size_and_mask;
12654-extern struct mtrr_ops *mtrr_if;
12655+extern const struct mtrr_ops *mtrr_if;
12656
12657 #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
12658 #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
12659diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c
12660--- linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-03-27 14:31:47.000000000 -0400
12661+++ linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-04-17 15:56:46.000000000 -0400
12662@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
12663
12664 /* Interface defining a CPU specific perfctr watchdog */
12665 struct wd_ops {
12666- int (*reserve)(void);
12667- void (*unreserve)(void);
12668- int (*setup)(unsigned nmi_hz);
12669- void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12670- void (*stop)(void);
12671+ int (* const reserve)(void);
12672+ void (* const unreserve)(void);
12673+ int (* const setup)(unsigned nmi_hz);
12674+ void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12675+ void (* const stop)(void);
12676 unsigned perfctr;
12677 unsigned evntsel;
12678 u64 checkbit;
12679@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
12680 #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
12681 #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
12682
12683+/* cannot be const */
12684 static struct wd_ops intel_arch_wd_ops;
12685
12686 static int setup_intel_arch_watchdog(unsigned nmi_hz)
12687@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
12688 return 1;
12689 }
12690
12691+/* cannot be const */
12692 static struct wd_ops intel_arch_wd_ops __read_mostly = {
12693 .reserve = single_msr_reserve,
12694 .unreserve = single_msr_unreserve,
12695diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c
12696--- linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c 2011-03-27 14:31:47.000000000 -0400
12697+++ linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c 2011-05-04 17:56:20.000000000 -0400
12698@@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event
12699 * count to the generic event atomically:
12700 */
12701 again:
12702- prev_raw_count = atomic64_read(&hwc->prev_count);
12703+ prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
12704 rdmsrl(hwc->event_base + idx, new_raw_count);
12705
12706- if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
12707+ if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
12708 new_raw_count) != prev_raw_count)
12709 goto again;
12710
12711@@ -741,7 +741,7 @@ again:
12712 delta = (new_raw_count << shift) - (prev_raw_count << shift);
12713 delta >>= shift;
12714
12715- atomic64_add(delta, &event->count);
12716+ atomic64_add_unchecked(delta, &event->count);
12717 atomic64_sub(delta, &hwc->period_left);
12718
12719 return new_raw_count;
12720@@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_ev
12721 * The hw event starts counting from this event offset,
12722 * mark it to be able to extra future deltas:
12723 */
12724- atomic64_set(&hwc->prev_count, (u64)-left);
12725+ atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
12726
12727 err = checking_wrmsrl(hwc->event_base + idx,
12728 (u64)(-left) & x86_pmu.event_mask);
12729@@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs
12730 break;
12731
12732 callchain_store(entry, frame.return_address);
12733- fp = frame.next_frame;
12734+ fp = (__force const void __user *)frame.next_frame;
12735 }
12736 }
12737
12738diff -urNp linux-2.6.32.46/arch/x86/kernel/crash.c linux-2.6.32.46/arch/x86/kernel/crash.c
12739--- linux-2.6.32.46/arch/x86/kernel/crash.c 2011-03-27 14:31:47.000000000 -0400
12740+++ linux-2.6.32.46/arch/x86/kernel/crash.c 2011-04-17 15:56:46.000000000 -0400
12741@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
12742 regs = args->regs;
12743
12744 #ifdef CONFIG_X86_32
12745- if (!user_mode_vm(regs)) {
12746+ if (!user_mode(regs)) {
12747 crash_fixup_ss_esp(&fixed_regs, regs);
12748 regs = &fixed_regs;
12749 }
12750diff -urNp linux-2.6.32.46/arch/x86/kernel/doublefault_32.c linux-2.6.32.46/arch/x86/kernel/doublefault_32.c
12751--- linux-2.6.32.46/arch/x86/kernel/doublefault_32.c 2011-03-27 14:31:47.000000000 -0400
12752+++ linux-2.6.32.46/arch/x86/kernel/doublefault_32.c 2011-04-17 15:56:46.000000000 -0400
12753@@ -11,7 +11,7 @@
12754
12755 #define DOUBLEFAULT_STACKSIZE (1024)
12756 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
12757-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
12758+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
12759
12760 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
12761
12762@@ -21,7 +21,7 @@ static void doublefault_fn(void)
12763 unsigned long gdt, tss;
12764
12765 store_gdt(&gdt_desc);
12766- gdt = gdt_desc.address;
12767+ gdt = (unsigned long)gdt_desc.address;
12768
12769 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
12770
12771@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
12772 /* 0x2 bit is always set */
12773 .flags = X86_EFLAGS_SF | 0x2,
12774 .sp = STACK_START,
12775- .es = __USER_DS,
12776+ .es = __KERNEL_DS,
12777 .cs = __KERNEL_CS,
12778 .ss = __KERNEL_DS,
12779- .ds = __USER_DS,
12780+ .ds = __KERNEL_DS,
12781 .fs = __KERNEL_PERCPU,
12782
12783 .__cr3 = __pa_nodebug(swapper_pg_dir),
12784diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c
12785--- linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c 2011-03-27 14:31:47.000000000 -0400
12786+++ linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c 2011-04-17 15:56:46.000000000 -0400
12787@@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task
12788 #endif
12789
12790 for (;;) {
12791- struct thread_info *context;
12792+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12793+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12794
12795- context = (struct thread_info *)
12796- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
12797- bp = print_context_stack(context, stack, bp, ops,
12798- data, NULL, &graph);
12799-
12800- stack = (unsigned long *)context->previous_esp;
12801- if (!stack)
12802+ if (stack_start == task_stack_page(task))
12803 break;
12804+ stack = *(unsigned long **)stack_start;
12805 if (ops->stack(data, "IRQ") < 0)
12806 break;
12807 touch_nmi_watchdog();
12808@@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs
12809 * When in-kernel, we also print out the stack and code at the
12810 * time of the fault..
12811 */
12812- if (!user_mode_vm(regs)) {
12813+ if (!user_mode(regs)) {
12814 unsigned int code_prologue = code_bytes * 43 / 64;
12815 unsigned int code_len = code_bytes;
12816 unsigned char c;
12817 u8 *ip;
12818+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
12819
12820 printk(KERN_EMERG "Stack:\n");
12821 show_stack_log_lvl(NULL, regs, &regs->sp,
12822@@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs
12823
12824 printk(KERN_EMERG "Code: ");
12825
12826- ip = (u8 *)regs->ip - code_prologue;
12827+ ip = (u8 *)regs->ip - code_prologue + cs_base;
12828 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
12829 /* try starting at IP */
12830- ip = (u8 *)regs->ip;
12831+ ip = (u8 *)regs->ip + cs_base;
12832 code_len = code_len - code_prologue + 1;
12833 }
12834 for (i = 0; i < code_len; i++, ip++) {
12835@@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs
12836 printk(" Bad EIP value.");
12837 break;
12838 }
12839- if (ip == (u8 *)regs->ip)
12840+ if (ip == (u8 *)regs->ip + cs_base)
12841 printk("<%02x> ", c);
12842 else
12843 printk("%02x ", c);
12844@@ -149,6 +146,7 @@ int is_valid_bugaddr(unsigned long ip)
12845 {
12846 unsigned short ud2;
12847
12848+ ip = ktla_ktva(ip);
12849 if (ip < PAGE_OFFSET)
12850 return 0;
12851 if (probe_kernel_address((unsigned short *)ip, ud2))
12852diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c
12853--- linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c 2011-03-27 14:31:47.000000000 -0400
12854+++ linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c 2011-04-17 15:56:46.000000000 -0400
12855@@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task
12856 unsigned long *irq_stack_end =
12857 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
12858 unsigned used = 0;
12859- struct thread_info *tinfo;
12860 int graph = 0;
12861+ void *stack_start;
12862
12863 if (!task)
12864 task = current;
12865@@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task
12866 * current stack address. If the stacks consist of nested
12867 * exceptions
12868 */
12869- tinfo = task_thread_info(task);
12870 for (;;) {
12871 char *id;
12872 unsigned long *estack_end;
12873+
12874 estack_end = in_exception_stack(cpu, (unsigned long)stack,
12875 &used, &id);
12876
12877@@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task
12878 if (ops->stack(data, id) < 0)
12879 break;
12880
12881- bp = print_context_stack(tinfo, stack, bp, ops,
12882+ bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
12883 data, estack_end, &graph);
12884 ops->stack(data, "<EOE>");
12885 /*
12886@@ -176,7 +176,7 @@ void dump_trace(struct task_struct *task
12887 if (stack >= irq_stack && stack < irq_stack_end) {
12888 if (ops->stack(data, "IRQ") < 0)
12889 break;
12890- bp = print_context_stack(tinfo, stack, bp,
12891+ bp = print_context_stack(task, irq_stack, stack, bp,
12892 ops, data, irq_stack_end, &graph);
12893 /*
12894 * We link to the next stack (which would be
12895@@ -195,7 +195,8 @@ void dump_trace(struct task_struct *task
12896 /*
12897 * This handles the process stack:
12898 */
12899- bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
12900+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
12901+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
12902 put_cpu();
12903 }
12904 EXPORT_SYMBOL(dump_trace);
12905diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack.c linux-2.6.32.46/arch/x86/kernel/dumpstack.c
12906--- linux-2.6.32.46/arch/x86/kernel/dumpstack.c 2011-03-27 14:31:47.000000000 -0400
12907+++ linux-2.6.32.46/arch/x86/kernel/dumpstack.c 2011-04-17 15:56:46.000000000 -0400
12908@@ -2,6 +2,9 @@
12909 * Copyright (C) 1991, 1992 Linus Torvalds
12910 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
12911 */
12912+#ifdef CONFIG_GRKERNSEC_HIDESYM
12913+#define __INCLUDED_BY_HIDESYM 1
12914+#endif
12915 #include <linux/kallsyms.h>
12916 #include <linux/kprobes.h>
12917 #include <linux/uaccess.h>
12918@@ -28,7 +31,7 @@ static int die_counter;
12919
12920 void printk_address(unsigned long address, int reliable)
12921 {
12922- printk(" [<%p>] %s%pS\n", (void *) address,
12923+ printk(" [<%p>] %s%pA\n", (void *) address,
12924 reliable ? "" : "? ", (void *) address);
12925 }
12926
12927@@ -36,9 +39,8 @@ void printk_address(unsigned long addres
12928 static void
12929 print_ftrace_graph_addr(unsigned long addr, void *data,
12930 const struct stacktrace_ops *ops,
12931- struct thread_info *tinfo, int *graph)
12932+ struct task_struct *task, int *graph)
12933 {
12934- struct task_struct *task = tinfo->task;
12935 unsigned long ret_addr;
12936 int index = task->curr_ret_stack;
12937
12938@@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long ad
12939 static inline void
12940 print_ftrace_graph_addr(unsigned long addr, void *data,
12941 const struct stacktrace_ops *ops,
12942- struct thread_info *tinfo, int *graph)
12943+ struct task_struct *task, int *graph)
12944 { }
12945 #endif
12946
12947@@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long ad
12948 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
12949 */
12950
12951-static inline int valid_stack_ptr(struct thread_info *tinfo,
12952- void *p, unsigned int size, void *end)
12953+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
12954 {
12955- void *t = tinfo;
12956 if (end) {
12957 if (p < end && p >= (end-THREAD_SIZE))
12958 return 1;
12959@@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct
12960 }
12961
12962 unsigned long
12963-print_context_stack(struct thread_info *tinfo,
12964+print_context_stack(struct task_struct *task, void *stack_start,
12965 unsigned long *stack, unsigned long bp,
12966 const struct stacktrace_ops *ops, void *data,
12967 unsigned long *end, int *graph)
12968 {
12969 struct stack_frame *frame = (struct stack_frame *)bp;
12970
12971- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
12972+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
12973 unsigned long addr;
12974
12975 addr = *stack;
12976@@ -103,7 +103,7 @@ print_context_stack(struct thread_info *
12977 } else {
12978 ops->address(data, addr, 0);
12979 }
12980- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
12981+ print_ftrace_graph_addr(addr, data, ops, task, graph);
12982 }
12983 stack++;
12984 }
12985@@ -180,7 +180,7 @@ void dump_stack(void)
12986 #endif
12987
12988 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
12989- current->pid, current->comm, print_tainted(),
12990+ task_pid_nr(current), current->comm, print_tainted(),
12991 init_utsname()->release,
12992 (int)strcspn(init_utsname()->version, " "),
12993 init_utsname()->version);
12994@@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
12995 return flags;
12996 }
12997
12998+extern void gr_handle_kernel_exploit(void);
12999+
13000 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13001 {
13002 if (regs && kexec_should_crash(current))
13003@@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long fl
13004 panic("Fatal exception in interrupt");
13005 if (panic_on_oops)
13006 panic("Fatal exception");
13007- do_exit(signr);
13008+
13009+ gr_handle_kernel_exploit();
13010+
13011+ do_group_exit(signr);
13012 }
13013
13014 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13015@@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs
13016 unsigned long flags = oops_begin();
13017 int sig = SIGSEGV;
13018
13019- if (!user_mode_vm(regs))
13020+ if (!user_mode(regs))
13021 report_bug(regs->ip, regs);
13022
13023 if (__die(str, regs, err))
13024diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack.h linux-2.6.32.46/arch/x86/kernel/dumpstack.h
13025--- linux-2.6.32.46/arch/x86/kernel/dumpstack.h 2011-03-27 14:31:47.000000000 -0400
13026+++ linux-2.6.32.46/arch/x86/kernel/dumpstack.h 2011-04-23 13:25:26.000000000 -0400
13027@@ -15,7 +15,7 @@
13028 #endif
13029
13030 extern unsigned long
13031-print_context_stack(struct thread_info *tinfo,
13032+print_context_stack(struct task_struct *task, void *stack_start,
13033 unsigned long *stack, unsigned long bp,
13034 const struct stacktrace_ops *ops, void *data,
13035 unsigned long *end, int *graph);
13036diff -urNp linux-2.6.32.46/arch/x86/kernel/e820.c linux-2.6.32.46/arch/x86/kernel/e820.c
13037--- linux-2.6.32.46/arch/x86/kernel/e820.c 2011-03-27 14:31:47.000000000 -0400
13038+++ linux-2.6.32.46/arch/x86/kernel/e820.c 2011-04-17 15:56:46.000000000 -0400
13039@@ -733,7 +733,7 @@ struct early_res {
13040 };
13041 static struct early_res early_res[MAX_EARLY_RES] __initdata = {
13042 { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
13043- {}
13044+ { 0, 0, {0}, 0 }
13045 };
13046
13047 static int __init find_overlapped_early(u64 start, u64 end)
13048diff -urNp linux-2.6.32.46/arch/x86/kernel/early_printk.c linux-2.6.32.46/arch/x86/kernel/early_printk.c
13049--- linux-2.6.32.46/arch/x86/kernel/early_printk.c 2011-03-27 14:31:47.000000000 -0400
13050+++ linux-2.6.32.46/arch/x86/kernel/early_printk.c 2011-05-16 21:46:57.000000000 -0400
13051@@ -7,6 +7,7 @@
13052 #include <linux/pci_regs.h>
13053 #include <linux/pci_ids.h>
13054 #include <linux/errno.h>
13055+#include <linux/sched.h>
13056 #include <asm/io.h>
13057 #include <asm/processor.h>
13058 #include <asm/fcntl.h>
13059@@ -170,6 +171,8 @@ asmlinkage void early_printk(const char
13060 int n;
13061 va_list ap;
13062
13063+ pax_track_stack();
13064+
13065 va_start(ap, fmt);
13066 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13067 early_console->write(early_console, buf, n);
13068diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/kernel/efi_32.c
13069--- linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400
13070+++ linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-04-17 15:56:46.000000000 -0400
13071@@ -38,70 +38,38 @@
13072 */
13073
13074 static unsigned long efi_rt_eflags;
13075-static pgd_t efi_bak_pg_dir_pointer[2];
13076+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
13077
13078-void efi_call_phys_prelog(void)
13079+void __init efi_call_phys_prelog(void)
13080 {
13081- unsigned long cr4;
13082- unsigned long temp;
13083 struct desc_ptr gdt_descr;
13084
13085 local_irq_save(efi_rt_eflags);
13086
13087- /*
13088- * If I don't have PAE, I should just duplicate two entries in page
13089- * directory. If I have PAE, I just need to duplicate one entry in
13090- * page directory.
13091- */
13092- cr4 = read_cr4_safe();
13093
13094- if (cr4 & X86_CR4_PAE) {
13095- efi_bak_pg_dir_pointer[0].pgd =
13096- swapper_pg_dir[pgd_index(0)].pgd;
13097- swapper_pg_dir[0].pgd =
13098- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13099- } else {
13100- efi_bak_pg_dir_pointer[0].pgd =
13101- swapper_pg_dir[pgd_index(0)].pgd;
13102- efi_bak_pg_dir_pointer[1].pgd =
13103- swapper_pg_dir[pgd_index(0x400000)].pgd;
13104- swapper_pg_dir[pgd_index(0)].pgd =
13105- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13106- temp = PAGE_OFFSET + 0x400000;
13107- swapper_pg_dir[pgd_index(0x400000)].pgd =
13108- swapper_pg_dir[pgd_index(temp)].pgd;
13109- }
13110+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
13111+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
13112+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
13113
13114 /*
13115 * After the lock is released, the original page table is restored.
13116 */
13117 __flush_tlb_all();
13118
13119- gdt_descr.address = __pa(get_cpu_gdt_table(0));
13120+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
13121 gdt_descr.size = GDT_SIZE - 1;
13122 load_gdt(&gdt_descr);
13123 }
13124
13125-void efi_call_phys_epilog(void)
13126+void __init efi_call_phys_epilog(void)
13127 {
13128- unsigned long cr4;
13129 struct desc_ptr gdt_descr;
13130
13131- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
13132+ gdt_descr.address = get_cpu_gdt_table(0);
13133 gdt_descr.size = GDT_SIZE - 1;
13134 load_gdt(&gdt_descr);
13135
13136- cr4 = read_cr4_safe();
13137-
13138- if (cr4 & X86_CR4_PAE) {
13139- swapper_pg_dir[pgd_index(0)].pgd =
13140- efi_bak_pg_dir_pointer[0].pgd;
13141- } else {
13142- swapper_pg_dir[pgd_index(0)].pgd =
13143- efi_bak_pg_dir_pointer[0].pgd;
13144- swapper_pg_dir[pgd_index(0x400000)].pgd =
13145- efi_bak_pg_dir_pointer[1].pgd;
13146- }
13147+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
13148
13149 /*
13150 * After the lock is released, the original page table is restored.
13151diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S
13152--- linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400
13153+++ linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-04-17 15:56:46.000000000 -0400
13154@@ -6,6 +6,7 @@
13155 */
13156
13157 #include <linux/linkage.h>
13158+#include <linux/init.h>
13159 #include <asm/page_types.h>
13160
13161 /*
13162@@ -20,7 +21,7 @@
13163 * service functions will comply with gcc calling convention, too.
13164 */
13165
13166-.text
13167+__INIT
13168 ENTRY(efi_call_phys)
13169 /*
13170 * 0. The function can only be called in Linux kernel. So CS has been
13171@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
13172 * The mapping of lower virtual memory has been created in prelog and
13173 * epilog.
13174 */
13175- movl $1f, %edx
13176- subl $__PAGE_OFFSET, %edx
13177- jmp *%edx
13178+ jmp 1f-__PAGE_OFFSET
13179 1:
13180
13181 /*
13182@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
13183 * parameter 2, ..., param n. To make things easy, we save the return
13184 * address of efi_call_phys in a global variable.
13185 */
13186- popl %edx
13187- movl %edx, saved_return_addr
13188- /* get the function pointer into ECX*/
13189- popl %ecx
13190- movl %ecx, efi_rt_function_ptr
13191- movl $2f, %edx
13192- subl $__PAGE_OFFSET, %edx
13193- pushl %edx
13194+ popl (saved_return_addr)
13195+ popl (efi_rt_function_ptr)
13196
13197 /*
13198 * 3. Clear PG bit in %CR0.
13199@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
13200 /*
13201 * 5. Call the physical function.
13202 */
13203- jmp *%ecx
13204+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
13205
13206-2:
13207 /*
13208 * 6. After EFI runtime service returns, control will return to
13209 * following instruction. We'd better readjust stack pointer first.
13210@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
13211 movl %cr0, %edx
13212 orl $0x80000000, %edx
13213 movl %edx, %cr0
13214- jmp 1f
13215-1:
13216+
13217 /*
13218 * 8. Now restore the virtual mode from flat mode by
13219 * adding EIP with PAGE_OFFSET.
13220 */
13221- movl $1f, %edx
13222- jmp *%edx
13223+ jmp 1f+__PAGE_OFFSET
13224 1:
13225
13226 /*
13227 * 9. Balance the stack. And because EAX contain the return value,
13228 * we'd better not clobber it.
13229 */
13230- leal efi_rt_function_ptr, %edx
13231- movl (%edx), %ecx
13232- pushl %ecx
13233+ pushl (efi_rt_function_ptr)
13234
13235 /*
13236- * 10. Push the saved return address onto the stack and return.
13237+ * 10. Return to the saved return address.
13238 */
13239- leal saved_return_addr, %edx
13240- movl (%edx), %ecx
13241- pushl %ecx
13242- ret
13243+ jmpl *(saved_return_addr)
13244 ENDPROC(efi_call_phys)
13245 .previous
13246
13247-.data
13248+__INITDATA
13249 saved_return_addr:
13250 .long 0
13251 efi_rt_function_ptr:
13252diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_32.S linux-2.6.32.46/arch/x86/kernel/entry_32.S
13253--- linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400
13254+++ linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-08-30 18:19:52.000000000 -0400
13255@@ -185,13 +185,146 @@
13256 /*CFI_REL_OFFSET gs, PT_GS*/
13257 .endm
13258 .macro SET_KERNEL_GS reg
13259+
13260+#ifdef CONFIG_CC_STACKPROTECTOR
13261 movl $(__KERNEL_STACK_CANARY), \reg
13262+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13263+ movl $(__USER_DS), \reg
13264+#else
13265+ xorl \reg, \reg
13266+#endif
13267+
13268 movl \reg, %gs
13269 .endm
13270
13271 #endif /* CONFIG_X86_32_LAZY_GS */
13272
13273-.macro SAVE_ALL
13274+.macro pax_enter_kernel
13275+#ifdef CONFIG_PAX_KERNEXEC
13276+ call pax_enter_kernel
13277+#endif
13278+.endm
13279+
13280+.macro pax_exit_kernel
13281+#ifdef CONFIG_PAX_KERNEXEC
13282+ call pax_exit_kernel
13283+#endif
13284+.endm
13285+
13286+#ifdef CONFIG_PAX_KERNEXEC
13287+ENTRY(pax_enter_kernel)
13288+#ifdef CONFIG_PARAVIRT
13289+ pushl %eax
13290+ pushl %ecx
13291+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13292+ mov %eax, %esi
13293+#else
13294+ mov %cr0, %esi
13295+#endif
13296+ bts $16, %esi
13297+ jnc 1f
13298+ mov %cs, %esi
13299+ cmp $__KERNEL_CS, %esi
13300+ jz 3f
13301+ ljmp $__KERNEL_CS, $3f
13302+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13303+2:
13304+#ifdef CONFIG_PARAVIRT
13305+ mov %esi, %eax
13306+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13307+#else
13308+ mov %esi, %cr0
13309+#endif
13310+3:
13311+#ifdef CONFIG_PARAVIRT
13312+ popl %ecx
13313+ popl %eax
13314+#endif
13315+ ret
13316+ENDPROC(pax_enter_kernel)
13317+
13318+ENTRY(pax_exit_kernel)
13319+#ifdef CONFIG_PARAVIRT
13320+ pushl %eax
13321+ pushl %ecx
13322+#endif
13323+ mov %cs, %esi
13324+ cmp $__KERNEXEC_KERNEL_CS, %esi
13325+ jnz 2f
13326+#ifdef CONFIG_PARAVIRT
13327+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13328+ mov %eax, %esi
13329+#else
13330+ mov %cr0, %esi
13331+#endif
13332+ btr $16, %esi
13333+ ljmp $__KERNEL_CS, $1f
13334+1:
13335+#ifdef CONFIG_PARAVIRT
13336+ mov %esi, %eax
13337+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13338+#else
13339+ mov %esi, %cr0
13340+#endif
13341+2:
13342+#ifdef CONFIG_PARAVIRT
13343+ popl %ecx
13344+ popl %eax
13345+#endif
13346+ ret
13347+ENDPROC(pax_exit_kernel)
13348+#endif
13349+
13350+.macro pax_erase_kstack
13351+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13352+ call pax_erase_kstack
13353+#endif
13354+.endm
13355+
13356+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13357+/*
13358+ * ebp: thread_info
13359+ * ecx, edx: can be clobbered
13360+ */
13361+ENTRY(pax_erase_kstack)
13362+ pushl %edi
13363+ pushl %eax
13364+
13365+ mov TI_lowest_stack(%ebp), %edi
13366+ mov $-0xBEEF, %eax
13367+ std
13368+
13369+1: mov %edi, %ecx
13370+ and $THREAD_SIZE_asm - 1, %ecx
13371+ shr $2, %ecx
13372+ repne scasl
13373+ jecxz 2f
13374+
13375+ cmp $2*16, %ecx
13376+ jc 2f
13377+
13378+ mov $2*16, %ecx
13379+ repe scasl
13380+ jecxz 2f
13381+ jne 1b
13382+
13383+2: cld
13384+ mov %esp, %ecx
13385+ sub %edi, %ecx
13386+ shr $2, %ecx
13387+ rep stosl
13388+
13389+ mov TI_task_thread_sp0(%ebp), %edi
13390+ sub $128, %edi
13391+ mov %edi, TI_lowest_stack(%ebp)
13392+
13393+ popl %eax
13394+ popl %edi
13395+ ret
13396+ENDPROC(pax_erase_kstack)
13397+#endif
13398+
13399+.macro __SAVE_ALL _DS
13400 cld
13401 PUSH_GS
13402 pushl %fs
13403@@ -224,7 +357,7 @@
13404 pushl %ebx
13405 CFI_ADJUST_CFA_OFFSET 4
13406 CFI_REL_OFFSET ebx, 0
13407- movl $(__USER_DS), %edx
13408+ movl $\_DS, %edx
13409 movl %edx, %ds
13410 movl %edx, %es
13411 movl $(__KERNEL_PERCPU), %edx
13412@@ -232,6 +365,15 @@
13413 SET_KERNEL_GS %edx
13414 .endm
13415
13416+.macro SAVE_ALL
13417+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13418+ __SAVE_ALL __KERNEL_DS
13419+ pax_enter_kernel
13420+#else
13421+ __SAVE_ALL __USER_DS
13422+#endif
13423+.endm
13424+
13425 .macro RESTORE_INT_REGS
13426 popl %ebx
13427 CFI_ADJUST_CFA_OFFSET -4
13428@@ -352,7 +494,15 @@ check_userspace:
13429 movb PT_CS(%esp), %al
13430 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13431 cmpl $USER_RPL, %eax
13432+
13433+#ifdef CONFIG_PAX_KERNEXEC
13434+ jae resume_userspace
13435+
13436+ PAX_EXIT_KERNEL
13437+ jmp resume_kernel
13438+#else
13439 jb resume_kernel # not returning to v8086 or userspace
13440+#endif
13441
13442 ENTRY(resume_userspace)
13443 LOCKDEP_SYS_EXIT
13444@@ -364,7 +514,7 @@ ENTRY(resume_userspace)
13445 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13446 # int/exception return?
13447 jne work_pending
13448- jmp restore_all
13449+ jmp restore_all_pax
13450 END(ret_from_exception)
13451
13452 #ifdef CONFIG_PREEMPT
13453@@ -414,25 +564,36 @@ sysenter_past_esp:
13454 /*CFI_REL_OFFSET cs, 0*/
13455 /*
13456 * Push current_thread_info()->sysenter_return to the stack.
13457- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13458- * pushed above; +8 corresponds to copy_thread's esp0 setting.
13459 */
13460- pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
13461+ pushl $0
13462 CFI_ADJUST_CFA_OFFSET 4
13463 CFI_REL_OFFSET eip, 0
13464
13465 pushl %eax
13466 CFI_ADJUST_CFA_OFFSET 4
13467 SAVE_ALL
13468+ GET_THREAD_INFO(%ebp)
13469+ movl TI_sysenter_return(%ebp),%ebp
13470+ movl %ebp,PT_EIP(%esp)
13471 ENABLE_INTERRUPTS(CLBR_NONE)
13472
13473 /*
13474 * Load the potential sixth argument from user stack.
13475 * Careful about security.
13476 */
13477+ movl PT_OLDESP(%esp),%ebp
13478+
13479+#ifdef CONFIG_PAX_MEMORY_UDEREF
13480+ mov PT_OLDSS(%esp),%ds
13481+1: movl %ds:(%ebp),%ebp
13482+ push %ss
13483+ pop %ds
13484+#else
13485 cmpl $__PAGE_OFFSET-3,%ebp
13486 jae syscall_fault
13487 1: movl (%ebp),%ebp
13488+#endif
13489+
13490 movl %ebp,PT_EBP(%esp)
13491 .section __ex_table,"a"
13492 .align 4
13493@@ -455,12 +616,24 @@ sysenter_do_call:
13494 testl $_TIF_ALLWORK_MASK, %ecx
13495 jne sysexit_audit
13496 sysenter_exit:
13497+
13498+#ifdef CONFIG_PAX_RANDKSTACK
13499+ pushl_cfi %eax
13500+ movl %esp, %eax
13501+ call pax_randomize_kstack
13502+ popl_cfi %eax
13503+#endif
13504+
13505+ pax_erase_kstack
13506+
13507 /* if something modifies registers it must also disable sysexit */
13508 movl PT_EIP(%esp), %edx
13509 movl PT_OLDESP(%esp), %ecx
13510 xorl %ebp,%ebp
13511 TRACE_IRQS_ON
13512 1: mov PT_FS(%esp), %fs
13513+2: mov PT_DS(%esp), %ds
13514+3: mov PT_ES(%esp), %es
13515 PTGS_TO_GS
13516 ENABLE_INTERRUPTS_SYSEXIT
13517
13518@@ -477,6 +650,9 @@ sysenter_audit:
13519 movl %eax,%edx /* 2nd arg: syscall number */
13520 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13521 call audit_syscall_entry
13522+
13523+ pax_erase_kstack
13524+
13525 pushl %ebx
13526 CFI_ADJUST_CFA_OFFSET 4
13527 movl PT_EAX(%esp),%eax /* reload syscall number */
13528@@ -504,11 +680,17 @@ sysexit_audit:
13529
13530 CFI_ENDPROC
13531 .pushsection .fixup,"ax"
13532-2: movl $0,PT_FS(%esp)
13533+4: movl $0,PT_FS(%esp)
13534+ jmp 1b
13535+5: movl $0,PT_DS(%esp)
13536+ jmp 1b
13537+6: movl $0,PT_ES(%esp)
13538 jmp 1b
13539 .section __ex_table,"a"
13540 .align 4
13541- .long 1b,2b
13542+ .long 1b,4b
13543+ .long 2b,5b
13544+ .long 3b,6b
13545 .popsection
13546 PTGS_TO_GS_EX
13547 ENDPROC(ia32_sysenter_target)
13548@@ -538,6 +720,15 @@ syscall_exit:
13549 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13550 jne syscall_exit_work
13551
13552+restore_all_pax:
13553+
13554+#ifdef CONFIG_PAX_RANDKSTACK
13555+ movl %esp, %eax
13556+ call pax_randomize_kstack
13557+#endif
13558+
13559+ pax_erase_kstack
13560+
13561 restore_all:
13562 TRACE_IRQS_IRET
13563 restore_all_notrace:
13564@@ -602,10 +793,29 @@ ldt_ss:
13565 mov PT_OLDESP(%esp), %eax /* load userspace esp */
13566 mov %dx, %ax /* eax: new kernel esp */
13567 sub %eax, %edx /* offset (low word is 0) */
13568- PER_CPU(gdt_page, %ebx)
13569+#ifdef CONFIG_SMP
13570+ movl PER_CPU_VAR(cpu_number), %ebx
13571+ shll $PAGE_SHIFT_asm, %ebx
13572+ addl $cpu_gdt_table, %ebx
13573+#else
13574+ movl $cpu_gdt_table, %ebx
13575+#endif
13576 shr $16, %edx
13577+
13578+#ifdef CONFIG_PAX_KERNEXEC
13579+ mov %cr0, %esi
13580+ btr $16, %esi
13581+ mov %esi, %cr0
13582+#endif
13583+
13584 mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
13585 mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
13586+
13587+#ifdef CONFIG_PAX_KERNEXEC
13588+ bts $16, %esi
13589+ mov %esi, %cr0
13590+#endif
13591+
13592 pushl $__ESPFIX_SS
13593 CFI_ADJUST_CFA_OFFSET 4
13594 push %eax /* new kernel esp */
13595@@ -636,31 +846,25 @@ work_resched:
13596 movl TI_flags(%ebp), %ecx
13597 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13598 # than syscall tracing?
13599- jz restore_all
13600+ jz restore_all_pax
13601 testb $_TIF_NEED_RESCHED, %cl
13602 jnz work_resched
13603
13604 work_notifysig: # deal with pending signals and
13605 # notify-resume requests
13606+ movl %esp, %eax
13607 #ifdef CONFIG_VM86
13608 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13609- movl %esp, %eax
13610- jne work_notifysig_v86 # returning to kernel-space or
13611+ jz 1f # returning to kernel-space or
13612 # vm86-space
13613- xorl %edx, %edx
13614- call do_notify_resume
13615- jmp resume_userspace_sig
13616
13617- ALIGN
13618-work_notifysig_v86:
13619 pushl %ecx # save ti_flags for do_notify_resume
13620 CFI_ADJUST_CFA_OFFSET 4
13621 call save_v86_state # %eax contains pt_regs pointer
13622 popl %ecx
13623 CFI_ADJUST_CFA_OFFSET -4
13624 movl %eax, %esp
13625-#else
13626- movl %esp, %eax
13627+1:
13628 #endif
13629 xorl %edx, %edx
13630 call do_notify_resume
13631@@ -673,6 +877,9 @@ syscall_trace_entry:
13632 movl $-ENOSYS,PT_EAX(%esp)
13633 movl %esp, %eax
13634 call syscall_trace_enter
13635+
13636+ pax_erase_kstack
13637+
13638 /* What it returned is what we'll actually use. */
13639 cmpl $(nr_syscalls), %eax
13640 jnae syscall_call
13641@@ -695,6 +902,10 @@ END(syscall_exit_work)
13642
13643 RING0_INT_FRAME # can't unwind into user space anyway
13644 syscall_fault:
13645+#ifdef CONFIG_PAX_MEMORY_UDEREF
13646+ push %ss
13647+ pop %ds
13648+#endif
13649 GET_THREAD_INFO(%ebp)
13650 movl $-EFAULT,PT_EAX(%esp)
13651 jmp resume_userspace
13652@@ -726,6 +937,33 @@ PTREGSCALL(rt_sigreturn)
13653 PTREGSCALL(vm86)
13654 PTREGSCALL(vm86old)
13655
13656+ ALIGN;
13657+ENTRY(kernel_execve)
13658+ push %ebp
13659+ sub $PT_OLDSS+4,%esp
13660+ push %edi
13661+ push %ecx
13662+ push %eax
13663+ lea 3*4(%esp),%edi
13664+ mov $PT_OLDSS/4+1,%ecx
13665+ xorl %eax,%eax
13666+ rep stosl
13667+ pop %eax
13668+ pop %ecx
13669+ pop %edi
13670+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13671+ mov %eax,PT_EBX(%esp)
13672+ mov %edx,PT_ECX(%esp)
13673+ mov %ecx,PT_EDX(%esp)
13674+ mov %esp,%eax
13675+ call sys_execve
13676+ GET_THREAD_INFO(%ebp)
13677+ test %eax,%eax
13678+ jz syscall_exit
13679+ add $PT_OLDSS+4,%esp
13680+ pop %ebp
13681+ ret
13682+
13683 .macro FIXUP_ESPFIX_STACK
13684 /*
13685 * Switch back for ESPFIX stack to the normal zerobased stack
13686@@ -735,7 +973,13 @@ PTREGSCALL(vm86old)
13687 * normal stack and adjusts ESP with the matching offset.
13688 */
13689 /* fixup the stack */
13690- PER_CPU(gdt_page, %ebx)
13691+#ifdef CONFIG_SMP
13692+ movl PER_CPU_VAR(cpu_number), %ebx
13693+ shll $PAGE_SHIFT_asm, %ebx
13694+ addl $cpu_gdt_table, %ebx
13695+#else
13696+ movl $cpu_gdt_table, %ebx
13697+#endif
13698 mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
13699 mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
13700 shl $16, %eax
13701@@ -1198,7 +1442,6 @@ return_to_handler:
13702 ret
13703 #endif
13704
13705-.section .rodata,"a"
13706 #include "syscall_table_32.S"
13707
13708 syscall_table_size=(.-sys_call_table)
13709@@ -1255,9 +1498,12 @@ error_code:
13710 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13711 REG_TO_PTGS %ecx
13712 SET_KERNEL_GS %ecx
13713- movl $(__USER_DS), %ecx
13714+ movl $(__KERNEL_DS), %ecx
13715 movl %ecx, %ds
13716 movl %ecx, %es
13717+
13718+ pax_enter_kernel
13719+
13720 TRACE_IRQS_OFF
13721 movl %esp,%eax # pt_regs pointer
13722 call *%edi
13723@@ -1351,6 +1597,9 @@ nmi_stack_correct:
13724 xorl %edx,%edx # zero error code
13725 movl %esp,%eax # pt_regs pointer
13726 call do_nmi
13727+
13728+ pax_exit_kernel
13729+
13730 jmp restore_all_notrace
13731 CFI_ENDPROC
13732
13733@@ -1391,6 +1640,9 @@ nmi_espfix_stack:
13734 FIXUP_ESPFIX_STACK # %eax == %esp
13735 xorl %edx,%edx # zero error code
13736 call do_nmi
13737+
13738+ pax_exit_kernel
13739+
13740 RESTORE_REGS
13741 lss 12+4(%esp), %esp # back to espfix stack
13742 CFI_ADJUST_CFA_OFFSET -24
13743diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/kernel/entry_64.S
13744--- linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400
13745+++ linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-08-26 20:19:09.000000000 -0400
13746@@ -53,6 +53,7 @@
13747 #include <asm/paravirt.h>
13748 #include <asm/ftrace.h>
13749 #include <asm/percpu.h>
13750+#include <asm/pgtable.h>
13751
13752 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
13753 #include <linux/elf-em.h>
13754@@ -174,6 +175,264 @@ ENTRY(native_usergs_sysret64)
13755 ENDPROC(native_usergs_sysret64)
13756 #endif /* CONFIG_PARAVIRT */
13757
13758+ .macro ljmpq sel, off
13759+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
13760+ .byte 0x48; ljmp *1234f(%rip)
13761+ .pushsection .rodata
13762+ .align 16
13763+ 1234: .quad \off; .word \sel
13764+ .popsection
13765+#else
13766+ pushq $\sel
13767+ pushq $\off
13768+ lretq
13769+#endif
13770+ .endm
13771+
13772+ .macro pax_enter_kernel
13773+#ifdef CONFIG_PAX_KERNEXEC
13774+ call pax_enter_kernel
13775+#endif
13776+ .endm
13777+
13778+ .macro pax_exit_kernel
13779+#ifdef CONFIG_PAX_KERNEXEC
13780+ call pax_exit_kernel
13781+#endif
13782+ .endm
13783+
13784+#ifdef CONFIG_PAX_KERNEXEC
13785+ENTRY(pax_enter_kernel)
13786+ pushq %rdi
13787+
13788+#ifdef CONFIG_PARAVIRT
13789+ PV_SAVE_REGS(CLBR_RDI)
13790+#endif
13791+
13792+ GET_CR0_INTO_RDI
13793+ bts $16,%rdi
13794+ jnc 1f
13795+ mov %cs,%edi
13796+ cmp $__KERNEL_CS,%edi
13797+ jz 3f
13798+ ljmpq __KERNEL_CS,3f
13799+1: ljmpq __KERNEXEC_KERNEL_CS,2f
13800+2: SET_RDI_INTO_CR0
13801+3:
13802+
13803+#ifdef CONFIG_PARAVIRT
13804+ PV_RESTORE_REGS(CLBR_RDI)
13805+#endif
13806+
13807+ popq %rdi
13808+ retq
13809+ENDPROC(pax_enter_kernel)
13810+
13811+ENTRY(pax_exit_kernel)
13812+ pushq %rdi
13813+
13814+#ifdef CONFIG_PARAVIRT
13815+ PV_SAVE_REGS(CLBR_RDI)
13816+#endif
13817+
13818+ mov %cs,%rdi
13819+ cmp $__KERNEXEC_KERNEL_CS,%edi
13820+ jnz 2f
13821+ GET_CR0_INTO_RDI
13822+ btr $16,%rdi
13823+ ljmpq __KERNEL_CS,1f
13824+1: SET_RDI_INTO_CR0
13825+2:
13826+
13827+#ifdef CONFIG_PARAVIRT
13828+ PV_RESTORE_REGS(CLBR_RDI);
13829+#endif
13830+
13831+ popq %rdi
13832+ retq
13833+ENDPROC(pax_exit_kernel)
13834+#endif
13835+
13836+ .macro pax_enter_kernel_user
13837+#ifdef CONFIG_PAX_MEMORY_UDEREF
13838+ call pax_enter_kernel_user
13839+#endif
13840+ .endm
13841+
13842+ .macro pax_exit_kernel_user
13843+#ifdef CONFIG_PAX_MEMORY_UDEREF
13844+ call pax_exit_kernel_user
13845+#endif
13846+#ifdef CONFIG_PAX_RANDKSTACK
13847+ push %rax
13848+ call pax_randomize_kstack
13849+ pop %rax
13850+#endif
13851+ .endm
13852+
13853+#ifdef CONFIG_PAX_MEMORY_UDEREF
13854+ENTRY(pax_enter_kernel_user)
13855+ pushq %rdi
13856+ pushq %rbx
13857+
13858+#ifdef CONFIG_PARAVIRT
13859+ PV_SAVE_REGS(CLBR_RDI)
13860+#endif
13861+
13862+ GET_CR3_INTO_RDI
13863+ mov %rdi,%rbx
13864+ add $__START_KERNEL_map,%rbx
13865+ sub phys_base(%rip),%rbx
13866+
13867+#ifdef CONFIG_PARAVIRT
13868+ pushq %rdi
13869+ cmpl $0, pv_info+PARAVIRT_enabled
13870+ jz 1f
13871+ i = 0
13872+ .rept USER_PGD_PTRS
13873+ mov i*8(%rbx),%rsi
13874+ mov $0,%sil
13875+ lea i*8(%rbx),%rdi
13876+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13877+ i = i + 1
13878+ .endr
13879+ jmp 2f
13880+1:
13881+#endif
13882+
13883+ i = 0
13884+ .rept USER_PGD_PTRS
13885+ movb $0,i*8(%rbx)
13886+ i = i + 1
13887+ .endr
13888+
13889+#ifdef CONFIG_PARAVIRT
13890+2: popq %rdi
13891+#endif
13892+ SET_RDI_INTO_CR3
13893+
13894+#ifdef CONFIG_PAX_KERNEXEC
13895+ GET_CR0_INTO_RDI
13896+ bts $16,%rdi
13897+ SET_RDI_INTO_CR0
13898+#endif
13899+
13900+#ifdef CONFIG_PARAVIRT
13901+ PV_RESTORE_REGS(CLBR_RDI)
13902+#endif
13903+
13904+ popq %rbx
13905+ popq %rdi
13906+ retq
13907+ENDPROC(pax_enter_kernel_user)
13908+
13909+ENTRY(pax_exit_kernel_user)
13910+ push %rdi
13911+
13912+#ifdef CONFIG_PARAVIRT
13913+ pushq %rbx
13914+ PV_SAVE_REGS(CLBR_RDI)
13915+#endif
13916+
13917+#ifdef CONFIG_PAX_KERNEXEC
13918+ GET_CR0_INTO_RDI
13919+ btr $16,%rdi
13920+ SET_RDI_INTO_CR0
13921+#endif
13922+
13923+ GET_CR3_INTO_RDI
13924+ add $__START_KERNEL_map,%rdi
13925+ sub phys_base(%rip),%rdi
13926+
13927+#ifdef CONFIG_PARAVIRT
13928+ cmpl $0, pv_info+PARAVIRT_enabled
13929+ jz 1f
13930+ mov %rdi,%rbx
13931+ i = 0
13932+ .rept USER_PGD_PTRS
13933+ mov i*8(%rbx),%rsi
13934+ mov $0x67,%sil
13935+ lea i*8(%rbx),%rdi
13936+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
13937+ i = i + 1
13938+ .endr
13939+ jmp 2f
13940+1:
13941+#endif
13942+
13943+ i = 0
13944+ .rept USER_PGD_PTRS
13945+ movb $0x67,i*8(%rdi)
13946+ i = i + 1
13947+ .endr
13948+
13949+#ifdef CONFIG_PARAVIRT
13950+2: PV_RESTORE_REGS(CLBR_RDI)
13951+ popq %rbx
13952+#endif
13953+
13954+ popq %rdi
13955+ retq
13956+ENDPROC(pax_exit_kernel_user)
13957+#endif
13958+
13959+.macro pax_erase_kstack
13960+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13961+ call pax_erase_kstack
13962+#endif
13963+.endm
13964+
13965+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13966+/*
13967+ * r10: thread_info
13968+ * rcx, rdx: can be clobbered
13969+ */
13970+ENTRY(pax_erase_kstack)
13971+ pushq %rdi
13972+ pushq %rax
13973+ pushq %r10
13974+
13975+ GET_THREAD_INFO(%r10)
13976+ mov TI_lowest_stack(%r10), %rdi
13977+ mov $-0xBEEF, %rax
13978+ std
13979+
13980+1: mov %edi, %ecx
13981+ and $THREAD_SIZE_asm - 1, %ecx
13982+ shr $3, %ecx
13983+ repne scasq
13984+ jecxz 2f
13985+
13986+ cmp $2*8, %ecx
13987+ jc 2f
13988+
13989+ mov $2*8, %ecx
13990+ repe scasq
13991+ jecxz 2f
13992+ jne 1b
13993+
13994+2: cld
13995+ mov %esp, %ecx
13996+ sub %edi, %ecx
13997+
13998+ cmp $THREAD_SIZE_asm, %rcx
13999+ jb 3f
14000+ ud2
14001+3:
14002+
14003+ shr $3, %ecx
14004+ rep stosq
14005+
14006+ mov TI_task_thread_sp0(%r10), %rdi
14007+ sub $256, %rdi
14008+ mov %rdi, TI_lowest_stack(%r10)
14009+
14010+ popq %r10
14011+ popq %rax
14012+ popq %rdi
14013+ ret
14014+ENDPROC(pax_erase_kstack)
14015+#endif
14016
14017 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14018 #ifdef CONFIG_TRACE_IRQFLAGS
14019@@ -317,7 +576,7 @@ ENTRY(save_args)
14020 leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
14021 movq_cfi rbp, 8 /* push %rbp */
14022 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14023- testl $3, CS(%rdi)
14024+ testb $3, CS(%rdi)
14025 je 1f
14026 SWAPGS
14027 /*
14028@@ -409,7 +668,7 @@ ENTRY(ret_from_fork)
14029
14030 RESTORE_REST
14031
14032- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14033+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14034 je int_ret_from_sys_call
14035
14036 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14037@@ -455,7 +714,7 @@ END(ret_from_fork)
14038 ENTRY(system_call)
14039 CFI_STARTPROC simple
14040 CFI_SIGNAL_FRAME
14041- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14042+ CFI_DEF_CFA rsp,0
14043 CFI_REGISTER rip,rcx
14044 /*CFI_REGISTER rflags,r11*/
14045 SWAPGS_UNSAFE_STACK
14046@@ -468,12 +727,13 @@ ENTRY(system_call_after_swapgs)
14047
14048 movq %rsp,PER_CPU_VAR(old_rsp)
14049 movq PER_CPU_VAR(kernel_stack),%rsp
14050+ pax_enter_kernel_user
14051 /*
14052 * No need to follow this irqs off/on section - it's straight
14053 * and short:
14054 */
14055 ENABLE_INTERRUPTS(CLBR_NONE)
14056- SAVE_ARGS 8,1
14057+ SAVE_ARGS 8*6,1
14058 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14059 movq %rcx,RIP-ARGOFFSET(%rsp)
14060 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14061@@ -502,6 +762,8 @@ sysret_check:
14062 andl %edi,%edx
14063 jnz sysret_careful
14064 CFI_REMEMBER_STATE
14065+ pax_exit_kernel_user
14066+ pax_erase_kstack
14067 /*
14068 * sysretq will re-enable interrupts:
14069 */
14070@@ -562,6 +824,9 @@ auditsys:
14071 movq %rax,%rsi /* 2nd arg: syscall number */
14072 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14073 call audit_syscall_entry
14074+
14075+ pax_erase_kstack
14076+
14077 LOAD_ARGS 0 /* reload call-clobbered registers */
14078 jmp system_call_fastpath
14079
14080@@ -592,6 +857,9 @@ tracesys:
14081 FIXUP_TOP_OF_STACK %rdi
14082 movq %rsp,%rdi
14083 call syscall_trace_enter
14084+
14085+ pax_erase_kstack
14086+
14087 /*
14088 * Reload arg registers from stack in case ptrace changed them.
14089 * We don't reload %rax because syscall_trace_enter() returned
14090@@ -613,7 +881,7 @@ tracesys:
14091 GLOBAL(int_ret_from_sys_call)
14092 DISABLE_INTERRUPTS(CLBR_NONE)
14093 TRACE_IRQS_OFF
14094- testl $3,CS-ARGOFFSET(%rsp)
14095+ testb $3,CS-ARGOFFSET(%rsp)
14096 je retint_restore_args
14097 movl $_TIF_ALLWORK_MASK,%edi
14098 /* edi: mask to check */
14099@@ -800,6 +1068,16 @@ END(interrupt)
14100 CFI_ADJUST_CFA_OFFSET 10*8
14101 call save_args
14102 PARTIAL_FRAME 0
14103+#ifdef CONFIG_PAX_MEMORY_UDEREF
14104+ testb $3, CS(%rdi)
14105+ jnz 1f
14106+ pax_enter_kernel
14107+ jmp 2f
14108+1: pax_enter_kernel_user
14109+2:
14110+#else
14111+ pax_enter_kernel
14112+#endif
14113 call \func
14114 .endm
14115
14116@@ -822,7 +1100,7 @@ ret_from_intr:
14117 CFI_ADJUST_CFA_OFFSET -8
14118 exit_intr:
14119 GET_THREAD_INFO(%rcx)
14120- testl $3,CS-ARGOFFSET(%rsp)
14121+ testb $3,CS-ARGOFFSET(%rsp)
14122 je retint_kernel
14123
14124 /* Interrupt came from user space */
14125@@ -844,12 +1122,15 @@ retint_swapgs: /* return to user-space
14126 * The iretq could re-enable interrupts:
14127 */
14128 DISABLE_INTERRUPTS(CLBR_ANY)
14129+ pax_exit_kernel_user
14130+ pax_erase_kstack
14131 TRACE_IRQS_IRETQ
14132 SWAPGS
14133 jmp restore_args
14134
14135 retint_restore_args: /* return to kernel space */
14136 DISABLE_INTERRUPTS(CLBR_ANY)
14137+ pax_exit_kernel
14138 /*
14139 * The iretq could re-enable interrupts:
14140 */
14141@@ -1032,6 +1313,16 @@ ENTRY(\sym)
14142 CFI_ADJUST_CFA_OFFSET 15*8
14143 call error_entry
14144 DEFAULT_FRAME 0
14145+#ifdef CONFIG_PAX_MEMORY_UDEREF
14146+ testb $3, CS(%rsp)
14147+ jnz 1f
14148+ pax_enter_kernel
14149+ jmp 2f
14150+1: pax_enter_kernel_user
14151+2:
14152+#else
14153+ pax_enter_kernel
14154+#endif
14155 movq %rsp,%rdi /* pt_regs pointer */
14156 xorl %esi,%esi /* no error code */
14157 call \do_sym
14158@@ -1049,6 +1340,16 @@ ENTRY(\sym)
14159 subq $15*8, %rsp
14160 call save_paranoid
14161 TRACE_IRQS_OFF
14162+#ifdef CONFIG_PAX_MEMORY_UDEREF
14163+ testb $3, CS(%rsp)
14164+ jnz 1f
14165+ pax_enter_kernel
14166+ jmp 2f
14167+1: pax_enter_kernel_user
14168+2:
14169+#else
14170+ pax_enter_kernel
14171+#endif
14172 movq %rsp,%rdi /* pt_regs pointer */
14173 xorl %esi,%esi /* no error code */
14174 call \do_sym
14175@@ -1066,9 +1367,24 @@ ENTRY(\sym)
14176 subq $15*8, %rsp
14177 call save_paranoid
14178 TRACE_IRQS_OFF
14179+#ifdef CONFIG_PAX_MEMORY_UDEREF
14180+ testb $3, CS(%rsp)
14181+ jnz 1f
14182+ pax_enter_kernel
14183+ jmp 2f
14184+1: pax_enter_kernel_user
14185+2:
14186+#else
14187+ pax_enter_kernel
14188+#endif
14189 movq %rsp,%rdi /* pt_regs pointer */
14190 xorl %esi,%esi /* no error code */
14191- PER_CPU(init_tss, %rbp)
14192+#ifdef CONFIG_SMP
14193+ imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
14194+ lea init_tss(%rbp), %rbp
14195+#else
14196+ lea init_tss(%rip), %rbp
14197+#endif
14198 subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
14199 call \do_sym
14200 addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
14201@@ -1085,6 +1401,16 @@ ENTRY(\sym)
14202 CFI_ADJUST_CFA_OFFSET 15*8
14203 call error_entry
14204 DEFAULT_FRAME 0
14205+#ifdef CONFIG_PAX_MEMORY_UDEREF
14206+ testb $3, CS(%rsp)
14207+ jnz 1f
14208+ pax_enter_kernel
14209+ jmp 2f
14210+1: pax_enter_kernel_user
14211+2:
14212+#else
14213+ pax_enter_kernel
14214+#endif
14215 movq %rsp,%rdi /* pt_regs pointer */
14216 movq ORIG_RAX(%rsp),%rsi /* get error code */
14217 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14218@@ -1104,6 +1430,16 @@ ENTRY(\sym)
14219 call save_paranoid
14220 DEFAULT_FRAME 0
14221 TRACE_IRQS_OFF
14222+#ifdef CONFIG_PAX_MEMORY_UDEREF
14223+ testb $3, CS(%rsp)
14224+ jnz 1f
14225+ pax_enter_kernel
14226+ jmp 2f
14227+1: pax_enter_kernel_user
14228+2:
14229+#else
14230+ pax_enter_kernel
14231+#endif
14232 movq %rsp,%rdi /* pt_regs pointer */
14233 movq ORIG_RAX(%rsp),%rsi /* get error code */
14234 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14235@@ -1405,14 +1741,27 @@ ENTRY(paranoid_exit)
14236 TRACE_IRQS_OFF
14237 testl %ebx,%ebx /* swapgs needed? */
14238 jnz paranoid_restore
14239- testl $3,CS(%rsp)
14240+ testb $3,CS(%rsp)
14241 jnz paranoid_userspace
14242+#ifdef CONFIG_PAX_MEMORY_UDEREF
14243+ pax_exit_kernel
14244+ TRACE_IRQS_IRETQ 0
14245+ SWAPGS_UNSAFE_STACK
14246+ RESTORE_ALL 8
14247+ jmp irq_return
14248+#endif
14249 paranoid_swapgs:
14250+#ifdef CONFIG_PAX_MEMORY_UDEREF
14251+ pax_exit_kernel_user
14252+#else
14253+ pax_exit_kernel
14254+#endif
14255 TRACE_IRQS_IRETQ 0
14256 SWAPGS_UNSAFE_STACK
14257 RESTORE_ALL 8
14258 jmp irq_return
14259 paranoid_restore:
14260+ pax_exit_kernel
14261 TRACE_IRQS_IRETQ 0
14262 RESTORE_ALL 8
14263 jmp irq_return
14264@@ -1470,7 +1819,7 @@ ENTRY(error_entry)
14265 movq_cfi r14, R14+8
14266 movq_cfi r15, R15+8
14267 xorl %ebx,%ebx
14268- testl $3,CS+8(%rsp)
14269+ testb $3,CS+8(%rsp)
14270 je error_kernelspace
14271 error_swapgs:
14272 SWAPGS
14273@@ -1529,6 +1878,16 @@ ENTRY(nmi)
14274 CFI_ADJUST_CFA_OFFSET 15*8
14275 call save_paranoid
14276 DEFAULT_FRAME 0
14277+#ifdef CONFIG_PAX_MEMORY_UDEREF
14278+ testb $3, CS(%rsp)
14279+ jnz 1f
14280+ pax_enter_kernel
14281+ jmp 2f
14282+1: pax_enter_kernel_user
14283+2:
14284+#else
14285+ pax_enter_kernel
14286+#endif
14287 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14288 movq %rsp,%rdi
14289 movq $-1,%rsi
14290@@ -1539,11 +1898,25 @@ ENTRY(nmi)
14291 DISABLE_INTERRUPTS(CLBR_NONE)
14292 testl %ebx,%ebx /* swapgs needed? */
14293 jnz nmi_restore
14294- testl $3,CS(%rsp)
14295+ testb $3,CS(%rsp)
14296 jnz nmi_userspace
14297+#ifdef CONFIG_PAX_MEMORY_UDEREF
14298+ pax_exit_kernel
14299+ SWAPGS_UNSAFE_STACK
14300+ RESTORE_ALL 8
14301+ jmp irq_return
14302+#endif
14303 nmi_swapgs:
14304+#ifdef CONFIG_PAX_MEMORY_UDEREF
14305+ pax_exit_kernel_user
14306+#else
14307+ pax_exit_kernel
14308+#endif
14309 SWAPGS_UNSAFE_STACK
14310+ RESTORE_ALL 8
14311+ jmp irq_return
14312 nmi_restore:
14313+ pax_exit_kernel
14314 RESTORE_ALL 8
14315 jmp irq_return
14316 nmi_userspace:
14317diff -urNp linux-2.6.32.46/arch/x86/kernel/ftrace.c linux-2.6.32.46/arch/x86/kernel/ftrace.c
14318--- linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400
14319+++ linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400
14320@@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the
14321 static void *mod_code_newcode; /* holds the text to write to the IP */
14322
14323 static unsigned nmi_wait_count;
14324-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14325+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14326
14327 int ftrace_arch_read_dyn_info(char *buf, int size)
14328 {
14329@@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14330
14331 r = snprintf(buf, size, "%u %u",
14332 nmi_wait_count,
14333- atomic_read(&nmi_update_count));
14334+ atomic_read_unchecked(&nmi_update_count));
14335 return r;
14336 }
14337
14338@@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
14339 {
14340 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14341 smp_rmb();
14342+ pax_open_kernel();
14343 ftrace_mod_code();
14344- atomic_inc(&nmi_update_count);
14345+ pax_close_kernel();
14346+ atomic_inc_unchecked(&nmi_update_count);
14347 }
14348 /* Must have previous changes seen before executions */
14349 smp_mb();
14350@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
14351
14352
14353
14354-static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
14355+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
14356
14357 static unsigned char *ftrace_nop_replace(void)
14358 {
14359@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
14360 {
14361 unsigned char replaced[MCOUNT_INSN_SIZE];
14362
14363+ ip = ktla_ktva(ip);
14364+
14365 /*
14366 * Note: Due to modules and __init, code can
14367 * disappear and change, we need to protect against faulting
14368@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14369 unsigned char old[MCOUNT_INSN_SIZE], *new;
14370 int ret;
14371
14372- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14373+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14374 new = ftrace_call_replace(ip, (unsigned long)func);
14375 ret = ftrace_modify_code(ip, old, new);
14376
14377@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
14378 switch (faulted) {
14379 case 0:
14380 pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
14381- memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
14382+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
14383 break;
14384 case 1:
14385 pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
14386- memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
14387+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
14388 break;
14389 case 2:
14390 pr_info("ftrace: converting mcount calls to jmp . + 5\n");
14391- memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
14392+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
14393 break;
14394 }
14395
14396@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long
14397 {
14398 unsigned char code[MCOUNT_INSN_SIZE];
14399
14400+ ip = ktla_ktva(ip);
14401+
14402 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14403 return -EFAULT;
14404
14405diff -urNp linux-2.6.32.46/arch/x86/kernel/head32.c linux-2.6.32.46/arch/x86/kernel/head32.c
14406--- linux-2.6.32.46/arch/x86/kernel/head32.c 2011-03-27 14:31:47.000000000 -0400
14407+++ linux-2.6.32.46/arch/x86/kernel/head32.c 2011-04-17 15:56:46.000000000 -0400
14408@@ -16,6 +16,7 @@
14409 #include <asm/apic.h>
14410 #include <asm/io_apic.h>
14411 #include <asm/bios_ebda.h>
14412+#include <asm/boot.h>
14413
14414 static void __init i386_default_early_setup(void)
14415 {
14416@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
14417 {
14418 reserve_trampoline_memory();
14419
14420- reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14421+ reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14422
14423 #ifdef CONFIG_BLK_DEV_INITRD
14424 /* Reserve INITRD */
14425diff -urNp linux-2.6.32.46/arch/x86/kernel/head_32.S linux-2.6.32.46/arch/x86/kernel/head_32.S
14426--- linux-2.6.32.46/arch/x86/kernel/head_32.S 2011-03-27 14:31:47.000000000 -0400
14427+++ linux-2.6.32.46/arch/x86/kernel/head_32.S 2011-07-06 19:53:33.000000000 -0400
14428@@ -19,10 +19,17 @@
14429 #include <asm/setup.h>
14430 #include <asm/processor-flags.h>
14431 #include <asm/percpu.h>
14432+#include <asm/msr-index.h>
14433
14434 /* Physical address */
14435 #define pa(X) ((X) - __PAGE_OFFSET)
14436
14437+#ifdef CONFIG_PAX_KERNEXEC
14438+#define ta(X) (X)
14439+#else
14440+#define ta(X) ((X) - __PAGE_OFFSET)
14441+#endif
14442+
14443 /*
14444 * References to members of the new_cpu_data structure.
14445 */
14446@@ -52,11 +59,7 @@
14447 * and small than max_low_pfn, otherwise will waste some page table entries
14448 */
14449
14450-#if PTRS_PER_PMD > 1
14451-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14452-#else
14453-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14454-#endif
14455+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14456
14457 /* Enough space to fit pagetables for the low memory linear map */
14458 MAPPING_BEYOND_END = \
14459@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
14460 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14461
14462 /*
14463+ * Real beginning of normal "text" segment
14464+ */
14465+ENTRY(stext)
14466+ENTRY(_stext)
14467+
14468+/*
14469 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14470 * %esi points to the real-mode code as a 32-bit pointer.
14471 * CS and DS must be 4 GB flat segments, but we don't depend on
14472@@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14473 * can.
14474 */
14475 __HEAD
14476+
14477+#ifdef CONFIG_PAX_KERNEXEC
14478+ jmp startup_32
14479+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14480+.fill PAGE_SIZE-5,1,0xcc
14481+#endif
14482+
14483 ENTRY(startup_32)
14484+ movl pa(stack_start),%ecx
14485+
14486 /* test KEEP_SEGMENTS flag to see if the bootloader is asking
14487 us to not reload segments */
14488 testb $(1<<6), BP_loadflags(%esi)
14489@@ -95,7 +113,60 @@ ENTRY(startup_32)
14490 movl %eax,%es
14491 movl %eax,%fs
14492 movl %eax,%gs
14493+ movl %eax,%ss
14494 2:
14495+ leal -__PAGE_OFFSET(%ecx),%esp
14496+
14497+#ifdef CONFIG_SMP
14498+ movl $pa(cpu_gdt_table),%edi
14499+ movl $__per_cpu_load,%eax
14500+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14501+ rorl $16,%eax
14502+ movb %al,__KERNEL_PERCPU + 4(%edi)
14503+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14504+ movl $__per_cpu_end - 1,%eax
14505+ subl $__per_cpu_start,%eax
14506+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14507+#endif
14508+
14509+#ifdef CONFIG_PAX_MEMORY_UDEREF
14510+ movl $NR_CPUS,%ecx
14511+ movl $pa(cpu_gdt_table),%edi
14512+1:
14513+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14514+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14515+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14516+ addl $PAGE_SIZE_asm,%edi
14517+ loop 1b
14518+#endif
14519+
14520+#ifdef CONFIG_PAX_KERNEXEC
14521+ movl $pa(boot_gdt),%edi
14522+ movl $__LOAD_PHYSICAL_ADDR,%eax
14523+ movw %ax,__BOOT_CS + 2(%edi)
14524+ rorl $16,%eax
14525+ movb %al,__BOOT_CS + 4(%edi)
14526+ movb %ah,__BOOT_CS + 7(%edi)
14527+ rorl $16,%eax
14528+
14529+ ljmp $(__BOOT_CS),$1f
14530+1:
14531+
14532+ movl $NR_CPUS,%ecx
14533+ movl $pa(cpu_gdt_table),%edi
14534+ addl $__PAGE_OFFSET,%eax
14535+1:
14536+ movw %ax,__KERNEL_CS + 2(%edi)
14537+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14538+ rorl $16,%eax
14539+ movb %al,__KERNEL_CS + 4(%edi)
14540+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14541+ movb %ah,__KERNEL_CS + 7(%edi)
14542+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14543+ rorl $16,%eax
14544+ addl $PAGE_SIZE_asm,%edi
14545+ loop 1b
14546+#endif
14547
14548 /*
14549 * Clear BSS first so that there are no surprises...
14550@@ -140,9 +211,7 @@ ENTRY(startup_32)
14551 cmpl $num_subarch_entries, %eax
14552 jae bad_subarch
14553
14554- movl pa(subarch_entries)(,%eax,4), %eax
14555- subl $__PAGE_OFFSET, %eax
14556- jmp *%eax
14557+ jmp *pa(subarch_entries)(,%eax,4)
14558
14559 bad_subarch:
14560 WEAK(lguest_entry)
14561@@ -154,10 +223,10 @@ WEAK(xen_entry)
14562 __INITDATA
14563
14564 subarch_entries:
14565- .long default_entry /* normal x86/PC */
14566- .long lguest_entry /* lguest hypervisor */
14567- .long xen_entry /* Xen hypervisor */
14568- .long default_entry /* Moorestown MID */
14569+ .long ta(default_entry) /* normal x86/PC */
14570+ .long ta(lguest_entry) /* lguest hypervisor */
14571+ .long ta(xen_entry) /* Xen hypervisor */
14572+ .long ta(default_entry) /* Moorestown MID */
14573 num_subarch_entries = (. - subarch_entries) / 4
14574 .previous
14575 #endif /* CONFIG_PARAVIRT */
14576@@ -218,8 +287,11 @@ default_entry:
14577 movl %eax, pa(max_pfn_mapped)
14578
14579 /* Do early initialization of the fixmap area */
14580- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
14581- movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
14582+#ifdef CONFIG_COMPAT_VDSO
14583+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
14584+#else
14585+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
14586+#endif
14587 #else /* Not PAE */
14588
14589 page_pde_offset = (__PAGE_OFFSET >> 20);
14590@@ -249,8 +321,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14591 movl %eax, pa(max_pfn_mapped)
14592
14593 /* Do early initialization of the fixmap area */
14594- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
14595- movl %eax,pa(swapper_pg_dir+0xffc)
14596+#ifdef CONFIG_COMPAT_VDSO
14597+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
14598+#else
14599+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
14600+#endif
14601 #endif
14602 jmp 3f
14603 /*
14604@@ -272,6 +347,9 @@ ENTRY(startup_32_smp)
14605 movl %eax,%es
14606 movl %eax,%fs
14607 movl %eax,%gs
14608+ movl pa(stack_start),%ecx
14609+ movl %eax,%ss
14610+ leal -__PAGE_OFFSET(%ecx),%esp
14611 #endif /* CONFIG_SMP */
14612 3:
14613
14614@@ -297,6 +375,7 @@ ENTRY(startup_32_smp)
14615 orl %edx,%eax
14616 movl %eax,%cr4
14617
14618+#ifdef CONFIG_X86_PAE
14619 btl $5, %eax # check if PAE is enabled
14620 jnc 6f
14621
14622@@ -305,6 +384,10 @@ ENTRY(startup_32_smp)
14623 cpuid
14624 cmpl $0x80000000, %eax
14625 jbe 6f
14626+
14627+ /* Clear bogus XD_DISABLE bits */
14628+ call verify_cpu
14629+
14630 mov $0x80000001, %eax
14631 cpuid
14632 /* Execute Disable bit supported? */
14633@@ -312,13 +395,17 @@ ENTRY(startup_32_smp)
14634 jnc 6f
14635
14636 /* Setup EFER (Extended Feature Enable Register) */
14637- movl $0xc0000080, %ecx
14638+ movl $MSR_EFER, %ecx
14639 rdmsr
14640
14641 btsl $11, %eax
14642 /* Make changes effective */
14643 wrmsr
14644
14645+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14646+ movl $1,pa(nx_enabled)
14647+#endif
14648+
14649 6:
14650
14651 /*
14652@@ -331,8 +418,8 @@ ENTRY(startup_32_smp)
14653 movl %eax,%cr0 /* ..and set paging (PG) bit */
14654 ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
14655 1:
14656- /* Set up the stack pointer */
14657- lss stack_start,%esp
14658+ /* Shift the stack pointer to a virtual address */
14659+ addl $__PAGE_OFFSET, %esp
14660
14661 /*
14662 * Initialize eflags. Some BIOS's leave bits like NT set. This would
14663@@ -344,9 +431,7 @@ ENTRY(startup_32_smp)
14664
14665 #ifdef CONFIG_SMP
14666 cmpb $0, ready
14667- jz 1f /* Initial CPU cleans BSS */
14668- jmp checkCPUtype
14669-1:
14670+ jnz checkCPUtype
14671 #endif /* CONFIG_SMP */
14672
14673 /*
14674@@ -424,7 +509,7 @@ is386: movl $2,%ecx # set MP
14675 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14676 movl %eax,%ss # after changing gdt.
14677
14678- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14679+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14680 movl %eax,%ds
14681 movl %eax,%es
14682
14683@@ -438,15 +523,22 @@ is386: movl $2,%ecx # set MP
14684 */
14685 cmpb $0,ready
14686 jne 1f
14687- movl $per_cpu__gdt_page,%eax
14688+ movl $cpu_gdt_table,%eax
14689 movl $per_cpu__stack_canary,%ecx
14690+#ifdef CONFIG_SMP
14691+ addl $__per_cpu_load,%ecx
14692+#endif
14693 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14694 shrl $16, %ecx
14695 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14696 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14697 1:
14698-#endif
14699 movl $(__KERNEL_STACK_CANARY),%eax
14700+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14701+ movl $(__USER_DS),%eax
14702+#else
14703+ xorl %eax,%eax
14704+#endif
14705 movl %eax,%gs
14706
14707 xorl %eax,%eax # Clear LDT
14708@@ -454,14 +546,7 @@ is386: movl $2,%ecx # set MP
14709
14710 cld # gcc2 wants the direction flag cleared at all times
14711 pushl $0 # fake return address for unwinder
14712-#ifdef CONFIG_SMP
14713- movb ready, %cl
14714 movb $1, ready
14715- cmpb $0,%cl # the first CPU calls start_kernel
14716- je 1f
14717- movl (stack_start), %esp
14718-1:
14719-#endif /* CONFIG_SMP */
14720 jmp *(initial_code)
14721
14722 /*
14723@@ -546,22 +631,22 @@ early_page_fault:
14724 jmp early_fault
14725
14726 early_fault:
14727- cld
14728 #ifdef CONFIG_PRINTK
14729+ cmpl $1,%ss:early_recursion_flag
14730+ je hlt_loop
14731+ incl %ss:early_recursion_flag
14732+ cld
14733 pusha
14734 movl $(__KERNEL_DS),%eax
14735 movl %eax,%ds
14736 movl %eax,%es
14737- cmpl $2,early_recursion_flag
14738- je hlt_loop
14739- incl early_recursion_flag
14740 movl %cr2,%eax
14741 pushl %eax
14742 pushl %edx /* trapno */
14743 pushl $fault_msg
14744 call printk
14745+; call dump_stack
14746 #endif
14747- call dump_stack
14748 hlt_loop:
14749 hlt
14750 jmp hlt_loop
14751@@ -569,8 +654,11 @@ hlt_loop:
14752 /* This is the default interrupt "handler" :-) */
14753 ALIGN
14754 ignore_int:
14755- cld
14756 #ifdef CONFIG_PRINTK
14757+ cmpl $2,%ss:early_recursion_flag
14758+ je hlt_loop
14759+ incl %ss:early_recursion_flag
14760+ cld
14761 pushl %eax
14762 pushl %ecx
14763 pushl %edx
14764@@ -579,9 +667,6 @@ ignore_int:
14765 movl $(__KERNEL_DS),%eax
14766 movl %eax,%ds
14767 movl %eax,%es
14768- cmpl $2,early_recursion_flag
14769- je hlt_loop
14770- incl early_recursion_flag
14771 pushl 16(%esp)
14772 pushl 24(%esp)
14773 pushl 32(%esp)
14774@@ -600,6 +685,8 @@ ignore_int:
14775 #endif
14776 iret
14777
14778+#include "verify_cpu.S"
14779+
14780 __REFDATA
14781 .align 4
14782 ENTRY(initial_code)
14783@@ -610,31 +697,47 @@ ENTRY(initial_page_table)
14784 /*
14785 * BSS section
14786 */
14787-__PAGE_ALIGNED_BSS
14788- .align PAGE_SIZE_asm
14789 #ifdef CONFIG_X86_PAE
14790+.section .swapper_pg_pmd,"a",@progbits
14791 swapper_pg_pmd:
14792 .fill 1024*KPMDS,4,0
14793 #else
14794+.section .swapper_pg_dir,"a",@progbits
14795 ENTRY(swapper_pg_dir)
14796 .fill 1024,4,0
14797 #endif
14798+.section .swapper_pg_fixmap,"a",@progbits
14799 swapper_pg_fixmap:
14800 .fill 1024,4,0
14801 #ifdef CONFIG_X86_TRAMPOLINE
14802+.section .trampoline_pg_dir,"a",@progbits
14803 ENTRY(trampoline_pg_dir)
14804+#ifdef CONFIG_X86_PAE
14805+ .fill 4,8,0
14806+#else
14807 .fill 1024,4,0
14808 #endif
14809+#endif
14810+
14811+.section .empty_zero_page,"a",@progbits
14812 ENTRY(empty_zero_page)
14813 .fill 4096,1,0
14814
14815 /*
14816+ * The IDT has to be page-aligned to simplify the Pentium
14817+ * F0 0F bug workaround.. We have a special link segment
14818+ * for this.
14819+ */
14820+.section .idt,"a",@progbits
14821+ENTRY(idt_table)
14822+ .fill 256,8,0
14823+
14824+/*
14825 * This starts the data section.
14826 */
14827 #ifdef CONFIG_X86_PAE
14828-__PAGE_ALIGNED_DATA
14829- /* Page-aligned for the benefit of paravirt? */
14830- .align PAGE_SIZE_asm
14831+.section .swapper_pg_dir,"a",@progbits
14832+
14833 ENTRY(swapper_pg_dir)
14834 .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
14835 # if KPMDS == 3
14836@@ -653,15 +756,24 @@ ENTRY(swapper_pg_dir)
14837 # error "Kernel PMDs should be 1, 2 or 3"
14838 # endif
14839 .align PAGE_SIZE_asm /* needs to be page-sized too */
14840+
14841+#ifdef CONFIG_PAX_PER_CPU_PGD
14842+ENTRY(cpu_pgd)
14843+ .rept NR_CPUS
14844+ .fill 4,8,0
14845+ .endr
14846+#endif
14847+
14848 #endif
14849
14850 .data
14851+.balign 4
14852 ENTRY(stack_start)
14853- .long init_thread_union+THREAD_SIZE
14854- .long __BOOT_DS
14855+ .long init_thread_union+THREAD_SIZE-8
14856
14857 ready: .byte 0
14858
14859+.section .rodata,"a",@progbits
14860 early_recursion_flag:
14861 .long 0
14862
14863@@ -697,7 +809,7 @@ fault_msg:
14864 .word 0 # 32 bit align gdt_desc.address
14865 boot_gdt_descr:
14866 .word __BOOT_DS+7
14867- .long boot_gdt - __PAGE_OFFSET
14868+ .long pa(boot_gdt)
14869
14870 .word 0 # 32-bit align idt_desc.address
14871 idt_descr:
14872@@ -708,7 +820,7 @@ idt_descr:
14873 .word 0 # 32 bit align gdt_desc.address
14874 ENTRY(early_gdt_descr)
14875 .word GDT_ENTRIES*8-1
14876- .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
14877+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
14878
14879 /*
14880 * The boot_gdt must mirror the equivalent in setup.S and is
14881@@ -717,5 +829,65 @@ ENTRY(early_gdt_descr)
14882 .align L1_CACHE_BYTES
14883 ENTRY(boot_gdt)
14884 .fill GDT_ENTRY_BOOT_CS,8,0
14885- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
14886- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
14887+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
14888+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
14889+
14890+ .align PAGE_SIZE_asm
14891+ENTRY(cpu_gdt_table)
14892+ .rept NR_CPUS
14893+ .quad 0x0000000000000000 /* NULL descriptor */
14894+ .quad 0x0000000000000000 /* 0x0b reserved */
14895+ .quad 0x0000000000000000 /* 0x13 reserved */
14896+ .quad 0x0000000000000000 /* 0x1b reserved */
14897+
14898+#ifdef CONFIG_PAX_KERNEXEC
14899+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
14900+#else
14901+ .quad 0x0000000000000000 /* 0x20 unused */
14902+#endif
14903+
14904+ .quad 0x0000000000000000 /* 0x28 unused */
14905+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
14906+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
14907+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
14908+ .quad 0x0000000000000000 /* 0x4b reserved */
14909+ .quad 0x0000000000000000 /* 0x53 reserved */
14910+ .quad 0x0000000000000000 /* 0x5b reserved */
14911+
14912+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
14913+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
14914+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
14915+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
14916+
14917+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
14918+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
14919+
14920+ /*
14921+ * Segments used for calling PnP BIOS have byte granularity.
14922+ * The code segments and data segments have fixed 64k limits,
14923+ * the transfer segment sizes are set at run time.
14924+ */
14925+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
14926+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
14927+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
14928+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
14929+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
14930+
14931+ /*
14932+ * The APM segments have byte granularity and their bases
14933+ * are set at run time. All have 64k limits.
14934+ */
14935+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
14936+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
14937+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
14938+
14939+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
14940+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
14941+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
14942+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
14943+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
14944+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
14945+
14946+ /* Be sure this is zeroed to avoid false validations in Xen */
14947+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
14948+ .endr
14949diff -urNp linux-2.6.32.46/arch/x86/kernel/head_64.S linux-2.6.32.46/arch/x86/kernel/head_64.S
14950--- linux-2.6.32.46/arch/x86/kernel/head_64.S 2011-03-27 14:31:47.000000000 -0400
14951+++ linux-2.6.32.46/arch/x86/kernel/head_64.S 2011-04-17 15:56:46.000000000 -0400
14952@@ -19,6 +19,7 @@
14953 #include <asm/cache.h>
14954 #include <asm/processor-flags.h>
14955 #include <asm/percpu.h>
14956+#include <asm/cpufeature.h>
14957
14958 #ifdef CONFIG_PARAVIRT
14959 #include <asm/asm-offsets.h>
14960@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
14961 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
14962 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
14963 L3_START_KERNEL = pud_index(__START_KERNEL_map)
14964+L4_VMALLOC_START = pgd_index(VMALLOC_START)
14965+L3_VMALLOC_START = pud_index(VMALLOC_START)
14966+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
14967+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
14968
14969 .text
14970 __HEAD
14971@@ -85,35 +90,22 @@ startup_64:
14972 */
14973 addq %rbp, init_level4_pgt + 0(%rip)
14974 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
14975+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
14976+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
14977 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
14978
14979 addq %rbp, level3_ident_pgt + 0(%rip)
14980+#ifndef CONFIG_XEN
14981+ addq %rbp, level3_ident_pgt + 8(%rip)
14982+#endif
14983
14984- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
14985- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
14986+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
14987
14988- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
14989+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
14990+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
14991
14992- /* Add an Identity mapping if I am above 1G */
14993- leaq _text(%rip), %rdi
14994- andq $PMD_PAGE_MASK, %rdi
14995-
14996- movq %rdi, %rax
14997- shrq $PUD_SHIFT, %rax
14998- andq $(PTRS_PER_PUD - 1), %rax
14999- jz ident_complete
15000-
15001- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15002- leaq level3_ident_pgt(%rip), %rbx
15003- movq %rdx, 0(%rbx, %rax, 8)
15004-
15005- movq %rdi, %rax
15006- shrq $PMD_SHIFT, %rax
15007- andq $(PTRS_PER_PMD - 1), %rax
15008- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15009- leaq level2_spare_pgt(%rip), %rbx
15010- movq %rdx, 0(%rbx, %rax, 8)
15011-ident_complete:
15012+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15013+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15014
15015 /*
15016 * Fixup the kernel text+data virtual addresses. Note that
15017@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
15018 * after the boot processor executes this code.
15019 */
15020
15021- /* Enable PAE mode and PGE */
15022- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15023+ /* Enable PAE mode and PSE/PGE */
15024+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15025 movq %rax, %cr4
15026
15027 /* Setup early boot stage 4 level pagetables. */
15028@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
15029 movl $MSR_EFER, %ecx
15030 rdmsr
15031 btsl $_EFER_SCE, %eax /* Enable System Call */
15032- btl $20,%edi /* No Execute supported? */
15033+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15034 jnc 1f
15035 btsl $_EFER_NX, %eax
15036+ leaq init_level4_pgt(%rip), %rdi
15037+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15038+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15039+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15040 1: wrmsr /* Make changes effective */
15041
15042 /* Setup cr0 */
15043@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
15044 .quad x86_64_start_kernel
15045 ENTRY(initial_gs)
15046 .quad INIT_PER_CPU_VAR(irq_stack_union)
15047- __FINITDATA
15048
15049 ENTRY(stack_start)
15050 .quad init_thread_union+THREAD_SIZE-8
15051 .word 0
15052+ __FINITDATA
15053
15054 bad_address:
15055 jmp bad_address
15056
15057- .section ".init.text","ax"
15058+ __INIT
15059 #ifdef CONFIG_EARLY_PRINTK
15060 .globl early_idt_handlers
15061 early_idt_handlers:
15062@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
15063 #endif /* EARLY_PRINTK */
15064 1: hlt
15065 jmp 1b
15066+ .previous
15067
15068 #ifdef CONFIG_EARLY_PRINTK
15069+ __INITDATA
15070 early_recursion_flag:
15071 .long 0
15072+ .previous
15073
15074+ .section .rodata,"a",@progbits
15075 early_idt_msg:
15076 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15077 early_idt_ripmsg:
15078 .asciz "RIP %s\n"
15079-#endif /* CONFIG_EARLY_PRINTK */
15080 .previous
15081+#endif /* CONFIG_EARLY_PRINTK */
15082
15083+ .section .rodata,"a",@progbits
15084 #define NEXT_PAGE(name) \
15085 .balign PAGE_SIZE; \
15086 ENTRY(name)
15087@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
15088 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15089 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15090 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15091+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15092+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15093+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15094+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15095 .org init_level4_pgt + L4_START_KERNEL*8, 0
15096 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15097 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15098
15099+#ifdef CONFIG_PAX_PER_CPU_PGD
15100+NEXT_PAGE(cpu_pgd)
15101+ .rept NR_CPUS
15102+ .fill 512,8,0
15103+ .endr
15104+#endif
15105+
15106 NEXT_PAGE(level3_ident_pgt)
15107 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15108+#ifdef CONFIG_XEN
15109 .fill 511,8,0
15110+#else
15111+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15112+ .fill 510,8,0
15113+#endif
15114+
15115+NEXT_PAGE(level3_vmalloc_pgt)
15116+ .fill 512,8,0
15117+
15118+NEXT_PAGE(level3_vmemmap_pgt)
15119+ .fill L3_VMEMMAP_START,8,0
15120+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15121
15122 NEXT_PAGE(level3_kernel_pgt)
15123 .fill L3_START_KERNEL,8,0
15124@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
15125 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15126 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15127
15128+NEXT_PAGE(level2_vmemmap_pgt)
15129+ .fill 512,8,0
15130+
15131 NEXT_PAGE(level2_fixmap_pgt)
15132- .fill 506,8,0
15133- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15134- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15135- .fill 5,8,0
15136+ .fill 507,8,0
15137+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15138+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15139+ .fill 4,8,0
15140
15141-NEXT_PAGE(level1_fixmap_pgt)
15142+NEXT_PAGE(level1_vsyscall_pgt)
15143 .fill 512,8,0
15144
15145-NEXT_PAGE(level2_ident_pgt)
15146- /* Since I easily can, map the first 1G.
15147+ /* Since I easily can, map the first 2G.
15148 * Don't set NX because code runs from these pages.
15149 */
15150- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15151+NEXT_PAGE(level2_ident_pgt)
15152+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15153
15154 NEXT_PAGE(level2_kernel_pgt)
15155 /*
15156@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
15157 * If you want to increase this then increase MODULES_VADDR
15158 * too.)
15159 */
15160- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15161- KERNEL_IMAGE_SIZE/PMD_SIZE)
15162-
15163-NEXT_PAGE(level2_spare_pgt)
15164- .fill 512, 8, 0
15165+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15166
15167 #undef PMDS
15168 #undef NEXT_PAGE
15169
15170- .data
15171+ .align PAGE_SIZE
15172+ENTRY(cpu_gdt_table)
15173+ .rept NR_CPUS
15174+ .quad 0x0000000000000000 /* NULL descriptor */
15175+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15176+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15177+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15178+ .quad 0x00cffb000000ffff /* __USER32_CS */
15179+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15180+ .quad 0x00affb000000ffff /* __USER_CS */
15181+
15182+#ifdef CONFIG_PAX_KERNEXEC
15183+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15184+#else
15185+ .quad 0x0 /* unused */
15186+#endif
15187+
15188+ .quad 0,0 /* TSS */
15189+ .quad 0,0 /* LDT */
15190+ .quad 0,0,0 /* three TLS descriptors */
15191+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15192+ /* asm/segment.h:GDT_ENTRIES must match this */
15193+
15194+ /* zero the remaining page */
15195+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15196+ .endr
15197+
15198 .align 16
15199 .globl early_gdt_descr
15200 early_gdt_descr:
15201 .word GDT_ENTRIES*8-1
15202 early_gdt_descr_base:
15203- .quad INIT_PER_CPU_VAR(gdt_page)
15204+ .quad cpu_gdt_table
15205
15206 ENTRY(phys_base)
15207 /* This must match the first entry in level2_kernel_pgt */
15208 .quad 0x0000000000000000
15209
15210 #include "../../x86/xen/xen-head.S"
15211-
15212- .section .bss, "aw", @nobits
15213+
15214+ .section .rodata,"a",@progbits
15215 .align L1_CACHE_BYTES
15216 ENTRY(idt_table)
15217- .skip IDT_ENTRIES * 16
15218+ .fill 512,8,0
15219
15220 __PAGE_ALIGNED_BSS
15221 .align PAGE_SIZE
15222diff -urNp linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c
15223--- linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c 2011-03-27 14:31:47.000000000 -0400
15224+++ linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c 2011-04-17 15:56:46.000000000 -0400
15225@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15226 EXPORT_SYMBOL(cmpxchg8b_emu);
15227 #endif
15228
15229+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15230+
15231 /* Networking helper routines. */
15232 EXPORT_SYMBOL(csum_partial_copy_generic);
15233+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15234+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15235
15236 EXPORT_SYMBOL(__get_user_1);
15237 EXPORT_SYMBOL(__get_user_2);
15238@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15239
15240 EXPORT_SYMBOL(csum_partial);
15241 EXPORT_SYMBOL(empty_zero_page);
15242+
15243+#ifdef CONFIG_PAX_KERNEXEC
15244+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15245+#endif
15246diff -urNp linux-2.6.32.46/arch/x86/kernel/i8259.c linux-2.6.32.46/arch/x86/kernel/i8259.c
15247--- linux-2.6.32.46/arch/x86/kernel/i8259.c 2011-03-27 14:31:47.000000000 -0400
15248+++ linux-2.6.32.46/arch/x86/kernel/i8259.c 2011-05-04 17:56:28.000000000 -0400
15249@@ -208,7 +208,7 @@ spurious_8259A_irq:
15250 "spurious 8259A interrupt: IRQ%d.\n", irq);
15251 spurious_irq_mask |= irqmask;
15252 }
15253- atomic_inc(&irq_err_count);
15254+ atomic_inc_unchecked(&irq_err_count);
15255 /*
15256 * Theoretically we do not have to handle this IRQ,
15257 * but in Linux this does not cause problems and is
15258diff -urNp linux-2.6.32.46/arch/x86/kernel/init_task.c linux-2.6.32.46/arch/x86/kernel/init_task.c
15259--- linux-2.6.32.46/arch/x86/kernel/init_task.c 2011-03-27 14:31:47.000000000 -0400
15260+++ linux-2.6.32.46/arch/x86/kernel/init_task.c 2011-04-17 15:56:46.000000000 -0400
15261@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15262 * way process stacks are handled. This is done by having a special
15263 * "init_task" linker map entry..
15264 */
15265-union thread_union init_thread_union __init_task_data =
15266- { INIT_THREAD_INFO(init_task) };
15267+union thread_union init_thread_union __init_task_data;
15268
15269 /*
15270 * Initial task structure.
15271@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15272 * section. Since TSS's are completely CPU-local, we want them
15273 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15274 */
15275-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15276-
15277+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15278+EXPORT_SYMBOL(init_tss);
15279diff -urNp linux-2.6.32.46/arch/x86/kernel/ioport.c linux-2.6.32.46/arch/x86/kernel/ioport.c
15280--- linux-2.6.32.46/arch/x86/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
15281+++ linux-2.6.32.46/arch/x86/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
15282@@ -6,6 +6,7 @@
15283 #include <linux/sched.h>
15284 #include <linux/kernel.h>
15285 #include <linux/capability.h>
15286+#include <linux/security.h>
15287 #include <linux/errno.h>
15288 #include <linux/types.h>
15289 #include <linux/ioport.h>
15290@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
15291
15292 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15293 return -EINVAL;
15294+#ifdef CONFIG_GRKERNSEC_IO
15295+ if (turn_on && grsec_disable_privio) {
15296+ gr_handle_ioperm();
15297+ return -EPERM;
15298+ }
15299+#endif
15300 if (turn_on && !capable(CAP_SYS_RAWIO))
15301 return -EPERM;
15302
15303@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
15304 * because the ->io_bitmap_max value must match the bitmap
15305 * contents:
15306 */
15307- tss = &per_cpu(init_tss, get_cpu());
15308+ tss = init_tss + get_cpu();
15309
15310 set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
15311
15312@@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, s
15313 return -EINVAL;
15314 /* Trying to gain more privileges? */
15315 if (level > old) {
15316+#ifdef CONFIG_GRKERNSEC_IO
15317+ if (grsec_disable_privio) {
15318+ gr_handle_iopl();
15319+ return -EPERM;
15320+ }
15321+#endif
15322 if (!capable(CAP_SYS_RAWIO))
15323 return -EPERM;
15324 }
15325diff -urNp linux-2.6.32.46/arch/x86/kernel/irq_32.c linux-2.6.32.46/arch/x86/kernel/irq_32.c
15326--- linux-2.6.32.46/arch/x86/kernel/irq_32.c 2011-03-27 14:31:47.000000000 -0400
15327+++ linux-2.6.32.46/arch/x86/kernel/irq_32.c 2011-07-06 19:53:33.000000000 -0400
15328@@ -35,7 +35,7 @@ static int check_stack_overflow(void)
15329 __asm__ __volatile__("andl %%esp,%0" :
15330 "=r" (sp) : "0" (THREAD_SIZE - 1));
15331
15332- return sp < (sizeof(struct thread_info) + STACK_WARN);
15333+ return sp < STACK_WARN;
15334 }
15335
15336 static void print_stack_overflow(void)
15337@@ -54,9 +54,9 @@ static inline void print_stack_overflow(
15338 * per-CPU IRQ handling contexts (thread information and stack)
15339 */
15340 union irq_ctx {
15341- struct thread_info tinfo;
15342- u32 stack[THREAD_SIZE/sizeof(u32)];
15343-} __attribute__((aligned(PAGE_SIZE)));
15344+ unsigned long previous_esp;
15345+ u32 stack[THREAD_SIZE/sizeof(u32)];
15346+} __attribute__((aligned(THREAD_SIZE)));
15347
15348 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15349 static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
15350@@ -78,10 +78,9 @@ static void call_on_stack(void *func, vo
15351 static inline int
15352 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15353 {
15354- union irq_ctx *curctx, *irqctx;
15355+ union irq_ctx *irqctx;
15356 u32 *isp, arg1, arg2;
15357
15358- curctx = (union irq_ctx *) current_thread_info();
15359 irqctx = __get_cpu_var(hardirq_ctx);
15360
15361 /*
15362@@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struc
15363 * handler) we can't do that and just have to keep using the
15364 * current stack (which is the irq stack already after all)
15365 */
15366- if (unlikely(curctx == irqctx))
15367+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15368 return 0;
15369
15370 /* build the stack frame on the IRQ stack */
15371- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15372- irqctx->tinfo.task = curctx->tinfo.task;
15373- irqctx->tinfo.previous_esp = current_stack_pointer;
15374+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15375+ irqctx->previous_esp = current_stack_pointer;
15376
15377- /*
15378- * Copy the softirq bits in preempt_count so that the
15379- * softirq checks work in the hardirq context.
15380- */
15381- irqctx->tinfo.preempt_count =
15382- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15383- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15384+#ifdef CONFIG_PAX_MEMORY_UDEREF
15385+ __set_fs(MAKE_MM_SEG(0));
15386+#endif
15387
15388 if (unlikely(overflow))
15389 call_on_stack(print_stack_overflow, isp);
15390@@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struc
15391 : "0" (irq), "1" (desc), "2" (isp),
15392 "D" (desc->handle_irq)
15393 : "memory", "cc", "ecx");
15394+
15395+#ifdef CONFIG_PAX_MEMORY_UDEREF
15396+ __set_fs(current_thread_info()->addr_limit);
15397+#endif
15398+
15399 return 1;
15400 }
15401
15402@@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struc
15403 */
15404 void __cpuinit irq_ctx_init(int cpu)
15405 {
15406- union irq_ctx *irqctx;
15407-
15408 if (per_cpu(hardirq_ctx, cpu))
15409 return;
15410
15411- irqctx = &per_cpu(hardirq_stack, cpu);
15412- irqctx->tinfo.task = NULL;
15413- irqctx->tinfo.exec_domain = NULL;
15414- irqctx->tinfo.cpu = cpu;
15415- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15416- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15417-
15418- per_cpu(hardirq_ctx, cpu) = irqctx;
15419-
15420- irqctx = &per_cpu(softirq_stack, cpu);
15421- irqctx->tinfo.task = NULL;
15422- irqctx->tinfo.exec_domain = NULL;
15423- irqctx->tinfo.cpu = cpu;
15424- irqctx->tinfo.preempt_count = 0;
15425- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15426-
15427- per_cpu(softirq_ctx, cpu) = irqctx;
15428+ per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
15429+ per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
15430
15431 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15432 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15433@@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
15434 asmlinkage void do_softirq(void)
15435 {
15436 unsigned long flags;
15437- struct thread_info *curctx;
15438 union irq_ctx *irqctx;
15439 u32 *isp;
15440
15441@@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
15442 local_irq_save(flags);
15443
15444 if (local_softirq_pending()) {
15445- curctx = current_thread_info();
15446 irqctx = __get_cpu_var(softirq_ctx);
15447- irqctx->tinfo.task = curctx->task;
15448- irqctx->tinfo.previous_esp = current_stack_pointer;
15449+ irqctx->previous_esp = current_stack_pointer;
15450
15451 /* build the stack frame on the softirq stack */
15452- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15453+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15454+
15455+#ifdef CONFIG_PAX_MEMORY_UDEREF
15456+ __set_fs(MAKE_MM_SEG(0));
15457+#endif
15458
15459 call_on_stack(__do_softirq, isp);
15460+
15461+#ifdef CONFIG_PAX_MEMORY_UDEREF
15462+ __set_fs(current_thread_info()->addr_limit);
15463+#endif
15464+
15465 /*
15466 * Shouldnt happen, we returned above if in_interrupt():
15467 */
15468diff -urNp linux-2.6.32.46/arch/x86/kernel/irq.c linux-2.6.32.46/arch/x86/kernel/irq.c
15469--- linux-2.6.32.46/arch/x86/kernel/irq.c 2011-03-27 14:31:47.000000000 -0400
15470+++ linux-2.6.32.46/arch/x86/kernel/irq.c 2011-05-04 17:56:28.000000000 -0400
15471@@ -15,7 +15,7 @@
15472 #include <asm/mce.h>
15473 #include <asm/hw_irq.h>
15474
15475-atomic_t irq_err_count;
15476+atomic_unchecked_t irq_err_count;
15477
15478 /* Function pointer for generic interrupt vector handling */
15479 void (*generic_interrupt_extension)(void) = NULL;
15480@@ -114,9 +114,9 @@ static int show_other_interrupts(struct
15481 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15482 seq_printf(p, " Machine check polls\n");
15483 #endif
15484- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15485+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15486 #if defined(CONFIG_X86_IO_APIC)
15487- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15488+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15489 #endif
15490 return 0;
15491 }
15492@@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15493
15494 u64 arch_irq_stat(void)
15495 {
15496- u64 sum = atomic_read(&irq_err_count);
15497+ u64 sum = atomic_read_unchecked(&irq_err_count);
15498
15499 #ifdef CONFIG_X86_IO_APIC
15500- sum += atomic_read(&irq_mis_count);
15501+ sum += atomic_read_unchecked(&irq_mis_count);
15502 #endif
15503 return sum;
15504 }
15505diff -urNp linux-2.6.32.46/arch/x86/kernel/kgdb.c linux-2.6.32.46/arch/x86/kernel/kgdb.c
15506--- linux-2.6.32.46/arch/x86/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
15507+++ linux-2.6.32.46/arch/x86/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
15508@@ -390,13 +390,13 @@ int kgdb_arch_handle_exception(int e_vec
15509
15510 /* clear the trace bit */
15511 linux_regs->flags &= ~X86_EFLAGS_TF;
15512- atomic_set(&kgdb_cpu_doing_single_step, -1);
15513+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15514
15515 /* set the trace bit if we're stepping */
15516 if (remcomInBuffer[0] == 's') {
15517 linux_regs->flags |= X86_EFLAGS_TF;
15518 kgdb_single_step = 1;
15519- atomic_set(&kgdb_cpu_doing_single_step,
15520+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15521 raw_smp_processor_id());
15522 }
15523
15524@@ -476,7 +476,7 @@ static int __kgdb_notify(struct die_args
15525 break;
15526
15527 case DIE_DEBUG:
15528- if (atomic_read(&kgdb_cpu_doing_single_step) ==
15529+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
15530 raw_smp_processor_id()) {
15531 if (user_mode(regs))
15532 return single_step_cont(regs, args);
15533@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
15534 return instruction_pointer(regs);
15535 }
15536
15537-struct kgdb_arch arch_kgdb_ops = {
15538+const struct kgdb_arch arch_kgdb_ops = {
15539 /* Breakpoint instruction: */
15540 .gdb_bpt_instr = { 0xcc },
15541 .flags = KGDB_HW_BREAKPOINT,
15542diff -urNp linux-2.6.32.46/arch/x86/kernel/kprobes.c linux-2.6.32.46/arch/x86/kernel/kprobes.c
15543--- linux-2.6.32.46/arch/x86/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
15544+++ linux-2.6.32.46/arch/x86/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
15545@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
15546 char op;
15547 s32 raddr;
15548 } __attribute__((packed)) * jop;
15549- jop = (struct __arch_jmp_op *)from;
15550+
15551+ jop = (struct __arch_jmp_op *)(ktla_ktva(from));
15552+
15553+ pax_open_kernel();
15554 jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
15555 jop->op = RELATIVEJUMP_INSTRUCTION;
15556+ pax_close_kernel();
15557 }
15558
15559 /*
15560@@ -193,7 +197,7 @@ static int __kprobes can_boost(kprobe_op
15561 kprobe_opcode_t opcode;
15562 kprobe_opcode_t *orig_opcodes = opcodes;
15563
15564- if (search_exception_tables((unsigned long)opcodes))
15565+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15566 return 0; /* Page fault may occur on this address. */
15567
15568 retry:
15569@@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct
15570 disp = (u8 *) p->addr + *((s32 *) insn) -
15571 (u8 *) p->ainsn.insn;
15572 BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
15573+ pax_open_kernel();
15574 *(s32 *)insn = (s32) disp;
15575+ pax_close_kernel();
15576 }
15577 }
15578 #endif
15579@@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct
15580
15581 static void __kprobes arch_copy_kprobe(struct kprobe *p)
15582 {
15583- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
15584+ pax_open_kernel();
15585+ memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
15586+ pax_close_kernel();
15587
15588 fix_riprel(p);
15589
15590- if (can_boost(p->addr))
15591+ if (can_boost(ktla_ktva(p->addr)))
15592 p->ainsn.boostable = 0;
15593 else
15594 p->ainsn.boostable = -1;
15595
15596- p->opcode = *p->addr;
15597+ p->opcode = *(ktla_ktva(p->addr));
15598 }
15599
15600 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15601@@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
15602 if (p->opcode == BREAKPOINT_INSTRUCTION)
15603 regs->ip = (unsigned long)p->addr;
15604 else
15605- regs->ip = (unsigned long)p->ainsn.insn;
15606+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15607 }
15608
15609 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
15610@@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
15611 if (p->ainsn.boostable == 1 && !p->post_handler) {
15612 /* Boost up -- we can execute copied instructions directly */
15613 reset_current_kprobe();
15614- regs->ip = (unsigned long)p->ainsn.insn;
15615+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15616 preempt_enable_no_resched();
15617 return;
15618 }
15619@@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
15620 struct kprobe_ctlblk *kcb;
15621
15622 addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
15623- if (*addr != BREAKPOINT_INSTRUCTION) {
15624+ if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15625 /*
15626 * The breakpoint instruction was removed right
15627 * after we hit it. Another cpu has removed
15628@@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
15629 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15630 {
15631 unsigned long *tos = stack_addr(regs);
15632- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15633+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15634 unsigned long orig_ip = (unsigned long)p->addr;
15635 kprobe_opcode_t *insn = p->ainsn.insn;
15636
15637@@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
15638 struct die_args *args = data;
15639 int ret = NOTIFY_DONE;
15640
15641- if (args->regs && user_mode_vm(args->regs))
15642+ if (args->regs && user_mode(args->regs))
15643 return ret;
15644
15645 switch (val) {
15646diff -urNp linux-2.6.32.46/arch/x86/kernel/kvm.c linux-2.6.32.46/arch/x86/kernel/kvm.c
15647--- linux-2.6.32.46/arch/x86/kernel/kvm.c 2011-03-27 14:31:47.000000000 -0400
15648+++ linux-2.6.32.46/arch/x86/kernel/kvm.c 2011-08-24 18:35:52.000000000 -0400
15649@@ -216,6 +216,7 @@ static void __init paravirt_ops_setup(vo
15650 pv_mmu_ops.set_pud = kvm_set_pud;
15651 #if PAGETABLE_LEVELS == 4
15652 pv_mmu_ops.set_pgd = kvm_set_pgd;
15653+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
15654 #endif
15655 #endif
15656 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
15657diff -urNp linux-2.6.32.46/arch/x86/kernel/ldt.c linux-2.6.32.46/arch/x86/kernel/ldt.c
15658--- linux-2.6.32.46/arch/x86/kernel/ldt.c 2011-03-27 14:31:47.000000000 -0400
15659+++ linux-2.6.32.46/arch/x86/kernel/ldt.c 2011-04-17 15:56:46.000000000 -0400
15660@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
15661 if (reload) {
15662 #ifdef CONFIG_SMP
15663 preempt_disable();
15664- load_LDT(pc);
15665+ load_LDT_nolock(pc);
15666 if (!cpumask_equal(mm_cpumask(current->mm),
15667 cpumask_of(smp_processor_id())))
15668 smp_call_function(flush_ldt, current->mm, 1);
15669 preempt_enable();
15670 #else
15671- load_LDT(pc);
15672+ load_LDT_nolock(pc);
15673 #endif
15674 }
15675 if (oldsize) {
15676@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t
15677 return err;
15678
15679 for (i = 0; i < old->size; i++)
15680- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15681+ write_ldt_entry(new->ldt, i, old->ldt + i);
15682 return 0;
15683 }
15684
15685@@ -115,6 +115,24 @@ int init_new_context(struct task_struct
15686 retval = copy_ldt(&mm->context, &old_mm->context);
15687 mutex_unlock(&old_mm->context.lock);
15688 }
15689+
15690+ if (tsk == current) {
15691+ mm->context.vdso = 0;
15692+
15693+#ifdef CONFIG_X86_32
15694+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15695+ mm->context.user_cs_base = 0UL;
15696+ mm->context.user_cs_limit = ~0UL;
15697+
15698+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15699+ cpus_clear(mm->context.cpu_user_cs_mask);
15700+#endif
15701+
15702+#endif
15703+#endif
15704+
15705+ }
15706+
15707 return retval;
15708 }
15709
15710@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
15711 }
15712 }
15713
15714+#ifdef CONFIG_PAX_SEGMEXEC
15715+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15716+ error = -EINVAL;
15717+ goto out_unlock;
15718+ }
15719+#endif
15720+
15721 fill_ldt(&ldt, &ldt_info);
15722 if (oldmode)
15723 ldt.avl = 0;
15724diff -urNp linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c
15725--- linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c 2011-03-27 14:31:47.000000000 -0400
15726+++ linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c 2011-04-17 15:56:46.000000000 -0400
15727@@ -26,7 +26,7 @@
15728 #include <asm/system.h>
15729 #include <asm/cacheflush.h>
15730
15731-static void set_idt(void *newidt, __u16 limit)
15732+static void set_idt(struct desc_struct *newidt, __u16 limit)
15733 {
15734 struct desc_ptr curidt;
15735
15736@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16
15737 }
15738
15739
15740-static void set_gdt(void *newgdt, __u16 limit)
15741+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15742 {
15743 struct desc_ptr curgdt;
15744
15745@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15746 }
15747
15748 control_page = page_address(image->control_code_page);
15749- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15750+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15751
15752 relocate_kernel_ptr = control_page;
15753 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15754diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_amd.c linux-2.6.32.46/arch/x86/kernel/microcode_amd.c
15755--- linux-2.6.32.46/arch/x86/kernel/microcode_amd.c 2011-04-17 17:00:52.000000000 -0400
15756+++ linux-2.6.32.46/arch/x86/kernel/microcode_amd.c 2011-04-17 17:03:05.000000000 -0400
15757@@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int c
15758 uci->mc = NULL;
15759 }
15760
15761-static struct microcode_ops microcode_amd_ops = {
15762+static const struct microcode_ops microcode_amd_ops = {
15763 .request_microcode_user = request_microcode_user,
15764 .request_microcode_fw = request_microcode_fw,
15765 .collect_cpu_info = collect_cpu_info_amd,
15766@@ -372,7 +372,7 @@ static struct microcode_ops microcode_am
15767 .microcode_fini_cpu = microcode_fini_cpu_amd,
15768 };
15769
15770-struct microcode_ops * __init init_amd_microcode(void)
15771+const struct microcode_ops * __init init_amd_microcode(void)
15772 {
15773 return &microcode_amd_ops;
15774 }
15775diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_core.c linux-2.6.32.46/arch/x86/kernel/microcode_core.c
15776--- linux-2.6.32.46/arch/x86/kernel/microcode_core.c 2011-03-27 14:31:47.000000000 -0400
15777+++ linux-2.6.32.46/arch/x86/kernel/microcode_core.c 2011-04-17 15:56:46.000000000 -0400
15778@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
15779
15780 #define MICROCODE_VERSION "2.00"
15781
15782-static struct microcode_ops *microcode_ops;
15783+static const struct microcode_ops *microcode_ops;
15784
15785 /*
15786 * Synchronization.
15787diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_intel.c linux-2.6.32.46/arch/x86/kernel/microcode_intel.c
15788--- linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400
15789+++ linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-04-17 15:56:46.000000000 -0400
15790@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
15791
15792 static int get_ucode_user(void *to, const void *from, size_t n)
15793 {
15794- return copy_from_user(to, from, n);
15795+ return copy_from_user(to, (__force const void __user *)from, n);
15796 }
15797
15798 static enum ucode_state
15799 request_microcode_user(int cpu, const void __user *buf, size_t size)
15800 {
15801- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
15802+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
15803 }
15804
15805 static void microcode_fini_cpu(int cpu)
15806@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
15807 uci->mc = NULL;
15808 }
15809
15810-static struct microcode_ops microcode_intel_ops = {
15811+static const struct microcode_ops microcode_intel_ops = {
15812 .request_microcode_user = request_microcode_user,
15813 .request_microcode_fw = request_microcode_fw,
15814 .collect_cpu_info = collect_cpu_info,
15815@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
15816 .microcode_fini_cpu = microcode_fini_cpu,
15817 };
15818
15819-struct microcode_ops * __init init_intel_microcode(void)
15820+const struct microcode_ops * __init init_intel_microcode(void)
15821 {
15822 return &microcode_intel_ops;
15823 }
15824diff -urNp linux-2.6.32.46/arch/x86/kernel/module.c linux-2.6.32.46/arch/x86/kernel/module.c
15825--- linux-2.6.32.46/arch/x86/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
15826+++ linux-2.6.32.46/arch/x86/kernel/module.c 2011-04-17 15:56:46.000000000 -0400
15827@@ -34,7 +34,7 @@
15828 #define DEBUGP(fmt...)
15829 #endif
15830
15831-void *module_alloc(unsigned long size)
15832+static void *__module_alloc(unsigned long size, pgprot_t prot)
15833 {
15834 struct vm_struct *area;
15835
15836@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
15837 if (!area)
15838 return NULL;
15839
15840- return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
15841- PAGE_KERNEL_EXEC);
15842+ return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
15843+}
15844+
15845+void *module_alloc(unsigned long size)
15846+{
15847+
15848+#ifdef CONFIG_PAX_KERNEXEC
15849+ return __module_alloc(size, PAGE_KERNEL);
15850+#else
15851+ return __module_alloc(size, PAGE_KERNEL_EXEC);
15852+#endif
15853+
15854 }
15855
15856 /* Free memory returned from module_alloc */
15857@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
15858 vfree(module_region);
15859 }
15860
15861+#ifdef CONFIG_PAX_KERNEXEC
15862+#ifdef CONFIG_X86_32
15863+void *module_alloc_exec(unsigned long size)
15864+{
15865+ struct vm_struct *area;
15866+
15867+ if (size == 0)
15868+ return NULL;
15869+
15870+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
15871+ return area ? area->addr : NULL;
15872+}
15873+EXPORT_SYMBOL(module_alloc_exec);
15874+
15875+void module_free_exec(struct module *mod, void *module_region)
15876+{
15877+ vunmap(module_region);
15878+}
15879+EXPORT_SYMBOL(module_free_exec);
15880+#else
15881+void module_free_exec(struct module *mod, void *module_region)
15882+{
15883+ module_free(mod, module_region);
15884+}
15885+EXPORT_SYMBOL(module_free_exec);
15886+
15887+void *module_alloc_exec(unsigned long size)
15888+{
15889+ return __module_alloc(size, PAGE_KERNEL_RX);
15890+}
15891+EXPORT_SYMBOL(module_alloc_exec);
15892+#endif
15893+#endif
15894+
15895 /* We don't need anything special. */
15896 int module_frob_arch_sections(Elf_Ehdr *hdr,
15897 Elf_Shdr *sechdrs,
15898@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15899 unsigned int i;
15900 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
15901 Elf32_Sym *sym;
15902- uint32_t *location;
15903+ uint32_t *plocation, location;
15904
15905 DEBUGP("Applying relocate section %u to %u\n", relsec,
15906 sechdrs[relsec].sh_info);
15907 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
15908 /* This is where to make the change */
15909- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
15910- + rel[i].r_offset;
15911+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
15912+ location = (uint32_t)plocation;
15913+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
15914+ plocation = ktla_ktva((void *)plocation);
15915 /* This is the symbol it is referring to. Note that all
15916 undefined symbols have been resolved. */
15917 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
15918@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
15919 switch (ELF32_R_TYPE(rel[i].r_info)) {
15920 case R_386_32:
15921 /* We add the value into the location given */
15922- *location += sym->st_value;
15923+ pax_open_kernel();
15924+ *plocation += sym->st_value;
15925+ pax_close_kernel();
15926 break;
15927 case R_386_PC32:
15928 /* Add the value, subtract its postition */
15929- *location += sym->st_value - (uint32_t)location;
15930+ pax_open_kernel();
15931+ *plocation += sym->st_value - location;
15932+ pax_close_kernel();
15933 break;
15934 default:
15935 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
15936@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
15937 case R_X86_64_NONE:
15938 break;
15939 case R_X86_64_64:
15940+ pax_open_kernel();
15941 *(u64 *)loc = val;
15942+ pax_close_kernel();
15943 break;
15944 case R_X86_64_32:
15945+ pax_open_kernel();
15946 *(u32 *)loc = val;
15947+ pax_close_kernel();
15948 if (val != *(u32 *)loc)
15949 goto overflow;
15950 break;
15951 case R_X86_64_32S:
15952+ pax_open_kernel();
15953 *(s32 *)loc = val;
15954+ pax_close_kernel();
15955 if ((s64)val != *(s32 *)loc)
15956 goto overflow;
15957 break;
15958 case R_X86_64_PC32:
15959 val -= (u64)loc;
15960+ pax_open_kernel();
15961 *(u32 *)loc = val;
15962+ pax_close_kernel();
15963+
15964 #if 0
15965 if ((s64)val != *(s32 *)loc)
15966 goto overflow;
15967diff -urNp linux-2.6.32.46/arch/x86/kernel/paravirt.c linux-2.6.32.46/arch/x86/kernel/paravirt.c
15968--- linux-2.6.32.46/arch/x86/kernel/paravirt.c 2011-03-27 14:31:47.000000000 -0400
15969+++ linux-2.6.32.46/arch/x86/kernel/paravirt.c 2011-08-23 20:24:19.000000000 -0400
15970@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
15971 {
15972 return x;
15973 }
15974+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
15975+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
15976+#endif
15977
15978 void __init default_banner(void)
15979 {
15980@@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
15981 * corresponding structure. */
15982 static void *get_call_destination(u8 type)
15983 {
15984- struct paravirt_patch_template tmpl = {
15985+ const struct paravirt_patch_template tmpl = {
15986 .pv_init_ops = pv_init_ops,
15987 .pv_time_ops = pv_time_ops,
15988 .pv_cpu_ops = pv_cpu_ops,
15989@@ -133,6 +136,8 @@ static void *get_call_destination(u8 typ
15990 .pv_lock_ops = pv_lock_ops,
15991 #endif
15992 };
15993+
15994+ pax_track_stack();
15995 return *((void **)&tmpl + type);
15996 }
15997
15998@@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type,
15999 if (opfunc == NULL)
16000 /* If there's no function, patch it with a ud2a (BUG) */
16001 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16002- else if (opfunc == _paravirt_nop)
16003+ else if (opfunc == (void *)_paravirt_nop)
16004 /* If the operation is a nop, then nop the callsite */
16005 ret = paravirt_patch_nop();
16006
16007 /* identity functions just return their single argument */
16008- else if (opfunc == _paravirt_ident_32)
16009+ else if (opfunc == (void *)_paravirt_ident_32)
16010 ret = paravirt_patch_ident_32(insnbuf, len);
16011- else if (opfunc == _paravirt_ident_64)
16012+ else if (opfunc == (void *)_paravirt_ident_64)
16013+ ret = paravirt_patch_ident_64(insnbuf, len);
16014+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16015+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16016 ret = paravirt_patch_ident_64(insnbuf, len);
16017+#endif
16018
16019 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16020 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16021@@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insn
16022 if (insn_len > len || start == NULL)
16023 insn_len = len;
16024 else
16025- memcpy(insnbuf, start, insn_len);
16026+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16027
16028 return insn_len;
16029 }
16030@@ -294,22 +303,22 @@ void arch_flush_lazy_mmu_mode(void)
16031 preempt_enable();
16032 }
16033
16034-struct pv_info pv_info = {
16035+struct pv_info pv_info __read_only = {
16036 .name = "bare hardware",
16037 .paravirt_enabled = 0,
16038 .kernel_rpl = 0,
16039 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16040 };
16041
16042-struct pv_init_ops pv_init_ops = {
16043+struct pv_init_ops pv_init_ops __read_only = {
16044 .patch = native_patch,
16045 };
16046
16047-struct pv_time_ops pv_time_ops = {
16048+struct pv_time_ops pv_time_ops __read_only = {
16049 .sched_clock = native_sched_clock,
16050 };
16051
16052-struct pv_irq_ops pv_irq_ops = {
16053+struct pv_irq_ops pv_irq_ops __read_only = {
16054 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16055 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16056 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16057@@ -321,7 +330,7 @@ struct pv_irq_ops pv_irq_ops = {
16058 #endif
16059 };
16060
16061-struct pv_cpu_ops pv_cpu_ops = {
16062+struct pv_cpu_ops pv_cpu_ops __read_only = {
16063 .cpuid = native_cpuid,
16064 .get_debugreg = native_get_debugreg,
16065 .set_debugreg = native_set_debugreg,
16066@@ -382,21 +391,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16067 .end_context_switch = paravirt_nop,
16068 };
16069
16070-struct pv_apic_ops pv_apic_ops = {
16071+struct pv_apic_ops pv_apic_ops __read_only = {
16072 #ifdef CONFIG_X86_LOCAL_APIC
16073 .startup_ipi_hook = paravirt_nop,
16074 #endif
16075 };
16076
16077-#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16078+#ifdef CONFIG_X86_32
16079+#ifdef CONFIG_X86_PAE
16080+/* 64-bit pagetable entries */
16081+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16082+#else
16083 /* 32-bit pagetable entries */
16084 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16085+#endif
16086 #else
16087 /* 64-bit pagetable entries */
16088 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16089 #endif
16090
16091-struct pv_mmu_ops pv_mmu_ops = {
16092+struct pv_mmu_ops pv_mmu_ops __read_only = {
16093
16094 .read_cr2 = native_read_cr2,
16095 .write_cr2 = native_write_cr2,
16096@@ -448,6 +462,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16097 .make_pud = PTE_IDENT,
16098
16099 .set_pgd = native_set_pgd,
16100+ .set_pgd_batched = native_set_pgd_batched,
16101 #endif
16102 #endif /* PAGETABLE_LEVELS >= 3 */
16103
16104@@ -467,6 +482,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16105 },
16106
16107 .set_fixmap = native_set_fixmap,
16108+
16109+#ifdef CONFIG_PAX_KERNEXEC
16110+ .pax_open_kernel = native_pax_open_kernel,
16111+ .pax_close_kernel = native_pax_close_kernel,
16112+#endif
16113+
16114 };
16115
16116 EXPORT_SYMBOL_GPL(pv_time_ops);
16117diff -urNp linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c
16118--- linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c 2011-03-27 14:31:47.000000000 -0400
16119+++ linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c 2011-04-17 15:56:46.000000000 -0400
16120@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
16121 __raw_spin_lock(lock);
16122 }
16123
16124-struct pv_lock_ops pv_lock_ops = {
16125+struct pv_lock_ops pv_lock_ops __read_only = {
16126 #ifdef CONFIG_SMP
16127 .spin_is_locked = __ticket_spin_is_locked,
16128 .spin_is_contended = __ticket_spin_is_contended,
16129diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c
16130--- linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c 2011-03-27 14:31:47.000000000 -0400
16131+++ linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c 2011-04-17 15:56:46.000000000 -0400
16132@@ -477,7 +477,7 @@ static void calgary_free_coherent(struct
16133 free_pages((unsigned long)vaddr, get_order(size));
16134 }
16135
16136-static struct dma_map_ops calgary_dma_ops = {
16137+static const struct dma_map_ops calgary_dma_ops = {
16138 .alloc_coherent = calgary_alloc_coherent,
16139 .free_coherent = calgary_free_coherent,
16140 .map_sg = calgary_map_sg,
16141diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-dma.c linux-2.6.32.46/arch/x86/kernel/pci-dma.c
16142--- linux-2.6.32.46/arch/x86/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
16143+++ linux-2.6.32.46/arch/x86/kernel/pci-dma.c 2011-04-17 15:56:46.000000000 -0400
16144@@ -14,7 +14,7 @@
16145
16146 static int forbid_dac __read_mostly;
16147
16148-struct dma_map_ops *dma_ops;
16149+const struct dma_map_ops *dma_ops;
16150 EXPORT_SYMBOL(dma_ops);
16151
16152 static int iommu_sac_force __read_mostly;
16153@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
16154
16155 int dma_supported(struct device *dev, u64 mask)
16156 {
16157- struct dma_map_ops *ops = get_dma_ops(dev);
16158+ const struct dma_map_ops *ops = get_dma_ops(dev);
16159
16160 #ifdef CONFIG_PCI
16161 if (mask > 0xffffffff && forbid_dac > 0) {
16162diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c
16163--- linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c 2011-03-27 14:31:47.000000000 -0400
16164+++ linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c 2011-04-17 15:56:46.000000000 -0400
16165@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
16166 return -1;
16167 }
16168
16169-static struct dma_map_ops gart_dma_ops = {
16170+static const struct dma_map_ops gart_dma_ops = {
16171 .map_sg = gart_map_sg,
16172 .unmap_sg = gart_unmap_sg,
16173 .map_page = gart_map_page,
16174diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-nommu.c linux-2.6.32.46/arch/x86/kernel/pci-nommu.c
16175--- linux-2.6.32.46/arch/x86/kernel/pci-nommu.c 2011-03-27 14:31:47.000000000 -0400
16176+++ linux-2.6.32.46/arch/x86/kernel/pci-nommu.c 2011-04-17 15:56:46.000000000 -0400
16177@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
16178 flush_write_buffers();
16179 }
16180
16181-struct dma_map_ops nommu_dma_ops = {
16182+const struct dma_map_ops nommu_dma_ops = {
16183 .alloc_coherent = dma_generic_alloc_coherent,
16184 .free_coherent = nommu_free_coherent,
16185 .map_sg = nommu_map_sg,
16186diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c
16187--- linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
16188+++ linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c 2011-04-17 15:56:46.000000000 -0400
16189@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
16190 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16191 }
16192
16193-static struct dma_map_ops swiotlb_dma_ops = {
16194+static const struct dma_map_ops swiotlb_dma_ops = {
16195 .mapping_error = swiotlb_dma_mapping_error,
16196 .alloc_coherent = x86_swiotlb_alloc_coherent,
16197 .free_coherent = swiotlb_free_coherent,
16198diff -urNp linux-2.6.32.46/arch/x86/kernel/process_32.c linux-2.6.32.46/arch/x86/kernel/process_32.c
16199--- linux-2.6.32.46/arch/x86/kernel/process_32.c 2011-06-25 12:55:34.000000000 -0400
16200+++ linux-2.6.32.46/arch/x86/kernel/process_32.c 2011-06-25 12:56:37.000000000 -0400
16201@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
16202 unsigned long thread_saved_pc(struct task_struct *tsk)
16203 {
16204 return ((unsigned long *)tsk->thread.sp)[3];
16205+//XXX return tsk->thread.eip;
16206 }
16207
16208 #ifndef CONFIG_SMP
16209@@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, i
16210 unsigned short ss, gs;
16211 const char *board;
16212
16213- if (user_mode_vm(regs)) {
16214+ if (user_mode(regs)) {
16215 sp = regs->sp;
16216 ss = regs->ss & 0xffff;
16217- gs = get_user_gs(regs);
16218 } else {
16219 sp = (unsigned long) (&regs->sp);
16220 savesegment(ss, ss);
16221- savesegment(gs, gs);
16222 }
16223+ gs = get_user_gs(regs);
16224
16225 printk("\n");
16226
16227@@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), voi
16228 regs.bx = (unsigned long) fn;
16229 regs.dx = (unsigned long) arg;
16230
16231- regs.ds = __USER_DS;
16232- regs.es = __USER_DS;
16233+ regs.ds = __KERNEL_DS;
16234+ regs.es = __KERNEL_DS;
16235 regs.fs = __KERNEL_PERCPU;
16236- regs.gs = __KERNEL_STACK_CANARY;
16237+ savesegment(gs, regs.gs);
16238 regs.orig_ax = -1;
16239 regs.ip = (unsigned long) kernel_thread_helper;
16240 regs.cs = __KERNEL_CS | get_kernel_rpl();
16241@@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flag
16242 struct task_struct *tsk;
16243 int err;
16244
16245- childregs = task_pt_regs(p);
16246+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16247 *childregs = *regs;
16248 childregs->ax = 0;
16249 childregs->sp = sp;
16250
16251 p->thread.sp = (unsigned long) childregs;
16252 p->thread.sp0 = (unsigned long) (childregs+1);
16253+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16254
16255 p->thread.ip = (unsigned long) ret_from_fork;
16256
16257@@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p,
16258 struct thread_struct *prev = &prev_p->thread,
16259 *next = &next_p->thread;
16260 int cpu = smp_processor_id();
16261- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16262+ struct tss_struct *tss = init_tss + cpu;
16263 bool preload_fpu;
16264
16265 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16266@@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p,
16267 */
16268 lazy_save_gs(prev->gs);
16269
16270+#ifdef CONFIG_PAX_MEMORY_UDEREF
16271+ __set_fs(task_thread_info(next_p)->addr_limit);
16272+#endif
16273+
16274 /*
16275 * Load the per-thread Thread-Local Storage descriptor.
16276 */
16277@@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p,
16278 */
16279 arch_end_context_switch(next_p);
16280
16281+ percpu_write(current_task, next_p);
16282+ percpu_write(current_tinfo, &next_p->tinfo);
16283+
16284 if (preload_fpu)
16285 __math_state_restore();
16286
16287@@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p,
16288 if (prev->gs | next->gs)
16289 lazy_load_gs(next->gs);
16290
16291- percpu_write(current_task, next_p);
16292-
16293 return prev_p;
16294 }
16295
16296@@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_stru
16297 } while (count++ < 16);
16298 return 0;
16299 }
16300-
16301diff -urNp linux-2.6.32.46/arch/x86/kernel/process_64.c linux-2.6.32.46/arch/x86/kernel/process_64.c
16302--- linux-2.6.32.46/arch/x86/kernel/process_64.c 2011-06-25 12:55:34.000000000 -0400
16303+++ linux-2.6.32.46/arch/x86/kernel/process_64.c 2011-06-25 12:56:37.000000000 -0400
16304@@ -91,7 +91,7 @@ static void __exit_idle(void)
16305 void exit_idle(void)
16306 {
16307 /* idle loop has pid 0 */
16308- if (current->pid)
16309+ if (task_pid_nr(current))
16310 return;
16311 __exit_idle();
16312 }
16313@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
16314 if (!board)
16315 board = "";
16316 printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
16317- current->pid, current->comm, print_tainted(),
16318+ task_pid_nr(current), current->comm, print_tainted(),
16319 init_utsname()->release,
16320 (int)strcspn(init_utsname()->version, " "),
16321 init_utsname()->version, board);
16322@@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flag
16323 struct pt_regs *childregs;
16324 struct task_struct *me = current;
16325
16326- childregs = ((struct pt_regs *)
16327- (THREAD_SIZE + task_stack_page(p))) - 1;
16328+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16329 *childregs = *regs;
16330
16331 childregs->ax = 0;
16332@@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flag
16333 p->thread.sp = (unsigned long) childregs;
16334 p->thread.sp0 = (unsigned long) (childregs+1);
16335 p->thread.usersp = me->thread.usersp;
16336+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16337
16338 set_tsk_thread_flag(p, TIF_FORK);
16339
16340@@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p,
16341 struct thread_struct *prev = &prev_p->thread;
16342 struct thread_struct *next = &next_p->thread;
16343 int cpu = smp_processor_id();
16344- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16345+ struct tss_struct *tss = init_tss + cpu;
16346 unsigned fsindex, gsindex;
16347 bool preload_fpu;
16348
16349@@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p,
16350 prev->usersp = percpu_read(old_rsp);
16351 percpu_write(old_rsp, next->usersp);
16352 percpu_write(current_task, next_p);
16353+ percpu_write(current_tinfo, &next_p->tinfo);
16354
16355- percpu_write(kernel_stack,
16356- (unsigned long)task_stack_page(next_p) +
16357- THREAD_SIZE - KERNEL_STACK_OFFSET);
16358+ percpu_write(kernel_stack, next->sp0);
16359
16360 /*
16361 * Now maybe reload the debug registers and handle I/O bitmaps
16362@@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_stru
16363 if (!p || p == current || p->state == TASK_RUNNING)
16364 return 0;
16365 stack = (unsigned long)task_stack_page(p);
16366- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16367+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16368 return 0;
16369 fp = *(u64 *)(p->thread.sp);
16370 do {
16371- if (fp < (unsigned long)stack ||
16372- fp >= (unsigned long)stack+THREAD_SIZE)
16373+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16374 return 0;
16375 ip = *(u64 *)(fp+8);
16376 if (!in_sched_functions(ip))
16377diff -urNp linux-2.6.32.46/arch/x86/kernel/process.c linux-2.6.32.46/arch/x86/kernel/process.c
16378--- linux-2.6.32.46/arch/x86/kernel/process.c 2011-04-22 19:16:29.000000000 -0400
16379+++ linux-2.6.32.46/arch/x86/kernel/process.c 2011-08-30 18:19:52.000000000 -0400
16380@@ -51,16 +51,33 @@ void free_thread_xstate(struct task_stru
16381
16382 void free_thread_info(struct thread_info *ti)
16383 {
16384- free_thread_xstate(ti->task);
16385 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16386 }
16387
16388+static struct kmem_cache *task_struct_cachep;
16389+
16390 void arch_task_cache_init(void)
16391 {
16392- task_xstate_cachep =
16393- kmem_cache_create("task_xstate", xstate_size,
16394+ /* create a slab on which task_structs can be allocated */
16395+ task_struct_cachep =
16396+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16397+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16398+
16399+ task_xstate_cachep =
16400+ kmem_cache_create("task_xstate", xstate_size,
16401 __alignof__(union thread_xstate),
16402- SLAB_PANIC | SLAB_NOTRACK, NULL);
16403+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16404+}
16405+
16406+struct task_struct *alloc_task_struct(void)
16407+{
16408+ return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
16409+}
16410+
16411+void free_task_struct(struct task_struct *task)
16412+{
16413+ free_thread_xstate(task);
16414+ kmem_cache_free(task_struct_cachep, task);
16415 }
16416
16417 /*
16418@@ -73,7 +90,7 @@ void exit_thread(void)
16419 unsigned long *bp = t->io_bitmap_ptr;
16420
16421 if (bp) {
16422- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16423+ struct tss_struct *tss = init_tss + get_cpu();
16424
16425 t->io_bitmap_ptr = NULL;
16426 clear_thread_flag(TIF_IO_BITMAP);
16427@@ -93,6 +110,9 @@ void flush_thread(void)
16428
16429 clear_tsk_thread_flag(tsk, TIF_DEBUG);
16430
16431+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16432+ loadsegment(gs, 0);
16433+#endif
16434 tsk->thread.debugreg0 = 0;
16435 tsk->thread.debugreg1 = 0;
16436 tsk->thread.debugreg2 = 0;
16437@@ -307,7 +327,7 @@ void default_idle(void)
16438 EXPORT_SYMBOL(default_idle);
16439 #endif
16440
16441-void stop_this_cpu(void *dummy)
16442+__noreturn void stop_this_cpu(void *dummy)
16443 {
16444 local_irq_disable();
16445 /*
16446@@ -568,16 +588,38 @@ static int __init idle_setup(char *str)
16447 }
16448 early_param("idle", idle_setup);
16449
16450-unsigned long arch_align_stack(unsigned long sp)
16451+#ifdef CONFIG_PAX_RANDKSTACK
16452+void pax_randomize_kstack(struct pt_regs *regs)
16453 {
16454- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16455- sp -= get_random_int() % 8192;
16456- return sp & ~0xf;
16457-}
16458+ struct thread_struct *thread = &current->thread;
16459+ unsigned long time;
16460
16461-unsigned long arch_randomize_brk(struct mm_struct *mm)
16462-{
16463- unsigned long range_end = mm->brk + 0x02000000;
16464- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16465+ if (!randomize_va_space)
16466+ return;
16467+
16468+ if (v8086_mode(regs))
16469+ return;
16470+
16471+ rdtscl(time);
16472+
16473+ /* P4 seems to return a 0 LSB, ignore it */
16474+#ifdef CONFIG_MPENTIUM4
16475+ time &= 0x3EUL;
16476+ time <<= 2;
16477+#elif defined(CONFIG_X86_64)
16478+ time &= 0xFUL;
16479+ time <<= 4;
16480+#else
16481+ time &= 0x1FUL;
16482+ time <<= 3;
16483+#endif
16484+
16485+ thread->sp0 ^= time;
16486+ load_sp0(init_tss + smp_processor_id(), thread);
16487+
16488+#ifdef CONFIG_X86_64
16489+ percpu_write(kernel_stack, thread->sp0);
16490+#endif
16491 }
16492+#endif
16493
16494diff -urNp linux-2.6.32.46/arch/x86/kernel/ptrace.c linux-2.6.32.46/arch/x86/kernel/ptrace.c
16495--- linux-2.6.32.46/arch/x86/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
16496+++ linux-2.6.32.46/arch/x86/kernel/ptrace.c 2011-04-17 15:56:46.000000000 -0400
16497@@ -925,7 +925,7 @@ static const struct user_regset_view use
16498 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
16499 {
16500 int ret;
16501- unsigned long __user *datap = (unsigned long __user *)data;
16502+ unsigned long __user *datap = (__force unsigned long __user *)data;
16503
16504 switch (request) {
16505 /* read the word at location addr in the USER area. */
16506@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
16507 if (addr < 0)
16508 return -EIO;
16509 ret = do_get_thread_area(child, addr,
16510- (struct user_desc __user *) data);
16511+ (__force struct user_desc __user *) data);
16512 break;
16513
16514 case PTRACE_SET_THREAD_AREA:
16515 if (addr < 0)
16516 return -EIO;
16517 ret = do_set_thread_area(child, addr,
16518- (struct user_desc __user *) data, 0);
16519+ (__force struct user_desc __user *) data, 0);
16520 break;
16521 #endif
16522
16523@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
16524 #ifdef CONFIG_X86_PTRACE_BTS
16525 case PTRACE_BTS_CONFIG:
16526 ret = ptrace_bts_config
16527- (child, data, (struct ptrace_bts_config __user *)addr);
16528+ (child, data, (__force struct ptrace_bts_config __user *)addr);
16529 break;
16530
16531 case PTRACE_BTS_STATUS:
16532 ret = ptrace_bts_status
16533- (child, data, (struct ptrace_bts_config __user *)addr);
16534+ (child, data, (__force struct ptrace_bts_config __user *)addr);
16535 break;
16536
16537 case PTRACE_BTS_SIZE:
16538@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
16539
16540 case PTRACE_BTS_GET:
16541 ret = ptrace_bts_read_record
16542- (child, data, (struct bts_struct __user *) addr);
16543+ (child, data, (__force struct bts_struct __user *) addr);
16544 break;
16545
16546 case PTRACE_BTS_CLEAR:
16547@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
16548
16549 case PTRACE_BTS_DRAIN:
16550 ret = ptrace_bts_drain
16551- (child, data, (struct bts_struct __user *) addr);
16552+ (child, data, (__force struct bts_struct __user *) addr);
16553 break;
16554 #endif /* CONFIG_X86_PTRACE_BTS */
16555
16556@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
16557 info.si_code = si_code;
16558
16559 /* User-mode ip? */
16560- info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
16561+ info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
16562
16563 /* Send us the fake SIGTRAP */
16564 force_sig_info(SIGTRAP, &info, tsk);
16565@@ -1469,7 +1469,7 @@ void send_sigtrap(struct task_struct *ts
16566 * We must return the syscall number to actually look up in the table.
16567 * This can be -1L to skip running any syscall at all.
16568 */
16569-asmregparm long syscall_trace_enter(struct pt_regs *regs)
16570+long syscall_trace_enter(struct pt_regs *regs)
16571 {
16572 long ret = 0;
16573
16574@@ -1514,7 +1514,7 @@ asmregparm long syscall_trace_enter(stru
16575 return ret ?: regs->orig_ax;
16576 }
16577
16578-asmregparm void syscall_trace_leave(struct pt_regs *regs)
16579+void syscall_trace_leave(struct pt_regs *regs)
16580 {
16581 if (unlikely(current->audit_context))
16582 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
16583diff -urNp linux-2.6.32.46/arch/x86/kernel/reboot.c linux-2.6.32.46/arch/x86/kernel/reboot.c
16584--- linux-2.6.32.46/arch/x86/kernel/reboot.c 2011-08-09 18:35:28.000000000 -0400
16585+++ linux-2.6.32.46/arch/x86/kernel/reboot.c 2011-08-09 18:33:59.000000000 -0400
16586@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
16587 EXPORT_SYMBOL(pm_power_off);
16588
16589 static const struct desc_ptr no_idt = {};
16590-static int reboot_mode;
16591+static unsigned short reboot_mode;
16592 enum reboot_type reboot_type = BOOT_KBD;
16593 int reboot_force;
16594
16595@@ -292,12 +292,12 @@ core_initcall(reboot_init);
16596 controller to pulse the CPU reset line, which is more thorough, but
16597 doesn't work with at least one type of 486 motherboard. It is easy
16598 to stop this code working; hence the copious comments. */
16599-static const unsigned long long
16600-real_mode_gdt_entries [3] =
16601+static struct desc_struct
16602+real_mode_gdt_entries [3] __read_only =
16603 {
16604- 0x0000000000000000ULL, /* Null descriptor */
16605- 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
16606- 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
16607+ GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
16608+ GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
16609+ GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
16610 };
16611
16612 static const struct desc_ptr
16613@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios
16614 * specified by the code and length parameters.
16615 * We assume that length will aways be less that 100!
16616 */
16617-void machine_real_restart(const unsigned char *code, int length)
16618+__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
16619 {
16620 local_irq_disable();
16621
16622@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
16623 /* Remap the kernel at virtual address zero, as well as offset zero
16624 from the kernel segment. This assumes the kernel segment starts at
16625 virtual address PAGE_OFFSET. */
16626- memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16627- sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
16628+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16629+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
16630
16631 /*
16632 * Use `swapper_pg_dir' as our page directory.
16633@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
16634 boot)". This seems like a fairly standard thing that gets set by
16635 REBOOT.COM programs, and the previous reset routine did this
16636 too. */
16637- *((unsigned short *)0x472) = reboot_mode;
16638+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16639
16640 /* For the switch to real mode, copy some code to low memory. It has
16641 to be in the first 64k because it is running in 16-bit mode, and it
16642 has to have the same physical and virtual address, because it turns
16643 off paging. Copy it near the end of the first page, out of the way
16644 of BIOS variables. */
16645- memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
16646- real_mode_switch, sizeof (real_mode_switch));
16647- memcpy((void *)(0x1000 - 100), code, length);
16648+ memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
16649+ memcpy(__va(0x1000 - 100), code, length);
16650
16651 /* Set up the IDT for real mode. */
16652 load_idt(&real_mode_idt);
16653@@ -416,6 +415,7 @@ void machine_real_restart(const unsigned
16654 __asm__ __volatile__ ("ljmp $0x0008,%0"
16655 :
16656 : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
16657+ do { } while (1);
16658 }
16659 #ifdef CONFIG_APM_MODULE
16660 EXPORT_SYMBOL(machine_real_restart);
16661@@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_f
16662 {
16663 }
16664
16665-static void native_machine_emergency_restart(void)
16666+__noreturn static void native_machine_emergency_restart(void)
16667 {
16668 int i;
16669
16670@@ -659,13 +659,13 @@ void native_machine_shutdown(void)
16671 #endif
16672 }
16673
16674-static void __machine_emergency_restart(int emergency)
16675+static __noreturn void __machine_emergency_restart(int emergency)
16676 {
16677 reboot_emergency = emergency;
16678 machine_ops.emergency_restart();
16679 }
16680
16681-static void native_machine_restart(char *__unused)
16682+static __noreturn void native_machine_restart(char *__unused)
16683 {
16684 printk("machine restart\n");
16685
16686@@ -674,7 +674,7 @@ static void native_machine_restart(char
16687 __machine_emergency_restart(0);
16688 }
16689
16690-static void native_machine_halt(void)
16691+static __noreturn void native_machine_halt(void)
16692 {
16693 /* stop other cpus and apics */
16694 machine_shutdown();
16695@@ -685,7 +685,7 @@ static void native_machine_halt(void)
16696 stop_this_cpu(NULL);
16697 }
16698
16699-static void native_machine_power_off(void)
16700+__noreturn static void native_machine_power_off(void)
16701 {
16702 if (pm_power_off) {
16703 if (!reboot_force)
16704@@ -694,6 +694,7 @@ static void native_machine_power_off(voi
16705 }
16706 /* a fallback in case there is no PM info available */
16707 tboot_shutdown(TB_SHUTDOWN_HALT);
16708+ do { } while (1);
16709 }
16710
16711 struct machine_ops machine_ops = {
16712diff -urNp linux-2.6.32.46/arch/x86/kernel/setup.c linux-2.6.32.46/arch/x86/kernel/setup.c
16713--- linux-2.6.32.46/arch/x86/kernel/setup.c 2011-04-17 17:00:52.000000000 -0400
16714+++ linux-2.6.32.46/arch/x86/kernel/setup.c 2011-04-17 17:03:05.000000000 -0400
16715@@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
16716
16717 if (!boot_params.hdr.root_flags)
16718 root_mountflags &= ~MS_RDONLY;
16719- init_mm.start_code = (unsigned long) _text;
16720- init_mm.end_code = (unsigned long) _etext;
16721+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16722+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16723 init_mm.end_data = (unsigned long) _edata;
16724 init_mm.brk = _brk_end;
16725
16726- code_resource.start = virt_to_phys(_text);
16727- code_resource.end = virt_to_phys(_etext)-1;
16728- data_resource.start = virt_to_phys(_etext);
16729+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16730+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16731+ data_resource.start = virt_to_phys(_sdata);
16732 data_resource.end = virt_to_phys(_edata)-1;
16733 bss_resource.start = virt_to_phys(&__bss_start);
16734 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16735diff -urNp linux-2.6.32.46/arch/x86/kernel/setup_percpu.c linux-2.6.32.46/arch/x86/kernel/setup_percpu.c
16736--- linux-2.6.32.46/arch/x86/kernel/setup_percpu.c 2011-03-27 14:31:47.000000000 -0400
16737+++ linux-2.6.32.46/arch/x86/kernel/setup_percpu.c 2011-06-04 20:36:29.000000000 -0400
16738@@ -25,19 +25,17 @@
16739 # define DBG(x...)
16740 #endif
16741
16742-DEFINE_PER_CPU(int, cpu_number);
16743+#ifdef CONFIG_SMP
16744+DEFINE_PER_CPU(unsigned int, cpu_number);
16745 EXPORT_PER_CPU_SYMBOL(cpu_number);
16746+#endif
16747
16748-#ifdef CONFIG_X86_64
16749 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16750-#else
16751-#define BOOT_PERCPU_OFFSET 0
16752-#endif
16753
16754 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16755 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16756
16757-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16758+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16759 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16760 };
16761 EXPORT_SYMBOL(__per_cpu_offset);
16762@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
16763 {
16764 #ifdef CONFIG_X86_32
16765 struct desc_struct gdt;
16766+ unsigned long base = per_cpu_offset(cpu);
16767
16768- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16769- 0x2 | DESCTYPE_S, 0x8);
16770- gdt.s = 1;
16771+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16772+ 0x83 | DESCTYPE_S, 0xC);
16773 write_gdt_entry(get_cpu_gdt_table(cpu),
16774 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16775 #endif
16776@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
16777 /* alrighty, percpu areas up and running */
16778 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16779 for_each_possible_cpu(cpu) {
16780+#ifdef CONFIG_CC_STACKPROTECTOR
16781+#ifdef CONFIG_X86_32
16782+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
16783+#endif
16784+#endif
16785 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
16786 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
16787 per_cpu(cpu_number, cpu) = cpu;
16788@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
16789 early_per_cpu_map(x86_cpu_to_node_map, cpu);
16790 #endif
16791 #endif
16792+#ifdef CONFIG_CC_STACKPROTECTOR
16793+#ifdef CONFIG_X86_32
16794+ if (!cpu)
16795+ per_cpu(stack_canary.canary, cpu) = canary;
16796+#endif
16797+#endif
16798 /*
16799 * Up to this point, the boot CPU has been using .data.init
16800 * area. Reload any changed state for the boot CPU.
16801diff -urNp linux-2.6.32.46/arch/x86/kernel/signal.c linux-2.6.32.46/arch/x86/kernel/signal.c
16802--- linux-2.6.32.46/arch/x86/kernel/signal.c 2011-03-27 14:31:47.000000000 -0400
16803+++ linux-2.6.32.46/arch/x86/kernel/signal.c 2011-05-22 23:02:03.000000000 -0400
16804@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
16805 * Align the stack pointer according to the i386 ABI,
16806 * i.e. so that on function entry ((sp + 4) & 15) == 0.
16807 */
16808- sp = ((sp + 4) & -16ul) - 4;
16809+ sp = ((sp - 12) & -16ul) - 4;
16810 #else /* !CONFIG_X86_32 */
16811 sp = round_down(sp, 16) - 8;
16812 #endif
16813@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
16814 * Return an always-bogus address instead so we will die with SIGSEGV.
16815 */
16816 if (onsigstack && !likely(on_sig_stack(sp)))
16817- return (void __user *)-1L;
16818+ return (__force void __user *)-1L;
16819
16820 /* save i387 state */
16821 if (used_math() && save_i387_xstate(*fpstate) < 0)
16822- return (void __user *)-1L;
16823+ return (__force void __user *)-1L;
16824
16825 return (void __user *)sp;
16826 }
16827@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
16828 }
16829
16830 if (current->mm->context.vdso)
16831- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16832+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
16833 else
16834- restorer = &frame->retcode;
16835+ restorer = (void __user *)&frame->retcode;
16836 if (ka->sa.sa_flags & SA_RESTORER)
16837 restorer = ka->sa.sa_restorer;
16838
16839@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
16840 * reasons and because gdb uses it as a signature to notice
16841 * signal handler stack frames.
16842 */
16843- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
16844+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
16845
16846 if (err)
16847 return -EFAULT;
16848@@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, str
16849 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
16850
16851 /* Set up to return from userspace. */
16852- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16853+ if (current->mm->context.vdso)
16854+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
16855+ else
16856+ restorer = (void __user *)&frame->retcode;
16857 if (ka->sa.sa_flags & SA_RESTORER)
16858 restorer = ka->sa.sa_restorer;
16859 put_user_ex(restorer, &frame->pretcode);
16860@@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, str
16861 * reasons and because gdb uses it as a signature to notice
16862 * signal handler stack frames.
16863 */
16864- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
16865+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
16866 } put_user_catch(err);
16867
16868 if (err)
16869@@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *re
16870 int signr;
16871 sigset_t *oldset;
16872
16873+ pax_track_stack();
16874+
16875 /*
16876 * We want the common case to go fast, which is why we may in certain
16877 * cases get here from kernel mode. Just return without doing anything
16878@@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *re
16879 * X86_32: vm86 regs switched out by assembly code before reaching
16880 * here, so testing against kernel CS suffices.
16881 */
16882- if (!user_mode(regs))
16883+ if (!user_mode_novm(regs))
16884 return;
16885
16886 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
16887diff -urNp linux-2.6.32.46/arch/x86/kernel/smpboot.c linux-2.6.32.46/arch/x86/kernel/smpboot.c
16888--- linux-2.6.32.46/arch/x86/kernel/smpboot.c 2011-03-27 14:31:47.000000000 -0400
16889+++ linux-2.6.32.46/arch/x86/kernel/smpboot.c 2011-07-01 19:10:03.000000000 -0400
16890@@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct
16891 */
16892 static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
16893
16894-void cpu_hotplug_driver_lock()
16895+void cpu_hotplug_driver_lock(void)
16896 {
16897- mutex_lock(&x86_cpu_hotplug_driver_mutex);
16898+ mutex_lock(&x86_cpu_hotplug_driver_mutex);
16899 }
16900
16901-void cpu_hotplug_driver_unlock()
16902+void cpu_hotplug_driver_unlock(void)
16903 {
16904- mutex_unlock(&x86_cpu_hotplug_driver_mutex);
16905+ mutex_unlock(&x86_cpu_hotplug_driver_mutex);
16906 }
16907
16908 ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
16909@@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_a
16910 * target processor state.
16911 */
16912 startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
16913- (unsigned long)stack_start.sp);
16914+ stack_start);
16915
16916 /*
16917 * Run STARTUP IPI loop.
16918@@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int api
16919 set_idle_for_cpu(cpu, c_idle.idle);
16920 do_rest:
16921 per_cpu(current_task, cpu) = c_idle.idle;
16922+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
16923 #ifdef CONFIG_X86_32
16924 /* Stack for startup_32 can be just as for start_secondary onwards */
16925 irq_ctx_init(cpu);
16926@@ -750,13 +751,15 @@ do_rest:
16927 #else
16928 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
16929 initial_gs = per_cpu_offset(cpu);
16930- per_cpu(kernel_stack, cpu) =
16931- (unsigned long)task_stack_page(c_idle.idle) -
16932- KERNEL_STACK_OFFSET + THREAD_SIZE;
16933+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
16934 #endif
16935+
16936+ pax_open_kernel();
16937 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
16938+ pax_close_kernel();
16939+
16940 initial_code = (unsigned long)start_secondary;
16941- stack_start.sp = (void *) c_idle.idle->thread.sp;
16942+ stack_start = c_idle.idle->thread.sp;
16943
16944 /* start_ip had better be page-aligned! */
16945 start_ip = setup_trampoline();
16946@@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int
16947
16948 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
16949
16950+#ifdef CONFIG_PAX_PER_CPU_PGD
16951+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
16952+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
16953+ KERNEL_PGD_PTRS);
16954+#endif
16955+
16956 err = do_boot_cpu(apicid, cpu);
16957
16958 if (err) {
16959diff -urNp linux-2.6.32.46/arch/x86/kernel/step.c linux-2.6.32.46/arch/x86/kernel/step.c
16960--- linux-2.6.32.46/arch/x86/kernel/step.c 2011-03-27 14:31:47.000000000 -0400
16961+++ linux-2.6.32.46/arch/x86/kernel/step.c 2011-04-17 15:56:46.000000000 -0400
16962@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
16963 struct desc_struct *desc;
16964 unsigned long base;
16965
16966- seg &= ~7UL;
16967+ seg >>= 3;
16968
16969 mutex_lock(&child->mm->context.lock);
16970- if (unlikely((seg >> 3) >= child->mm->context.size))
16971+ if (unlikely(seg >= child->mm->context.size))
16972 addr = -1L; /* bogus selector, access would fault */
16973 else {
16974 desc = child->mm->context.ldt + seg;
16975@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
16976 addr += base;
16977 }
16978 mutex_unlock(&child->mm->context.lock);
16979- }
16980+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
16981+ addr = ktla_ktva(addr);
16982
16983 return addr;
16984 }
16985@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
16986 unsigned char opcode[15];
16987 unsigned long addr = convert_ip_to_linear(child, regs);
16988
16989+ if (addr == -EINVAL)
16990+ return 0;
16991+
16992 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
16993 for (i = 0; i < copied; i++) {
16994 switch (opcode[i]) {
16995@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
16996
16997 #ifdef CONFIG_X86_64
16998 case 0x40 ... 0x4f:
16999- if (regs->cs != __USER_CS)
17000+ if ((regs->cs & 0xffff) != __USER_CS)
17001 /* 32-bit mode: register increment */
17002 return 0;
17003 /* 64-bit mode: REX prefix */
17004diff -urNp linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S
17005--- linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S 2011-03-27 14:31:47.000000000 -0400
17006+++ linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S 2011-04-17 15:56:46.000000000 -0400
17007@@ -1,3 +1,4 @@
17008+.section .rodata,"a",@progbits
17009 ENTRY(sys_call_table)
17010 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17011 .long sys_exit
17012diff -urNp linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c
17013--- linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c 2011-03-27 14:31:47.000000000 -0400
17014+++ linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c 2011-04-17 15:56:46.000000000 -0400
17015@@ -24,6 +24,21 @@
17016
17017 #include <asm/syscalls.h>
17018
17019+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17020+{
17021+ unsigned long pax_task_size = TASK_SIZE;
17022+
17023+#ifdef CONFIG_PAX_SEGMEXEC
17024+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17025+ pax_task_size = SEGMEXEC_TASK_SIZE;
17026+#endif
17027+
17028+ if (len > pax_task_size || addr > pax_task_size - len)
17029+ return -EINVAL;
17030+
17031+ return 0;
17032+}
17033+
17034 /*
17035 * Perform the select(nd, in, out, ex, tv) and mmap() system
17036 * calls. Linux/i386 didn't use to be able to handle more than
17037@@ -58,6 +73,212 @@ out:
17038 return err;
17039 }
17040
17041+unsigned long
17042+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17043+ unsigned long len, unsigned long pgoff, unsigned long flags)
17044+{
17045+ struct mm_struct *mm = current->mm;
17046+ struct vm_area_struct *vma;
17047+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17048+
17049+#ifdef CONFIG_PAX_SEGMEXEC
17050+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17051+ pax_task_size = SEGMEXEC_TASK_SIZE;
17052+#endif
17053+
17054+ pax_task_size -= PAGE_SIZE;
17055+
17056+ if (len > pax_task_size)
17057+ return -ENOMEM;
17058+
17059+ if (flags & MAP_FIXED)
17060+ return addr;
17061+
17062+#ifdef CONFIG_PAX_RANDMMAP
17063+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17064+#endif
17065+
17066+ if (addr) {
17067+ addr = PAGE_ALIGN(addr);
17068+ if (pax_task_size - len >= addr) {
17069+ vma = find_vma(mm, addr);
17070+ if (check_heap_stack_gap(vma, addr, len))
17071+ return addr;
17072+ }
17073+ }
17074+ if (len > mm->cached_hole_size) {
17075+ start_addr = addr = mm->free_area_cache;
17076+ } else {
17077+ start_addr = addr = mm->mmap_base;
17078+ mm->cached_hole_size = 0;
17079+ }
17080+
17081+#ifdef CONFIG_PAX_PAGEEXEC
17082+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17083+ start_addr = 0x00110000UL;
17084+
17085+#ifdef CONFIG_PAX_RANDMMAP
17086+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17087+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17088+#endif
17089+
17090+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17091+ start_addr = addr = mm->mmap_base;
17092+ else
17093+ addr = start_addr;
17094+ }
17095+#endif
17096+
17097+full_search:
17098+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17099+ /* At this point: (!vma || addr < vma->vm_end). */
17100+ if (pax_task_size - len < addr) {
17101+ /*
17102+ * Start a new search - just in case we missed
17103+ * some holes.
17104+ */
17105+ if (start_addr != mm->mmap_base) {
17106+ start_addr = addr = mm->mmap_base;
17107+ mm->cached_hole_size = 0;
17108+ goto full_search;
17109+ }
17110+ return -ENOMEM;
17111+ }
17112+ if (check_heap_stack_gap(vma, addr, len))
17113+ break;
17114+ if (addr + mm->cached_hole_size < vma->vm_start)
17115+ mm->cached_hole_size = vma->vm_start - addr;
17116+ addr = vma->vm_end;
17117+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17118+ start_addr = addr = mm->mmap_base;
17119+ mm->cached_hole_size = 0;
17120+ goto full_search;
17121+ }
17122+ }
17123+
17124+ /*
17125+ * Remember the place where we stopped the search:
17126+ */
17127+ mm->free_area_cache = addr + len;
17128+ return addr;
17129+}
17130+
17131+unsigned long
17132+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17133+ const unsigned long len, const unsigned long pgoff,
17134+ const unsigned long flags)
17135+{
17136+ struct vm_area_struct *vma;
17137+ struct mm_struct *mm = current->mm;
17138+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17139+
17140+#ifdef CONFIG_PAX_SEGMEXEC
17141+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17142+ pax_task_size = SEGMEXEC_TASK_SIZE;
17143+#endif
17144+
17145+ pax_task_size -= PAGE_SIZE;
17146+
17147+ /* requested length too big for entire address space */
17148+ if (len > pax_task_size)
17149+ return -ENOMEM;
17150+
17151+ if (flags & MAP_FIXED)
17152+ return addr;
17153+
17154+#ifdef CONFIG_PAX_PAGEEXEC
17155+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17156+ goto bottomup;
17157+#endif
17158+
17159+#ifdef CONFIG_PAX_RANDMMAP
17160+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17161+#endif
17162+
17163+ /* requesting a specific address */
17164+ if (addr) {
17165+ addr = PAGE_ALIGN(addr);
17166+ if (pax_task_size - len >= addr) {
17167+ vma = find_vma(mm, addr);
17168+ if (check_heap_stack_gap(vma, addr, len))
17169+ return addr;
17170+ }
17171+ }
17172+
17173+ /* check if free_area_cache is useful for us */
17174+ if (len <= mm->cached_hole_size) {
17175+ mm->cached_hole_size = 0;
17176+ mm->free_area_cache = mm->mmap_base;
17177+ }
17178+
17179+ /* either no address requested or can't fit in requested address hole */
17180+ addr = mm->free_area_cache;
17181+
17182+ /* make sure it can fit in the remaining address space */
17183+ if (addr > len) {
17184+ vma = find_vma(mm, addr-len);
17185+ if (check_heap_stack_gap(vma, addr - len, len))
17186+ /* remember the address as a hint for next time */
17187+ return (mm->free_area_cache = addr-len);
17188+ }
17189+
17190+ if (mm->mmap_base < len)
17191+ goto bottomup;
17192+
17193+ addr = mm->mmap_base-len;
17194+
17195+ do {
17196+ /*
17197+ * Lookup failure means no vma is above this address,
17198+ * else if new region fits below vma->vm_start,
17199+ * return with success:
17200+ */
17201+ vma = find_vma(mm, addr);
17202+ if (check_heap_stack_gap(vma, addr, len))
17203+ /* remember the address as a hint for next time */
17204+ return (mm->free_area_cache = addr);
17205+
17206+ /* remember the largest hole we saw so far */
17207+ if (addr + mm->cached_hole_size < vma->vm_start)
17208+ mm->cached_hole_size = vma->vm_start - addr;
17209+
17210+ /* try just below the current vma->vm_start */
17211+ addr = skip_heap_stack_gap(vma, len);
17212+ } while (!IS_ERR_VALUE(addr));
17213+
17214+bottomup:
17215+ /*
17216+ * A failed mmap() very likely causes application failure,
17217+ * so fall back to the bottom-up function here. This scenario
17218+ * can happen with large stack limits and large mmap()
17219+ * allocations.
17220+ */
17221+
17222+#ifdef CONFIG_PAX_SEGMEXEC
17223+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17224+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17225+ else
17226+#endif
17227+
17228+ mm->mmap_base = TASK_UNMAPPED_BASE;
17229+
17230+#ifdef CONFIG_PAX_RANDMMAP
17231+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17232+ mm->mmap_base += mm->delta_mmap;
17233+#endif
17234+
17235+ mm->free_area_cache = mm->mmap_base;
17236+ mm->cached_hole_size = ~0UL;
17237+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17238+ /*
17239+ * Restore the topdown base:
17240+ */
17241+ mm->mmap_base = base;
17242+ mm->free_area_cache = base;
17243+ mm->cached_hole_size = ~0UL;
17244+
17245+ return addr;
17246+}
17247
17248 struct sel_arg_struct {
17249 unsigned long n;
17250@@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
17251 return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
17252 case SEMTIMEDOP:
17253 return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
17254- (const struct timespec __user *)fifth);
17255+ (__force const struct timespec __user *)fifth);
17256
17257 case SEMGET:
17258 return sys_semget(first, second, third);
17259@@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
17260 ret = do_shmat(first, (char __user *) ptr, second, &raddr);
17261 if (ret)
17262 return ret;
17263- return put_user(raddr, (ulong __user *) third);
17264+ return put_user(raddr, (__force ulong __user *) third);
17265 }
17266 case 1: /* iBCS2 emulator entry point */
17267 if (!segment_eq(get_fs(), get_ds()))
17268@@ -207,17 +428,3 @@ asmlinkage int sys_olduname(struct oldol
17269
17270 return error;
17271 }
17272-
17273-
17274-/*
17275- * Do a system call from kernel instead of calling sys_execve so we
17276- * end up with proper pt_regs.
17277- */
17278-int kernel_execve(const char *filename, char *const argv[], char *const envp[])
17279-{
17280- long __res;
17281- asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
17282- : "=a" (__res)
17283- : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
17284- return __res;
17285-}
17286diff -urNp linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c
17287--- linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c 2011-03-27 14:31:47.000000000 -0400
17288+++ linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c 2011-04-17 15:56:46.000000000 -0400
17289@@ -32,8 +32,8 @@ out:
17290 return error;
17291 }
17292
17293-static void find_start_end(unsigned long flags, unsigned long *begin,
17294- unsigned long *end)
17295+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17296+ unsigned long *begin, unsigned long *end)
17297 {
17298 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17299 unsigned long new_begin;
17300@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17301 *begin = new_begin;
17302 }
17303 } else {
17304- *begin = TASK_UNMAPPED_BASE;
17305+ *begin = mm->mmap_base;
17306 *end = TASK_SIZE;
17307 }
17308 }
17309@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17310 if (flags & MAP_FIXED)
17311 return addr;
17312
17313- find_start_end(flags, &begin, &end);
17314+ find_start_end(mm, flags, &begin, &end);
17315
17316 if (len > end)
17317 return -ENOMEM;
17318
17319+#ifdef CONFIG_PAX_RANDMMAP
17320+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17321+#endif
17322+
17323 if (addr) {
17324 addr = PAGE_ALIGN(addr);
17325 vma = find_vma(mm, addr);
17326- if (end - len >= addr &&
17327- (!vma || addr + len <= vma->vm_start))
17328+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17329 return addr;
17330 }
17331 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17332@@ -106,7 +109,7 @@ full_search:
17333 }
17334 return -ENOMEM;
17335 }
17336- if (!vma || addr + len <= vma->vm_start) {
17337+ if (check_heap_stack_gap(vma, addr, len)) {
17338 /*
17339 * Remember the place where we stopped the search:
17340 */
17341@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17342 {
17343 struct vm_area_struct *vma;
17344 struct mm_struct *mm = current->mm;
17345- unsigned long addr = addr0;
17346+ unsigned long base = mm->mmap_base, addr = addr0;
17347
17348 /* requested length too big for entire address space */
17349 if (len > TASK_SIZE)
17350@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17351 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17352 goto bottomup;
17353
17354+#ifdef CONFIG_PAX_RANDMMAP
17355+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17356+#endif
17357+
17358 /* requesting a specific address */
17359 if (addr) {
17360 addr = PAGE_ALIGN(addr);
17361- vma = find_vma(mm, addr);
17362- if (TASK_SIZE - len >= addr &&
17363- (!vma || addr + len <= vma->vm_start))
17364- return addr;
17365+ if (TASK_SIZE - len >= addr) {
17366+ vma = find_vma(mm, addr);
17367+ if (check_heap_stack_gap(vma, addr, len))
17368+ return addr;
17369+ }
17370 }
17371
17372 /* check if free_area_cache is useful for us */
17373@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17374 /* make sure it can fit in the remaining address space */
17375 if (addr > len) {
17376 vma = find_vma(mm, addr-len);
17377- if (!vma || addr <= vma->vm_start)
17378+ if (check_heap_stack_gap(vma, addr - len, len))
17379 /* remember the address as a hint for next time */
17380 return mm->free_area_cache = addr-len;
17381 }
17382@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17383 * return with success:
17384 */
17385 vma = find_vma(mm, addr);
17386- if (!vma || addr+len <= vma->vm_start)
17387+ if (check_heap_stack_gap(vma, addr, len))
17388 /* remember the address as a hint for next time */
17389 return mm->free_area_cache = addr;
17390
17391@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17392 mm->cached_hole_size = vma->vm_start - addr;
17393
17394 /* try just below the current vma->vm_start */
17395- addr = vma->vm_start-len;
17396- } while (len < vma->vm_start);
17397+ addr = skip_heap_stack_gap(vma, len);
17398+ } while (!IS_ERR_VALUE(addr));
17399
17400 bottomup:
17401 /*
17402@@ -198,13 +206,21 @@ bottomup:
17403 * can happen with large stack limits and large mmap()
17404 * allocations.
17405 */
17406+ mm->mmap_base = TASK_UNMAPPED_BASE;
17407+
17408+#ifdef CONFIG_PAX_RANDMMAP
17409+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17410+ mm->mmap_base += mm->delta_mmap;
17411+#endif
17412+
17413+ mm->free_area_cache = mm->mmap_base;
17414 mm->cached_hole_size = ~0UL;
17415- mm->free_area_cache = TASK_UNMAPPED_BASE;
17416 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17417 /*
17418 * Restore the topdown base:
17419 */
17420- mm->free_area_cache = mm->mmap_base;
17421+ mm->mmap_base = base;
17422+ mm->free_area_cache = base;
17423 mm->cached_hole_size = ~0UL;
17424
17425 return addr;
17426diff -urNp linux-2.6.32.46/arch/x86/kernel/tboot.c linux-2.6.32.46/arch/x86/kernel/tboot.c
17427--- linux-2.6.32.46/arch/x86/kernel/tboot.c 2011-03-27 14:31:47.000000000 -0400
17428+++ linux-2.6.32.46/arch/x86/kernel/tboot.c 2011-05-22 23:02:03.000000000 -0400
17429@@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
17430
17431 void tboot_shutdown(u32 shutdown_type)
17432 {
17433- void (*shutdown)(void);
17434+ void (* __noreturn shutdown)(void);
17435
17436 if (!tboot_enabled())
17437 return;
17438@@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
17439
17440 switch_to_tboot_pt();
17441
17442- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17443+ shutdown = (void *)tboot->shutdown_entry;
17444 shutdown();
17445
17446 /* should not reach here */
17447@@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17448 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17449 }
17450
17451-static atomic_t ap_wfs_count;
17452+static atomic_unchecked_t ap_wfs_count;
17453
17454 static int tboot_wait_for_aps(int num_aps)
17455 {
17456@@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(
17457 {
17458 switch (action) {
17459 case CPU_DYING:
17460- atomic_inc(&ap_wfs_count);
17461+ atomic_inc_unchecked(&ap_wfs_count);
17462 if (num_online_cpus() == 1)
17463- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17464+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17465 return NOTIFY_BAD;
17466 break;
17467 }
17468@@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
17469
17470 tboot_create_trampoline();
17471
17472- atomic_set(&ap_wfs_count, 0);
17473+ atomic_set_unchecked(&ap_wfs_count, 0);
17474 register_hotcpu_notifier(&tboot_cpu_notifier);
17475 return 0;
17476 }
17477diff -urNp linux-2.6.32.46/arch/x86/kernel/time.c linux-2.6.32.46/arch/x86/kernel/time.c
17478--- linux-2.6.32.46/arch/x86/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
17479+++ linux-2.6.32.46/arch/x86/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
17480@@ -26,17 +26,13 @@
17481 int timer_ack;
17482 #endif
17483
17484-#ifdef CONFIG_X86_64
17485-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17486-#endif
17487-
17488 unsigned long profile_pc(struct pt_regs *regs)
17489 {
17490 unsigned long pc = instruction_pointer(regs);
17491
17492- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17493+ if (!user_mode(regs) && in_lock_functions(pc)) {
17494 #ifdef CONFIG_FRAME_POINTER
17495- return *(unsigned long *)(regs->bp + sizeof(long));
17496+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17497 #else
17498 unsigned long *sp =
17499 (unsigned long *)kernel_stack_pointer(regs);
17500@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
17501 * or above a saved flags. Eflags has bits 22-31 zero,
17502 * kernel addresses don't.
17503 */
17504+
17505+#ifdef CONFIG_PAX_KERNEXEC
17506+ return ktla_ktva(sp[0]);
17507+#else
17508 if (sp[0] >> 22)
17509 return sp[0];
17510 if (sp[1] >> 22)
17511 return sp[1];
17512 #endif
17513+
17514+#endif
17515 }
17516 return pc;
17517 }
17518diff -urNp linux-2.6.32.46/arch/x86/kernel/tls.c linux-2.6.32.46/arch/x86/kernel/tls.c
17519--- linux-2.6.32.46/arch/x86/kernel/tls.c 2011-03-27 14:31:47.000000000 -0400
17520+++ linux-2.6.32.46/arch/x86/kernel/tls.c 2011-04-17 15:56:46.000000000 -0400
17521@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
17522 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17523 return -EINVAL;
17524
17525+#ifdef CONFIG_PAX_SEGMEXEC
17526+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17527+ return -EINVAL;
17528+#endif
17529+
17530 set_tls_desc(p, idx, &info, 1);
17531
17532 return 0;
17533diff -urNp linux-2.6.32.46/arch/x86/kernel/trampoline_32.S linux-2.6.32.46/arch/x86/kernel/trampoline_32.S
17534--- linux-2.6.32.46/arch/x86/kernel/trampoline_32.S 2011-03-27 14:31:47.000000000 -0400
17535+++ linux-2.6.32.46/arch/x86/kernel/trampoline_32.S 2011-04-17 15:56:46.000000000 -0400
17536@@ -32,6 +32,12 @@
17537 #include <asm/segment.h>
17538 #include <asm/page_types.h>
17539
17540+#ifdef CONFIG_PAX_KERNEXEC
17541+#define ta(X) (X)
17542+#else
17543+#define ta(X) ((X) - __PAGE_OFFSET)
17544+#endif
17545+
17546 /* We can free up trampoline after bootup if cpu hotplug is not supported. */
17547 __CPUINITRODATA
17548 .code16
17549@@ -60,7 +66,7 @@ r_base = .
17550 inc %ax # protected mode (PE) bit
17551 lmsw %ax # into protected mode
17552 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17553- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17554+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17555
17556 # These need to be in the same 64K segment as the above;
17557 # hence we don't use the boot_gdt_descr defined in head.S
17558diff -urNp linux-2.6.32.46/arch/x86/kernel/trampoline_64.S linux-2.6.32.46/arch/x86/kernel/trampoline_64.S
17559--- linux-2.6.32.46/arch/x86/kernel/trampoline_64.S 2011-03-27 14:31:47.000000000 -0400
17560+++ linux-2.6.32.46/arch/x86/kernel/trampoline_64.S 2011-07-01 18:53:26.000000000 -0400
17561@@ -91,7 +91,7 @@ startup_32:
17562 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17563 movl %eax, %ds
17564
17565- movl $X86_CR4_PAE, %eax
17566+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17567 movl %eax, %cr4 # Enable PAE mode
17568
17569 # Setup trampoline 4 level pagetables
17570@@ -127,7 +127,7 @@ startup_64:
17571 no_longmode:
17572 hlt
17573 jmp no_longmode
17574-#include "verify_cpu_64.S"
17575+#include "verify_cpu.S"
17576
17577 # Careful these need to be in the same 64K segment as the above;
17578 tidt:
17579@@ -138,7 +138,7 @@ tidt:
17580 # so the kernel can live anywhere
17581 .balign 4
17582 tgdt:
17583- .short tgdt_end - tgdt # gdt limit
17584+ .short tgdt_end - tgdt - 1 # gdt limit
17585 .long tgdt - r_base
17586 .short 0
17587 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17588diff -urNp linux-2.6.32.46/arch/x86/kernel/traps.c linux-2.6.32.46/arch/x86/kernel/traps.c
17589--- linux-2.6.32.46/arch/x86/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
17590+++ linux-2.6.32.46/arch/x86/kernel/traps.c 2011-07-06 19:53:33.000000000 -0400
17591@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
17592
17593 /* Do we ignore FPU interrupts ? */
17594 char ignore_fpu_irq;
17595-
17596-/*
17597- * The IDT has to be page-aligned to simplify the Pentium
17598- * F0 0F bug workaround.
17599- */
17600-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17601 #endif
17602
17603 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17604@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
17605 static inline void
17606 die_if_kernel(const char *str, struct pt_regs *regs, long err)
17607 {
17608- if (!user_mode_vm(regs))
17609+ if (!user_mode(regs))
17610 die(str, regs, err);
17611 }
17612 #endif
17613
17614 static void __kprobes
17615-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17616+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17617 long error_code, siginfo_t *info)
17618 {
17619 struct task_struct *tsk = current;
17620
17621 #ifdef CONFIG_X86_32
17622- if (regs->flags & X86_VM_MASK) {
17623+ if (v8086_mode(regs)) {
17624 /*
17625 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17626 * On nmi (interrupt 2), do_trap should not be called.
17627@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
17628 }
17629 #endif
17630
17631- if (!user_mode(regs))
17632+ if (!user_mode_novm(regs))
17633 goto kernel_trap;
17634
17635 #ifdef CONFIG_X86_32
17636@@ -158,7 +152,7 @@ trap_signal:
17637 printk_ratelimit()) {
17638 printk(KERN_INFO
17639 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17640- tsk->comm, tsk->pid, str,
17641+ tsk->comm, task_pid_nr(tsk), str,
17642 regs->ip, regs->sp, error_code);
17643 print_vma_addr(" in ", regs->ip);
17644 printk("\n");
17645@@ -175,8 +169,20 @@ kernel_trap:
17646 if (!fixup_exception(regs)) {
17647 tsk->thread.error_code = error_code;
17648 tsk->thread.trap_no = trapnr;
17649+
17650+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17651+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17652+ str = "PAX: suspicious stack segment fault";
17653+#endif
17654+
17655 die(str, regs, error_code);
17656 }
17657+
17658+#ifdef CONFIG_PAX_REFCOUNT
17659+ if (trapnr == 4)
17660+ pax_report_refcount_overflow(regs);
17661+#endif
17662+
17663 return;
17664
17665 #ifdef CONFIG_X86_32
17666@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
17667 conditional_sti(regs);
17668
17669 #ifdef CONFIG_X86_32
17670- if (regs->flags & X86_VM_MASK)
17671+ if (v8086_mode(regs))
17672 goto gp_in_vm86;
17673 #endif
17674
17675 tsk = current;
17676- if (!user_mode(regs))
17677+ if (!user_mode_novm(regs))
17678 goto gp_in_kernel;
17679
17680+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17681+ if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17682+ struct mm_struct *mm = tsk->mm;
17683+ unsigned long limit;
17684+
17685+ down_write(&mm->mmap_sem);
17686+ limit = mm->context.user_cs_limit;
17687+ if (limit < TASK_SIZE) {
17688+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17689+ up_write(&mm->mmap_sem);
17690+ return;
17691+ }
17692+ up_write(&mm->mmap_sem);
17693+ }
17694+#endif
17695+
17696 tsk->thread.error_code = error_code;
17697 tsk->thread.trap_no = 13;
17698
17699@@ -305,6 +327,13 @@ gp_in_kernel:
17700 if (notify_die(DIE_GPF, "general protection fault", regs,
17701 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17702 return;
17703+
17704+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17705+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17706+ die("PAX: suspicious general protection fault", regs, error_code);
17707+ else
17708+#endif
17709+
17710 die("general protection fault", regs, error_code);
17711 }
17712
17713@@ -435,6 +464,17 @@ static notrace __kprobes void default_do
17714 dotraplinkage notrace __kprobes void
17715 do_nmi(struct pt_regs *regs, long error_code)
17716 {
17717+
17718+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17719+ if (!user_mode(regs)) {
17720+ unsigned long cs = regs->cs & 0xFFFF;
17721+ unsigned long ip = ktva_ktla(regs->ip);
17722+
17723+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
17724+ regs->ip = ip;
17725+ }
17726+#endif
17727+
17728 nmi_enter();
17729
17730 inc_irq_stat(__nmi_count);
17731@@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
17732 }
17733
17734 #ifdef CONFIG_X86_32
17735- if (regs->flags & X86_VM_MASK)
17736+ if (v8086_mode(regs))
17737 goto debug_vm86;
17738 #endif
17739
17740@@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(st
17741 * kernel space (but re-enable TF when returning to user mode).
17742 */
17743 if (condition & DR_STEP) {
17744- if (!user_mode(regs))
17745+ if (!user_mode_novm(regs))
17746 goto clear_TF_reenable;
17747 }
17748
17749@@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs
17750 * Handle strange cache flush from user space exception
17751 * in all other cases. This is undocumented behaviour.
17752 */
17753- if (regs->flags & X86_VM_MASK) {
17754+ if (v8086_mode(regs)) {
17755 handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
17756 return;
17757 }
17758@@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) sm
17759 void __math_state_restore(void)
17760 {
17761 struct thread_info *thread = current_thread_info();
17762- struct task_struct *tsk = thread->task;
17763+ struct task_struct *tsk = current;
17764
17765 /*
17766 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17767@@ -825,8 +865,7 @@ void __math_state_restore(void)
17768 */
17769 asmlinkage void math_state_restore(void)
17770 {
17771- struct thread_info *thread = current_thread_info();
17772- struct task_struct *tsk = thread->task;
17773+ struct task_struct *tsk = current;
17774
17775 if (!tsk_used_math(tsk)) {
17776 local_irq_enable();
17777diff -urNp linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S
17778--- linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S 2011-03-27 14:31:47.000000000 -0400
17779+++ linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
17780@@ -1,105 +0,0 @@
17781-/*
17782- *
17783- * verify_cpu.S - Code for cpu long mode and SSE verification. This
17784- * code has been borrowed from boot/setup.S and was introduced by
17785- * Andi Kleen.
17786- *
17787- * Copyright (c) 2007 Andi Kleen (ak@suse.de)
17788- * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
17789- * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
17790- *
17791- * This source code is licensed under the GNU General Public License,
17792- * Version 2. See the file COPYING for more details.
17793- *
17794- * This is a common code for verification whether CPU supports
17795- * long mode and SSE or not. It is not called directly instead this
17796- * file is included at various places and compiled in that context.
17797- * Following are the current usage.
17798- *
17799- * This file is included by both 16bit and 32bit code.
17800- *
17801- * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
17802- * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
17803- * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
17804- * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
17805- *
17806- * verify_cpu, returns the status of cpu check in register %eax.
17807- * 0: Success 1: Failure
17808- *
17809- * The caller needs to check for the error code and take the action
17810- * appropriately. Either display a message or halt.
17811- */
17812-
17813-#include <asm/cpufeature.h>
17814-
17815-verify_cpu:
17816- pushfl # Save caller passed flags
17817- pushl $0 # Kill any dangerous flags
17818- popfl
17819-
17820- pushfl # standard way to check for cpuid
17821- popl %eax
17822- movl %eax,%ebx
17823- xorl $0x200000,%eax
17824- pushl %eax
17825- popfl
17826- pushfl
17827- popl %eax
17828- cmpl %eax,%ebx
17829- jz verify_cpu_no_longmode # cpu has no cpuid
17830-
17831- movl $0x0,%eax # See if cpuid 1 is implemented
17832- cpuid
17833- cmpl $0x1,%eax
17834- jb verify_cpu_no_longmode # no cpuid 1
17835-
17836- xor %di,%di
17837- cmpl $0x68747541,%ebx # AuthenticAMD
17838- jnz verify_cpu_noamd
17839- cmpl $0x69746e65,%edx
17840- jnz verify_cpu_noamd
17841- cmpl $0x444d4163,%ecx
17842- jnz verify_cpu_noamd
17843- mov $1,%di # cpu is from AMD
17844-
17845-verify_cpu_noamd:
17846- movl $0x1,%eax # Does the cpu have what it takes
17847- cpuid
17848- andl $REQUIRED_MASK0,%edx
17849- xorl $REQUIRED_MASK0,%edx
17850- jnz verify_cpu_no_longmode
17851-
17852- movl $0x80000000,%eax # See if extended cpuid is implemented
17853- cpuid
17854- cmpl $0x80000001,%eax
17855- jb verify_cpu_no_longmode # no extended cpuid
17856-
17857- movl $0x80000001,%eax # Does the cpu have what it takes
17858- cpuid
17859- andl $REQUIRED_MASK1,%edx
17860- xorl $REQUIRED_MASK1,%edx
17861- jnz verify_cpu_no_longmode
17862-
17863-verify_cpu_sse_test:
17864- movl $1,%eax
17865- cpuid
17866- andl $SSE_MASK,%edx
17867- cmpl $SSE_MASK,%edx
17868- je verify_cpu_sse_ok
17869- test %di,%di
17870- jz verify_cpu_no_longmode # only try to force SSE on AMD
17871- movl $0xc0010015,%ecx # HWCR
17872- rdmsr
17873- btr $15,%eax # enable SSE
17874- wrmsr
17875- xor %di,%di # don't loop
17876- jmp verify_cpu_sse_test # try again
17877-
17878-verify_cpu_no_longmode:
17879- popfl # Restore caller passed flags
17880- movl $1,%eax
17881- ret
17882-verify_cpu_sse_ok:
17883- popfl # Restore caller passed flags
17884- xorl %eax, %eax
17885- ret
17886diff -urNp linux-2.6.32.46/arch/x86/kernel/verify_cpu.S linux-2.6.32.46/arch/x86/kernel/verify_cpu.S
17887--- linux-2.6.32.46/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
17888+++ linux-2.6.32.46/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:42.000000000 -0400
17889@@ -0,0 +1,140 @@
17890+/*
17891+ *
17892+ * verify_cpu.S - Code for cpu long mode and SSE verification. This
17893+ * code has been borrowed from boot/setup.S and was introduced by
17894+ * Andi Kleen.
17895+ *
17896+ * Copyright (c) 2007 Andi Kleen (ak@suse.de)
17897+ * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
17898+ * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
17899+ * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
17900+ *
17901+ * This source code is licensed under the GNU General Public License,
17902+ * Version 2. See the file COPYING for more details.
17903+ *
17904+ * This is a common code for verification whether CPU supports
17905+ * long mode and SSE or not. It is not called directly instead this
17906+ * file is included at various places and compiled in that context.
17907+ * This file is expected to run in 32bit code. Currently:
17908+ *
17909+ * arch/x86/boot/compressed/head_64.S: Boot cpu verification
17910+ * arch/x86/kernel/trampoline_64.S: secondary processor verification
17911+ * arch/x86/kernel/head_32.S: processor startup
17912+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
17913+ *
17914+ * verify_cpu, returns the status of longmode and SSE in register %eax.
17915+ * 0: Success 1: Failure
17916+ *
17917+ * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
17918+ *
17919+ * The caller needs to check for the error code and take the action
17920+ * appropriately. Either display a message or halt.
17921+ */
17922+
17923+#include <asm/cpufeature.h>
17924+#include <asm/msr-index.h>
17925+
17926+verify_cpu:
17927+ pushfl # Save caller passed flags
17928+ pushl $0 # Kill any dangerous flags
17929+ popfl
17930+
17931+ pushfl # standard way to check for cpuid
17932+ popl %eax
17933+ movl %eax,%ebx
17934+ xorl $0x200000,%eax
17935+ pushl %eax
17936+ popfl
17937+ pushfl
17938+ popl %eax
17939+ cmpl %eax,%ebx
17940+ jz verify_cpu_no_longmode # cpu has no cpuid
17941+
17942+ movl $0x0,%eax # See if cpuid 1 is implemented
17943+ cpuid
17944+ cmpl $0x1,%eax
17945+ jb verify_cpu_no_longmode # no cpuid 1
17946+
17947+ xor %di,%di
17948+ cmpl $0x68747541,%ebx # AuthenticAMD
17949+ jnz verify_cpu_noamd
17950+ cmpl $0x69746e65,%edx
17951+ jnz verify_cpu_noamd
17952+ cmpl $0x444d4163,%ecx
17953+ jnz verify_cpu_noamd
17954+ mov $1,%di # cpu is from AMD
17955+ jmp verify_cpu_check
17956+
17957+verify_cpu_noamd:
17958+ cmpl $0x756e6547,%ebx # GenuineIntel?
17959+ jnz verify_cpu_check
17960+ cmpl $0x49656e69,%edx
17961+ jnz verify_cpu_check
17962+ cmpl $0x6c65746e,%ecx
17963+ jnz verify_cpu_check
17964+
17965+ # only call IA32_MISC_ENABLE when:
17966+ # family > 6 || (family == 6 && model >= 0xd)
17967+ movl $0x1, %eax # check CPU family and model
17968+ cpuid
17969+ movl %eax, %ecx
17970+
17971+ andl $0x0ff00f00, %eax # mask family and extended family
17972+ shrl $8, %eax
17973+ cmpl $6, %eax
17974+ ja verify_cpu_clear_xd # family > 6, ok
17975+ jb verify_cpu_check # family < 6, skip
17976+
17977+ andl $0x000f00f0, %ecx # mask model and extended model
17978+ shrl $4, %ecx
17979+ cmpl $0xd, %ecx
17980+ jb verify_cpu_check # family == 6, model < 0xd, skip
17981+
17982+verify_cpu_clear_xd:
17983+ movl $MSR_IA32_MISC_ENABLE, %ecx
17984+ rdmsr
17985+ btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
17986+ jnc verify_cpu_check # only write MSR if bit was changed
17987+ wrmsr
17988+
17989+verify_cpu_check:
17990+ movl $0x1,%eax # Does the cpu have what it takes
17991+ cpuid
17992+ andl $REQUIRED_MASK0,%edx
17993+ xorl $REQUIRED_MASK0,%edx
17994+ jnz verify_cpu_no_longmode
17995+
17996+ movl $0x80000000,%eax # See if extended cpuid is implemented
17997+ cpuid
17998+ cmpl $0x80000001,%eax
17999+ jb verify_cpu_no_longmode # no extended cpuid
18000+
18001+ movl $0x80000001,%eax # Does the cpu have what it takes
18002+ cpuid
18003+ andl $REQUIRED_MASK1,%edx
18004+ xorl $REQUIRED_MASK1,%edx
18005+ jnz verify_cpu_no_longmode
18006+
18007+verify_cpu_sse_test:
18008+ movl $1,%eax
18009+ cpuid
18010+ andl $SSE_MASK,%edx
18011+ cmpl $SSE_MASK,%edx
18012+ je verify_cpu_sse_ok
18013+ test %di,%di
18014+ jz verify_cpu_no_longmode # only try to force SSE on AMD
18015+ movl $MSR_K7_HWCR,%ecx
18016+ rdmsr
18017+ btr $15,%eax # enable SSE
18018+ wrmsr
18019+ xor %di,%di # don't loop
18020+ jmp verify_cpu_sse_test # try again
18021+
18022+verify_cpu_no_longmode:
18023+ popfl # Restore caller passed flags
18024+ movl $1,%eax
18025+ ret
18026+verify_cpu_sse_ok:
18027+ popfl # Restore caller passed flags
18028+ xorl %eax, %eax
18029+ ret
18030diff -urNp linux-2.6.32.46/arch/x86/kernel/vm86_32.c linux-2.6.32.46/arch/x86/kernel/vm86_32.c
18031--- linux-2.6.32.46/arch/x86/kernel/vm86_32.c 2011-03-27 14:31:47.000000000 -0400
18032+++ linux-2.6.32.46/arch/x86/kernel/vm86_32.c 2011-04-17 15:56:46.000000000 -0400
18033@@ -41,6 +41,7 @@
18034 #include <linux/ptrace.h>
18035 #include <linux/audit.h>
18036 #include <linux/stddef.h>
18037+#include <linux/grsecurity.h>
18038
18039 #include <asm/uaccess.h>
18040 #include <asm/io.h>
18041@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
18042 do_exit(SIGSEGV);
18043 }
18044
18045- tss = &per_cpu(init_tss, get_cpu());
18046+ tss = init_tss + get_cpu();
18047 current->thread.sp0 = current->thread.saved_sp0;
18048 current->thread.sysenter_cs = __KERNEL_CS;
18049 load_sp0(tss, &current->thread);
18050@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
18051 struct task_struct *tsk;
18052 int tmp, ret = -EPERM;
18053
18054+#ifdef CONFIG_GRKERNSEC_VM86
18055+ if (!capable(CAP_SYS_RAWIO)) {
18056+ gr_handle_vm86();
18057+ goto out;
18058+ }
18059+#endif
18060+
18061 tsk = current;
18062 if (tsk->thread.saved_sp0)
18063 goto out;
18064@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
18065 int tmp, ret;
18066 struct vm86plus_struct __user *v86;
18067
18068+#ifdef CONFIG_GRKERNSEC_VM86
18069+ if (!capable(CAP_SYS_RAWIO)) {
18070+ gr_handle_vm86();
18071+ ret = -EPERM;
18072+ goto out;
18073+ }
18074+#endif
18075+
18076 tsk = current;
18077 switch (regs->bx) {
18078 case VM86_REQUEST_IRQ:
18079@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
18080 tsk->thread.saved_fs = info->regs32->fs;
18081 tsk->thread.saved_gs = get_user_gs(info->regs32);
18082
18083- tss = &per_cpu(init_tss, get_cpu());
18084+ tss = init_tss + get_cpu();
18085 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
18086 if (cpu_has_sep)
18087 tsk->thread.sysenter_cs = 0;
18088@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
18089 goto cannot_handle;
18090 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
18091 goto cannot_handle;
18092- intr_ptr = (unsigned long __user *) (i << 2);
18093+ intr_ptr = (__force unsigned long __user *) (i << 2);
18094 if (get_user(segoffs, intr_ptr))
18095 goto cannot_handle;
18096 if ((segoffs >> 16) == BIOSSEG)
18097diff -urNp linux-2.6.32.46/arch/x86/kernel/vmi_32.c linux-2.6.32.46/arch/x86/kernel/vmi_32.c
18098--- linux-2.6.32.46/arch/x86/kernel/vmi_32.c 2011-03-27 14:31:47.000000000 -0400
18099+++ linux-2.6.32.46/arch/x86/kernel/vmi_32.c 2011-08-05 20:33:55.000000000 -0400
18100@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
18101 typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
18102
18103 #define call_vrom_func(rom,func) \
18104- (((VROMFUNC *)(rom->func))())
18105+ (((VROMFUNC *)(ktva_ktla(rom.func)))())
18106
18107 #define call_vrom_long_func(rom,func,arg) \
18108- (((VROMLONGFUNC *)(rom->func)) (arg))
18109+({\
18110+ u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
18111+ struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
18112+ __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
18113+ __reloc;\
18114+})
18115
18116-static struct vrom_header *vmi_rom;
18117+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
18118 static int disable_pge;
18119 static int disable_pse;
18120 static int disable_sep;
18121@@ -76,10 +81,10 @@ static struct {
18122 void (*set_initial_ap_state)(int, int);
18123 void (*halt)(void);
18124 void (*set_lazy_mode)(int mode);
18125-} vmi_ops;
18126+} __no_const vmi_ops __read_only;
18127
18128 /* Cached VMI operations */
18129-struct vmi_timer_ops vmi_timer_ops;
18130+struct vmi_timer_ops vmi_timer_ops __read_only;
18131
18132 /*
18133 * VMI patching routines.
18134@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
18135 static inline void patch_offset(void *insnbuf,
18136 unsigned long ip, unsigned long dest)
18137 {
18138- *(unsigned long *)(insnbuf+1) = dest-ip-5;
18139+ *(unsigned long *)(insnbuf+1) = dest-ip-5;
18140 }
18141
18142 static unsigned patch_internal(int call, unsigned len, void *insnbuf,
18143@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
18144 {
18145 u64 reloc;
18146 struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
18147+
18148 reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
18149 switch(rel->type) {
18150 case VMI_RELOCATION_CALL_REL:
18151@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
18152
18153 static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
18154 {
18155- const pte_t pte = { .pte = 0 };
18156+ const pte_t pte = __pte(0ULL);
18157 vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
18158 }
18159
18160 static void vmi_pmd_clear(pmd_t *pmd)
18161 {
18162- const pte_t pte = { .pte = 0 };
18163+ const pte_t pte = __pte(0ULL);
18164 vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
18165 }
18166 #endif
18167@@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, un
18168 ap.ss = __KERNEL_DS;
18169 ap.esp = (unsigned long) start_esp;
18170
18171- ap.ds = __USER_DS;
18172- ap.es = __USER_DS;
18173+ ap.ds = __KERNEL_DS;
18174+ ap.es = __KERNEL_DS;
18175 ap.fs = __KERNEL_PERCPU;
18176- ap.gs = __KERNEL_STACK_CANARY;
18177+ savesegment(gs, ap.gs);
18178
18179 ap.eflags = 0;
18180
18181@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
18182 paravirt_leave_lazy_mmu();
18183 }
18184
18185+#ifdef CONFIG_PAX_KERNEXEC
18186+static unsigned long vmi_pax_open_kernel(void)
18187+{
18188+ return 0;
18189+}
18190+
18191+static unsigned long vmi_pax_close_kernel(void)
18192+{
18193+ return 0;
18194+}
18195+#endif
18196+
18197 static inline int __init check_vmi_rom(struct vrom_header *rom)
18198 {
18199 struct pci_header *pci;
18200@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
18201 return 0;
18202 if (rom->vrom_signature != VMI_SIGNATURE)
18203 return 0;
18204+ if (rom->rom_length * 512 > sizeof(*rom)) {
18205+ printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
18206+ return 0;
18207+ }
18208 if (rom->api_version_maj != VMI_API_REV_MAJOR ||
18209 rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
18210 printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
18211@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
18212 struct vrom_header *romstart;
18213 romstart = (struct vrom_header *)isa_bus_to_virt(base);
18214 if (check_vmi_rom(romstart)) {
18215- vmi_rom = romstart;
18216+ vmi_rom = *romstart;
18217 return 1;
18218 }
18219 }
18220@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
18221
18222 para_fill(pv_irq_ops.safe_halt, Halt);
18223
18224+#ifdef CONFIG_PAX_KERNEXEC
18225+ pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
18226+ pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
18227+#endif
18228+
18229 /*
18230 * Alternative instruction rewriting doesn't happen soon enough
18231 * to convert VMI_IRET to a call instead of a jump; so we have
18232@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
18233
18234 void __init vmi_init(void)
18235 {
18236- if (!vmi_rom)
18237+ if (!vmi_rom.rom_signature)
18238 probe_vmi_rom();
18239 else
18240- check_vmi_rom(vmi_rom);
18241+ check_vmi_rom(&vmi_rom);
18242
18243 /* In case probing for or validating the ROM failed, basil */
18244- if (!vmi_rom)
18245+ if (!vmi_rom.rom_signature)
18246 return;
18247
18248- reserve_top_address(-vmi_rom->virtual_top);
18249+ reserve_top_address(-vmi_rom.virtual_top);
18250
18251 #ifdef CONFIG_X86_IO_APIC
18252 /* This is virtual hardware; timer routing is wired correctly */
18253@@ -874,7 +901,7 @@ void __init vmi_activate(void)
18254 {
18255 unsigned long flags;
18256
18257- if (!vmi_rom)
18258+ if (!vmi_rom.rom_signature)
18259 return;
18260
18261 local_irq_save(flags);
18262diff -urNp linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S
18263--- linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
18264+++ linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S 2011-04-17 15:56:46.000000000 -0400
18265@@ -26,6 +26,13 @@
18266 #include <asm/page_types.h>
18267 #include <asm/cache.h>
18268 #include <asm/boot.h>
18269+#include <asm/segment.h>
18270+
18271+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18272+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
18273+#else
18274+#define __KERNEL_TEXT_OFFSET 0
18275+#endif
18276
18277 #undef i386 /* in case the preprocessor is a 32bit one */
18278
18279@@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
18280 #ifdef CONFIG_X86_32
18281 OUTPUT_ARCH(i386)
18282 ENTRY(phys_startup_32)
18283-jiffies = jiffies_64;
18284 #else
18285 OUTPUT_ARCH(i386:x86-64)
18286 ENTRY(phys_startup_64)
18287-jiffies_64 = jiffies;
18288 #endif
18289
18290 PHDRS {
18291 text PT_LOAD FLAGS(5); /* R_E */
18292- data PT_LOAD FLAGS(7); /* RWE */
18293+#ifdef CONFIG_X86_32
18294+ module PT_LOAD FLAGS(5); /* R_E */
18295+#endif
18296+#ifdef CONFIG_XEN
18297+ rodata PT_LOAD FLAGS(5); /* R_E */
18298+#else
18299+ rodata PT_LOAD FLAGS(4); /* R__ */
18300+#endif
18301+ data PT_LOAD FLAGS(6); /* RW_ */
18302 #ifdef CONFIG_X86_64
18303 user PT_LOAD FLAGS(5); /* R_E */
18304+#endif
18305+ init.begin PT_LOAD FLAGS(6); /* RW_ */
18306 #ifdef CONFIG_SMP
18307 percpu PT_LOAD FLAGS(6); /* RW_ */
18308 #endif
18309+ text.init PT_LOAD FLAGS(5); /* R_E */
18310+ text.exit PT_LOAD FLAGS(5); /* R_E */
18311 init PT_LOAD FLAGS(7); /* RWE */
18312-#endif
18313 note PT_NOTE FLAGS(0); /* ___ */
18314 }
18315
18316 SECTIONS
18317 {
18318 #ifdef CONFIG_X86_32
18319- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18320- phys_startup_32 = startup_32 - LOAD_OFFSET;
18321+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18322 #else
18323- . = __START_KERNEL;
18324- phys_startup_64 = startup_64 - LOAD_OFFSET;
18325+ . = __START_KERNEL;
18326 #endif
18327
18328 /* Text and read-only data */
18329- .text : AT(ADDR(.text) - LOAD_OFFSET) {
18330- _text = .;
18331+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18332 /* bootstrapping code */
18333+#ifdef CONFIG_X86_32
18334+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18335+#else
18336+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18337+#endif
18338+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18339+ _text = .;
18340 HEAD_TEXT
18341 #ifdef CONFIG_X86_32
18342 . = ALIGN(PAGE_SIZE);
18343@@ -82,28 +102,71 @@ SECTIONS
18344 IRQENTRY_TEXT
18345 *(.fixup)
18346 *(.gnu.warning)
18347- /* End of text section */
18348- _etext = .;
18349 } :text = 0x9090
18350
18351- NOTES :text :note
18352+ . += __KERNEL_TEXT_OFFSET;
18353+
18354+#ifdef CONFIG_X86_32
18355+ . = ALIGN(PAGE_SIZE);
18356+ .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
18357+ *(.vmi.rom)
18358+ } :module
18359+
18360+ . = ALIGN(PAGE_SIZE);
18361+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18362+
18363+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18364+ MODULES_EXEC_VADDR = .;
18365+ BYTE(0)
18366+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18367+ . = ALIGN(HPAGE_SIZE);
18368+ MODULES_EXEC_END = . - 1;
18369+#endif
18370+
18371+ } :module
18372+#endif
18373
18374- EXCEPTION_TABLE(16) :text = 0x9090
18375+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18376+ /* End of text section */
18377+ _etext = . - __KERNEL_TEXT_OFFSET;
18378+ }
18379+
18380+#ifdef CONFIG_X86_32
18381+ . = ALIGN(PAGE_SIZE);
18382+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18383+ *(.idt)
18384+ . = ALIGN(PAGE_SIZE);
18385+ *(.empty_zero_page)
18386+ *(.swapper_pg_fixmap)
18387+ *(.swapper_pg_pmd)
18388+ *(.swapper_pg_dir)
18389+ *(.trampoline_pg_dir)
18390+ } :rodata
18391+#endif
18392+
18393+ . = ALIGN(PAGE_SIZE);
18394+ NOTES :rodata :note
18395+
18396+ EXCEPTION_TABLE(16) :rodata
18397
18398 RO_DATA(PAGE_SIZE)
18399
18400 /* Data */
18401 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18402+
18403+#ifdef CONFIG_PAX_KERNEXEC
18404+ . = ALIGN(HPAGE_SIZE);
18405+#else
18406+ . = ALIGN(PAGE_SIZE);
18407+#endif
18408+
18409 /* Start of data section */
18410 _sdata = .;
18411
18412 /* init_task */
18413 INIT_TASK_DATA(THREAD_SIZE)
18414
18415-#ifdef CONFIG_X86_32
18416- /* 32 bit has nosave before _edata */
18417 NOSAVE_DATA
18418-#endif
18419
18420 PAGE_ALIGNED_DATA(PAGE_SIZE)
18421
18422@@ -112,6 +175,8 @@ SECTIONS
18423 DATA_DATA
18424 CONSTRUCTORS
18425
18426+ jiffies = jiffies_64;
18427+
18428 /* rarely changed data like cpu maps */
18429 READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
18430
18431@@ -166,12 +231,6 @@ SECTIONS
18432 }
18433 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18434
18435- . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
18436- .jiffies : AT(VLOAD(.jiffies)) {
18437- *(.jiffies)
18438- }
18439- jiffies = VVIRT(.jiffies);
18440-
18441 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18442 *(.vsyscall_3)
18443 }
18444@@ -187,12 +246,19 @@ SECTIONS
18445 #endif /* CONFIG_X86_64 */
18446
18447 /* Init code and data - will be freed after init */
18448- . = ALIGN(PAGE_SIZE);
18449 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18450+ BYTE(0)
18451+
18452+#ifdef CONFIG_PAX_KERNEXEC
18453+ . = ALIGN(HPAGE_SIZE);
18454+#else
18455+ . = ALIGN(PAGE_SIZE);
18456+#endif
18457+
18458 __init_begin = .; /* paired with __init_end */
18459- }
18460+ } :init.begin
18461
18462-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18463+#ifdef CONFIG_SMP
18464 /*
18465 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18466 * output PHDR, so the next output section - .init.text - should
18467@@ -201,12 +267,27 @@ SECTIONS
18468 PERCPU_VADDR(0, :percpu)
18469 #endif
18470
18471- INIT_TEXT_SECTION(PAGE_SIZE)
18472-#ifdef CONFIG_X86_64
18473- :init
18474-#endif
18475+ . = ALIGN(PAGE_SIZE);
18476+ init_begin = .;
18477+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18478+ VMLINUX_SYMBOL(_sinittext) = .;
18479+ INIT_TEXT
18480+ VMLINUX_SYMBOL(_einittext) = .;
18481+ . = ALIGN(PAGE_SIZE);
18482+ } :text.init
18483
18484- INIT_DATA_SECTION(16)
18485+ /*
18486+ * .exit.text is discard at runtime, not link time, to deal with
18487+ * references from .altinstructions and .eh_frame
18488+ */
18489+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18490+ EXIT_TEXT
18491+ . = ALIGN(16);
18492+ } :text.exit
18493+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18494+
18495+ . = ALIGN(PAGE_SIZE);
18496+ INIT_DATA_SECTION(16) :init
18497
18498 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
18499 __x86_cpu_dev_start = .;
18500@@ -232,19 +313,11 @@ SECTIONS
18501 *(.altinstr_replacement)
18502 }
18503
18504- /*
18505- * .exit.text is discard at runtime, not link time, to deal with
18506- * references from .altinstructions and .eh_frame
18507- */
18508- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18509- EXIT_TEXT
18510- }
18511-
18512 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18513 EXIT_DATA
18514 }
18515
18516-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18517+#ifndef CONFIG_SMP
18518 PERCPU(PAGE_SIZE)
18519 #endif
18520
18521@@ -267,12 +340,6 @@ SECTIONS
18522 . = ALIGN(PAGE_SIZE);
18523 }
18524
18525-#ifdef CONFIG_X86_64
18526- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18527- NOSAVE_DATA
18528- }
18529-#endif
18530-
18531 /* BSS */
18532 . = ALIGN(PAGE_SIZE);
18533 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18534@@ -288,6 +355,7 @@ SECTIONS
18535 __brk_base = .;
18536 . += 64 * 1024; /* 64k alignment slop space */
18537 *(.brk_reservation) /* areas brk users have reserved */
18538+ . = ALIGN(HPAGE_SIZE);
18539 __brk_limit = .;
18540 }
18541
18542@@ -316,13 +384,12 @@ SECTIONS
18543 * for the boot processor.
18544 */
18545 #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
18546-INIT_PER_CPU(gdt_page);
18547 INIT_PER_CPU(irq_stack_union);
18548
18549 /*
18550 * Build-time check on the image size:
18551 */
18552-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18553+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18554 "kernel image bigger than KERNEL_IMAGE_SIZE");
18555
18556 #ifdef CONFIG_SMP
18557diff -urNp linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c
18558--- linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c 2011-03-27 14:31:47.000000000 -0400
18559+++ linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c 2011-04-23 12:56:10.000000000 -0400
18560@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
18561
18562 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18563 /* copy vsyscall data */
18564+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18565 vsyscall_gtod_data.clock.vread = clock->vread;
18566 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18567 vsyscall_gtod_data.clock.mask = clock->mask;
18568@@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
18569 We do this here because otherwise user space would do it on
18570 its own in a likely inferior way (no access to jiffies).
18571 If you don't like it pass NULL. */
18572- if (tcache && tcache->blob[0] == (j = __jiffies)) {
18573+ if (tcache && tcache->blob[0] == (j = jiffies)) {
18574 p = tcache->blob[1];
18575 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18576 /* Load per CPU data from RDTSCP */
18577diff -urNp linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c
18578--- linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c 2011-03-27 14:31:47.000000000 -0400
18579+++ linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c 2011-04-17 15:56:46.000000000 -0400
18580@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
18581
18582 EXPORT_SYMBOL(copy_user_generic);
18583 EXPORT_SYMBOL(__copy_user_nocache);
18584-EXPORT_SYMBOL(copy_from_user);
18585-EXPORT_SYMBOL(copy_to_user);
18586 EXPORT_SYMBOL(__copy_from_user_inatomic);
18587
18588 EXPORT_SYMBOL(copy_page);
18589diff -urNp linux-2.6.32.46/arch/x86/kernel/xsave.c linux-2.6.32.46/arch/x86/kernel/xsave.c
18590--- linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400
18591+++ linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-04-17 15:56:46.000000000 -0400
18592@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
18593 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18594 return -1;
18595
18596- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18597+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18598 fx_sw_user->extended_size -
18599 FP_XSTATE_MAGIC2_SIZE));
18600 /*
18601@@ -196,7 +196,7 @@ fx_only:
18602 * the other extended state.
18603 */
18604 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18605- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18606+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18607 }
18608
18609 /*
18610@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
18611 if (task_thread_info(tsk)->status & TS_XSAVE)
18612 err = restore_user_xstate(buf);
18613 else
18614- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18615+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
18616 buf);
18617 if (unlikely(err)) {
18618 /*
18619diff -urNp linux-2.6.32.46/arch/x86/kvm/emulate.c linux-2.6.32.46/arch/x86/kvm/emulate.c
18620--- linux-2.6.32.46/arch/x86/kvm/emulate.c 2011-03-27 14:31:47.000000000 -0400
18621+++ linux-2.6.32.46/arch/x86/kvm/emulate.c 2011-04-17 15:56:46.000000000 -0400
18622@@ -81,8 +81,8 @@
18623 #define Src2CL (1<<29)
18624 #define Src2ImmByte (2<<29)
18625 #define Src2One (3<<29)
18626-#define Src2Imm16 (4<<29)
18627-#define Src2Mask (7<<29)
18628+#define Src2Imm16 (4U<<29)
18629+#define Src2Mask (7U<<29)
18630
18631 enum {
18632 Group1_80, Group1_81, Group1_82, Group1_83,
18633@@ -411,6 +411,7 @@ static u32 group2_table[] = {
18634
18635 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
18636 do { \
18637+ unsigned long _tmp; \
18638 __asm__ __volatile__ ( \
18639 _PRE_EFLAGS("0", "4", "2") \
18640 _op _suffix " %"_x"3,%1; " \
18641@@ -424,8 +425,6 @@ static u32 group2_table[] = {
18642 /* Raw emulation: instruction has two explicit operands. */
18643 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18644 do { \
18645- unsigned long _tmp; \
18646- \
18647 switch ((_dst).bytes) { \
18648 case 2: \
18649 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
18650@@ -441,7 +440,6 @@ static u32 group2_table[] = {
18651
18652 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18653 do { \
18654- unsigned long _tmp; \
18655 switch ((_dst).bytes) { \
18656 case 1: \
18657 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
18658diff -urNp linux-2.6.32.46/arch/x86/kvm/lapic.c linux-2.6.32.46/arch/x86/kvm/lapic.c
18659--- linux-2.6.32.46/arch/x86/kvm/lapic.c 2011-03-27 14:31:47.000000000 -0400
18660+++ linux-2.6.32.46/arch/x86/kvm/lapic.c 2011-04-17 15:56:46.000000000 -0400
18661@@ -52,7 +52,7 @@
18662 #define APIC_BUS_CYCLE_NS 1
18663
18664 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18665-#define apic_debug(fmt, arg...)
18666+#define apic_debug(fmt, arg...) do {} while (0)
18667
18668 #define APIC_LVT_NUM 6
18669 /* 14 is the version for Xeon and Pentium 8.4.8*/
18670diff -urNp linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h
18671--- linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h 2011-03-27 14:31:47.000000000 -0400
18672+++ linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h 2011-05-16 21:46:57.000000000 -0400
18673@@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_
18674 int level = PT_PAGE_TABLE_LEVEL;
18675 unsigned long mmu_seq;
18676
18677+ pax_track_stack();
18678+
18679 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18680 kvm_mmu_audit(vcpu, "pre page fault");
18681
18682diff -urNp linux-2.6.32.46/arch/x86/kvm/svm.c linux-2.6.32.46/arch/x86/kvm/svm.c
18683--- linux-2.6.32.46/arch/x86/kvm/svm.c 2011-03-27 14:31:47.000000000 -0400
18684+++ linux-2.6.32.46/arch/x86/kvm/svm.c 2011-08-05 20:33:55.000000000 -0400
18685@@ -2485,7 +2485,11 @@ static void reload_tss(struct kvm_vcpu *
18686 int cpu = raw_smp_processor_id();
18687
18688 struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
18689+
18690+ pax_open_kernel();
18691 svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
18692+ pax_close_kernel();
18693+
18694 load_TR_desc();
18695 }
18696
18697@@ -2946,7 +2950,7 @@ static bool svm_gb_page_enable(void)
18698 return true;
18699 }
18700
18701-static struct kvm_x86_ops svm_x86_ops = {
18702+static const struct kvm_x86_ops svm_x86_ops = {
18703 .cpu_has_kvm_support = has_svm,
18704 .disabled_by_bios = is_disabled,
18705 .hardware_setup = svm_hardware_setup,
18706diff -urNp linux-2.6.32.46/arch/x86/kvm/vmx.c linux-2.6.32.46/arch/x86/kvm/vmx.c
18707--- linux-2.6.32.46/arch/x86/kvm/vmx.c 2011-03-27 14:31:47.000000000 -0400
18708+++ linux-2.6.32.46/arch/x86/kvm/vmx.c 2011-05-04 17:56:20.000000000 -0400
18709@@ -570,7 +570,11 @@ static void reload_tss(void)
18710
18711 kvm_get_gdt(&gdt);
18712 descs = (void *)gdt.base;
18713+
18714+ pax_open_kernel();
18715 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18716+ pax_close_kernel();
18717+
18718 load_TR_desc();
18719 }
18720
18721@@ -1409,8 +1413,11 @@ static __init int hardware_setup(void)
18722 if (!cpu_has_vmx_flexpriority())
18723 flexpriority_enabled = 0;
18724
18725- if (!cpu_has_vmx_tpr_shadow())
18726- kvm_x86_ops->update_cr8_intercept = NULL;
18727+ if (!cpu_has_vmx_tpr_shadow()) {
18728+ pax_open_kernel();
18729+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18730+ pax_close_kernel();
18731+ }
18732
18733 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18734 kvm_disable_largepages();
18735@@ -2361,7 +2368,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
18736 vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
18737
18738 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18739- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18740+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18741 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18742 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
18743 vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
18744@@ -3717,6 +3724,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
18745 "jmp .Lkvm_vmx_return \n\t"
18746 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18747 ".Lkvm_vmx_return: "
18748+
18749+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18750+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18751+ ".Lkvm_vmx_return2: "
18752+#endif
18753+
18754 /* Save guest registers, load host registers, keep flags */
18755 "xchg %0, (%%"R"sp) \n\t"
18756 "mov %%"R"ax, %c[rax](%0) \n\t"
18757@@ -3763,8 +3776,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
18758 [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
18759 #endif
18760 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
18761+
18762+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18763+ ,[cs]"i"(__KERNEL_CS)
18764+#endif
18765+
18766 : "cc", "memory"
18767- , R"bx", R"di", R"si"
18768+ , R"ax", R"bx", R"di", R"si"
18769 #ifdef CONFIG_X86_64
18770 , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
18771 #endif
18772@@ -3781,7 +3799,16 @@ static void vmx_vcpu_run(struct kvm_vcpu
18773 if (vmx->rmode.irq.pending)
18774 fixup_rmode_irq(vmx);
18775
18776- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18777+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18778+
18779+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18780+ loadsegment(fs, __KERNEL_PERCPU);
18781+#endif
18782+
18783+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18784+ __set_fs(current_thread_info()->addr_limit);
18785+#endif
18786+
18787 vmx->launched = 1;
18788
18789 vmx_complete_interrupts(vmx);
18790@@ -3956,7 +3983,7 @@ static bool vmx_gb_page_enable(void)
18791 return false;
18792 }
18793
18794-static struct kvm_x86_ops vmx_x86_ops = {
18795+static const struct kvm_x86_ops vmx_x86_ops = {
18796 .cpu_has_kvm_support = cpu_has_kvm_support,
18797 .disabled_by_bios = vmx_disabled_by_bios,
18798 .hardware_setup = hardware_setup,
18799diff -urNp linux-2.6.32.46/arch/x86/kvm/x86.c linux-2.6.32.46/arch/x86/kvm/x86.c
18800--- linux-2.6.32.46/arch/x86/kvm/x86.c 2011-05-10 22:12:01.000000000 -0400
18801+++ linux-2.6.32.46/arch/x86/kvm/x86.c 2011-05-10 22:12:26.000000000 -0400
18802@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct
18803 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18804 struct kvm_cpuid_entry2 __user *entries);
18805
18806-struct kvm_x86_ops *kvm_x86_ops;
18807+const struct kvm_x86_ops *kvm_x86_ops;
18808 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18809
18810 int ignore_msrs = 0;
18811@@ -1430,15 +1430,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
18812 struct kvm_cpuid2 *cpuid,
18813 struct kvm_cpuid_entry2 __user *entries)
18814 {
18815- int r;
18816+ int r, i;
18817
18818 r = -E2BIG;
18819 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18820 goto out;
18821 r = -EFAULT;
18822- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18823- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18824+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18825 goto out;
18826+ for (i = 0; i < cpuid->nent; ++i) {
18827+ struct kvm_cpuid_entry2 cpuid_entry;
18828+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18829+ goto out;
18830+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18831+ }
18832 vcpu->arch.cpuid_nent = cpuid->nent;
18833 kvm_apic_set_version(vcpu);
18834 return 0;
18835@@ -1451,16 +1456,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
18836 struct kvm_cpuid2 *cpuid,
18837 struct kvm_cpuid_entry2 __user *entries)
18838 {
18839- int r;
18840+ int r, i;
18841
18842 vcpu_load(vcpu);
18843 r = -E2BIG;
18844 if (cpuid->nent < vcpu->arch.cpuid_nent)
18845 goto out;
18846 r = -EFAULT;
18847- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18848- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18849+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18850 goto out;
18851+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18852+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18853+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18854+ goto out;
18855+ }
18856 return 0;
18857
18858 out:
18859@@ -1678,7 +1687,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
18860 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18861 struct kvm_interrupt *irq)
18862 {
18863- if (irq->irq < 0 || irq->irq >= 256)
18864+ if (irq->irq >= 256)
18865 return -EINVAL;
18866 if (irqchip_in_kernel(vcpu->kvm))
18867 return -ENXIO;
18868@@ -3260,10 +3269,10 @@ static struct notifier_block kvmclock_cp
18869 .notifier_call = kvmclock_cpufreq_notifier
18870 };
18871
18872-int kvm_arch_init(void *opaque)
18873+int kvm_arch_init(const void *opaque)
18874 {
18875 int r, cpu;
18876- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18877+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18878
18879 if (kvm_x86_ops) {
18880 printk(KERN_ERR "kvm: already loaded the other module\n");
18881diff -urNp linux-2.6.32.46/arch/x86/lguest/boot.c linux-2.6.32.46/arch/x86/lguest/boot.c
18882--- linux-2.6.32.46/arch/x86/lguest/boot.c 2011-03-27 14:31:47.000000000 -0400
18883+++ linux-2.6.32.46/arch/x86/lguest/boot.c 2011-08-05 20:33:55.000000000 -0400
18884@@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vt
18885 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
18886 * Launcher to reboot us.
18887 */
18888-static void lguest_restart(char *reason)
18889+static __noreturn void lguest_restart(char *reason)
18890 {
18891 kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
18892+ BUG();
18893 }
18894
18895 /*G:050
18896diff -urNp linux-2.6.32.46/arch/x86/lib/atomic64_32.c linux-2.6.32.46/arch/x86/lib/atomic64_32.c
18897--- linux-2.6.32.46/arch/x86/lib/atomic64_32.c 2011-03-27 14:31:47.000000000 -0400
18898+++ linux-2.6.32.46/arch/x86/lib/atomic64_32.c 2011-05-04 17:56:28.000000000 -0400
18899@@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u6
18900 }
18901 EXPORT_SYMBOL(atomic64_cmpxchg);
18902
18903+u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
18904+{
18905+ return cmpxchg8b(&ptr->counter, old_val, new_val);
18906+}
18907+EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
18908+
18909 /**
18910 * atomic64_xchg - xchg atomic64 variable
18911 * @ptr: pointer to type atomic64_t
18912@@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 n
18913 EXPORT_SYMBOL(atomic64_xchg);
18914
18915 /**
18916+ * atomic64_xchg_unchecked - xchg atomic64 variable
18917+ * @ptr: pointer to type atomic64_unchecked_t
18918+ * @new_val: value to assign
18919+ *
18920+ * Atomically xchgs the value of @ptr to @new_val and returns
18921+ * the old value.
18922+ */
18923+u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
18924+{
18925+ /*
18926+ * Try first with a (possibly incorrect) assumption about
18927+ * what we have there. We'll do two loops most likely,
18928+ * but we'll get an ownership MESI transaction straight away
18929+ * instead of a read transaction followed by a
18930+ * flush-for-ownership transaction:
18931+ */
18932+ u64 old_val, real_val = 0;
18933+
18934+ do {
18935+ old_val = real_val;
18936+
18937+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
18938+
18939+ } while (real_val != old_val);
18940+
18941+ return old_val;
18942+}
18943+EXPORT_SYMBOL(atomic64_xchg_unchecked);
18944+
18945+/**
18946 * atomic64_set - set atomic64 variable
18947 * @ptr: pointer to type atomic64_t
18948 * @new_val: value to assign
18949@@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 n
18950 EXPORT_SYMBOL(atomic64_set);
18951
18952 /**
18953-EXPORT_SYMBOL(atomic64_read);
18954+ * atomic64_unchecked_set - set atomic64 variable
18955+ * @ptr: pointer to type atomic64_unchecked_t
18956+ * @new_val: value to assign
18957+ *
18958+ * Atomically sets the value of @ptr to @new_val.
18959+ */
18960+void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
18961+{
18962+ atomic64_xchg_unchecked(ptr, new_val);
18963+}
18964+EXPORT_SYMBOL(atomic64_set_unchecked);
18965+
18966+/**
18967 * atomic64_add_return - add and return
18968 * @delta: integer value to add
18969 * @ptr: pointer to type atomic64_t
18970@@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 del
18971 }
18972 EXPORT_SYMBOL(atomic64_add_return);
18973
18974+/**
18975+ * atomic64_add_return_unchecked - add and return
18976+ * @delta: integer value to add
18977+ * @ptr: pointer to type atomic64_unchecked_t
18978+ *
18979+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
18980+ */
18981+noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
18982+{
18983+ /*
18984+ * Try first with a (possibly incorrect) assumption about
18985+ * what we have there. We'll do two loops most likely,
18986+ * but we'll get an ownership MESI transaction straight away
18987+ * instead of a read transaction followed by a
18988+ * flush-for-ownership transaction:
18989+ */
18990+ u64 old_val, new_val, real_val = 0;
18991+
18992+ do {
18993+ old_val = real_val;
18994+ new_val = old_val + delta;
18995+
18996+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
18997+
18998+ } while (real_val != old_val);
18999+
19000+ return new_val;
19001+}
19002+EXPORT_SYMBOL(atomic64_add_return_unchecked);
19003+
19004 u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
19005 {
19006 return atomic64_add_return(-delta, ptr);
19007 }
19008 EXPORT_SYMBOL(atomic64_sub_return);
19009
19010+u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19011+{
19012+ return atomic64_add_return_unchecked(-delta, ptr);
19013+}
19014+EXPORT_SYMBOL(atomic64_sub_return_unchecked);
19015+
19016 u64 atomic64_inc_return(atomic64_t *ptr)
19017 {
19018 return atomic64_add_return(1, ptr);
19019 }
19020 EXPORT_SYMBOL(atomic64_inc_return);
19021
19022+u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
19023+{
19024+ return atomic64_add_return_unchecked(1, ptr);
19025+}
19026+EXPORT_SYMBOL(atomic64_inc_return_unchecked);
19027+
19028 u64 atomic64_dec_return(atomic64_t *ptr)
19029 {
19030 return atomic64_sub_return(1, ptr);
19031 }
19032 EXPORT_SYMBOL(atomic64_dec_return);
19033
19034+u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
19035+{
19036+ return atomic64_sub_return_unchecked(1, ptr);
19037+}
19038+EXPORT_SYMBOL(atomic64_dec_return_unchecked);
19039+
19040 /**
19041 * atomic64_add - add integer to atomic64 variable
19042 * @delta: integer value to add
19043@@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t
19044 EXPORT_SYMBOL(atomic64_add);
19045
19046 /**
19047+ * atomic64_add_unchecked - add integer to atomic64 variable
19048+ * @delta: integer value to add
19049+ * @ptr: pointer to type atomic64_unchecked_t
19050+ *
19051+ * Atomically adds @delta to @ptr.
19052+ */
19053+void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19054+{
19055+ atomic64_add_return_unchecked(delta, ptr);
19056+}
19057+EXPORT_SYMBOL(atomic64_add_unchecked);
19058+
19059+/**
19060 * atomic64_sub - subtract the atomic64 variable
19061 * @delta: integer value to subtract
19062 * @ptr: pointer to type atomic64_t
19063@@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t
19064 EXPORT_SYMBOL(atomic64_sub);
19065
19066 /**
19067+ * atomic64_sub_unchecked - subtract the atomic64 variable
19068+ * @delta: integer value to subtract
19069+ * @ptr: pointer to type atomic64_unchecked_t
19070+ *
19071+ * Atomically subtracts @delta from @ptr.
19072+ */
19073+void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19074+{
19075+ atomic64_add_unchecked(-delta, ptr);
19076+}
19077+EXPORT_SYMBOL(atomic64_sub_unchecked);
19078+
19079+/**
19080 * atomic64_sub_and_test - subtract value from variable and test result
19081 * @delta: integer value to subtract
19082 * @ptr: pointer to type atomic64_t
19083@@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
19084 EXPORT_SYMBOL(atomic64_inc);
19085
19086 /**
19087+ * atomic64_inc_unchecked - increment atomic64 variable
19088+ * @ptr: pointer to type atomic64_unchecked_t
19089+ *
19090+ * Atomically increments @ptr by 1.
19091+ */
19092+void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
19093+{
19094+ atomic64_add_unchecked(1, ptr);
19095+}
19096+EXPORT_SYMBOL(atomic64_inc_unchecked);
19097+
19098+/**
19099 * atomic64_dec - decrement atomic64 variable
19100 * @ptr: pointer to type atomic64_t
19101 *
19102@@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
19103 EXPORT_SYMBOL(atomic64_dec);
19104
19105 /**
19106+ * atomic64_dec_unchecked - decrement atomic64 variable
19107+ * @ptr: pointer to type atomic64_unchecked_t
19108+ *
19109+ * Atomically decrements @ptr by 1.
19110+ */
19111+void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
19112+{
19113+ atomic64_sub_unchecked(1, ptr);
19114+}
19115+EXPORT_SYMBOL(atomic64_dec_unchecked);
19116+
19117+/**
19118 * atomic64_dec_and_test - decrement and test
19119 * @ptr: pointer to type atomic64_t
19120 *
19121diff -urNp linux-2.6.32.46/arch/x86/lib/checksum_32.S linux-2.6.32.46/arch/x86/lib/checksum_32.S
19122--- linux-2.6.32.46/arch/x86/lib/checksum_32.S 2011-03-27 14:31:47.000000000 -0400
19123+++ linux-2.6.32.46/arch/x86/lib/checksum_32.S 2011-04-17 15:56:46.000000000 -0400
19124@@ -28,7 +28,8 @@
19125 #include <linux/linkage.h>
19126 #include <asm/dwarf2.h>
19127 #include <asm/errno.h>
19128-
19129+#include <asm/segment.h>
19130+
19131 /*
19132 * computes a partial checksum, e.g. for TCP/UDP fragments
19133 */
19134@@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (
19135
19136 #define ARGBASE 16
19137 #define FP 12
19138-
19139-ENTRY(csum_partial_copy_generic)
19140+
19141+ENTRY(csum_partial_copy_generic_to_user)
19142 CFI_STARTPROC
19143+
19144+#ifdef CONFIG_PAX_MEMORY_UDEREF
19145+ pushl %gs
19146+ CFI_ADJUST_CFA_OFFSET 4
19147+ popl %es
19148+ CFI_ADJUST_CFA_OFFSET -4
19149+ jmp csum_partial_copy_generic
19150+#endif
19151+
19152+ENTRY(csum_partial_copy_generic_from_user)
19153+
19154+#ifdef CONFIG_PAX_MEMORY_UDEREF
19155+ pushl %gs
19156+ CFI_ADJUST_CFA_OFFSET 4
19157+ popl %ds
19158+ CFI_ADJUST_CFA_OFFSET -4
19159+#endif
19160+
19161+ENTRY(csum_partial_copy_generic)
19162 subl $4,%esp
19163 CFI_ADJUST_CFA_OFFSET 4
19164 pushl %edi
19165@@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
19166 jmp 4f
19167 SRC(1: movw (%esi), %bx )
19168 addl $2, %esi
19169-DST( movw %bx, (%edi) )
19170+DST( movw %bx, %es:(%edi) )
19171 addl $2, %edi
19172 addw %bx, %ax
19173 adcl $0, %eax
19174@@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
19175 SRC(1: movl (%esi), %ebx )
19176 SRC( movl 4(%esi), %edx )
19177 adcl %ebx, %eax
19178-DST( movl %ebx, (%edi) )
19179+DST( movl %ebx, %es:(%edi) )
19180 adcl %edx, %eax
19181-DST( movl %edx, 4(%edi) )
19182+DST( movl %edx, %es:4(%edi) )
19183
19184 SRC( movl 8(%esi), %ebx )
19185 SRC( movl 12(%esi), %edx )
19186 adcl %ebx, %eax
19187-DST( movl %ebx, 8(%edi) )
19188+DST( movl %ebx, %es:8(%edi) )
19189 adcl %edx, %eax
19190-DST( movl %edx, 12(%edi) )
19191+DST( movl %edx, %es:12(%edi) )
19192
19193 SRC( movl 16(%esi), %ebx )
19194 SRC( movl 20(%esi), %edx )
19195 adcl %ebx, %eax
19196-DST( movl %ebx, 16(%edi) )
19197+DST( movl %ebx, %es:16(%edi) )
19198 adcl %edx, %eax
19199-DST( movl %edx, 20(%edi) )
19200+DST( movl %edx, %es:20(%edi) )
19201
19202 SRC( movl 24(%esi), %ebx )
19203 SRC( movl 28(%esi), %edx )
19204 adcl %ebx, %eax
19205-DST( movl %ebx, 24(%edi) )
19206+DST( movl %ebx, %es:24(%edi) )
19207 adcl %edx, %eax
19208-DST( movl %edx, 28(%edi) )
19209+DST( movl %edx, %es:28(%edi) )
19210
19211 lea 32(%esi), %esi
19212 lea 32(%edi), %edi
19213@@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
19214 shrl $2, %edx # This clears CF
19215 SRC(3: movl (%esi), %ebx )
19216 adcl %ebx, %eax
19217-DST( movl %ebx, (%edi) )
19218+DST( movl %ebx, %es:(%edi) )
19219 lea 4(%esi), %esi
19220 lea 4(%edi), %edi
19221 dec %edx
19222@@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
19223 jb 5f
19224 SRC( movw (%esi), %cx )
19225 leal 2(%esi), %esi
19226-DST( movw %cx, (%edi) )
19227+DST( movw %cx, %es:(%edi) )
19228 leal 2(%edi), %edi
19229 je 6f
19230 shll $16,%ecx
19231 SRC(5: movb (%esi), %cl )
19232-DST( movb %cl, (%edi) )
19233+DST( movb %cl, %es:(%edi) )
19234 6: addl %ecx, %eax
19235 adcl $0, %eax
19236 7:
19237@@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
19238
19239 6001:
19240 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19241- movl $-EFAULT, (%ebx)
19242+ movl $-EFAULT, %ss:(%ebx)
19243
19244 # zero the complete destination - computing the rest
19245 # is too much work
19246@@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
19247
19248 6002:
19249 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19250- movl $-EFAULT,(%ebx)
19251+ movl $-EFAULT,%ss:(%ebx)
19252 jmp 5000b
19253
19254 .previous
19255
19256+ pushl %ss
19257+ CFI_ADJUST_CFA_OFFSET 4
19258+ popl %ds
19259+ CFI_ADJUST_CFA_OFFSET -4
19260+ pushl %ss
19261+ CFI_ADJUST_CFA_OFFSET 4
19262+ popl %es
19263+ CFI_ADJUST_CFA_OFFSET -4
19264 popl %ebx
19265 CFI_ADJUST_CFA_OFFSET -4
19266 CFI_RESTORE ebx
19267@@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
19268 CFI_ADJUST_CFA_OFFSET -4
19269 ret
19270 CFI_ENDPROC
19271-ENDPROC(csum_partial_copy_generic)
19272+ENDPROC(csum_partial_copy_generic_to_user)
19273
19274 #else
19275
19276 /* Version for PentiumII/PPro */
19277
19278 #define ROUND1(x) \
19279+ nop; nop; nop; \
19280 SRC(movl x(%esi), %ebx ) ; \
19281 addl %ebx, %eax ; \
19282- DST(movl %ebx, x(%edi) ) ;
19283+ DST(movl %ebx, %es:x(%edi)) ;
19284
19285 #define ROUND(x) \
19286+ nop; nop; nop; \
19287 SRC(movl x(%esi), %ebx ) ; \
19288 adcl %ebx, %eax ; \
19289- DST(movl %ebx, x(%edi) ) ;
19290+ DST(movl %ebx, %es:x(%edi)) ;
19291
19292 #define ARGBASE 12
19293-
19294-ENTRY(csum_partial_copy_generic)
19295+
19296+ENTRY(csum_partial_copy_generic_to_user)
19297 CFI_STARTPROC
19298+
19299+#ifdef CONFIG_PAX_MEMORY_UDEREF
19300+ pushl %gs
19301+ CFI_ADJUST_CFA_OFFSET 4
19302+ popl %es
19303+ CFI_ADJUST_CFA_OFFSET -4
19304+ jmp csum_partial_copy_generic
19305+#endif
19306+
19307+ENTRY(csum_partial_copy_generic_from_user)
19308+
19309+#ifdef CONFIG_PAX_MEMORY_UDEREF
19310+ pushl %gs
19311+ CFI_ADJUST_CFA_OFFSET 4
19312+ popl %ds
19313+ CFI_ADJUST_CFA_OFFSET -4
19314+#endif
19315+
19316+ENTRY(csum_partial_copy_generic)
19317 pushl %ebx
19318 CFI_ADJUST_CFA_OFFSET 4
19319 CFI_REL_OFFSET ebx, 0
19320@@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
19321 subl %ebx, %edi
19322 lea -1(%esi),%edx
19323 andl $-32,%edx
19324- lea 3f(%ebx,%ebx), %ebx
19325+ lea 3f(%ebx,%ebx,2), %ebx
19326 testl %esi, %esi
19327 jmp *%ebx
19328 1: addl $64,%esi
19329@@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
19330 jb 5f
19331 SRC( movw (%esi), %dx )
19332 leal 2(%esi), %esi
19333-DST( movw %dx, (%edi) )
19334+DST( movw %dx, %es:(%edi) )
19335 leal 2(%edi), %edi
19336 je 6f
19337 shll $16,%edx
19338 5:
19339 SRC( movb (%esi), %dl )
19340-DST( movb %dl, (%edi) )
19341+DST( movb %dl, %es:(%edi) )
19342 6: addl %edx, %eax
19343 adcl $0, %eax
19344 7:
19345 .section .fixup, "ax"
19346 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19347- movl $-EFAULT, (%ebx)
19348+ movl $-EFAULT, %ss:(%ebx)
19349 # zero the complete destination (computing the rest is too much work)
19350 movl ARGBASE+8(%esp),%edi # dst
19351 movl ARGBASE+12(%esp),%ecx # len
19352@@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
19353 rep; stosb
19354 jmp 7b
19355 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19356- movl $-EFAULT, (%ebx)
19357+ movl $-EFAULT, %ss:(%ebx)
19358 jmp 7b
19359 .previous
19360
19361+#ifdef CONFIG_PAX_MEMORY_UDEREF
19362+ pushl %ss
19363+ CFI_ADJUST_CFA_OFFSET 4
19364+ popl %ds
19365+ CFI_ADJUST_CFA_OFFSET -4
19366+ pushl %ss
19367+ CFI_ADJUST_CFA_OFFSET 4
19368+ popl %es
19369+ CFI_ADJUST_CFA_OFFSET -4
19370+#endif
19371+
19372 popl %esi
19373 CFI_ADJUST_CFA_OFFSET -4
19374 CFI_RESTORE esi
19375@@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
19376 CFI_RESTORE ebx
19377 ret
19378 CFI_ENDPROC
19379-ENDPROC(csum_partial_copy_generic)
19380+ENDPROC(csum_partial_copy_generic_to_user)
19381
19382 #undef ROUND
19383 #undef ROUND1
19384diff -urNp linux-2.6.32.46/arch/x86/lib/clear_page_64.S linux-2.6.32.46/arch/x86/lib/clear_page_64.S
19385--- linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400
19386+++ linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-04-17 15:56:46.000000000 -0400
19387@@ -43,7 +43,7 @@ ENDPROC(clear_page)
19388
19389 #include <asm/cpufeature.h>
19390
19391- .section .altinstr_replacement,"ax"
19392+ .section .altinstr_replacement,"a"
19393 1: .byte 0xeb /* jmp <disp8> */
19394 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19395 2:
19396diff -urNp linux-2.6.32.46/arch/x86/lib/copy_page_64.S linux-2.6.32.46/arch/x86/lib/copy_page_64.S
19397--- linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400
19398+++ linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-04-17 15:56:46.000000000 -0400
19399@@ -104,7 +104,7 @@ ENDPROC(copy_page)
19400
19401 #include <asm/cpufeature.h>
19402
19403- .section .altinstr_replacement,"ax"
19404+ .section .altinstr_replacement,"a"
19405 1: .byte 0xeb /* jmp <disp8> */
19406 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19407 2:
19408diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_64.S linux-2.6.32.46/arch/x86/lib/copy_user_64.S
19409--- linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400
19410+++ linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-06-25 12:56:37.000000000 -0400
19411@@ -15,13 +15,14 @@
19412 #include <asm/asm-offsets.h>
19413 #include <asm/thread_info.h>
19414 #include <asm/cpufeature.h>
19415+#include <asm/pgtable.h>
19416
19417 .macro ALTERNATIVE_JUMP feature,orig,alt
19418 0:
19419 .byte 0xe9 /* 32bit jump */
19420 .long \orig-1f /* by default jump to orig */
19421 1:
19422- .section .altinstr_replacement,"ax"
19423+ .section .altinstr_replacement,"a"
19424 2: .byte 0xe9 /* near jump with 32bit immediate */
19425 .long \alt-1b /* offset */ /* or alternatively to alt */
19426 .previous
19427@@ -64,49 +65,19 @@
19428 #endif
19429 .endm
19430
19431-/* Standard copy_to_user with segment limit checking */
19432-ENTRY(copy_to_user)
19433- CFI_STARTPROC
19434- GET_THREAD_INFO(%rax)
19435- movq %rdi,%rcx
19436- addq %rdx,%rcx
19437- jc bad_to_user
19438- cmpq TI_addr_limit(%rax),%rcx
19439- ja bad_to_user
19440- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19441- CFI_ENDPROC
19442-ENDPROC(copy_to_user)
19443-
19444-/* Standard copy_from_user with segment limit checking */
19445-ENTRY(copy_from_user)
19446- CFI_STARTPROC
19447- GET_THREAD_INFO(%rax)
19448- movq %rsi,%rcx
19449- addq %rdx,%rcx
19450- jc bad_from_user
19451- cmpq TI_addr_limit(%rax),%rcx
19452- ja bad_from_user
19453- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19454- CFI_ENDPROC
19455-ENDPROC(copy_from_user)
19456-
19457 ENTRY(copy_user_generic)
19458 CFI_STARTPROC
19459 ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19460 CFI_ENDPROC
19461 ENDPROC(copy_user_generic)
19462
19463-ENTRY(__copy_from_user_inatomic)
19464- CFI_STARTPROC
19465- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19466- CFI_ENDPROC
19467-ENDPROC(__copy_from_user_inatomic)
19468-
19469 .section .fixup,"ax"
19470 /* must zero dest */
19471 ENTRY(bad_from_user)
19472 bad_from_user:
19473 CFI_STARTPROC
19474+ testl %edx,%edx
19475+ js bad_to_user
19476 movl %edx,%ecx
19477 xorl %eax,%eax
19478 rep
19479diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S
19480--- linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400
19481+++ linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-04-17 15:56:46.000000000 -0400
19482@@ -14,6 +14,7 @@
19483 #include <asm/current.h>
19484 #include <asm/asm-offsets.h>
19485 #include <asm/thread_info.h>
19486+#include <asm/pgtable.h>
19487
19488 .macro ALIGN_DESTINATION
19489 #ifdef FIX_ALIGNMENT
19490@@ -50,6 +51,15 @@
19491 */
19492 ENTRY(__copy_user_nocache)
19493 CFI_STARTPROC
19494+
19495+#ifdef CONFIG_PAX_MEMORY_UDEREF
19496+ mov $PAX_USER_SHADOW_BASE,%rcx
19497+ cmp %rcx,%rsi
19498+ jae 1f
19499+ add %rcx,%rsi
19500+1:
19501+#endif
19502+
19503 cmpl $8,%edx
19504 jb 20f /* less then 8 bytes, go to byte copy loop */
19505 ALIGN_DESTINATION
19506diff -urNp linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c
19507--- linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400
19508+++ linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-05-04 17:56:20.000000000 -0400
19509@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
19510 len -= 2;
19511 }
19512 }
19513+
19514+#ifdef CONFIG_PAX_MEMORY_UDEREF
19515+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19516+ src += PAX_USER_SHADOW_BASE;
19517+#endif
19518+
19519 isum = csum_partial_copy_generic((__force const void *)src,
19520 dst, len, isum, errp, NULL);
19521 if (unlikely(*errp))
19522@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
19523 }
19524
19525 *errp = 0;
19526+
19527+#ifdef CONFIG_PAX_MEMORY_UDEREF
19528+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19529+ dst += PAX_USER_SHADOW_BASE;
19530+#endif
19531+
19532 return csum_partial_copy_generic(src, (void __force *)dst,
19533 len, isum, NULL, errp);
19534 }
19535diff -urNp linux-2.6.32.46/arch/x86/lib/getuser.S linux-2.6.32.46/arch/x86/lib/getuser.S
19536--- linux-2.6.32.46/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400
19537+++ linux-2.6.32.46/arch/x86/lib/getuser.S 2011-04-17 15:56:46.000000000 -0400
19538@@ -33,14 +33,35 @@
19539 #include <asm/asm-offsets.h>
19540 #include <asm/thread_info.h>
19541 #include <asm/asm.h>
19542+#include <asm/segment.h>
19543+#include <asm/pgtable.h>
19544+
19545+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19546+#define __copyuser_seg gs;
19547+#else
19548+#define __copyuser_seg
19549+#endif
19550
19551 .text
19552 ENTRY(__get_user_1)
19553 CFI_STARTPROC
19554+
19555+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19556 GET_THREAD_INFO(%_ASM_DX)
19557 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19558 jae bad_get_user
19559-1: movzb (%_ASM_AX),%edx
19560+
19561+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19562+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19563+ cmp %_ASM_DX,%_ASM_AX
19564+ jae 1234f
19565+ add %_ASM_DX,%_ASM_AX
19566+1234:
19567+#endif
19568+
19569+#endif
19570+
19571+1: __copyuser_seg movzb (%_ASM_AX),%edx
19572 xor %eax,%eax
19573 ret
19574 CFI_ENDPROC
19575@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
19576 ENTRY(__get_user_2)
19577 CFI_STARTPROC
19578 add $1,%_ASM_AX
19579+
19580+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19581 jc bad_get_user
19582 GET_THREAD_INFO(%_ASM_DX)
19583 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19584 jae bad_get_user
19585-2: movzwl -1(%_ASM_AX),%edx
19586+
19587+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19588+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19589+ cmp %_ASM_DX,%_ASM_AX
19590+ jae 1234f
19591+ add %_ASM_DX,%_ASM_AX
19592+1234:
19593+#endif
19594+
19595+#endif
19596+
19597+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19598 xor %eax,%eax
19599 ret
19600 CFI_ENDPROC
19601@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
19602 ENTRY(__get_user_4)
19603 CFI_STARTPROC
19604 add $3,%_ASM_AX
19605+
19606+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19607 jc bad_get_user
19608 GET_THREAD_INFO(%_ASM_DX)
19609 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19610 jae bad_get_user
19611-3: mov -3(%_ASM_AX),%edx
19612+
19613+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19614+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19615+ cmp %_ASM_DX,%_ASM_AX
19616+ jae 1234f
19617+ add %_ASM_DX,%_ASM_AX
19618+1234:
19619+#endif
19620+
19621+#endif
19622+
19623+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19624 xor %eax,%eax
19625 ret
19626 CFI_ENDPROC
19627@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
19628 GET_THREAD_INFO(%_ASM_DX)
19629 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19630 jae bad_get_user
19631+
19632+#ifdef CONFIG_PAX_MEMORY_UDEREF
19633+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19634+ cmp %_ASM_DX,%_ASM_AX
19635+ jae 1234f
19636+ add %_ASM_DX,%_ASM_AX
19637+1234:
19638+#endif
19639+
19640 4: movq -7(%_ASM_AX),%_ASM_DX
19641 xor %eax,%eax
19642 ret
19643diff -urNp linux-2.6.32.46/arch/x86/lib/memcpy_64.S linux-2.6.32.46/arch/x86/lib/memcpy_64.S
19644--- linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400
19645+++ linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-04-17 15:56:46.000000000 -0400
19646@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
19647 * It is also a lot simpler. Use this when possible:
19648 */
19649
19650- .section .altinstr_replacement, "ax"
19651+ .section .altinstr_replacement, "a"
19652 1: .byte 0xeb /* jmp <disp8> */
19653 .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
19654 2:
19655diff -urNp linux-2.6.32.46/arch/x86/lib/memset_64.S linux-2.6.32.46/arch/x86/lib/memset_64.S
19656--- linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400
19657+++ linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-04-17 15:56:46.000000000 -0400
19658@@ -118,7 +118,7 @@ ENDPROC(__memset)
19659
19660 #include <asm/cpufeature.h>
19661
19662- .section .altinstr_replacement,"ax"
19663+ .section .altinstr_replacement,"a"
19664 1: .byte 0xeb /* jmp <disp8> */
19665 .byte (memset_c - memset) - (2f - 1b) /* offset */
19666 2:
19667diff -urNp linux-2.6.32.46/arch/x86/lib/mmx_32.c linux-2.6.32.46/arch/x86/lib/mmx_32.c
19668--- linux-2.6.32.46/arch/x86/lib/mmx_32.c 2011-03-27 14:31:47.000000000 -0400
19669+++ linux-2.6.32.46/arch/x86/lib/mmx_32.c 2011-04-17 15:56:46.000000000 -0400
19670@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
19671 {
19672 void *p;
19673 int i;
19674+ unsigned long cr0;
19675
19676 if (unlikely(in_interrupt()))
19677 return __memcpy(to, from, len);
19678@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
19679 kernel_fpu_begin();
19680
19681 __asm__ __volatile__ (
19682- "1: prefetch (%0)\n" /* This set is 28 bytes */
19683- " prefetch 64(%0)\n"
19684- " prefetch 128(%0)\n"
19685- " prefetch 192(%0)\n"
19686- " prefetch 256(%0)\n"
19687+ "1: prefetch (%1)\n" /* This set is 28 bytes */
19688+ " prefetch 64(%1)\n"
19689+ " prefetch 128(%1)\n"
19690+ " prefetch 192(%1)\n"
19691+ " prefetch 256(%1)\n"
19692 "2: \n"
19693 ".section .fixup, \"ax\"\n"
19694- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19695+ "3: \n"
19696+
19697+#ifdef CONFIG_PAX_KERNEXEC
19698+ " movl %%cr0, %0\n"
19699+ " movl %0, %%eax\n"
19700+ " andl $0xFFFEFFFF, %%eax\n"
19701+ " movl %%eax, %%cr0\n"
19702+#endif
19703+
19704+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19705+
19706+#ifdef CONFIG_PAX_KERNEXEC
19707+ " movl %0, %%cr0\n"
19708+#endif
19709+
19710 " jmp 2b\n"
19711 ".previous\n"
19712 _ASM_EXTABLE(1b, 3b)
19713- : : "r" (from));
19714+ : "=&r" (cr0) : "r" (from) : "ax");
19715
19716 for ( ; i > 5; i--) {
19717 __asm__ __volatile__ (
19718- "1: prefetch 320(%0)\n"
19719- "2: movq (%0), %%mm0\n"
19720- " movq 8(%0), %%mm1\n"
19721- " movq 16(%0), %%mm2\n"
19722- " movq 24(%0), %%mm3\n"
19723- " movq %%mm0, (%1)\n"
19724- " movq %%mm1, 8(%1)\n"
19725- " movq %%mm2, 16(%1)\n"
19726- " movq %%mm3, 24(%1)\n"
19727- " movq 32(%0), %%mm0\n"
19728- " movq 40(%0), %%mm1\n"
19729- " movq 48(%0), %%mm2\n"
19730- " movq 56(%0), %%mm3\n"
19731- " movq %%mm0, 32(%1)\n"
19732- " movq %%mm1, 40(%1)\n"
19733- " movq %%mm2, 48(%1)\n"
19734- " movq %%mm3, 56(%1)\n"
19735+ "1: prefetch 320(%1)\n"
19736+ "2: movq (%1), %%mm0\n"
19737+ " movq 8(%1), %%mm1\n"
19738+ " movq 16(%1), %%mm2\n"
19739+ " movq 24(%1), %%mm3\n"
19740+ " movq %%mm0, (%2)\n"
19741+ " movq %%mm1, 8(%2)\n"
19742+ " movq %%mm2, 16(%2)\n"
19743+ " movq %%mm3, 24(%2)\n"
19744+ " movq 32(%1), %%mm0\n"
19745+ " movq 40(%1), %%mm1\n"
19746+ " movq 48(%1), %%mm2\n"
19747+ " movq 56(%1), %%mm3\n"
19748+ " movq %%mm0, 32(%2)\n"
19749+ " movq %%mm1, 40(%2)\n"
19750+ " movq %%mm2, 48(%2)\n"
19751+ " movq %%mm3, 56(%2)\n"
19752 ".section .fixup, \"ax\"\n"
19753- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19754+ "3:\n"
19755+
19756+#ifdef CONFIG_PAX_KERNEXEC
19757+ " movl %%cr0, %0\n"
19758+ " movl %0, %%eax\n"
19759+ " andl $0xFFFEFFFF, %%eax\n"
19760+ " movl %%eax, %%cr0\n"
19761+#endif
19762+
19763+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19764+
19765+#ifdef CONFIG_PAX_KERNEXEC
19766+ " movl %0, %%cr0\n"
19767+#endif
19768+
19769 " jmp 2b\n"
19770 ".previous\n"
19771 _ASM_EXTABLE(1b, 3b)
19772- : : "r" (from), "r" (to) : "memory");
19773+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19774
19775 from += 64;
19776 to += 64;
19777@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
19778 static void fast_copy_page(void *to, void *from)
19779 {
19780 int i;
19781+ unsigned long cr0;
19782
19783 kernel_fpu_begin();
19784
19785@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
19786 * but that is for later. -AV
19787 */
19788 __asm__ __volatile__(
19789- "1: prefetch (%0)\n"
19790- " prefetch 64(%0)\n"
19791- " prefetch 128(%0)\n"
19792- " prefetch 192(%0)\n"
19793- " prefetch 256(%0)\n"
19794+ "1: prefetch (%1)\n"
19795+ " prefetch 64(%1)\n"
19796+ " prefetch 128(%1)\n"
19797+ " prefetch 192(%1)\n"
19798+ " prefetch 256(%1)\n"
19799 "2: \n"
19800 ".section .fixup, \"ax\"\n"
19801- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19802+ "3: \n"
19803+
19804+#ifdef CONFIG_PAX_KERNEXEC
19805+ " movl %%cr0, %0\n"
19806+ " movl %0, %%eax\n"
19807+ " andl $0xFFFEFFFF, %%eax\n"
19808+ " movl %%eax, %%cr0\n"
19809+#endif
19810+
19811+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19812+
19813+#ifdef CONFIG_PAX_KERNEXEC
19814+ " movl %0, %%cr0\n"
19815+#endif
19816+
19817 " jmp 2b\n"
19818 ".previous\n"
19819- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19820+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19821
19822 for (i = 0; i < (4096-320)/64; i++) {
19823 __asm__ __volatile__ (
19824- "1: prefetch 320(%0)\n"
19825- "2: movq (%0), %%mm0\n"
19826- " movntq %%mm0, (%1)\n"
19827- " movq 8(%0), %%mm1\n"
19828- " movntq %%mm1, 8(%1)\n"
19829- " movq 16(%0), %%mm2\n"
19830- " movntq %%mm2, 16(%1)\n"
19831- " movq 24(%0), %%mm3\n"
19832- " movntq %%mm3, 24(%1)\n"
19833- " movq 32(%0), %%mm4\n"
19834- " movntq %%mm4, 32(%1)\n"
19835- " movq 40(%0), %%mm5\n"
19836- " movntq %%mm5, 40(%1)\n"
19837- " movq 48(%0), %%mm6\n"
19838- " movntq %%mm6, 48(%1)\n"
19839- " movq 56(%0), %%mm7\n"
19840- " movntq %%mm7, 56(%1)\n"
19841+ "1: prefetch 320(%1)\n"
19842+ "2: movq (%1), %%mm0\n"
19843+ " movntq %%mm0, (%2)\n"
19844+ " movq 8(%1), %%mm1\n"
19845+ " movntq %%mm1, 8(%2)\n"
19846+ " movq 16(%1), %%mm2\n"
19847+ " movntq %%mm2, 16(%2)\n"
19848+ " movq 24(%1), %%mm3\n"
19849+ " movntq %%mm3, 24(%2)\n"
19850+ " movq 32(%1), %%mm4\n"
19851+ " movntq %%mm4, 32(%2)\n"
19852+ " movq 40(%1), %%mm5\n"
19853+ " movntq %%mm5, 40(%2)\n"
19854+ " movq 48(%1), %%mm6\n"
19855+ " movntq %%mm6, 48(%2)\n"
19856+ " movq 56(%1), %%mm7\n"
19857+ " movntq %%mm7, 56(%2)\n"
19858 ".section .fixup, \"ax\"\n"
19859- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19860+ "3:\n"
19861+
19862+#ifdef CONFIG_PAX_KERNEXEC
19863+ " movl %%cr0, %0\n"
19864+ " movl %0, %%eax\n"
19865+ " andl $0xFFFEFFFF, %%eax\n"
19866+ " movl %%eax, %%cr0\n"
19867+#endif
19868+
19869+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19870+
19871+#ifdef CONFIG_PAX_KERNEXEC
19872+ " movl %0, %%cr0\n"
19873+#endif
19874+
19875 " jmp 2b\n"
19876 ".previous\n"
19877- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
19878+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19879
19880 from += 64;
19881 to += 64;
19882@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
19883 static void fast_copy_page(void *to, void *from)
19884 {
19885 int i;
19886+ unsigned long cr0;
19887
19888 kernel_fpu_begin();
19889
19890 __asm__ __volatile__ (
19891- "1: prefetch (%0)\n"
19892- " prefetch 64(%0)\n"
19893- " prefetch 128(%0)\n"
19894- " prefetch 192(%0)\n"
19895- " prefetch 256(%0)\n"
19896+ "1: prefetch (%1)\n"
19897+ " prefetch 64(%1)\n"
19898+ " prefetch 128(%1)\n"
19899+ " prefetch 192(%1)\n"
19900+ " prefetch 256(%1)\n"
19901 "2: \n"
19902 ".section .fixup, \"ax\"\n"
19903- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19904+ "3: \n"
19905+
19906+#ifdef CONFIG_PAX_KERNEXEC
19907+ " movl %%cr0, %0\n"
19908+ " movl %0, %%eax\n"
19909+ " andl $0xFFFEFFFF, %%eax\n"
19910+ " movl %%eax, %%cr0\n"
19911+#endif
19912+
19913+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19914+
19915+#ifdef CONFIG_PAX_KERNEXEC
19916+ " movl %0, %%cr0\n"
19917+#endif
19918+
19919 " jmp 2b\n"
19920 ".previous\n"
19921- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19922+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19923
19924 for (i = 0; i < 4096/64; i++) {
19925 __asm__ __volatile__ (
19926- "1: prefetch 320(%0)\n"
19927- "2: movq (%0), %%mm0\n"
19928- " movq 8(%0), %%mm1\n"
19929- " movq 16(%0), %%mm2\n"
19930- " movq 24(%0), %%mm3\n"
19931- " movq %%mm0, (%1)\n"
19932- " movq %%mm1, 8(%1)\n"
19933- " movq %%mm2, 16(%1)\n"
19934- " movq %%mm3, 24(%1)\n"
19935- " movq 32(%0), %%mm0\n"
19936- " movq 40(%0), %%mm1\n"
19937- " movq 48(%0), %%mm2\n"
19938- " movq 56(%0), %%mm3\n"
19939- " movq %%mm0, 32(%1)\n"
19940- " movq %%mm1, 40(%1)\n"
19941- " movq %%mm2, 48(%1)\n"
19942- " movq %%mm3, 56(%1)\n"
19943+ "1: prefetch 320(%1)\n"
19944+ "2: movq (%1), %%mm0\n"
19945+ " movq 8(%1), %%mm1\n"
19946+ " movq 16(%1), %%mm2\n"
19947+ " movq 24(%1), %%mm3\n"
19948+ " movq %%mm0, (%2)\n"
19949+ " movq %%mm1, 8(%2)\n"
19950+ " movq %%mm2, 16(%2)\n"
19951+ " movq %%mm3, 24(%2)\n"
19952+ " movq 32(%1), %%mm0\n"
19953+ " movq 40(%1), %%mm1\n"
19954+ " movq 48(%1), %%mm2\n"
19955+ " movq 56(%1), %%mm3\n"
19956+ " movq %%mm0, 32(%2)\n"
19957+ " movq %%mm1, 40(%2)\n"
19958+ " movq %%mm2, 48(%2)\n"
19959+ " movq %%mm3, 56(%2)\n"
19960 ".section .fixup, \"ax\"\n"
19961- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19962+ "3:\n"
19963+
19964+#ifdef CONFIG_PAX_KERNEXEC
19965+ " movl %%cr0, %0\n"
19966+ " movl %0, %%eax\n"
19967+ " andl $0xFFFEFFFF, %%eax\n"
19968+ " movl %%eax, %%cr0\n"
19969+#endif
19970+
19971+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19972+
19973+#ifdef CONFIG_PAX_KERNEXEC
19974+ " movl %0, %%cr0\n"
19975+#endif
19976+
19977 " jmp 2b\n"
19978 ".previous\n"
19979 _ASM_EXTABLE(1b, 3b)
19980- : : "r" (from), "r" (to) : "memory");
19981+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19982
19983 from += 64;
19984 to += 64;
19985diff -urNp linux-2.6.32.46/arch/x86/lib/putuser.S linux-2.6.32.46/arch/x86/lib/putuser.S
19986--- linux-2.6.32.46/arch/x86/lib/putuser.S 2011-03-27 14:31:47.000000000 -0400
19987+++ linux-2.6.32.46/arch/x86/lib/putuser.S 2011-04-17 15:56:46.000000000 -0400
19988@@ -15,7 +15,8 @@
19989 #include <asm/thread_info.h>
19990 #include <asm/errno.h>
19991 #include <asm/asm.h>
19992-
19993+#include <asm/segment.h>
19994+#include <asm/pgtable.h>
19995
19996 /*
19997 * __put_user_X
19998@@ -29,52 +30,119 @@
19999 * as they get called from within inline assembly.
20000 */
20001
20002-#define ENTER CFI_STARTPROC ; \
20003- GET_THREAD_INFO(%_ASM_BX)
20004+#define ENTER CFI_STARTPROC
20005 #define EXIT ret ; \
20006 CFI_ENDPROC
20007
20008+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20009+#define _DEST %_ASM_CX,%_ASM_BX
20010+#else
20011+#define _DEST %_ASM_CX
20012+#endif
20013+
20014+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20015+#define __copyuser_seg gs;
20016+#else
20017+#define __copyuser_seg
20018+#endif
20019+
20020 .text
20021 ENTRY(__put_user_1)
20022 ENTER
20023+
20024+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20025+ GET_THREAD_INFO(%_ASM_BX)
20026 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20027 jae bad_put_user
20028-1: movb %al,(%_ASM_CX)
20029+
20030+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20031+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20032+ cmp %_ASM_BX,%_ASM_CX
20033+ jb 1234f
20034+ xor %ebx,%ebx
20035+1234:
20036+#endif
20037+
20038+#endif
20039+
20040+1: __copyuser_seg movb %al,(_DEST)
20041 xor %eax,%eax
20042 EXIT
20043 ENDPROC(__put_user_1)
20044
20045 ENTRY(__put_user_2)
20046 ENTER
20047+
20048+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20049+ GET_THREAD_INFO(%_ASM_BX)
20050 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20051 sub $1,%_ASM_BX
20052 cmp %_ASM_BX,%_ASM_CX
20053 jae bad_put_user
20054-2: movw %ax,(%_ASM_CX)
20055+
20056+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20057+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20058+ cmp %_ASM_BX,%_ASM_CX
20059+ jb 1234f
20060+ xor %ebx,%ebx
20061+1234:
20062+#endif
20063+
20064+#endif
20065+
20066+2: __copyuser_seg movw %ax,(_DEST)
20067 xor %eax,%eax
20068 EXIT
20069 ENDPROC(__put_user_2)
20070
20071 ENTRY(__put_user_4)
20072 ENTER
20073+
20074+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20075+ GET_THREAD_INFO(%_ASM_BX)
20076 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20077 sub $3,%_ASM_BX
20078 cmp %_ASM_BX,%_ASM_CX
20079 jae bad_put_user
20080-3: movl %eax,(%_ASM_CX)
20081+
20082+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20083+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20084+ cmp %_ASM_BX,%_ASM_CX
20085+ jb 1234f
20086+ xor %ebx,%ebx
20087+1234:
20088+#endif
20089+
20090+#endif
20091+
20092+3: __copyuser_seg movl %eax,(_DEST)
20093 xor %eax,%eax
20094 EXIT
20095 ENDPROC(__put_user_4)
20096
20097 ENTRY(__put_user_8)
20098 ENTER
20099+
20100+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20101+ GET_THREAD_INFO(%_ASM_BX)
20102 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20103 sub $7,%_ASM_BX
20104 cmp %_ASM_BX,%_ASM_CX
20105 jae bad_put_user
20106-4: mov %_ASM_AX,(%_ASM_CX)
20107+
20108+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20109+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20110+ cmp %_ASM_BX,%_ASM_CX
20111+ jb 1234f
20112+ xor %ebx,%ebx
20113+1234:
20114+#endif
20115+
20116+#endif
20117+
20118+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20119 #ifdef CONFIG_X86_32
20120-5: movl %edx,4(%_ASM_CX)
20121+5: __copyuser_seg movl %edx,4(_DEST)
20122 #endif
20123 xor %eax,%eax
20124 EXIT
20125diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_32.c linux-2.6.32.46/arch/x86/lib/usercopy_32.c
20126--- linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400
20127+++ linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400
20128@@ -43,7 +43,7 @@ do { \
20129 __asm__ __volatile__( \
20130 " testl %1,%1\n" \
20131 " jz 2f\n" \
20132- "0: lodsb\n" \
20133+ "0: "__copyuser_seg"lodsb\n" \
20134 " stosb\n" \
20135 " testb %%al,%%al\n" \
20136 " jz 1f\n" \
20137@@ -128,10 +128,12 @@ do { \
20138 int __d0; \
20139 might_fault(); \
20140 __asm__ __volatile__( \
20141+ __COPYUSER_SET_ES \
20142 "0: rep; stosl\n" \
20143 " movl %2,%0\n" \
20144 "1: rep; stosb\n" \
20145 "2:\n" \
20146+ __COPYUSER_RESTORE_ES \
20147 ".section .fixup,\"ax\"\n" \
20148 "3: lea 0(%2,%0,4),%0\n" \
20149 " jmp 2b\n" \
20150@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20151 might_fault();
20152
20153 __asm__ __volatile__(
20154+ __COPYUSER_SET_ES
20155 " testl %0, %0\n"
20156 " jz 3f\n"
20157 " andl %0,%%ecx\n"
20158@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20159 " subl %%ecx,%0\n"
20160 " addl %0,%%eax\n"
20161 "1:\n"
20162+ __COPYUSER_RESTORE_ES
20163 ".section .fixup,\"ax\"\n"
20164 "2: xorl %%eax,%%eax\n"
20165 " jmp 1b\n"
20166@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20167
20168 #ifdef CONFIG_X86_INTEL_USERCOPY
20169 static unsigned long
20170-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20171+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20172 {
20173 int d0, d1;
20174 __asm__ __volatile__(
20175@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20176 " .align 2,0x90\n"
20177 "3: movl 0(%4), %%eax\n"
20178 "4: movl 4(%4), %%edx\n"
20179- "5: movl %%eax, 0(%3)\n"
20180- "6: movl %%edx, 4(%3)\n"
20181+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20182+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20183 "7: movl 8(%4), %%eax\n"
20184 "8: movl 12(%4),%%edx\n"
20185- "9: movl %%eax, 8(%3)\n"
20186- "10: movl %%edx, 12(%3)\n"
20187+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20188+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20189 "11: movl 16(%4), %%eax\n"
20190 "12: movl 20(%4), %%edx\n"
20191- "13: movl %%eax, 16(%3)\n"
20192- "14: movl %%edx, 20(%3)\n"
20193+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20194+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20195 "15: movl 24(%4), %%eax\n"
20196 "16: movl 28(%4), %%edx\n"
20197- "17: movl %%eax, 24(%3)\n"
20198- "18: movl %%edx, 28(%3)\n"
20199+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20200+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20201 "19: movl 32(%4), %%eax\n"
20202 "20: movl 36(%4), %%edx\n"
20203- "21: movl %%eax, 32(%3)\n"
20204- "22: movl %%edx, 36(%3)\n"
20205+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20206+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20207 "23: movl 40(%4), %%eax\n"
20208 "24: movl 44(%4), %%edx\n"
20209- "25: movl %%eax, 40(%3)\n"
20210- "26: movl %%edx, 44(%3)\n"
20211+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20212+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20213 "27: movl 48(%4), %%eax\n"
20214 "28: movl 52(%4), %%edx\n"
20215- "29: movl %%eax, 48(%3)\n"
20216- "30: movl %%edx, 52(%3)\n"
20217+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20218+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20219 "31: movl 56(%4), %%eax\n"
20220 "32: movl 60(%4), %%edx\n"
20221- "33: movl %%eax, 56(%3)\n"
20222- "34: movl %%edx, 60(%3)\n"
20223+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20224+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20225 " addl $-64, %0\n"
20226 " addl $64, %4\n"
20227 " addl $64, %3\n"
20228@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20229 " shrl $2, %0\n"
20230 " andl $3, %%eax\n"
20231 " cld\n"
20232+ __COPYUSER_SET_ES
20233 "99: rep; movsl\n"
20234 "36: movl %%eax, %0\n"
20235 "37: rep; movsb\n"
20236 "100:\n"
20237+ __COPYUSER_RESTORE_ES
20238+ ".section .fixup,\"ax\"\n"
20239+ "101: lea 0(%%eax,%0,4),%0\n"
20240+ " jmp 100b\n"
20241+ ".previous\n"
20242+ ".section __ex_table,\"a\"\n"
20243+ " .align 4\n"
20244+ " .long 1b,100b\n"
20245+ " .long 2b,100b\n"
20246+ " .long 3b,100b\n"
20247+ " .long 4b,100b\n"
20248+ " .long 5b,100b\n"
20249+ " .long 6b,100b\n"
20250+ " .long 7b,100b\n"
20251+ " .long 8b,100b\n"
20252+ " .long 9b,100b\n"
20253+ " .long 10b,100b\n"
20254+ " .long 11b,100b\n"
20255+ " .long 12b,100b\n"
20256+ " .long 13b,100b\n"
20257+ " .long 14b,100b\n"
20258+ " .long 15b,100b\n"
20259+ " .long 16b,100b\n"
20260+ " .long 17b,100b\n"
20261+ " .long 18b,100b\n"
20262+ " .long 19b,100b\n"
20263+ " .long 20b,100b\n"
20264+ " .long 21b,100b\n"
20265+ " .long 22b,100b\n"
20266+ " .long 23b,100b\n"
20267+ " .long 24b,100b\n"
20268+ " .long 25b,100b\n"
20269+ " .long 26b,100b\n"
20270+ " .long 27b,100b\n"
20271+ " .long 28b,100b\n"
20272+ " .long 29b,100b\n"
20273+ " .long 30b,100b\n"
20274+ " .long 31b,100b\n"
20275+ " .long 32b,100b\n"
20276+ " .long 33b,100b\n"
20277+ " .long 34b,100b\n"
20278+ " .long 35b,100b\n"
20279+ " .long 36b,100b\n"
20280+ " .long 37b,100b\n"
20281+ " .long 99b,101b\n"
20282+ ".previous"
20283+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20284+ : "1"(to), "2"(from), "0"(size)
20285+ : "eax", "edx", "memory");
20286+ return size;
20287+}
20288+
20289+static unsigned long
20290+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20291+{
20292+ int d0, d1;
20293+ __asm__ __volatile__(
20294+ " .align 2,0x90\n"
20295+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20296+ " cmpl $67, %0\n"
20297+ " jbe 3f\n"
20298+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20299+ " .align 2,0x90\n"
20300+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20301+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20302+ "5: movl %%eax, 0(%3)\n"
20303+ "6: movl %%edx, 4(%3)\n"
20304+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20305+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20306+ "9: movl %%eax, 8(%3)\n"
20307+ "10: movl %%edx, 12(%3)\n"
20308+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20309+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20310+ "13: movl %%eax, 16(%3)\n"
20311+ "14: movl %%edx, 20(%3)\n"
20312+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20313+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20314+ "17: movl %%eax, 24(%3)\n"
20315+ "18: movl %%edx, 28(%3)\n"
20316+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20317+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20318+ "21: movl %%eax, 32(%3)\n"
20319+ "22: movl %%edx, 36(%3)\n"
20320+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20321+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20322+ "25: movl %%eax, 40(%3)\n"
20323+ "26: movl %%edx, 44(%3)\n"
20324+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20325+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20326+ "29: movl %%eax, 48(%3)\n"
20327+ "30: movl %%edx, 52(%3)\n"
20328+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20329+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20330+ "33: movl %%eax, 56(%3)\n"
20331+ "34: movl %%edx, 60(%3)\n"
20332+ " addl $-64, %0\n"
20333+ " addl $64, %4\n"
20334+ " addl $64, %3\n"
20335+ " cmpl $63, %0\n"
20336+ " ja 1b\n"
20337+ "35: movl %0, %%eax\n"
20338+ " shrl $2, %0\n"
20339+ " andl $3, %%eax\n"
20340+ " cld\n"
20341+ "99: rep; "__copyuser_seg" movsl\n"
20342+ "36: movl %%eax, %0\n"
20343+ "37: rep; "__copyuser_seg" movsb\n"
20344+ "100:\n"
20345 ".section .fixup,\"ax\"\n"
20346 "101: lea 0(%%eax,%0,4),%0\n"
20347 " jmp 100b\n"
20348@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
20349 int d0, d1;
20350 __asm__ __volatile__(
20351 " .align 2,0x90\n"
20352- "0: movl 32(%4), %%eax\n"
20353+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20354 " cmpl $67, %0\n"
20355 " jbe 2f\n"
20356- "1: movl 64(%4), %%eax\n"
20357+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20358 " .align 2,0x90\n"
20359- "2: movl 0(%4), %%eax\n"
20360- "21: movl 4(%4), %%edx\n"
20361+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20362+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20363 " movl %%eax, 0(%3)\n"
20364 " movl %%edx, 4(%3)\n"
20365- "3: movl 8(%4), %%eax\n"
20366- "31: movl 12(%4),%%edx\n"
20367+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20368+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20369 " movl %%eax, 8(%3)\n"
20370 " movl %%edx, 12(%3)\n"
20371- "4: movl 16(%4), %%eax\n"
20372- "41: movl 20(%4), %%edx\n"
20373+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20374+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20375 " movl %%eax, 16(%3)\n"
20376 " movl %%edx, 20(%3)\n"
20377- "10: movl 24(%4), %%eax\n"
20378- "51: movl 28(%4), %%edx\n"
20379+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20380+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20381 " movl %%eax, 24(%3)\n"
20382 " movl %%edx, 28(%3)\n"
20383- "11: movl 32(%4), %%eax\n"
20384- "61: movl 36(%4), %%edx\n"
20385+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20386+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20387 " movl %%eax, 32(%3)\n"
20388 " movl %%edx, 36(%3)\n"
20389- "12: movl 40(%4), %%eax\n"
20390- "71: movl 44(%4), %%edx\n"
20391+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20392+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20393 " movl %%eax, 40(%3)\n"
20394 " movl %%edx, 44(%3)\n"
20395- "13: movl 48(%4), %%eax\n"
20396- "81: movl 52(%4), %%edx\n"
20397+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20398+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20399 " movl %%eax, 48(%3)\n"
20400 " movl %%edx, 52(%3)\n"
20401- "14: movl 56(%4), %%eax\n"
20402- "91: movl 60(%4), %%edx\n"
20403+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20404+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20405 " movl %%eax, 56(%3)\n"
20406 " movl %%edx, 60(%3)\n"
20407 " addl $-64, %0\n"
20408@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20409 " shrl $2, %0\n"
20410 " andl $3, %%eax\n"
20411 " cld\n"
20412- "6: rep; movsl\n"
20413+ "6: rep; "__copyuser_seg" movsl\n"
20414 " movl %%eax,%0\n"
20415- "7: rep; movsb\n"
20416+ "7: rep; "__copyuser_seg" movsb\n"
20417 "8:\n"
20418 ".section .fixup,\"ax\"\n"
20419 "9: lea 0(%%eax,%0,4),%0\n"
20420@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
20421
20422 __asm__ __volatile__(
20423 " .align 2,0x90\n"
20424- "0: movl 32(%4), %%eax\n"
20425+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20426 " cmpl $67, %0\n"
20427 " jbe 2f\n"
20428- "1: movl 64(%4), %%eax\n"
20429+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20430 " .align 2,0x90\n"
20431- "2: movl 0(%4), %%eax\n"
20432- "21: movl 4(%4), %%edx\n"
20433+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20434+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20435 " movnti %%eax, 0(%3)\n"
20436 " movnti %%edx, 4(%3)\n"
20437- "3: movl 8(%4), %%eax\n"
20438- "31: movl 12(%4),%%edx\n"
20439+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20440+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20441 " movnti %%eax, 8(%3)\n"
20442 " movnti %%edx, 12(%3)\n"
20443- "4: movl 16(%4), %%eax\n"
20444- "41: movl 20(%4), %%edx\n"
20445+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20446+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20447 " movnti %%eax, 16(%3)\n"
20448 " movnti %%edx, 20(%3)\n"
20449- "10: movl 24(%4), %%eax\n"
20450- "51: movl 28(%4), %%edx\n"
20451+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20452+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20453 " movnti %%eax, 24(%3)\n"
20454 " movnti %%edx, 28(%3)\n"
20455- "11: movl 32(%4), %%eax\n"
20456- "61: movl 36(%4), %%edx\n"
20457+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20458+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20459 " movnti %%eax, 32(%3)\n"
20460 " movnti %%edx, 36(%3)\n"
20461- "12: movl 40(%4), %%eax\n"
20462- "71: movl 44(%4), %%edx\n"
20463+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20464+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20465 " movnti %%eax, 40(%3)\n"
20466 " movnti %%edx, 44(%3)\n"
20467- "13: movl 48(%4), %%eax\n"
20468- "81: movl 52(%4), %%edx\n"
20469+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20470+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20471 " movnti %%eax, 48(%3)\n"
20472 " movnti %%edx, 52(%3)\n"
20473- "14: movl 56(%4), %%eax\n"
20474- "91: movl 60(%4), %%edx\n"
20475+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20476+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20477 " movnti %%eax, 56(%3)\n"
20478 " movnti %%edx, 60(%3)\n"
20479 " addl $-64, %0\n"
20480@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20481 " shrl $2, %0\n"
20482 " andl $3, %%eax\n"
20483 " cld\n"
20484- "6: rep; movsl\n"
20485+ "6: rep; "__copyuser_seg" movsl\n"
20486 " movl %%eax,%0\n"
20487- "7: rep; movsb\n"
20488+ "7: rep; "__copyuser_seg" movsb\n"
20489 "8:\n"
20490 ".section .fixup,\"ax\"\n"
20491 "9: lea 0(%%eax,%0,4),%0\n"
20492@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
20493
20494 __asm__ __volatile__(
20495 " .align 2,0x90\n"
20496- "0: movl 32(%4), %%eax\n"
20497+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20498 " cmpl $67, %0\n"
20499 " jbe 2f\n"
20500- "1: movl 64(%4), %%eax\n"
20501+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20502 " .align 2,0x90\n"
20503- "2: movl 0(%4), %%eax\n"
20504- "21: movl 4(%4), %%edx\n"
20505+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20506+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20507 " movnti %%eax, 0(%3)\n"
20508 " movnti %%edx, 4(%3)\n"
20509- "3: movl 8(%4), %%eax\n"
20510- "31: movl 12(%4),%%edx\n"
20511+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20512+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20513 " movnti %%eax, 8(%3)\n"
20514 " movnti %%edx, 12(%3)\n"
20515- "4: movl 16(%4), %%eax\n"
20516- "41: movl 20(%4), %%edx\n"
20517+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20518+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20519 " movnti %%eax, 16(%3)\n"
20520 " movnti %%edx, 20(%3)\n"
20521- "10: movl 24(%4), %%eax\n"
20522- "51: movl 28(%4), %%edx\n"
20523+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20524+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20525 " movnti %%eax, 24(%3)\n"
20526 " movnti %%edx, 28(%3)\n"
20527- "11: movl 32(%4), %%eax\n"
20528- "61: movl 36(%4), %%edx\n"
20529+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20530+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20531 " movnti %%eax, 32(%3)\n"
20532 " movnti %%edx, 36(%3)\n"
20533- "12: movl 40(%4), %%eax\n"
20534- "71: movl 44(%4), %%edx\n"
20535+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20536+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20537 " movnti %%eax, 40(%3)\n"
20538 " movnti %%edx, 44(%3)\n"
20539- "13: movl 48(%4), %%eax\n"
20540- "81: movl 52(%4), %%edx\n"
20541+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20542+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20543 " movnti %%eax, 48(%3)\n"
20544 " movnti %%edx, 52(%3)\n"
20545- "14: movl 56(%4), %%eax\n"
20546- "91: movl 60(%4), %%edx\n"
20547+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20548+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20549 " movnti %%eax, 56(%3)\n"
20550 " movnti %%edx, 60(%3)\n"
20551 " addl $-64, %0\n"
20552@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20553 " shrl $2, %0\n"
20554 " andl $3, %%eax\n"
20555 " cld\n"
20556- "6: rep; movsl\n"
20557+ "6: rep; "__copyuser_seg" movsl\n"
20558 " movl %%eax,%0\n"
20559- "7: rep; movsb\n"
20560+ "7: rep; "__copyuser_seg" movsb\n"
20561 "8:\n"
20562 ".section .fixup,\"ax\"\n"
20563 "9: lea 0(%%eax,%0,4),%0\n"
20564@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
20565 */
20566 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20567 unsigned long size);
20568-unsigned long __copy_user_intel(void __user *to, const void *from,
20569+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20570+ unsigned long size);
20571+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20572 unsigned long size);
20573 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20574 const void __user *from, unsigned long size);
20575 #endif /* CONFIG_X86_INTEL_USERCOPY */
20576
20577 /* Generic arbitrary sized copy. */
20578-#define __copy_user(to, from, size) \
20579+#define __copy_user(to, from, size, prefix, set, restore) \
20580 do { \
20581 int __d0, __d1, __d2; \
20582 __asm__ __volatile__( \
20583+ set \
20584 " cmp $7,%0\n" \
20585 " jbe 1f\n" \
20586 " movl %1,%0\n" \
20587 " negl %0\n" \
20588 " andl $7,%0\n" \
20589 " subl %0,%3\n" \
20590- "4: rep; movsb\n" \
20591+ "4: rep; "prefix"movsb\n" \
20592 " movl %3,%0\n" \
20593 " shrl $2,%0\n" \
20594 " andl $3,%3\n" \
20595 " .align 2,0x90\n" \
20596- "0: rep; movsl\n" \
20597+ "0: rep; "prefix"movsl\n" \
20598 " movl %3,%0\n" \
20599- "1: rep; movsb\n" \
20600+ "1: rep; "prefix"movsb\n" \
20601 "2:\n" \
20602+ restore \
20603 ".section .fixup,\"ax\"\n" \
20604 "5: addl %3,%0\n" \
20605 " jmp 2b\n" \
20606@@ -682,14 +799,14 @@ do { \
20607 " negl %0\n" \
20608 " andl $7,%0\n" \
20609 " subl %0,%3\n" \
20610- "4: rep; movsb\n" \
20611+ "4: rep; "__copyuser_seg"movsb\n" \
20612 " movl %3,%0\n" \
20613 " shrl $2,%0\n" \
20614 " andl $3,%3\n" \
20615 " .align 2,0x90\n" \
20616- "0: rep; movsl\n" \
20617+ "0: rep; "__copyuser_seg"movsl\n" \
20618 " movl %3,%0\n" \
20619- "1: rep; movsb\n" \
20620+ "1: rep; "__copyuser_seg"movsb\n" \
20621 "2:\n" \
20622 ".section .fixup,\"ax\"\n" \
20623 "5: addl %3,%0\n" \
20624@@ -775,9 +892,9 @@ survive:
20625 }
20626 #endif
20627 if (movsl_is_ok(to, from, n))
20628- __copy_user(to, from, n);
20629+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
20630 else
20631- n = __copy_user_intel(to, from, n);
20632+ n = __generic_copy_to_user_intel(to, from, n);
20633 return n;
20634 }
20635 EXPORT_SYMBOL(__copy_to_user_ll);
20636@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
20637 unsigned long n)
20638 {
20639 if (movsl_is_ok(to, from, n))
20640- __copy_user(to, from, n);
20641+ __copy_user(to, from, n, __copyuser_seg, "", "");
20642 else
20643- n = __copy_user_intel((void __user *)to,
20644- (const void *)from, n);
20645+ n = __generic_copy_from_user_intel(to, from, n);
20646 return n;
20647 }
20648 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
20649@@ -827,59 +943,38 @@ unsigned long __copy_from_user_ll_nocach
20650 if (n > 64 && cpu_has_xmm2)
20651 n = __copy_user_intel_nocache(to, from, n);
20652 else
20653- __copy_user(to, from, n);
20654+ __copy_user(to, from, n, __copyuser_seg, "", "");
20655 #else
20656- __copy_user(to, from, n);
20657+ __copy_user(to, from, n, __copyuser_seg, "", "");
20658 #endif
20659 return n;
20660 }
20661 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
20662
20663-/**
20664- * copy_to_user: - Copy a block of data into user space.
20665- * @to: Destination address, in user space.
20666- * @from: Source address, in kernel space.
20667- * @n: Number of bytes to copy.
20668- *
20669- * Context: User context only. This function may sleep.
20670- *
20671- * Copy data from kernel space to user space.
20672- *
20673- * Returns number of bytes that could not be copied.
20674- * On success, this will be zero.
20675- */
20676-unsigned long
20677-copy_to_user(void __user *to, const void *from, unsigned long n)
20678+#ifdef CONFIG_PAX_MEMORY_UDEREF
20679+void __set_fs(mm_segment_t x)
20680 {
20681- if (access_ok(VERIFY_WRITE, to, n))
20682- n = __copy_to_user(to, from, n);
20683- return n;
20684+ switch (x.seg) {
20685+ case 0:
20686+ loadsegment(gs, 0);
20687+ break;
20688+ case TASK_SIZE_MAX:
20689+ loadsegment(gs, __USER_DS);
20690+ break;
20691+ case -1UL:
20692+ loadsegment(gs, __KERNEL_DS);
20693+ break;
20694+ default:
20695+ BUG();
20696+ }
20697+ return;
20698 }
20699-EXPORT_SYMBOL(copy_to_user);
20700+EXPORT_SYMBOL(__set_fs);
20701
20702-/**
20703- * copy_from_user: - Copy a block of data from user space.
20704- * @to: Destination address, in kernel space.
20705- * @from: Source address, in user space.
20706- * @n: Number of bytes to copy.
20707- *
20708- * Context: User context only. This function may sleep.
20709- *
20710- * Copy data from user space to kernel space.
20711- *
20712- * Returns number of bytes that could not be copied.
20713- * On success, this will be zero.
20714- *
20715- * If some data could not be copied, this function will pad the copied
20716- * data to the requested size using zero bytes.
20717- */
20718-unsigned long
20719-copy_from_user(void *to, const void __user *from, unsigned long n)
20720+void set_fs(mm_segment_t x)
20721 {
20722- if (access_ok(VERIFY_READ, from, n))
20723- n = __copy_from_user(to, from, n);
20724- else
20725- memset(to, 0, n);
20726- return n;
20727+ current_thread_info()->addr_limit = x;
20728+ __set_fs(x);
20729 }
20730-EXPORT_SYMBOL(copy_from_user);
20731+EXPORT_SYMBOL(set_fs);
20732+#endif
20733diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_64.c linux-2.6.32.46/arch/x86/lib/usercopy_64.c
20734--- linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
20735+++ linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-05-04 17:56:20.000000000 -0400
20736@@ -42,6 +42,12 @@ long
20737 __strncpy_from_user(char *dst, const char __user *src, long count)
20738 {
20739 long res;
20740+
20741+#ifdef CONFIG_PAX_MEMORY_UDEREF
20742+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20743+ src += PAX_USER_SHADOW_BASE;
20744+#endif
20745+
20746 __do_strncpy_from_user(dst, src, count, res);
20747 return res;
20748 }
20749@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
20750 {
20751 long __d0;
20752 might_fault();
20753+
20754+#ifdef CONFIG_PAX_MEMORY_UDEREF
20755+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
20756+ addr += PAX_USER_SHADOW_BASE;
20757+#endif
20758+
20759 /* no memory constraint because it doesn't change any memory gcc knows
20760 about */
20761 asm volatile(
20762@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
20763
20764 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
20765 {
20766- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20767+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20768+
20769+#ifdef CONFIG_PAX_MEMORY_UDEREF
20770+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
20771+ to += PAX_USER_SHADOW_BASE;
20772+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
20773+ from += PAX_USER_SHADOW_BASE;
20774+#endif
20775+
20776 return copy_user_generic((__force void *)to, (__force void *)from, len);
20777- }
20778- return len;
20779+ }
20780+ return len;
20781 }
20782 EXPORT_SYMBOL(copy_in_user);
20783
20784diff -urNp linux-2.6.32.46/arch/x86/Makefile linux-2.6.32.46/arch/x86/Makefile
20785--- linux-2.6.32.46/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400
20786+++ linux-2.6.32.46/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400
20787@@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
20788 else
20789 BITS := 64
20790 UTS_MACHINE := x86_64
20791+ biarch := $(call cc-option,-m64)
20792 CHECKFLAGS += -D__x86_64__ -m64
20793
20794 KBUILD_AFLAGS += -m64
20795@@ -189,3 +190,12 @@ define archhelp
20796 echo ' FDARGS="..." arguments for the booted kernel'
20797 echo ' FDINITRD=file initrd for the booted kernel'
20798 endef
20799+
20800+define OLD_LD
20801+
20802+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
20803+*** Please upgrade your binutils to 2.18 or newer
20804+endef
20805+
20806+archprepare:
20807+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
20808diff -urNp linux-2.6.32.46/arch/x86/mm/extable.c linux-2.6.32.46/arch/x86/mm/extable.c
20809--- linux-2.6.32.46/arch/x86/mm/extable.c 2011-03-27 14:31:47.000000000 -0400
20810+++ linux-2.6.32.46/arch/x86/mm/extable.c 2011-04-17 15:56:46.000000000 -0400
20811@@ -1,14 +1,71 @@
20812 #include <linux/module.h>
20813 #include <linux/spinlock.h>
20814+#include <linux/sort.h>
20815 #include <asm/uaccess.h>
20816+#include <asm/pgtable.h>
20817
20818+/*
20819+ * The exception table needs to be sorted so that the binary
20820+ * search that we use to find entries in it works properly.
20821+ * This is used both for the kernel exception table and for
20822+ * the exception tables of modules that get loaded.
20823+ */
20824+static int cmp_ex(const void *a, const void *b)
20825+{
20826+ const struct exception_table_entry *x = a, *y = b;
20827+
20828+ /* avoid overflow */
20829+ if (x->insn > y->insn)
20830+ return 1;
20831+ if (x->insn < y->insn)
20832+ return -1;
20833+ return 0;
20834+}
20835+
20836+static void swap_ex(void *a, void *b, int size)
20837+{
20838+ struct exception_table_entry t, *x = a, *y = b;
20839+
20840+ t = *x;
20841+
20842+ pax_open_kernel();
20843+ *x = *y;
20844+ *y = t;
20845+ pax_close_kernel();
20846+}
20847+
20848+void sort_extable(struct exception_table_entry *start,
20849+ struct exception_table_entry *finish)
20850+{
20851+ sort(start, finish - start, sizeof(struct exception_table_entry),
20852+ cmp_ex, swap_ex);
20853+}
20854+
20855+#ifdef CONFIG_MODULES
20856+/*
20857+ * If the exception table is sorted, any referring to the module init
20858+ * will be at the beginning or the end.
20859+ */
20860+void trim_init_extable(struct module *m)
20861+{
20862+ /*trim the beginning*/
20863+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
20864+ m->extable++;
20865+ m->num_exentries--;
20866+ }
20867+ /*trim the end*/
20868+ while (m->num_exentries &&
20869+ within_module_init(m->extable[m->num_exentries-1].insn, m))
20870+ m->num_exentries--;
20871+}
20872+#endif /* CONFIG_MODULES */
20873
20874 int fixup_exception(struct pt_regs *regs)
20875 {
20876 const struct exception_table_entry *fixup;
20877
20878 #ifdef CONFIG_PNPBIOS
20879- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
20880+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
20881 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
20882 extern u32 pnp_bios_is_utter_crap;
20883 pnp_bios_is_utter_crap = 1;
20884diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault.c
20885--- linux-2.6.32.46/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
20886+++ linux-2.6.32.46/arch/x86/mm/fault.c 2011-08-17 20:06:44.000000000 -0400
20887@@ -11,10 +11,19 @@
20888 #include <linux/kprobes.h> /* __kprobes, ... */
20889 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
20890 #include <linux/perf_event.h> /* perf_sw_event */
20891+#include <linux/unistd.h>
20892+#include <linux/compiler.h>
20893
20894 #include <asm/traps.h> /* dotraplinkage, ... */
20895 #include <asm/pgalloc.h> /* pgd_*(), ... */
20896 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
20897+#include <asm/vsyscall.h>
20898+#include <asm/tlbflush.h>
20899+
20900+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20901+#include <asm/stacktrace.h>
20902+#include "../kernel/dumpstack.h"
20903+#endif
20904
20905 /*
20906 * Page fault error code bits:
20907@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
20908 int ret = 0;
20909
20910 /* kprobe_running() needs smp_processor_id() */
20911- if (kprobes_built_in() && !user_mode_vm(regs)) {
20912+ if (kprobes_built_in() && !user_mode(regs)) {
20913 preempt_disable();
20914 if (kprobe_running() && kprobe_fault_handler(regs, 14))
20915 ret = 1;
20916@@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *re
20917 return !instr_lo || (instr_lo>>1) == 1;
20918 case 0x00:
20919 /* Prefetch instruction is 0x0F0D or 0x0F18 */
20920- if (probe_kernel_address(instr, opcode))
20921+ if (user_mode(regs)) {
20922+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20923+ return 0;
20924+ } else if (probe_kernel_address(instr, opcode))
20925 return 0;
20926
20927 *prefetch = (instr_lo == 0xF) &&
20928@@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsign
20929 while (instr < max_instr) {
20930 unsigned char opcode;
20931
20932- if (probe_kernel_address(instr, opcode))
20933+ if (user_mode(regs)) {
20934+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20935+ break;
20936+ } else if (probe_kernel_address(instr, opcode))
20937 break;
20938
20939 instr++;
20940@@ -172,6 +187,30 @@ force_sig_info_fault(int si_signo, int s
20941 force_sig_info(si_signo, &info, tsk);
20942 }
20943
20944+#ifdef CONFIG_PAX_EMUTRAMP
20945+static int pax_handle_fetch_fault(struct pt_regs *regs);
20946+#endif
20947+
20948+#ifdef CONFIG_PAX_PAGEEXEC
20949+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
20950+{
20951+ pgd_t *pgd;
20952+ pud_t *pud;
20953+ pmd_t *pmd;
20954+
20955+ pgd = pgd_offset(mm, address);
20956+ if (!pgd_present(*pgd))
20957+ return NULL;
20958+ pud = pud_offset(pgd, address);
20959+ if (!pud_present(*pud))
20960+ return NULL;
20961+ pmd = pmd_offset(pud, address);
20962+ if (!pmd_present(*pmd))
20963+ return NULL;
20964+ return pmd;
20965+}
20966+#endif
20967+
20968 DEFINE_SPINLOCK(pgd_lock);
20969 LIST_HEAD(pgd_list);
20970
20971@@ -224,11 +263,24 @@ void vmalloc_sync_all(void)
20972 address += PMD_SIZE) {
20973
20974 unsigned long flags;
20975+
20976+#ifdef CONFIG_PAX_PER_CPU_PGD
20977+ unsigned long cpu;
20978+#else
20979 struct page *page;
20980+#endif
20981
20982 spin_lock_irqsave(&pgd_lock, flags);
20983+
20984+#ifdef CONFIG_PAX_PER_CPU_PGD
20985+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
20986+ pgd_t *pgd = get_cpu_pgd(cpu);
20987+#else
20988 list_for_each_entry(page, &pgd_list, lru) {
20989- if (!vmalloc_sync_one(page_address(page), address))
20990+ pgd_t *pgd = page_address(page);
20991+#endif
20992+
20993+ if (!vmalloc_sync_one(pgd, address))
20994 break;
20995 }
20996 spin_unlock_irqrestore(&pgd_lock, flags);
20997@@ -258,6 +310,11 @@ static noinline int vmalloc_fault(unsign
20998 * an interrupt in the middle of a task switch..
20999 */
21000 pgd_paddr = read_cr3();
21001+
21002+#ifdef CONFIG_PAX_PER_CPU_PGD
21003+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21004+#endif
21005+
21006 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21007 if (!pmd_k)
21008 return -1;
21009@@ -332,15 +389,27 @@ void vmalloc_sync_all(void)
21010
21011 const pgd_t *pgd_ref = pgd_offset_k(address);
21012 unsigned long flags;
21013+
21014+#ifdef CONFIG_PAX_PER_CPU_PGD
21015+ unsigned long cpu;
21016+#else
21017 struct page *page;
21018+#endif
21019
21020 if (pgd_none(*pgd_ref))
21021 continue;
21022
21023 spin_lock_irqsave(&pgd_lock, flags);
21024+
21025+#ifdef CONFIG_PAX_PER_CPU_PGD
21026+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21027+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
21028+#else
21029 list_for_each_entry(page, &pgd_list, lru) {
21030 pgd_t *pgd;
21031 pgd = (pgd_t *)page_address(page) + pgd_index(address);
21032+#endif
21033+
21034 if (pgd_none(*pgd))
21035 set_pgd(pgd, *pgd_ref);
21036 else
21037@@ -373,7 +442,14 @@ static noinline int vmalloc_fault(unsign
21038 * happen within a race in page table update. In the later
21039 * case just flush:
21040 */
21041+
21042+#ifdef CONFIG_PAX_PER_CPU_PGD
21043+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21044+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21045+#else
21046 pgd = pgd_offset(current->active_mm, address);
21047+#endif
21048+
21049 pgd_ref = pgd_offset_k(address);
21050 if (pgd_none(*pgd_ref))
21051 return -1;
21052@@ -535,7 +611,7 @@ static int is_errata93(struct pt_regs *r
21053 static int is_errata100(struct pt_regs *regs, unsigned long address)
21054 {
21055 #ifdef CONFIG_X86_64
21056- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21057+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21058 return 1;
21059 #endif
21060 return 0;
21061@@ -562,7 +638,7 @@ static int is_f00f_bug(struct pt_regs *r
21062 }
21063
21064 static const char nx_warning[] = KERN_CRIT
21065-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21066+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21067
21068 static void
21069 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21070@@ -571,15 +647,26 @@ show_fault_oops(struct pt_regs *regs, un
21071 if (!oops_may_print())
21072 return;
21073
21074- if (error_code & PF_INSTR) {
21075+ if (nx_enabled && (error_code & PF_INSTR)) {
21076 unsigned int level;
21077
21078 pte_t *pte = lookup_address(address, &level);
21079
21080 if (pte && pte_present(*pte) && !pte_exec(*pte))
21081- printk(nx_warning, current_uid());
21082+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21083 }
21084
21085+#ifdef CONFIG_PAX_KERNEXEC
21086+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21087+ if (current->signal->curr_ip)
21088+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21089+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21090+ else
21091+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21092+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21093+ }
21094+#endif
21095+
21096 printk(KERN_ALERT "BUG: unable to handle kernel ");
21097 if (address < PAGE_SIZE)
21098 printk(KERN_CONT "NULL pointer dereference");
21099@@ -704,6 +791,70 @@ __bad_area_nosemaphore(struct pt_regs *r
21100 unsigned long address, int si_code)
21101 {
21102 struct task_struct *tsk = current;
21103+#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21104+ struct mm_struct *mm = tsk->mm;
21105+#endif
21106+
21107+#ifdef CONFIG_X86_64
21108+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21109+ if (regs->ip == (unsigned long)vgettimeofday) {
21110+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21111+ return;
21112+ } else if (regs->ip == (unsigned long)vtime) {
21113+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21114+ return;
21115+ } else if (regs->ip == (unsigned long)vgetcpu) {
21116+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21117+ return;
21118+ }
21119+ }
21120+#endif
21121+
21122+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21123+ if (mm && (error_code & PF_USER)) {
21124+ unsigned long ip = regs->ip;
21125+
21126+ if (v8086_mode(regs))
21127+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21128+
21129+ /*
21130+ * It's possible to have interrupts off here:
21131+ */
21132+ local_irq_enable();
21133+
21134+#ifdef CONFIG_PAX_PAGEEXEC
21135+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21136+ ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21137+
21138+#ifdef CONFIG_PAX_EMUTRAMP
21139+ switch (pax_handle_fetch_fault(regs)) {
21140+ case 2:
21141+ return;
21142+ }
21143+#endif
21144+
21145+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21146+ do_group_exit(SIGKILL);
21147+ }
21148+#endif
21149+
21150+#ifdef CONFIG_PAX_SEGMEXEC
21151+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21152+
21153+#ifdef CONFIG_PAX_EMUTRAMP
21154+ switch (pax_handle_fetch_fault(regs)) {
21155+ case 2:
21156+ return;
21157+ }
21158+#endif
21159+
21160+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21161+ do_group_exit(SIGKILL);
21162+ }
21163+#endif
21164+
21165+ }
21166+#endif
21167
21168 /* User mode accesses just cause a SIGSEGV */
21169 if (error_code & PF_USER) {
21170@@ -857,6 +1008,99 @@ static int spurious_fault_check(unsigned
21171 return 1;
21172 }
21173
21174+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21175+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21176+{
21177+ pte_t *pte;
21178+ pmd_t *pmd;
21179+ spinlock_t *ptl;
21180+ unsigned char pte_mask;
21181+
21182+ if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21183+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21184+ return 0;
21185+
21186+ /* PaX: it's our fault, let's handle it if we can */
21187+
21188+ /* PaX: take a look at read faults before acquiring any locks */
21189+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21190+ /* instruction fetch attempt from a protected page in user mode */
21191+ up_read(&mm->mmap_sem);
21192+
21193+#ifdef CONFIG_PAX_EMUTRAMP
21194+ switch (pax_handle_fetch_fault(regs)) {
21195+ case 2:
21196+ return 1;
21197+ }
21198+#endif
21199+
21200+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21201+ do_group_exit(SIGKILL);
21202+ }
21203+
21204+ pmd = pax_get_pmd(mm, address);
21205+ if (unlikely(!pmd))
21206+ return 0;
21207+
21208+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21209+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21210+ pte_unmap_unlock(pte, ptl);
21211+ return 0;
21212+ }
21213+
21214+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21215+ /* write attempt to a protected page in user mode */
21216+ pte_unmap_unlock(pte, ptl);
21217+ return 0;
21218+ }
21219+
21220+#ifdef CONFIG_SMP
21221+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21222+#else
21223+ if (likely(address > get_limit(regs->cs)))
21224+#endif
21225+ {
21226+ set_pte(pte, pte_mkread(*pte));
21227+ __flush_tlb_one(address);
21228+ pte_unmap_unlock(pte, ptl);
21229+ up_read(&mm->mmap_sem);
21230+ return 1;
21231+ }
21232+
21233+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21234+
21235+ /*
21236+ * PaX: fill DTLB with user rights and retry
21237+ */
21238+ __asm__ __volatile__ (
21239+ "orb %2,(%1)\n"
21240+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21241+/*
21242+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21243+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21244+ * page fault when examined during a TLB load attempt. this is true not only
21245+ * for PTEs holding a non-present entry but also present entries that will
21246+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21247+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21248+ * for our target pages since their PTEs are simply not in the TLBs at all.
21249+
21250+ * the best thing in omitting it is that we gain around 15-20% speed in the
21251+ * fast path of the page fault handler and can get rid of tracing since we
21252+ * can no longer flush unintended entries.
21253+ */
21254+ "invlpg (%0)\n"
21255+#endif
21256+ __copyuser_seg"testb $0,(%0)\n"
21257+ "xorb %3,(%1)\n"
21258+ :
21259+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21260+ : "memory", "cc");
21261+ pte_unmap_unlock(pte, ptl);
21262+ up_read(&mm->mmap_sem);
21263+ return 1;
21264+}
21265+#endif
21266+
21267 /*
21268 * Handle a spurious fault caused by a stale TLB entry.
21269 *
21270@@ -923,6 +1167,9 @@ int show_unhandled_signals = 1;
21271 static inline int
21272 access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
21273 {
21274+ if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21275+ return 1;
21276+
21277 if (write) {
21278 /* write, present and write, not present: */
21279 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21280@@ -956,17 +1203,31 @@ do_page_fault(struct pt_regs *regs, unsi
21281 {
21282 struct vm_area_struct *vma;
21283 struct task_struct *tsk;
21284- unsigned long address;
21285 struct mm_struct *mm;
21286 int write;
21287 int fault;
21288
21289+ /* Get the faulting address: */
21290+ unsigned long address = read_cr2();
21291+
21292+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21293+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21294+ if (!search_exception_tables(regs->ip)) {
21295+ bad_area_nosemaphore(regs, error_code, address);
21296+ return;
21297+ }
21298+ if (address < PAX_USER_SHADOW_BASE) {
21299+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21300+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
21301+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21302+ } else
21303+ address -= PAX_USER_SHADOW_BASE;
21304+ }
21305+#endif
21306+
21307 tsk = current;
21308 mm = tsk->mm;
21309
21310- /* Get the faulting address: */
21311- address = read_cr2();
21312-
21313 /*
21314 * Detect and handle instructions that would cause a page fault for
21315 * both a tracked kernel page and a userspace page.
21316@@ -1026,7 +1287,7 @@ do_page_fault(struct pt_regs *regs, unsi
21317 * User-mode registers count as a user access even for any
21318 * potential system fault or CPU buglet:
21319 */
21320- if (user_mode_vm(regs)) {
21321+ if (user_mode(regs)) {
21322 local_irq_enable();
21323 error_code |= PF_USER;
21324 } else {
21325@@ -1080,6 +1341,11 @@ do_page_fault(struct pt_regs *regs, unsi
21326 might_sleep();
21327 }
21328
21329+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21330+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21331+ return;
21332+#endif
21333+
21334 vma = find_vma(mm, address);
21335 if (unlikely(!vma)) {
21336 bad_area(regs, error_code, address);
21337@@ -1091,18 +1357,24 @@ do_page_fault(struct pt_regs *regs, unsi
21338 bad_area(regs, error_code, address);
21339 return;
21340 }
21341- if (error_code & PF_USER) {
21342- /*
21343- * Accessing the stack below %sp is always a bug.
21344- * The large cushion allows instructions like enter
21345- * and pusha to work. ("enter $65535, $31" pushes
21346- * 32 pointers and then decrements %sp by 65535.)
21347- */
21348- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21349- bad_area(regs, error_code, address);
21350- return;
21351- }
21352+ /*
21353+ * Accessing the stack below %sp is always a bug.
21354+ * The large cushion allows instructions like enter
21355+ * and pusha to work. ("enter $65535, $31" pushes
21356+ * 32 pointers and then decrements %sp by 65535.)
21357+ */
21358+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21359+ bad_area(regs, error_code, address);
21360+ return;
21361 }
21362+
21363+#ifdef CONFIG_PAX_SEGMEXEC
21364+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21365+ bad_area(regs, error_code, address);
21366+ return;
21367+ }
21368+#endif
21369+
21370 if (unlikely(expand_stack(vma, address))) {
21371 bad_area(regs, error_code, address);
21372 return;
21373@@ -1146,3 +1418,199 @@ good_area:
21374
21375 up_read(&mm->mmap_sem);
21376 }
21377+
21378+#ifdef CONFIG_PAX_EMUTRAMP
21379+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21380+{
21381+ int err;
21382+
21383+ do { /* PaX: gcc trampoline emulation #1 */
21384+ unsigned char mov1, mov2;
21385+ unsigned short jmp;
21386+ unsigned int addr1, addr2;
21387+
21388+#ifdef CONFIG_X86_64
21389+ if ((regs->ip + 11) >> 32)
21390+ break;
21391+#endif
21392+
21393+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21394+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21395+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21396+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21397+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21398+
21399+ if (err)
21400+ break;
21401+
21402+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21403+ regs->cx = addr1;
21404+ regs->ax = addr2;
21405+ regs->ip = addr2;
21406+ return 2;
21407+ }
21408+ } while (0);
21409+
21410+ do { /* PaX: gcc trampoline emulation #2 */
21411+ unsigned char mov, jmp;
21412+ unsigned int addr1, addr2;
21413+
21414+#ifdef CONFIG_X86_64
21415+ if ((regs->ip + 9) >> 32)
21416+ break;
21417+#endif
21418+
21419+ err = get_user(mov, (unsigned char __user *)regs->ip);
21420+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21421+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21422+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21423+
21424+ if (err)
21425+ break;
21426+
21427+ if (mov == 0xB9 && jmp == 0xE9) {
21428+ regs->cx = addr1;
21429+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21430+ return 2;
21431+ }
21432+ } while (0);
21433+
21434+ return 1; /* PaX in action */
21435+}
21436+
21437+#ifdef CONFIG_X86_64
21438+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21439+{
21440+ int err;
21441+
21442+ do { /* PaX: gcc trampoline emulation #1 */
21443+ unsigned short mov1, mov2, jmp1;
21444+ unsigned char jmp2;
21445+ unsigned int addr1;
21446+ unsigned long addr2;
21447+
21448+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21449+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21450+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21451+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21452+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21453+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21454+
21455+ if (err)
21456+ break;
21457+
21458+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21459+ regs->r11 = addr1;
21460+ regs->r10 = addr2;
21461+ regs->ip = addr1;
21462+ return 2;
21463+ }
21464+ } while (0);
21465+
21466+ do { /* PaX: gcc trampoline emulation #2 */
21467+ unsigned short mov1, mov2, jmp1;
21468+ unsigned char jmp2;
21469+ unsigned long addr1, addr2;
21470+
21471+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21472+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21473+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21474+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21475+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21476+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21477+
21478+ if (err)
21479+ break;
21480+
21481+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21482+ regs->r11 = addr1;
21483+ regs->r10 = addr2;
21484+ regs->ip = addr1;
21485+ return 2;
21486+ }
21487+ } while (0);
21488+
21489+ return 1; /* PaX in action */
21490+}
21491+#endif
21492+
21493+/*
21494+ * PaX: decide what to do with offenders (regs->ip = fault address)
21495+ *
21496+ * returns 1 when task should be killed
21497+ * 2 when gcc trampoline was detected
21498+ */
21499+static int pax_handle_fetch_fault(struct pt_regs *regs)
21500+{
21501+ if (v8086_mode(regs))
21502+ return 1;
21503+
21504+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21505+ return 1;
21506+
21507+#ifdef CONFIG_X86_32
21508+ return pax_handle_fetch_fault_32(regs);
21509+#else
21510+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21511+ return pax_handle_fetch_fault_32(regs);
21512+ else
21513+ return pax_handle_fetch_fault_64(regs);
21514+#endif
21515+}
21516+#endif
21517+
21518+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21519+void pax_report_insns(void *pc, void *sp)
21520+{
21521+ long i;
21522+
21523+ printk(KERN_ERR "PAX: bytes at PC: ");
21524+ for (i = 0; i < 20; i++) {
21525+ unsigned char c;
21526+ if (get_user(c, (__force unsigned char __user *)pc+i))
21527+ printk(KERN_CONT "?? ");
21528+ else
21529+ printk(KERN_CONT "%02x ", c);
21530+ }
21531+ printk("\n");
21532+
21533+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
21534+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
21535+ unsigned long c;
21536+ if (get_user(c, (__force unsigned long __user *)sp+i))
21537+#ifdef CONFIG_X86_32
21538+ printk(KERN_CONT "???????? ");
21539+#else
21540+ printk(KERN_CONT "???????????????? ");
21541+#endif
21542+ else
21543+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21544+ }
21545+ printk("\n");
21546+}
21547+#endif
21548+
21549+/**
21550+ * probe_kernel_write(): safely attempt to write to a location
21551+ * @dst: address to write to
21552+ * @src: pointer to the data that shall be written
21553+ * @size: size of the data chunk
21554+ *
21555+ * Safely write to address @dst from the buffer at @src. If a kernel fault
21556+ * happens, handle that and return -EFAULT.
21557+ */
21558+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21559+{
21560+ long ret;
21561+ mm_segment_t old_fs = get_fs();
21562+
21563+ set_fs(KERNEL_DS);
21564+ pagefault_disable();
21565+ pax_open_kernel();
21566+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21567+ pax_close_kernel();
21568+ pagefault_enable();
21569+ set_fs(old_fs);
21570+
21571+ return ret ? -EFAULT : 0;
21572+}
21573diff -urNp linux-2.6.32.46/arch/x86/mm/gup.c linux-2.6.32.46/arch/x86/mm/gup.c
21574--- linux-2.6.32.46/arch/x86/mm/gup.c 2011-03-27 14:31:47.000000000 -0400
21575+++ linux-2.6.32.46/arch/x86/mm/gup.c 2011-04-17 15:56:46.000000000 -0400
21576@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
21577 addr = start;
21578 len = (unsigned long) nr_pages << PAGE_SHIFT;
21579 end = start + len;
21580- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21581+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21582 (void __user *)start, len)))
21583 return 0;
21584
21585diff -urNp linux-2.6.32.46/arch/x86/mm/highmem_32.c linux-2.6.32.46/arch/x86/mm/highmem_32.c
21586--- linux-2.6.32.46/arch/x86/mm/highmem_32.c 2011-03-27 14:31:47.000000000 -0400
21587+++ linux-2.6.32.46/arch/x86/mm/highmem_32.c 2011-04-17 15:56:46.000000000 -0400
21588@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
21589 idx = type + KM_TYPE_NR*smp_processor_id();
21590 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21591 BUG_ON(!pte_none(*(kmap_pte-idx)));
21592+
21593+ pax_open_kernel();
21594 set_pte(kmap_pte-idx, mk_pte(page, prot));
21595+ pax_close_kernel();
21596
21597 return (void *)vaddr;
21598 }
21599diff -urNp linux-2.6.32.46/arch/x86/mm/hugetlbpage.c linux-2.6.32.46/arch/x86/mm/hugetlbpage.c
21600--- linux-2.6.32.46/arch/x86/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
21601+++ linux-2.6.32.46/arch/x86/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
21602@@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
21603 struct hstate *h = hstate_file(file);
21604 struct mm_struct *mm = current->mm;
21605 struct vm_area_struct *vma;
21606- unsigned long start_addr;
21607+ unsigned long start_addr, pax_task_size = TASK_SIZE;
21608+
21609+#ifdef CONFIG_PAX_SEGMEXEC
21610+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21611+ pax_task_size = SEGMEXEC_TASK_SIZE;
21612+#endif
21613+
21614+ pax_task_size -= PAGE_SIZE;
21615
21616 if (len > mm->cached_hole_size) {
21617- start_addr = mm->free_area_cache;
21618+ start_addr = mm->free_area_cache;
21619 } else {
21620- start_addr = TASK_UNMAPPED_BASE;
21621- mm->cached_hole_size = 0;
21622+ start_addr = mm->mmap_base;
21623+ mm->cached_hole_size = 0;
21624 }
21625
21626 full_search:
21627@@ -281,26 +288,27 @@ full_search:
21628
21629 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21630 /* At this point: (!vma || addr < vma->vm_end). */
21631- if (TASK_SIZE - len < addr) {
21632+ if (pax_task_size - len < addr) {
21633 /*
21634 * Start a new search - just in case we missed
21635 * some holes.
21636 */
21637- if (start_addr != TASK_UNMAPPED_BASE) {
21638- start_addr = TASK_UNMAPPED_BASE;
21639+ if (start_addr != mm->mmap_base) {
21640+ start_addr = mm->mmap_base;
21641 mm->cached_hole_size = 0;
21642 goto full_search;
21643 }
21644 return -ENOMEM;
21645 }
21646- if (!vma || addr + len <= vma->vm_start) {
21647- mm->free_area_cache = addr + len;
21648- return addr;
21649- }
21650+ if (check_heap_stack_gap(vma, addr, len))
21651+ break;
21652 if (addr + mm->cached_hole_size < vma->vm_start)
21653 mm->cached_hole_size = vma->vm_start - addr;
21654 addr = ALIGN(vma->vm_end, huge_page_size(h));
21655 }
21656+
21657+ mm->free_area_cache = addr + len;
21658+ return addr;
21659 }
21660
21661 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
21662@@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
21663 {
21664 struct hstate *h = hstate_file(file);
21665 struct mm_struct *mm = current->mm;
21666- struct vm_area_struct *vma, *prev_vma;
21667- unsigned long base = mm->mmap_base, addr = addr0;
21668+ struct vm_area_struct *vma;
21669+ unsigned long base = mm->mmap_base, addr;
21670 unsigned long largest_hole = mm->cached_hole_size;
21671- int first_time = 1;
21672
21673 /* don't allow allocations above current base */
21674 if (mm->free_area_cache > base)
21675@@ -322,64 +329,63 @@ static unsigned long hugetlb_get_unmappe
21676 largest_hole = 0;
21677 mm->free_area_cache = base;
21678 }
21679-try_again:
21680+
21681 /* make sure it can fit in the remaining address space */
21682 if (mm->free_area_cache < len)
21683 goto fail;
21684
21685 /* either no address requested or cant fit in requested address hole */
21686- addr = (mm->free_area_cache - len) & huge_page_mask(h);
21687+ addr = (mm->free_area_cache - len);
21688 do {
21689+ addr &= huge_page_mask(h);
21690+ vma = find_vma(mm, addr);
21691 /*
21692 * Lookup failure means no vma is above this address,
21693 * i.e. return with success:
21694- */
21695- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
21696- return addr;
21697-
21698- /*
21699 * new region fits between prev_vma->vm_end and
21700 * vma->vm_start, use it:
21701 */
21702- if (addr + len <= vma->vm_start &&
21703- (!prev_vma || (addr >= prev_vma->vm_end))) {
21704+ if (check_heap_stack_gap(vma, addr, len)) {
21705 /* remember the address as a hint for next time */
21706- mm->cached_hole_size = largest_hole;
21707- return (mm->free_area_cache = addr);
21708- } else {
21709- /* pull free_area_cache down to the first hole */
21710- if (mm->free_area_cache == vma->vm_end) {
21711- mm->free_area_cache = vma->vm_start;
21712- mm->cached_hole_size = largest_hole;
21713- }
21714+ mm->cached_hole_size = largest_hole;
21715+ return (mm->free_area_cache = addr);
21716+ }
21717+ /* pull free_area_cache down to the first hole */
21718+ if (mm->free_area_cache == vma->vm_end) {
21719+ mm->free_area_cache = vma->vm_start;
21720+ mm->cached_hole_size = largest_hole;
21721 }
21722
21723 /* remember the largest hole we saw so far */
21724 if (addr + largest_hole < vma->vm_start)
21725- largest_hole = vma->vm_start - addr;
21726+ largest_hole = vma->vm_start - addr;
21727
21728 /* try just below the current vma->vm_start */
21729- addr = (vma->vm_start - len) & huge_page_mask(h);
21730- } while (len <= vma->vm_start);
21731+ addr = skip_heap_stack_gap(vma, len);
21732+ } while (!IS_ERR_VALUE(addr));
21733
21734 fail:
21735 /*
21736- * if hint left us with no space for the requested
21737- * mapping then try again:
21738- */
21739- if (first_time) {
21740- mm->free_area_cache = base;
21741- largest_hole = 0;
21742- first_time = 0;
21743- goto try_again;
21744- }
21745- /*
21746 * A failed mmap() very likely causes application failure,
21747 * so fall back to the bottom-up function here. This scenario
21748 * can happen with large stack limits and large mmap()
21749 * allocations.
21750 */
21751- mm->free_area_cache = TASK_UNMAPPED_BASE;
21752+
21753+#ifdef CONFIG_PAX_SEGMEXEC
21754+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21755+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
21756+ else
21757+#endif
21758+
21759+ mm->mmap_base = TASK_UNMAPPED_BASE;
21760+
21761+#ifdef CONFIG_PAX_RANDMMAP
21762+ if (mm->pax_flags & MF_PAX_RANDMMAP)
21763+ mm->mmap_base += mm->delta_mmap;
21764+#endif
21765+
21766+ mm->free_area_cache = mm->mmap_base;
21767 mm->cached_hole_size = ~0UL;
21768 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
21769 len, pgoff, flags);
21770@@ -387,6 +393,7 @@ fail:
21771 /*
21772 * Restore the topdown base:
21773 */
21774+ mm->mmap_base = base;
21775 mm->free_area_cache = base;
21776 mm->cached_hole_size = ~0UL;
21777
21778@@ -400,10 +407,19 @@ hugetlb_get_unmapped_area(struct file *f
21779 struct hstate *h = hstate_file(file);
21780 struct mm_struct *mm = current->mm;
21781 struct vm_area_struct *vma;
21782+ unsigned long pax_task_size = TASK_SIZE;
21783
21784 if (len & ~huge_page_mask(h))
21785 return -EINVAL;
21786- if (len > TASK_SIZE)
21787+
21788+#ifdef CONFIG_PAX_SEGMEXEC
21789+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21790+ pax_task_size = SEGMEXEC_TASK_SIZE;
21791+#endif
21792+
21793+ pax_task_size -= PAGE_SIZE;
21794+
21795+ if (len > pax_task_size)
21796 return -ENOMEM;
21797
21798 if (flags & MAP_FIXED) {
21799@@ -415,8 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
21800 if (addr) {
21801 addr = ALIGN(addr, huge_page_size(h));
21802 vma = find_vma(mm, addr);
21803- if (TASK_SIZE - len >= addr &&
21804- (!vma || addr + len <= vma->vm_start))
21805+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
21806 return addr;
21807 }
21808 if (mm->get_unmapped_area == arch_get_unmapped_area)
21809diff -urNp linux-2.6.32.46/arch/x86/mm/init_32.c linux-2.6.32.46/arch/x86/mm/init_32.c
21810--- linux-2.6.32.46/arch/x86/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
21811+++ linux-2.6.32.46/arch/x86/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
21812@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
21813 }
21814
21815 /*
21816- * Creates a middle page table and puts a pointer to it in the
21817- * given global directory entry. This only returns the gd entry
21818- * in non-PAE compilation mode, since the middle layer is folded.
21819- */
21820-static pmd_t * __init one_md_table_init(pgd_t *pgd)
21821-{
21822- pud_t *pud;
21823- pmd_t *pmd_table;
21824-
21825-#ifdef CONFIG_X86_PAE
21826- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
21827- if (after_bootmem)
21828- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
21829- else
21830- pmd_table = (pmd_t *)alloc_low_page();
21831- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
21832- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
21833- pud = pud_offset(pgd, 0);
21834- BUG_ON(pmd_table != pmd_offset(pud, 0));
21835-
21836- return pmd_table;
21837- }
21838-#endif
21839- pud = pud_offset(pgd, 0);
21840- pmd_table = pmd_offset(pud, 0);
21841-
21842- return pmd_table;
21843-}
21844-
21845-/*
21846 * Create a page table and place a pointer to it in a middle page
21847 * directory entry:
21848 */
21849@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
21850 page_table = (pte_t *)alloc_low_page();
21851
21852 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
21853+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21854+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
21855+#else
21856 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
21857+#endif
21858 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
21859 }
21860
21861 return pte_offset_kernel(pmd, 0);
21862 }
21863
21864+static pmd_t * __init one_md_table_init(pgd_t *pgd)
21865+{
21866+ pud_t *pud;
21867+ pmd_t *pmd_table;
21868+
21869+ pud = pud_offset(pgd, 0);
21870+ pmd_table = pmd_offset(pud, 0);
21871+
21872+ return pmd_table;
21873+}
21874+
21875 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
21876 {
21877 int pgd_idx = pgd_index(vaddr);
21878@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
21879 int pgd_idx, pmd_idx;
21880 unsigned long vaddr;
21881 pgd_t *pgd;
21882+ pud_t *pud;
21883 pmd_t *pmd;
21884 pte_t *pte = NULL;
21885
21886@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
21887 pgd = pgd_base + pgd_idx;
21888
21889 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
21890- pmd = one_md_table_init(pgd);
21891- pmd = pmd + pmd_index(vaddr);
21892+ pud = pud_offset(pgd, vaddr);
21893+ pmd = pmd_offset(pud, vaddr);
21894+
21895+#ifdef CONFIG_X86_PAE
21896+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21897+#endif
21898+
21899 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
21900 pmd++, pmd_idx++) {
21901 pte = page_table_kmap_check(one_page_table_init(pmd),
21902@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
21903 }
21904 }
21905
21906-static inline int is_kernel_text(unsigned long addr)
21907+static inline int is_kernel_text(unsigned long start, unsigned long end)
21908 {
21909- if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
21910- return 1;
21911- return 0;
21912+ if ((start > ktla_ktva((unsigned long)_etext) ||
21913+ end <= ktla_ktva((unsigned long)_stext)) &&
21914+ (start > ktla_ktva((unsigned long)_einittext) ||
21915+ end <= ktla_ktva((unsigned long)_sinittext)) &&
21916+
21917+#ifdef CONFIG_ACPI_SLEEP
21918+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
21919+#endif
21920+
21921+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
21922+ return 0;
21923+ return 1;
21924 }
21925
21926 /*
21927@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
21928 int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
21929 unsigned long start_pfn, end_pfn;
21930 pgd_t *pgd_base = swapper_pg_dir;
21931- int pgd_idx, pmd_idx, pte_ofs;
21932+ unsigned int pgd_idx, pmd_idx, pte_ofs;
21933 unsigned long pfn;
21934 pgd_t *pgd;
21935+ pud_t *pud;
21936 pmd_t *pmd;
21937 pte_t *pte;
21938 unsigned pages_2m, pages_4k;
21939@@ -278,8 +279,13 @@ repeat:
21940 pfn = start_pfn;
21941 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21942 pgd = pgd_base + pgd_idx;
21943- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
21944- pmd = one_md_table_init(pgd);
21945+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
21946+ pud = pud_offset(pgd, 0);
21947+ pmd = pmd_offset(pud, 0);
21948+
21949+#ifdef CONFIG_X86_PAE
21950+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21951+#endif
21952
21953 if (pfn >= end_pfn)
21954 continue;
21955@@ -291,14 +297,13 @@ repeat:
21956 #endif
21957 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
21958 pmd++, pmd_idx++) {
21959- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
21960+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
21961
21962 /*
21963 * Map with big pages if possible, otherwise
21964 * create normal page tables:
21965 */
21966 if (use_pse) {
21967- unsigned int addr2;
21968 pgprot_t prot = PAGE_KERNEL_LARGE;
21969 /*
21970 * first pass will use the same initial
21971@@ -308,11 +313,7 @@ repeat:
21972 __pgprot(PTE_IDENT_ATTR |
21973 _PAGE_PSE);
21974
21975- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
21976- PAGE_OFFSET + PAGE_SIZE-1;
21977-
21978- if (is_kernel_text(addr) ||
21979- is_kernel_text(addr2))
21980+ if (is_kernel_text(address, address + PMD_SIZE))
21981 prot = PAGE_KERNEL_LARGE_EXEC;
21982
21983 pages_2m++;
21984@@ -329,7 +330,7 @@ repeat:
21985 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21986 pte += pte_ofs;
21987 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
21988- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
21989+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
21990 pgprot_t prot = PAGE_KERNEL;
21991 /*
21992 * first pass will use the same initial
21993@@ -337,7 +338,7 @@ repeat:
21994 */
21995 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
21996
21997- if (is_kernel_text(addr))
21998+ if (is_kernel_text(address, address + PAGE_SIZE))
21999 prot = PAGE_KERNEL_EXEC;
22000
22001 pages_4k++;
22002@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
22003
22004 pud = pud_offset(pgd, va);
22005 pmd = pmd_offset(pud, va);
22006- if (!pmd_present(*pmd))
22007+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22008 break;
22009
22010 pte = pte_offset_kernel(pmd, va);
22011@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
22012
22013 static void __init pagetable_init(void)
22014 {
22015- pgd_t *pgd_base = swapper_pg_dir;
22016-
22017- permanent_kmaps_init(pgd_base);
22018+ permanent_kmaps_init(swapper_pg_dir);
22019 }
22020
22021 #ifdef CONFIG_ACPI_SLEEP
22022@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
22023 * ACPI suspend needs this for resume, because things like the intel-agp
22024 * driver might have split up a kernel 4MB mapping.
22025 */
22026-char swsusp_pg_dir[PAGE_SIZE]
22027+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
22028 __attribute__ ((aligned(PAGE_SIZE)));
22029
22030 static inline void save_pg_dir(void)
22031 {
22032- memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
22033+ clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
22034 }
22035 #else /* !CONFIG_ACPI_SLEEP */
22036 static inline void save_pg_dir(void)
22037@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
22038 flush_tlb_all();
22039 }
22040
22041-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22042+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22043 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22044
22045 /* user-defined highmem size */
22046@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
22047 * Initialize the boot-time allocator (with low memory only):
22048 */
22049 bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
22050- bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
22051+ bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
22052 PAGE_SIZE);
22053 if (bootmap == -1L)
22054 panic("Cannot find bootmem map of size %ld\n", bootmap_size);
22055@@ -864,6 +863,12 @@ void __init mem_init(void)
22056
22057 pci_iommu_alloc();
22058
22059+#ifdef CONFIG_PAX_PER_CPU_PGD
22060+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22061+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22062+ KERNEL_PGD_PTRS);
22063+#endif
22064+
22065 #ifdef CONFIG_FLATMEM
22066 BUG_ON(!mem_map);
22067 #endif
22068@@ -881,7 +886,7 @@ void __init mem_init(void)
22069 set_highmem_pages_init();
22070
22071 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22072- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22073+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22074 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22075
22076 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22077@@ -923,10 +928,10 @@ void __init mem_init(void)
22078 ((unsigned long)&__init_end -
22079 (unsigned long)&__init_begin) >> 10,
22080
22081- (unsigned long)&_etext, (unsigned long)&_edata,
22082- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22083+ (unsigned long)&_sdata, (unsigned long)&_edata,
22084+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22085
22086- (unsigned long)&_text, (unsigned long)&_etext,
22087+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22088 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22089
22090 /*
22091@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
22092 if (!kernel_set_to_readonly)
22093 return;
22094
22095+ start = ktla_ktva(start);
22096 pr_debug("Set kernel text: %lx - %lx for read write\n",
22097 start, start+size);
22098
22099@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
22100 if (!kernel_set_to_readonly)
22101 return;
22102
22103+ start = ktla_ktva(start);
22104 pr_debug("Set kernel text: %lx - %lx for read only\n",
22105 start, start+size);
22106
22107@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
22108 unsigned long start = PFN_ALIGN(_text);
22109 unsigned long size = PFN_ALIGN(_etext) - start;
22110
22111+ start = ktla_ktva(start);
22112 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22113 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22114 size >> 10);
22115diff -urNp linux-2.6.32.46/arch/x86/mm/init_64.c linux-2.6.32.46/arch/x86/mm/init_64.c
22116--- linux-2.6.32.46/arch/x86/mm/init_64.c 2011-04-17 17:00:52.000000000 -0400
22117+++ linux-2.6.32.46/arch/x86/mm/init_64.c 2011-04-17 17:03:05.000000000 -0400
22118@@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22119 pmd = fill_pmd(pud, vaddr);
22120 pte = fill_pte(pmd, vaddr);
22121
22122+ pax_open_kernel();
22123 set_pte(pte, new_pte);
22124+ pax_close_kernel();
22125
22126 /*
22127 * It's enough to flush this one mapping.
22128@@ -223,14 +225,12 @@ static void __init __init_extra_mapping(
22129 pgd = pgd_offset_k((unsigned long)__va(phys));
22130 if (pgd_none(*pgd)) {
22131 pud = (pud_t *) spp_getpage();
22132- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22133- _PAGE_USER));
22134+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22135 }
22136 pud = pud_offset(pgd, (unsigned long)__va(phys));
22137 if (pud_none(*pud)) {
22138 pmd = (pmd_t *) spp_getpage();
22139- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22140- _PAGE_USER));
22141+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22142 }
22143 pmd = pmd_offset(pud, phys);
22144 BUG_ON(!pmd_none(*pmd));
22145@@ -675,6 +675,12 @@ void __init mem_init(void)
22146
22147 pci_iommu_alloc();
22148
22149+#ifdef CONFIG_PAX_PER_CPU_PGD
22150+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22151+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22152+ KERNEL_PGD_PTRS);
22153+#endif
22154+
22155 /* clear_bss() already clear the empty_zero_page */
22156
22157 reservedpages = 0;
22158@@ -861,8 +867,8 @@ int kern_addr_valid(unsigned long addr)
22159 static struct vm_area_struct gate_vma = {
22160 .vm_start = VSYSCALL_START,
22161 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22162- .vm_page_prot = PAGE_READONLY_EXEC,
22163- .vm_flags = VM_READ | VM_EXEC
22164+ .vm_page_prot = PAGE_READONLY,
22165+ .vm_flags = VM_READ
22166 };
22167
22168 struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
22169@@ -896,7 +902,7 @@ int in_gate_area_no_task(unsigned long a
22170
22171 const char *arch_vma_name(struct vm_area_struct *vma)
22172 {
22173- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22174+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22175 return "[vdso]";
22176 if (vma == &gate_vma)
22177 return "[vsyscall]";
22178diff -urNp linux-2.6.32.46/arch/x86/mm/init.c linux-2.6.32.46/arch/x86/mm/init.c
22179--- linux-2.6.32.46/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400
22180+++ linux-2.6.32.46/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400
22181@@ -69,11 +69,7 @@ static void __init find_early_table_spac
22182 * cause a hotspot and fill up ZONE_DMA. The page tables
22183 * need roughly 0.5KB per GB.
22184 */
22185-#ifdef CONFIG_X86_32
22186- start = 0x7000;
22187-#else
22188- start = 0x8000;
22189-#endif
22190+ start = 0x100000;
22191 e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
22192 tables, PAGE_SIZE);
22193 if (e820_table_start == -1UL)
22194@@ -147,7 +143,7 @@ unsigned long __init_refok init_memory_m
22195 #endif
22196
22197 set_nx();
22198- if (nx_enabled)
22199+ if (nx_enabled && cpu_has_nx)
22200 printk(KERN_INFO "NX (Execute Disable) protection: active\n");
22201
22202 /* Enable PSE if available */
22203@@ -329,10 +325,27 @@ unsigned long __init_refok init_memory_m
22204 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
22205 * mmio resources as well as potential bios/acpi data regions.
22206 */
22207+
22208 int devmem_is_allowed(unsigned long pagenr)
22209 {
22210+#ifdef CONFIG_GRKERNSEC_KMEM
22211+ /* allow BDA */
22212+ if (!pagenr)
22213+ return 1;
22214+ /* allow EBDA */
22215+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22216+ return 1;
22217+ /* allow ISA/video mem */
22218+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22219+ return 1;
22220+ /* throw out everything else below 1MB */
22221+ if (pagenr <= 256)
22222+ return 0;
22223+#else
22224 if (pagenr <= 256)
22225 return 1;
22226+#endif
22227+
22228 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22229 return 0;
22230 if (!page_is_ram(pagenr))
22231@@ -379,6 +392,86 @@ void free_init_pages(char *what, unsigne
22232
22233 void free_initmem(void)
22234 {
22235+
22236+#ifdef CONFIG_PAX_KERNEXEC
22237+#ifdef CONFIG_X86_32
22238+ /* PaX: limit KERNEL_CS to actual size */
22239+ unsigned long addr, limit;
22240+ struct desc_struct d;
22241+ int cpu;
22242+
22243+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22244+ limit = (limit - 1UL) >> PAGE_SHIFT;
22245+
22246+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22247+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22248+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22249+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22250+ }
22251+
22252+ /* PaX: make KERNEL_CS read-only */
22253+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22254+ if (!paravirt_enabled())
22255+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22256+/*
22257+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22258+ pgd = pgd_offset_k(addr);
22259+ pud = pud_offset(pgd, addr);
22260+ pmd = pmd_offset(pud, addr);
22261+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22262+ }
22263+*/
22264+#ifdef CONFIG_X86_PAE
22265+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22266+/*
22267+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22268+ pgd = pgd_offset_k(addr);
22269+ pud = pud_offset(pgd, addr);
22270+ pmd = pmd_offset(pud, addr);
22271+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22272+ }
22273+*/
22274+#endif
22275+
22276+#ifdef CONFIG_MODULES
22277+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22278+#endif
22279+
22280+#else
22281+ pgd_t *pgd;
22282+ pud_t *pud;
22283+ pmd_t *pmd;
22284+ unsigned long addr, end;
22285+
22286+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22287+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22288+ pgd = pgd_offset_k(addr);
22289+ pud = pud_offset(pgd, addr);
22290+ pmd = pmd_offset(pud, addr);
22291+ if (!pmd_present(*pmd))
22292+ continue;
22293+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22294+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22295+ else
22296+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22297+ }
22298+
22299+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22300+ end = addr + KERNEL_IMAGE_SIZE;
22301+ for (; addr < end; addr += PMD_SIZE) {
22302+ pgd = pgd_offset_k(addr);
22303+ pud = pud_offset(pgd, addr);
22304+ pmd = pmd_offset(pud, addr);
22305+ if (!pmd_present(*pmd))
22306+ continue;
22307+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22308+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22309+ }
22310+#endif
22311+
22312+ flush_tlb_all();
22313+#endif
22314+
22315 free_init_pages("unused kernel memory",
22316 (unsigned long)(&__init_begin),
22317 (unsigned long)(&__init_end));
22318diff -urNp linux-2.6.32.46/arch/x86/mm/iomap_32.c linux-2.6.32.46/arch/x86/mm/iomap_32.c
22319--- linux-2.6.32.46/arch/x86/mm/iomap_32.c 2011-03-27 14:31:47.000000000 -0400
22320+++ linux-2.6.32.46/arch/x86/mm/iomap_32.c 2011-04-17 15:56:46.000000000 -0400
22321@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22322 debug_kmap_atomic(type);
22323 idx = type + KM_TYPE_NR * smp_processor_id();
22324 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22325+
22326+ pax_open_kernel();
22327 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22328+ pax_close_kernel();
22329+
22330 arch_flush_lazy_mmu_mode();
22331
22332 return (void *)vaddr;
22333diff -urNp linux-2.6.32.46/arch/x86/mm/ioremap.c linux-2.6.32.46/arch/x86/mm/ioremap.c
22334--- linux-2.6.32.46/arch/x86/mm/ioremap.c 2011-03-27 14:31:47.000000000 -0400
22335+++ linux-2.6.32.46/arch/x86/mm/ioremap.c 2011-04-17 15:56:46.000000000 -0400
22336@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
22337 * Second special case: Some BIOSen report the PC BIOS
22338 * area (640->1Mb) as ram even though it is not.
22339 */
22340- if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
22341- pagenr < (BIOS_END >> PAGE_SHIFT))
22342+ if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
22343+ pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22344 return 0;
22345
22346 for (i = 0; i < e820.nr_map; i++) {
22347@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
22348 /*
22349 * Don't allow anybody to remap normal RAM that we're using..
22350 */
22351- for (pfn = phys_addr >> PAGE_SHIFT;
22352- (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
22353- pfn++) {
22354-
22355+ for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
22356 int is_ram = page_is_ram(pfn);
22357
22358- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22359+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22360 return NULL;
22361 WARN_ON_ONCE(is_ram);
22362 }
22363@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
22364 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22365
22366 static __initdata int after_paging_init;
22367-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22368+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22369
22370 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22371 {
22372@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
22373 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22374
22375 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22376- memset(bm_pte, 0, sizeof(bm_pte));
22377- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22378+ pmd_populate_user(&init_mm, pmd, bm_pte);
22379
22380 /*
22381 * The boot-ioremap range spans multiple pmds, for which
22382diff -urNp linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c
22383--- linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c 2011-03-27 14:31:47.000000000 -0400
22384+++ linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c 2011-04-17 15:56:46.000000000 -0400
22385@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22386 * memory (e.g. tracked pages)? For now, we need this to avoid
22387 * invoking kmemcheck for PnP BIOS calls.
22388 */
22389- if (regs->flags & X86_VM_MASK)
22390+ if (v8086_mode(regs))
22391 return false;
22392- if (regs->cs != __KERNEL_CS)
22393+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22394 return false;
22395
22396 pte = kmemcheck_pte_lookup(address);
22397diff -urNp linux-2.6.32.46/arch/x86/mm/mmap.c linux-2.6.32.46/arch/x86/mm/mmap.c
22398--- linux-2.6.32.46/arch/x86/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
22399+++ linux-2.6.32.46/arch/x86/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
22400@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22401 * Leave an at least ~128 MB hole with possible stack randomization.
22402 */
22403 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22404-#define MAX_GAP (TASK_SIZE/6*5)
22405+#define MAX_GAP (pax_task_size/6*5)
22406
22407 /*
22408 * True on X86_32 or when emulating IA32 on X86_64
22409@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22410 return rnd << PAGE_SHIFT;
22411 }
22412
22413-static unsigned long mmap_base(void)
22414+static unsigned long mmap_base(struct mm_struct *mm)
22415 {
22416 unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
22417+ unsigned long pax_task_size = TASK_SIZE;
22418+
22419+#ifdef CONFIG_PAX_SEGMEXEC
22420+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22421+ pax_task_size = SEGMEXEC_TASK_SIZE;
22422+#endif
22423
22424 if (gap < MIN_GAP)
22425 gap = MIN_GAP;
22426 else if (gap > MAX_GAP)
22427 gap = MAX_GAP;
22428
22429- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22430+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22431 }
22432
22433 /*
22434 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22435 * does, but not when emulating X86_32
22436 */
22437-static unsigned long mmap_legacy_base(void)
22438+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22439 {
22440- if (mmap_is_ia32())
22441+ if (mmap_is_ia32()) {
22442+
22443+#ifdef CONFIG_PAX_SEGMEXEC
22444+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22445+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22446+ else
22447+#endif
22448+
22449 return TASK_UNMAPPED_BASE;
22450- else
22451+ } else
22452 return TASK_UNMAPPED_BASE + mmap_rnd();
22453 }
22454
22455@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
22456 void arch_pick_mmap_layout(struct mm_struct *mm)
22457 {
22458 if (mmap_is_legacy()) {
22459- mm->mmap_base = mmap_legacy_base();
22460+ mm->mmap_base = mmap_legacy_base(mm);
22461+
22462+#ifdef CONFIG_PAX_RANDMMAP
22463+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22464+ mm->mmap_base += mm->delta_mmap;
22465+#endif
22466+
22467 mm->get_unmapped_area = arch_get_unmapped_area;
22468 mm->unmap_area = arch_unmap_area;
22469 } else {
22470- mm->mmap_base = mmap_base();
22471+ mm->mmap_base = mmap_base(mm);
22472+
22473+#ifdef CONFIG_PAX_RANDMMAP
22474+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22475+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22476+#endif
22477+
22478 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22479 mm->unmap_area = arch_unmap_area_topdown;
22480 }
22481diff -urNp linux-2.6.32.46/arch/x86/mm/mmio-mod.c linux-2.6.32.46/arch/x86/mm/mmio-mod.c
22482--- linux-2.6.32.46/arch/x86/mm/mmio-mod.c 2011-03-27 14:31:47.000000000 -0400
22483+++ linux-2.6.32.46/arch/x86/mm/mmio-mod.c 2011-07-06 19:53:33.000000000 -0400
22484@@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, s
22485 break;
22486 default:
22487 {
22488- unsigned char *ip = (unsigned char *)instptr;
22489+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
22490 my_trace->opcode = MMIO_UNKNOWN_OP;
22491 my_trace->width = 0;
22492 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
22493@@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p,
22494 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22495 void __iomem *addr)
22496 {
22497- static atomic_t next_id;
22498+ static atomic_unchecked_t next_id;
22499 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22500 /* These are page-unaligned. */
22501 struct mmiotrace_map map = {
22502@@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_
22503 .private = trace
22504 },
22505 .phys = offset,
22506- .id = atomic_inc_return(&next_id)
22507+ .id = atomic_inc_return_unchecked(&next_id)
22508 };
22509 map.map_id = trace->id;
22510
22511diff -urNp linux-2.6.32.46/arch/x86/mm/numa_32.c linux-2.6.32.46/arch/x86/mm/numa_32.c
22512--- linux-2.6.32.46/arch/x86/mm/numa_32.c 2011-03-27 14:31:47.000000000 -0400
22513+++ linux-2.6.32.46/arch/x86/mm/numa_32.c 2011-04-17 15:56:46.000000000 -0400
22514@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
22515 }
22516 #endif
22517
22518-extern unsigned long find_max_low_pfn(void);
22519 extern unsigned long highend_pfn, highstart_pfn;
22520
22521 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
22522diff -urNp linux-2.6.32.46/arch/x86/mm/pageattr.c linux-2.6.32.46/arch/x86/mm/pageattr.c
22523--- linux-2.6.32.46/arch/x86/mm/pageattr.c 2011-03-27 14:31:47.000000000 -0400
22524+++ linux-2.6.32.46/arch/x86/mm/pageattr.c 2011-04-17 15:56:46.000000000 -0400
22525@@ -261,16 +261,17 @@ static inline pgprot_t static_protection
22526 * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
22527 */
22528 if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
22529- pgprot_val(forbidden) |= _PAGE_NX;
22530+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22531
22532 /*
22533 * The kernel text needs to be executable for obvious reasons
22534 * Does not cover __inittext since that is gone later on. On
22535 * 64bit we do not enforce !NX on the low mapping
22536 */
22537- if (within(address, (unsigned long)_text, (unsigned long)_etext))
22538- pgprot_val(forbidden) |= _PAGE_NX;
22539+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
22540+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22541
22542+#ifdef CONFIG_DEBUG_RODATA
22543 /*
22544 * The .rodata section needs to be read-only. Using the pfn
22545 * catches all aliases.
22546@@ -278,6 +279,14 @@ static inline pgprot_t static_protection
22547 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22548 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22549 pgprot_val(forbidden) |= _PAGE_RW;
22550+#endif
22551+
22552+#ifdef CONFIG_PAX_KERNEXEC
22553+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22554+ pgprot_val(forbidden) |= _PAGE_RW;
22555+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22556+ }
22557+#endif
22558
22559 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22560
22561@@ -331,23 +340,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
22562 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22563 {
22564 /* change init_mm */
22565+ pax_open_kernel();
22566 set_pte_atomic(kpte, pte);
22567+
22568 #ifdef CONFIG_X86_32
22569 if (!SHARED_KERNEL_PMD) {
22570+
22571+#ifdef CONFIG_PAX_PER_CPU_PGD
22572+ unsigned long cpu;
22573+#else
22574 struct page *page;
22575+#endif
22576
22577+#ifdef CONFIG_PAX_PER_CPU_PGD
22578+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22579+ pgd_t *pgd = get_cpu_pgd(cpu);
22580+#else
22581 list_for_each_entry(page, &pgd_list, lru) {
22582- pgd_t *pgd;
22583+ pgd_t *pgd = (pgd_t *)page_address(page);
22584+#endif
22585+
22586 pud_t *pud;
22587 pmd_t *pmd;
22588
22589- pgd = (pgd_t *)page_address(page) + pgd_index(address);
22590+ pgd += pgd_index(address);
22591 pud = pud_offset(pgd, address);
22592 pmd = pmd_offset(pud, address);
22593 set_pte_atomic((pte_t *)pmd, pte);
22594 }
22595 }
22596 #endif
22597+ pax_close_kernel();
22598 }
22599
22600 static int
22601diff -urNp linux-2.6.32.46/arch/x86/mm/pageattr-test.c linux-2.6.32.46/arch/x86/mm/pageattr-test.c
22602--- linux-2.6.32.46/arch/x86/mm/pageattr-test.c 2011-03-27 14:31:47.000000000 -0400
22603+++ linux-2.6.32.46/arch/x86/mm/pageattr-test.c 2011-04-17 15:56:46.000000000 -0400
22604@@ -36,7 +36,7 @@ enum {
22605
22606 static int pte_testbit(pte_t pte)
22607 {
22608- return pte_flags(pte) & _PAGE_UNUSED1;
22609+ return pte_flags(pte) & _PAGE_CPA_TEST;
22610 }
22611
22612 struct split_state {
22613diff -urNp linux-2.6.32.46/arch/x86/mm/pat.c linux-2.6.32.46/arch/x86/mm/pat.c
22614--- linux-2.6.32.46/arch/x86/mm/pat.c 2011-03-27 14:31:47.000000000 -0400
22615+++ linux-2.6.32.46/arch/x86/mm/pat.c 2011-04-17 15:56:46.000000000 -0400
22616@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
22617
22618 conflict:
22619 printk(KERN_INFO "%s:%d conflicting memory types "
22620- "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
22621+ "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
22622 new->end, cattr_name(new->type), cattr_name(entry->type));
22623 return -EBUSY;
22624 }
22625@@ -559,7 +559,7 @@ unlock_ret:
22626
22627 if (err) {
22628 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22629- current->comm, current->pid, start, end);
22630+ current->comm, task_pid_nr(current), start, end);
22631 }
22632
22633 dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
22634@@ -689,8 +689,8 @@ static inline int range_is_allowed(unsig
22635 while (cursor < to) {
22636 if (!devmem_is_allowed(pfn)) {
22637 printk(KERN_INFO
22638- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22639- current->comm, from, to);
22640+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22641+ current->comm, from, to, cursor);
22642 return 0;
22643 }
22644 cursor += PAGE_SIZE;
22645@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
22646 printk(KERN_INFO
22647 "%s:%d ioremap_change_attr failed %s "
22648 "for %Lx-%Lx\n",
22649- current->comm, current->pid,
22650+ current->comm, task_pid_nr(current),
22651 cattr_name(flags),
22652 base, (unsigned long long)(base + size));
22653 return -EINVAL;
22654@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr,
22655 free_memtype(paddr, paddr + size);
22656 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
22657 " for %Lx-%Lx, got %s\n",
22658- current->comm, current->pid,
22659+ current->comm, task_pid_nr(current),
22660 cattr_name(want_flags),
22661 (unsigned long long)paddr,
22662 (unsigned long long)(paddr + size),
22663diff -urNp linux-2.6.32.46/arch/x86/mm/pf_in.c linux-2.6.32.46/arch/x86/mm/pf_in.c
22664--- linux-2.6.32.46/arch/x86/mm/pf_in.c 2011-03-27 14:31:47.000000000 -0400
22665+++ linux-2.6.32.46/arch/x86/mm/pf_in.c 2011-07-06 19:53:33.000000000 -0400
22666@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
22667 int i;
22668 enum reason_type rv = OTHERS;
22669
22670- p = (unsigned char *)ins_addr;
22671+ p = (unsigned char *)ktla_ktva(ins_addr);
22672 p += skip_prefix(p, &prf);
22673 p += get_opcode(p, &opcode);
22674
22675@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
22676 struct prefix_bits prf;
22677 int i;
22678
22679- p = (unsigned char *)ins_addr;
22680+ p = (unsigned char *)ktla_ktva(ins_addr);
22681 p += skip_prefix(p, &prf);
22682 p += get_opcode(p, &opcode);
22683
22684@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
22685 struct prefix_bits prf;
22686 int i;
22687
22688- p = (unsigned char *)ins_addr;
22689+ p = (unsigned char *)ktla_ktva(ins_addr);
22690 p += skip_prefix(p, &prf);
22691 p += get_opcode(p, &opcode);
22692
22693@@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned l
22694 int i;
22695 unsigned long rv;
22696
22697- p = (unsigned char *)ins_addr;
22698+ p = (unsigned char *)ktla_ktva(ins_addr);
22699 p += skip_prefix(p, &prf);
22700 p += get_opcode(p, &opcode);
22701 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
22702@@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned l
22703 int i;
22704 unsigned long rv;
22705
22706- p = (unsigned char *)ins_addr;
22707+ p = (unsigned char *)ktla_ktva(ins_addr);
22708 p += skip_prefix(p, &prf);
22709 p += get_opcode(p, &opcode);
22710 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
22711diff -urNp linux-2.6.32.46/arch/x86/mm/pgtable_32.c linux-2.6.32.46/arch/x86/mm/pgtable_32.c
22712--- linux-2.6.32.46/arch/x86/mm/pgtable_32.c 2011-03-27 14:31:47.000000000 -0400
22713+++ linux-2.6.32.46/arch/x86/mm/pgtable_32.c 2011-04-17 15:56:46.000000000 -0400
22714@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
22715 return;
22716 }
22717 pte = pte_offset_kernel(pmd, vaddr);
22718+
22719+ pax_open_kernel();
22720 if (pte_val(pteval))
22721 set_pte_at(&init_mm, vaddr, pte, pteval);
22722 else
22723 pte_clear(&init_mm, vaddr, pte);
22724+ pax_close_kernel();
22725
22726 /*
22727 * It's enough to flush this one mapping.
22728diff -urNp linux-2.6.32.46/arch/x86/mm/pgtable.c linux-2.6.32.46/arch/x86/mm/pgtable.c
22729--- linux-2.6.32.46/arch/x86/mm/pgtable.c 2011-03-27 14:31:47.000000000 -0400
22730+++ linux-2.6.32.46/arch/x86/mm/pgtable.c 2011-05-11 18:25:15.000000000 -0400
22731@@ -83,9 +83,52 @@ static inline void pgd_list_del(pgd_t *p
22732 list_del(&page->lru);
22733 }
22734
22735-#define UNSHARED_PTRS_PER_PGD \
22736- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22737+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22738+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
22739
22740+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22741+{
22742+ while (count--)
22743+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
22744+}
22745+#endif
22746+
22747+#ifdef CONFIG_PAX_PER_CPU_PGD
22748+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22749+{
22750+ while (count--)
22751+
22752+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22753+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
22754+#else
22755+ *dst++ = *src++;
22756+#endif
22757+
22758+}
22759+#endif
22760+
22761+#ifdef CONFIG_X86_64
22762+#define pxd_t pud_t
22763+#define pyd_t pgd_t
22764+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
22765+#define pxd_free(mm, pud) pud_free((mm), (pud))
22766+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
22767+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
22768+#define PYD_SIZE PGDIR_SIZE
22769+#else
22770+#define pxd_t pmd_t
22771+#define pyd_t pud_t
22772+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
22773+#define pxd_free(mm, pud) pmd_free((mm), (pud))
22774+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
22775+#define pyd_offset(mm ,address) pud_offset((mm), (address))
22776+#define PYD_SIZE PUD_SIZE
22777+#endif
22778+
22779+#ifdef CONFIG_PAX_PER_CPU_PGD
22780+static inline void pgd_ctor(pgd_t *pgd) {}
22781+static inline void pgd_dtor(pgd_t *pgd) {}
22782+#else
22783 static void pgd_ctor(pgd_t *pgd)
22784 {
22785 /* If the pgd points to a shared pagetable level (either the
22786@@ -119,6 +162,7 @@ static void pgd_dtor(pgd_t *pgd)
22787 pgd_list_del(pgd);
22788 spin_unlock_irqrestore(&pgd_lock, flags);
22789 }
22790+#endif
22791
22792 /*
22793 * List of all pgd's needed for non-PAE so it can invalidate entries
22794@@ -131,7 +175,7 @@ static void pgd_dtor(pgd_t *pgd)
22795 * -- wli
22796 */
22797
22798-#ifdef CONFIG_X86_PAE
22799+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22800 /*
22801 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
22802 * updating the top-level pagetable entries to guarantee the
22803@@ -143,7 +187,7 @@ static void pgd_dtor(pgd_t *pgd)
22804 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
22805 * and initialize the kernel pmds here.
22806 */
22807-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
22808+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22809
22810 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
22811 {
22812@@ -161,36 +205,38 @@ void pud_populate(struct mm_struct *mm,
22813 */
22814 flush_tlb_mm(mm);
22815 }
22816+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
22817+#define PREALLOCATED_PXDS USER_PGD_PTRS
22818 #else /* !CONFIG_X86_PAE */
22819
22820 /* No need to prepopulate any pagetable entries in non-PAE modes. */
22821-#define PREALLOCATED_PMDS 0
22822+#define PREALLOCATED_PXDS 0
22823
22824 #endif /* CONFIG_X86_PAE */
22825
22826-static void free_pmds(pmd_t *pmds[])
22827+static void free_pxds(pxd_t *pxds[])
22828 {
22829 int i;
22830
22831- for(i = 0; i < PREALLOCATED_PMDS; i++)
22832- if (pmds[i])
22833- free_page((unsigned long)pmds[i]);
22834+ for(i = 0; i < PREALLOCATED_PXDS; i++)
22835+ if (pxds[i])
22836+ free_page((unsigned long)pxds[i]);
22837 }
22838
22839-static int preallocate_pmds(pmd_t *pmds[])
22840+static int preallocate_pxds(pxd_t *pxds[])
22841 {
22842 int i;
22843 bool failed = false;
22844
22845- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22846- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
22847- if (pmd == NULL)
22848+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22849+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
22850+ if (pxd == NULL)
22851 failed = true;
22852- pmds[i] = pmd;
22853+ pxds[i] = pxd;
22854 }
22855
22856 if (failed) {
22857- free_pmds(pmds);
22858+ free_pxds(pxds);
22859 return -ENOMEM;
22860 }
22861
22862@@ -203,51 +249,56 @@ static int preallocate_pmds(pmd_t *pmds[
22863 * preallocate which never got a corresponding vma will need to be
22864 * freed manually.
22865 */
22866-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
22867+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
22868 {
22869 int i;
22870
22871- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22872+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22873 pgd_t pgd = pgdp[i];
22874
22875 if (pgd_val(pgd) != 0) {
22876- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
22877+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
22878
22879- pgdp[i] = native_make_pgd(0);
22880+ set_pgd(pgdp + i, native_make_pgd(0));
22881
22882- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
22883- pmd_free(mm, pmd);
22884+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
22885+ pxd_free(mm, pxd);
22886 }
22887 }
22888 }
22889
22890-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
22891+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
22892 {
22893- pud_t *pud;
22894+ pyd_t *pyd;
22895 unsigned long addr;
22896 int i;
22897
22898- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
22899+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
22900 return;
22901
22902- pud = pud_offset(pgd, 0);
22903+#ifdef CONFIG_X86_64
22904+ pyd = pyd_offset(mm, 0L);
22905+#else
22906+ pyd = pyd_offset(pgd, 0L);
22907+#endif
22908
22909- for (addr = i = 0; i < PREALLOCATED_PMDS;
22910- i++, pud++, addr += PUD_SIZE) {
22911- pmd_t *pmd = pmds[i];
22912+ for (addr = i = 0; i < PREALLOCATED_PXDS;
22913+ i++, pyd++, addr += PYD_SIZE) {
22914+ pxd_t *pxd = pxds[i];
22915
22916 if (i >= KERNEL_PGD_BOUNDARY)
22917- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22918- sizeof(pmd_t) * PTRS_PER_PMD);
22919+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22920+ sizeof(pxd_t) * PTRS_PER_PMD);
22921
22922- pud_populate(mm, pud, pmd);
22923+ pyd_populate(mm, pyd, pxd);
22924 }
22925 }
22926
22927 pgd_t *pgd_alloc(struct mm_struct *mm)
22928 {
22929 pgd_t *pgd;
22930- pmd_t *pmds[PREALLOCATED_PMDS];
22931+ pxd_t *pxds[PREALLOCATED_PXDS];
22932+
22933 unsigned long flags;
22934
22935 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
22936@@ -257,11 +308,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22937
22938 mm->pgd = pgd;
22939
22940- if (preallocate_pmds(pmds) != 0)
22941+ if (preallocate_pxds(pxds) != 0)
22942 goto out_free_pgd;
22943
22944 if (paravirt_pgd_alloc(mm) != 0)
22945- goto out_free_pmds;
22946+ goto out_free_pxds;
22947
22948 /*
22949 * Make sure that pre-populating the pmds is atomic with
22950@@ -271,14 +322,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22951 spin_lock_irqsave(&pgd_lock, flags);
22952
22953 pgd_ctor(pgd);
22954- pgd_prepopulate_pmd(mm, pgd, pmds);
22955+ pgd_prepopulate_pxd(mm, pgd, pxds);
22956
22957 spin_unlock_irqrestore(&pgd_lock, flags);
22958
22959 return pgd;
22960
22961-out_free_pmds:
22962- free_pmds(pmds);
22963+out_free_pxds:
22964+ free_pxds(pxds);
22965 out_free_pgd:
22966 free_page((unsigned long)pgd);
22967 out:
22968@@ -287,7 +338,7 @@ out:
22969
22970 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
22971 {
22972- pgd_mop_up_pmds(mm, pgd);
22973+ pgd_mop_up_pxds(mm, pgd);
22974 pgd_dtor(pgd);
22975 paravirt_pgd_free(mm, pgd);
22976 free_page((unsigned long)pgd);
22977diff -urNp linux-2.6.32.46/arch/x86/mm/setup_nx.c linux-2.6.32.46/arch/x86/mm/setup_nx.c
22978--- linux-2.6.32.46/arch/x86/mm/setup_nx.c 2011-03-27 14:31:47.000000000 -0400
22979+++ linux-2.6.32.46/arch/x86/mm/setup_nx.c 2011-04-17 15:56:46.000000000 -0400
22980@@ -4,11 +4,10 @@
22981
22982 #include <asm/pgtable.h>
22983
22984+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22985 int nx_enabled;
22986
22987-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22988-static int disable_nx __cpuinitdata;
22989-
22990+#ifndef CONFIG_PAX_PAGEEXEC
22991 /*
22992 * noexec = on|off
22993 *
22994@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
22995 if (!str)
22996 return -EINVAL;
22997 if (!strncmp(str, "on", 2)) {
22998- __supported_pte_mask |= _PAGE_NX;
22999- disable_nx = 0;
23000+ nx_enabled = 1;
23001 } else if (!strncmp(str, "off", 3)) {
23002- disable_nx = 1;
23003- __supported_pte_mask &= ~_PAGE_NX;
23004+ nx_enabled = 0;
23005 }
23006 return 0;
23007 }
23008 early_param("noexec", noexec_setup);
23009 #endif
23010+#endif
23011
23012 #ifdef CONFIG_X86_PAE
23013 void __init set_nx(void)
23014 {
23015- unsigned int v[4], l, h;
23016+ if (!nx_enabled && cpu_has_nx) {
23017+ unsigned l, h;
23018
23019- if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
23020- cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
23021-
23022- if ((v[3] & (1 << 20)) && !disable_nx) {
23023- rdmsr(MSR_EFER, l, h);
23024- l |= EFER_NX;
23025- wrmsr(MSR_EFER, l, h);
23026- nx_enabled = 1;
23027- __supported_pte_mask |= _PAGE_NX;
23028- }
23029+ __supported_pte_mask &= ~_PAGE_NX;
23030+ rdmsr(MSR_EFER, l, h);
23031+ l &= ~EFER_NX;
23032+ wrmsr(MSR_EFER, l, h);
23033 }
23034 }
23035 #else
23036@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
23037 unsigned long efer;
23038
23039 rdmsrl(MSR_EFER, efer);
23040- if (!(efer & EFER_NX) || disable_nx)
23041+ if (!(efer & EFER_NX) || !nx_enabled)
23042 __supported_pte_mask &= ~_PAGE_NX;
23043 }
23044 #endif
23045diff -urNp linux-2.6.32.46/arch/x86/mm/tlb.c linux-2.6.32.46/arch/x86/mm/tlb.c
23046--- linux-2.6.32.46/arch/x86/mm/tlb.c 2011-03-27 14:31:47.000000000 -0400
23047+++ linux-2.6.32.46/arch/x86/mm/tlb.c 2011-04-23 12:56:10.000000000 -0400
23048@@ -61,7 +61,11 @@ void leave_mm(int cpu)
23049 BUG();
23050 cpumask_clear_cpu(cpu,
23051 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23052+
23053+#ifndef CONFIG_PAX_PER_CPU_PGD
23054 load_cr3(swapper_pg_dir);
23055+#endif
23056+
23057 }
23058 EXPORT_SYMBOL_GPL(leave_mm);
23059
23060diff -urNp linux-2.6.32.46/arch/x86/oprofile/backtrace.c linux-2.6.32.46/arch/x86/oprofile/backtrace.c
23061--- linux-2.6.32.46/arch/x86/oprofile/backtrace.c 2011-03-27 14:31:47.000000000 -0400
23062+++ linux-2.6.32.46/arch/x86/oprofile/backtrace.c 2011-04-17 15:56:46.000000000 -0400
23063@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
23064 struct frame_head bufhead[2];
23065
23066 /* Also check accessibility of one struct frame_head beyond */
23067- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
23068+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
23069 return NULL;
23070 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
23071 return NULL;
23072@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
23073 {
23074 struct frame_head *head = (struct frame_head *)frame_pointer(regs);
23075
23076- if (!user_mode_vm(regs)) {
23077+ if (!user_mode(regs)) {
23078 unsigned long stack = kernel_stack_pointer(regs);
23079 if (depth)
23080 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23081diff -urNp linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c
23082--- linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c 2011-03-27 14:31:47.000000000 -0400
23083+++ linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c 2011-04-17 15:56:46.000000000 -0400
23084@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
23085 #endif
23086 }
23087
23088-static int inline addr_increment(void)
23089+static inline int addr_increment(void)
23090 {
23091 #ifdef CONFIG_SMP
23092 return smp_num_siblings == 2 ? 2 : 1;
23093diff -urNp linux-2.6.32.46/arch/x86/pci/common.c linux-2.6.32.46/arch/x86/pci/common.c
23094--- linux-2.6.32.46/arch/x86/pci/common.c 2011-03-27 14:31:47.000000000 -0400
23095+++ linux-2.6.32.46/arch/x86/pci/common.c 2011-04-23 12:56:10.000000000 -0400
23096@@ -31,8 +31,8 @@ int noioapicreroute = 1;
23097 int pcibios_last_bus = -1;
23098 unsigned long pirq_table_addr;
23099 struct pci_bus *pci_root_bus;
23100-struct pci_raw_ops *raw_pci_ops;
23101-struct pci_raw_ops *raw_pci_ext_ops;
23102+const struct pci_raw_ops *raw_pci_ops;
23103+const struct pci_raw_ops *raw_pci_ext_ops;
23104
23105 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23106 int reg, int len, u32 *val)
23107diff -urNp linux-2.6.32.46/arch/x86/pci/direct.c linux-2.6.32.46/arch/x86/pci/direct.c
23108--- linux-2.6.32.46/arch/x86/pci/direct.c 2011-03-27 14:31:47.000000000 -0400
23109+++ linux-2.6.32.46/arch/x86/pci/direct.c 2011-04-17 15:56:46.000000000 -0400
23110@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23111
23112 #undef PCI_CONF1_ADDRESS
23113
23114-struct pci_raw_ops pci_direct_conf1 = {
23115+const struct pci_raw_ops pci_direct_conf1 = {
23116 .read = pci_conf1_read,
23117 .write = pci_conf1_write,
23118 };
23119@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23120
23121 #undef PCI_CONF2_ADDRESS
23122
23123-struct pci_raw_ops pci_direct_conf2 = {
23124+const struct pci_raw_ops pci_direct_conf2 = {
23125 .read = pci_conf2_read,
23126 .write = pci_conf2_write,
23127 };
23128@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23129 * This should be close to trivial, but it isn't, because there are buggy
23130 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23131 */
23132-static int __init pci_sanity_check(struct pci_raw_ops *o)
23133+static int __init pci_sanity_check(const struct pci_raw_ops *o)
23134 {
23135 u32 x = 0;
23136 int year, devfn;
23137diff -urNp linux-2.6.32.46/arch/x86/pci/mmconfig_32.c linux-2.6.32.46/arch/x86/pci/mmconfig_32.c
23138--- linux-2.6.32.46/arch/x86/pci/mmconfig_32.c 2011-03-27 14:31:47.000000000 -0400
23139+++ linux-2.6.32.46/arch/x86/pci/mmconfig_32.c 2011-04-17 15:56:46.000000000 -0400
23140@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int
23141 return 0;
23142 }
23143
23144-static struct pci_raw_ops pci_mmcfg = {
23145+static const struct pci_raw_ops pci_mmcfg = {
23146 .read = pci_mmcfg_read,
23147 .write = pci_mmcfg_write,
23148 };
23149diff -urNp linux-2.6.32.46/arch/x86/pci/mmconfig_64.c linux-2.6.32.46/arch/x86/pci/mmconfig_64.c
23150--- linux-2.6.32.46/arch/x86/pci/mmconfig_64.c 2011-03-27 14:31:47.000000000 -0400
23151+++ linux-2.6.32.46/arch/x86/pci/mmconfig_64.c 2011-04-17 15:56:46.000000000 -0400
23152@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int
23153 return 0;
23154 }
23155
23156-static struct pci_raw_ops pci_mmcfg = {
23157+static const struct pci_raw_ops pci_mmcfg = {
23158 .read = pci_mmcfg_read,
23159 .write = pci_mmcfg_write,
23160 };
23161diff -urNp linux-2.6.32.46/arch/x86/pci/numaq_32.c linux-2.6.32.46/arch/x86/pci/numaq_32.c
23162--- linux-2.6.32.46/arch/x86/pci/numaq_32.c 2011-03-27 14:31:47.000000000 -0400
23163+++ linux-2.6.32.46/arch/x86/pci/numaq_32.c 2011-04-17 15:56:46.000000000 -0400
23164@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
23165
23166 #undef PCI_CONF1_MQ_ADDRESS
23167
23168-static struct pci_raw_ops pci_direct_conf1_mq = {
23169+static const struct pci_raw_ops pci_direct_conf1_mq = {
23170 .read = pci_conf1_mq_read,
23171 .write = pci_conf1_mq_write
23172 };
23173diff -urNp linux-2.6.32.46/arch/x86/pci/olpc.c linux-2.6.32.46/arch/x86/pci/olpc.c
23174--- linux-2.6.32.46/arch/x86/pci/olpc.c 2011-03-27 14:31:47.000000000 -0400
23175+++ linux-2.6.32.46/arch/x86/pci/olpc.c 2011-04-17 15:56:46.000000000 -0400
23176@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23177 return 0;
23178 }
23179
23180-static struct pci_raw_ops pci_olpc_conf = {
23181+static const struct pci_raw_ops pci_olpc_conf = {
23182 .read = pci_olpc_read,
23183 .write = pci_olpc_write,
23184 };
23185diff -urNp linux-2.6.32.46/arch/x86/pci/pcbios.c linux-2.6.32.46/arch/x86/pci/pcbios.c
23186--- linux-2.6.32.46/arch/x86/pci/pcbios.c 2011-03-27 14:31:47.000000000 -0400
23187+++ linux-2.6.32.46/arch/x86/pci/pcbios.c 2011-04-17 15:56:46.000000000 -0400
23188@@ -56,50 +56,93 @@ union bios32 {
23189 static struct {
23190 unsigned long address;
23191 unsigned short segment;
23192-} bios32_indirect = { 0, __KERNEL_CS };
23193+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23194
23195 /*
23196 * Returns the entry point for the given service, NULL on error
23197 */
23198
23199-static unsigned long bios32_service(unsigned long service)
23200+static unsigned long __devinit bios32_service(unsigned long service)
23201 {
23202 unsigned char return_code; /* %al */
23203 unsigned long address; /* %ebx */
23204 unsigned long length; /* %ecx */
23205 unsigned long entry; /* %edx */
23206 unsigned long flags;
23207+ struct desc_struct d, *gdt;
23208
23209 local_irq_save(flags);
23210- __asm__("lcall *(%%edi); cld"
23211+
23212+ gdt = get_cpu_gdt_table(smp_processor_id());
23213+
23214+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23215+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23216+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23217+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23218+
23219+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23220 : "=a" (return_code),
23221 "=b" (address),
23222 "=c" (length),
23223 "=d" (entry)
23224 : "0" (service),
23225 "1" (0),
23226- "D" (&bios32_indirect));
23227+ "D" (&bios32_indirect),
23228+ "r"(__PCIBIOS_DS)
23229+ : "memory");
23230+
23231+ pax_open_kernel();
23232+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23233+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23234+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23235+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23236+ pax_close_kernel();
23237+
23238 local_irq_restore(flags);
23239
23240 switch (return_code) {
23241- case 0:
23242- return address + entry;
23243- case 0x80: /* Not present */
23244- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23245- return 0;
23246- default: /* Shouldn't happen */
23247- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23248- service, return_code);
23249+ case 0: {
23250+ int cpu;
23251+ unsigned char flags;
23252+
23253+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23254+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23255+ printk(KERN_WARNING "bios32_service: not valid\n");
23256 return 0;
23257+ }
23258+ address = address + PAGE_OFFSET;
23259+ length += 16UL; /* some BIOSs underreport this... */
23260+ flags = 4;
23261+ if (length >= 64*1024*1024) {
23262+ length >>= PAGE_SHIFT;
23263+ flags |= 8;
23264+ }
23265+
23266+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23267+ gdt = get_cpu_gdt_table(cpu);
23268+ pack_descriptor(&d, address, length, 0x9b, flags);
23269+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23270+ pack_descriptor(&d, address, length, 0x93, flags);
23271+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23272+ }
23273+ return entry;
23274+ }
23275+ case 0x80: /* Not present */
23276+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23277+ return 0;
23278+ default: /* Shouldn't happen */
23279+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23280+ service, return_code);
23281+ return 0;
23282 }
23283 }
23284
23285 static struct {
23286 unsigned long address;
23287 unsigned short segment;
23288-} pci_indirect = { 0, __KERNEL_CS };
23289+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23290
23291-static int pci_bios_present;
23292+static int pci_bios_present __read_only;
23293
23294 static int __devinit check_pcibios(void)
23295 {
23296@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
23297 unsigned long flags, pcibios_entry;
23298
23299 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23300- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23301+ pci_indirect.address = pcibios_entry;
23302
23303 local_irq_save(flags);
23304- __asm__(
23305- "lcall *(%%edi); cld\n\t"
23306+ __asm__("movw %w6, %%ds\n\t"
23307+ "lcall *%%ss:(%%edi); cld\n\t"
23308+ "push %%ss\n\t"
23309+ "pop %%ds\n\t"
23310 "jc 1f\n\t"
23311 "xor %%ah, %%ah\n"
23312 "1:"
23313@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
23314 "=b" (ebx),
23315 "=c" (ecx)
23316 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23317- "D" (&pci_indirect)
23318+ "D" (&pci_indirect),
23319+ "r" (__PCIBIOS_DS)
23320 : "memory");
23321 local_irq_restore(flags);
23322
23323@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
23324
23325 switch (len) {
23326 case 1:
23327- __asm__("lcall *(%%esi); cld\n\t"
23328+ __asm__("movw %w6, %%ds\n\t"
23329+ "lcall *%%ss:(%%esi); cld\n\t"
23330+ "push %%ss\n\t"
23331+ "pop %%ds\n\t"
23332 "jc 1f\n\t"
23333 "xor %%ah, %%ah\n"
23334 "1:"
23335@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
23336 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23337 "b" (bx),
23338 "D" ((long)reg),
23339- "S" (&pci_indirect));
23340+ "S" (&pci_indirect),
23341+ "r" (__PCIBIOS_DS));
23342 /*
23343 * Zero-extend the result beyond 8 bits, do not trust the
23344 * BIOS having done it:
23345@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
23346 *value &= 0xff;
23347 break;
23348 case 2:
23349- __asm__("lcall *(%%esi); cld\n\t"
23350+ __asm__("movw %w6, %%ds\n\t"
23351+ "lcall *%%ss:(%%esi); cld\n\t"
23352+ "push %%ss\n\t"
23353+ "pop %%ds\n\t"
23354 "jc 1f\n\t"
23355 "xor %%ah, %%ah\n"
23356 "1:"
23357@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
23358 : "1" (PCIBIOS_READ_CONFIG_WORD),
23359 "b" (bx),
23360 "D" ((long)reg),
23361- "S" (&pci_indirect));
23362+ "S" (&pci_indirect),
23363+ "r" (__PCIBIOS_DS));
23364 /*
23365 * Zero-extend the result beyond 16 bits, do not trust the
23366 * BIOS having done it:
23367@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
23368 *value &= 0xffff;
23369 break;
23370 case 4:
23371- __asm__("lcall *(%%esi); cld\n\t"
23372+ __asm__("movw %w6, %%ds\n\t"
23373+ "lcall *%%ss:(%%esi); cld\n\t"
23374+ "push %%ss\n\t"
23375+ "pop %%ds\n\t"
23376 "jc 1f\n\t"
23377 "xor %%ah, %%ah\n"
23378 "1:"
23379@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
23380 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23381 "b" (bx),
23382 "D" ((long)reg),
23383- "S" (&pci_indirect));
23384+ "S" (&pci_indirect),
23385+ "r" (__PCIBIOS_DS));
23386 break;
23387 }
23388
23389@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
23390
23391 switch (len) {
23392 case 1:
23393- __asm__("lcall *(%%esi); cld\n\t"
23394+ __asm__("movw %w6, %%ds\n\t"
23395+ "lcall *%%ss:(%%esi); cld\n\t"
23396+ "push %%ss\n\t"
23397+ "pop %%ds\n\t"
23398 "jc 1f\n\t"
23399 "xor %%ah, %%ah\n"
23400 "1:"
23401@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
23402 "c" (value),
23403 "b" (bx),
23404 "D" ((long)reg),
23405- "S" (&pci_indirect));
23406+ "S" (&pci_indirect),
23407+ "r" (__PCIBIOS_DS));
23408 break;
23409 case 2:
23410- __asm__("lcall *(%%esi); cld\n\t"
23411+ __asm__("movw %w6, %%ds\n\t"
23412+ "lcall *%%ss:(%%esi); cld\n\t"
23413+ "push %%ss\n\t"
23414+ "pop %%ds\n\t"
23415 "jc 1f\n\t"
23416 "xor %%ah, %%ah\n"
23417 "1:"
23418@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
23419 "c" (value),
23420 "b" (bx),
23421 "D" ((long)reg),
23422- "S" (&pci_indirect));
23423+ "S" (&pci_indirect),
23424+ "r" (__PCIBIOS_DS));
23425 break;
23426 case 4:
23427- __asm__("lcall *(%%esi); cld\n\t"
23428+ __asm__("movw %w6, %%ds\n\t"
23429+ "lcall *%%ss:(%%esi); cld\n\t"
23430+ "push %%ss\n\t"
23431+ "pop %%ds\n\t"
23432 "jc 1f\n\t"
23433 "xor %%ah, %%ah\n"
23434 "1:"
23435@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
23436 "c" (value),
23437 "b" (bx),
23438 "D" ((long)reg),
23439- "S" (&pci_indirect));
23440+ "S" (&pci_indirect),
23441+ "r" (__PCIBIOS_DS));
23442 break;
23443 }
23444
23445@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
23446 * Function table for BIOS32 access
23447 */
23448
23449-static struct pci_raw_ops pci_bios_access = {
23450+static const struct pci_raw_ops pci_bios_access = {
23451 .read = pci_bios_read,
23452 .write = pci_bios_write
23453 };
23454@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
23455 * Try to find PCI BIOS.
23456 */
23457
23458-static struct pci_raw_ops * __devinit pci_find_bios(void)
23459+static const struct pci_raw_ops * __devinit pci_find_bios(void)
23460 {
23461 union bios32 *check;
23462 unsigned char sum;
23463@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
23464
23465 DBG("PCI: Fetching IRQ routing table... ");
23466 __asm__("push %%es\n\t"
23467+ "movw %w8, %%ds\n\t"
23468 "push %%ds\n\t"
23469 "pop %%es\n\t"
23470- "lcall *(%%esi); cld\n\t"
23471+ "lcall *%%ss:(%%esi); cld\n\t"
23472 "pop %%es\n\t"
23473+ "push %%ss\n\t"
23474+ "pop %%ds\n"
23475 "jc 1f\n\t"
23476 "xor %%ah, %%ah\n"
23477 "1:"
23478@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
23479 "1" (0),
23480 "D" ((long) &opt),
23481 "S" (&pci_indirect),
23482- "m" (opt)
23483+ "m" (opt),
23484+ "r" (__PCIBIOS_DS)
23485 : "memory");
23486 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23487 if (ret & 0xff00)
23488@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
23489 {
23490 int ret;
23491
23492- __asm__("lcall *(%%esi); cld\n\t"
23493+ __asm__("movw %w5, %%ds\n\t"
23494+ "lcall *%%ss:(%%esi); cld\n\t"
23495+ "push %%ss\n\t"
23496+ "pop %%ds\n"
23497 "jc 1f\n\t"
23498 "xor %%ah, %%ah\n"
23499 "1:"
23500@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
23501 : "0" (PCIBIOS_SET_PCI_HW_INT),
23502 "b" ((dev->bus->number << 8) | dev->devfn),
23503 "c" ((irq << 8) | (pin + 10)),
23504- "S" (&pci_indirect));
23505+ "S" (&pci_indirect),
23506+ "r" (__PCIBIOS_DS));
23507 return !(ret & 0xff00);
23508 }
23509 EXPORT_SYMBOL(pcibios_set_irq_routing);
23510diff -urNp linux-2.6.32.46/arch/x86/power/cpu.c linux-2.6.32.46/arch/x86/power/cpu.c
23511--- linux-2.6.32.46/arch/x86/power/cpu.c 2011-03-27 14:31:47.000000000 -0400
23512+++ linux-2.6.32.46/arch/x86/power/cpu.c 2011-04-17 15:56:46.000000000 -0400
23513@@ -129,7 +129,7 @@ static void do_fpu_end(void)
23514 static void fix_processor_context(void)
23515 {
23516 int cpu = smp_processor_id();
23517- struct tss_struct *t = &per_cpu(init_tss, cpu);
23518+ struct tss_struct *t = init_tss + cpu;
23519
23520 set_tss_desc(cpu, t); /*
23521 * This just modifies memory; should not be
23522@@ -139,7 +139,9 @@ static void fix_processor_context(void)
23523 */
23524
23525 #ifdef CONFIG_X86_64
23526+ pax_open_kernel();
23527 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
23528+ pax_close_kernel();
23529
23530 syscall_init(); /* This sets MSR_*STAR and related */
23531 #endif
23532diff -urNp linux-2.6.32.46/arch/x86/vdso/Makefile linux-2.6.32.46/arch/x86/vdso/Makefile
23533--- linux-2.6.32.46/arch/x86/vdso/Makefile 2011-03-27 14:31:47.000000000 -0400
23534+++ linux-2.6.32.46/arch/x86/vdso/Makefile 2011-04-17 15:56:46.000000000 -0400
23535@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
23536 $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
23537 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
23538
23539-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23540+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23541 GCOV_PROFILE := n
23542
23543 #
23544diff -urNp linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c
23545--- linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c 2011-03-27 14:31:47.000000000 -0400
23546+++ linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c 2011-04-17 15:56:46.000000000 -0400
23547@@ -22,24 +22,48 @@
23548 #include <asm/hpet.h>
23549 #include <asm/unistd.h>
23550 #include <asm/io.h>
23551+#include <asm/fixmap.h>
23552 #include "vextern.h"
23553
23554 #define gtod vdso_vsyscall_gtod_data
23555
23556+notrace noinline long __vdso_fallback_time(long *t)
23557+{
23558+ long secs;
23559+ asm volatile("syscall"
23560+ : "=a" (secs)
23561+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
23562+ return secs;
23563+}
23564+
23565 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
23566 {
23567 long ret;
23568 asm("syscall" : "=a" (ret) :
23569- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
23570+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
23571 return ret;
23572 }
23573
23574+notrace static inline cycle_t __vdso_vread_hpet(void)
23575+{
23576+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
23577+}
23578+
23579+notrace static inline cycle_t __vdso_vread_tsc(void)
23580+{
23581+ cycle_t ret = (cycle_t)vget_cycles();
23582+
23583+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
23584+}
23585+
23586 notrace static inline long vgetns(void)
23587 {
23588 long v;
23589- cycles_t (*vread)(void);
23590- vread = gtod->clock.vread;
23591- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
23592+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
23593+ v = __vdso_vread_tsc();
23594+ else
23595+ v = __vdso_vread_hpet();
23596+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
23597 return (v * gtod->clock.mult) >> gtod->clock.shift;
23598 }
23599
23600@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
23601
23602 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
23603 {
23604- if (likely(gtod->sysctl_enabled))
23605+ if (likely(gtod->sysctl_enabled &&
23606+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23607+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23608 switch (clock) {
23609 case CLOCK_REALTIME:
23610 if (likely(gtod->clock.vread))
23611@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
23612 int clock_gettime(clockid_t, struct timespec *)
23613 __attribute__((weak, alias("__vdso_clock_gettime")));
23614
23615-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23616+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
23617 {
23618 long ret;
23619- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
23620+ asm("syscall" : "=a" (ret) :
23621+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
23622+ return ret;
23623+}
23624+
23625+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23626+{
23627+ if (likely(gtod->sysctl_enabled &&
23628+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23629+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23630+ {
23631 if (likely(tv != NULL)) {
23632 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
23633 offsetof(struct timespec, tv_nsec) ||
23634@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
23635 }
23636 return 0;
23637 }
23638- asm("syscall" : "=a" (ret) :
23639- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
23640- return ret;
23641+ return __vdso_fallback_gettimeofday(tv, tz);
23642 }
23643 int gettimeofday(struct timeval *, struct timezone *)
23644 __attribute__((weak, alias("__vdso_gettimeofday")));
23645diff -urNp linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c
23646--- linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c 2011-03-27 14:31:47.000000000 -0400
23647+++ linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c 2011-04-23 12:56:10.000000000 -0400
23648@@ -25,6 +25,7 @@
23649 #include <asm/tlbflush.h>
23650 #include <asm/vdso.h>
23651 #include <asm/proto.h>
23652+#include <asm/mman.h>
23653
23654 enum {
23655 VDSO_DISABLED = 0,
23656@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
23657 void enable_sep_cpu(void)
23658 {
23659 int cpu = get_cpu();
23660- struct tss_struct *tss = &per_cpu(init_tss, cpu);
23661+ struct tss_struct *tss = init_tss + cpu;
23662
23663 if (!boot_cpu_has(X86_FEATURE_SEP)) {
23664 put_cpu();
23665@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
23666 gate_vma.vm_start = FIXADDR_USER_START;
23667 gate_vma.vm_end = FIXADDR_USER_END;
23668 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
23669- gate_vma.vm_page_prot = __P101;
23670+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
23671 /*
23672 * Make sure the vDSO gets into every core dump.
23673 * Dumping its contents makes post-mortem fully interpretable later
23674@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
23675 if (compat)
23676 addr = VDSO_HIGH_BASE;
23677 else {
23678- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
23679+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
23680 if (IS_ERR_VALUE(addr)) {
23681 ret = addr;
23682 goto up_fail;
23683 }
23684 }
23685
23686- current->mm->context.vdso = (void *)addr;
23687+ current->mm->context.vdso = addr;
23688
23689 if (compat_uses_vma || !compat) {
23690 /*
23691@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
23692 }
23693
23694 current_thread_info()->sysenter_return =
23695- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23696+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23697
23698 up_fail:
23699 if (ret)
23700- current->mm->context.vdso = NULL;
23701+ current->mm->context.vdso = 0;
23702
23703 up_write(&mm->mmap_sem);
23704
23705@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
23706
23707 const char *arch_vma_name(struct vm_area_struct *vma)
23708 {
23709- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
23710+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
23711 return "[vdso]";
23712+
23713+#ifdef CONFIG_PAX_SEGMEXEC
23714+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
23715+ return "[vdso]";
23716+#endif
23717+
23718 return NULL;
23719 }
23720
23721@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
23722 struct mm_struct *mm = tsk->mm;
23723
23724 /* Check to see if this task was created in compat vdso mode */
23725- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
23726+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
23727 return &gate_vma;
23728 return NULL;
23729 }
23730diff -urNp linux-2.6.32.46/arch/x86/vdso/vdso.lds.S linux-2.6.32.46/arch/x86/vdso/vdso.lds.S
23731--- linux-2.6.32.46/arch/x86/vdso/vdso.lds.S 2011-03-27 14:31:47.000000000 -0400
23732+++ linux-2.6.32.46/arch/x86/vdso/vdso.lds.S 2011-06-06 17:35:35.000000000 -0400
23733@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
23734 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
23735 #include "vextern.h"
23736 #undef VEXTERN
23737+
23738+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
23739+VEXTERN(fallback_gettimeofday)
23740+VEXTERN(fallback_time)
23741+VEXTERN(getcpu)
23742+#undef VEXTERN
23743diff -urNp linux-2.6.32.46/arch/x86/vdso/vextern.h linux-2.6.32.46/arch/x86/vdso/vextern.h
23744--- linux-2.6.32.46/arch/x86/vdso/vextern.h 2011-03-27 14:31:47.000000000 -0400
23745+++ linux-2.6.32.46/arch/x86/vdso/vextern.h 2011-04-17 15:56:46.000000000 -0400
23746@@ -11,6 +11,5 @@
23747 put into vextern.h and be referenced as a pointer with vdso prefix.
23748 The main kernel later fills in the values. */
23749
23750-VEXTERN(jiffies)
23751 VEXTERN(vgetcpu_mode)
23752 VEXTERN(vsyscall_gtod_data)
23753diff -urNp linux-2.6.32.46/arch/x86/vdso/vma.c linux-2.6.32.46/arch/x86/vdso/vma.c
23754--- linux-2.6.32.46/arch/x86/vdso/vma.c 2011-03-27 14:31:47.000000000 -0400
23755+++ linux-2.6.32.46/arch/x86/vdso/vma.c 2011-08-23 20:24:19.000000000 -0400
23756@@ -17,8 +17,6 @@
23757 #include "vextern.h" /* Just for VMAGIC. */
23758 #undef VEXTERN
23759
23760-unsigned int __read_mostly vdso_enabled = 1;
23761-
23762 extern char vdso_start[], vdso_end[];
23763 extern unsigned short vdso_sync_cpuid;
23764
23765@@ -27,10 +25,8 @@ static unsigned vdso_size;
23766
23767 static inline void *var_ref(void *p, char *name)
23768 {
23769- if (*(void **)p != (void *)VMAGIC) {
23770- printk("VDSO: variable %s broken\n", name);
23771- vdso_enabled = 0;
23772- }
23773+ if (*(void **)p != (void *)VMAGIC)
23774+ panic("VDSO: variable %s broken\n", name);
23775 return p;
23776 }
23777
23778@@ -57,21 +53,18 @@ static int __init init_vdso_vars(void)
23779 if (!vbase)
23780 goto oom;
23781
23782- if (memcmp(vbase, "\177ELF", 4)) {
23783- printk("VDSO: I'm broken; not ELF\n");
23784- vdso_enabled = 0;
23785- }
23786+ if (memcmp(vbase, ELFMAG, SELFMAG))
23787+ panic("VDSO: I'm broken; not ELF\n");
23788
23789 #define VEXTERN(x) \
23790 *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
23791 #include "vextern.h"
23792 #undef VEXTERN
23793+ vunmap(vbase);
23794 return 0;
23795
23796 oom:
23797- printk("Cannot allocate vdso\n");
23798- vdso_enabled = 0;
23799- return -ENOMEM;
23800+ panic("Cannot allocate vdso\n");
23801 }
23802 __initcall(init_vdso_vars);
23803
23804@@ -105,9 +98,6 @@ int arch_setup_additional_pages(struct l
23805 unsigned long addr;
23806 int ret;
23807
23808- if (!vdso_enabled)
23809- return 0;
23810-
23811 down_write(&mm->mmap_sem);
23812 addr = vdso_addr(mm->start_stack, vdso_size);
23813 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
23814@@ -116,7 +106,7 @@ int arch_setup_additional_pages(struct l
23815 goto up_fail;
23816 }
23817
23818- current->mm->context.vdso = (void *)addr;
23819+ current->mm->context.vdso = addr;
23820
23821 ret = install_special_mapping(mm, addr, vdso_size,
23822 VM_READ|VM_EXEC|
23823@@ -124,7 +114,7 @@ int arch_setup_additional_pages(struct l
23824 VM_ALWAYSDUMP,
23825 vdso_pages);
23826 if (ret) {
23827- current->mm->context.vdso = NULL;
23828+ current->mm->context.vdso = 0;
23829 goto up_fail;
23830 }
23831
23832@@ -132,10 +122,3 @@ up_fail:
23833 up_write(&mm->mmap_sem);
23834 return ret;
23835 }
23836-
23837-static __init int vdso_setup(char *s)
23838-{
23839- vdso_enabled = simple_strtoul(s, NULL, 0);
23840- return 0;
23841-}
23842-__setup("vdso=", vdso_setup);
23843diff -urNp linux-2.6.32.46/arch/x86/xen/enlighten.c linux-2.6.32.46/arch/x86/xen/enlighten.c
23844--- linux-2.6.32.46/arch/x86/xen/enlighten.c 2011-03-27 14:31:47.000000000 -0400
23845+++ linux-2.6.32.46/arch/x86/xen/enlighten.c 2011-05-22 23:02:03.000000000 -0400
23846@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
23847
23848 struct shared_info xen_dummy_shared_info;
23849
23850-void *xen_initial_gdt;
23851-
23852 /*
23853 * Point at some empty memory to start with. We map the real shared_info
23854 * page as soon as fixmap is up and running.
23855@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
23856
23857 preempt_disable();
23858
23859- start = __get_cpu_var(idt_desc).address;
23860+ start = (unsigned long)__get_cpu_var(idt_desc).address;
23861 end = start + __get_cpu_var(idt_desc).size + 1;
23862
23863 xen_mc_flush();
23864@@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic
23865 #endif
23866 };
23867
23868-static void xen_reboot(int reason)
23869+static __noreturn void xen_reboot(int reason)
23870 {
23871 struct sched_shutdown r = { .reason = reason };
23872
23873@@ -1001,17 +999,17 @@ static void xen_reboot(int reason)
23874 BUG();
23875 }
23876
23877-static void xen_restart(char *msg)
23878+static __noreturn void xen_restart(char *msg)
23879 {
23880 xen_reboot(SHUTDOWN_reboot);
23881 }
23882
23883-static void xen_emergency_restart(void)
23884+static __noreturn void xen_emergency_restart(void)
23885 {
23886 xen_reboot(SHUTDOWN_reboot);
23887 }
23888
23889-static void xen_machine_halt(void)
23890+static __noreturn void xen_machine_halt(void)
23891 {
23892 xen_reboot(SHUTDOWN_poweroff);
23893 }
23894@@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(
23895 */
23896 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
23897
23898-#ifdef CONFIG_X86_64
23899 /* Work out if we support NX */
23900- check_efer();
23901+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23902+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
23903+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
23904+ unsigned l, h;
23905+
23906+#ifdef CONFIG_X86_PAE
23907+ nx_enabled = 1;
23908+#endif
23909+ __supported_pte_mask |= _PAGE_NX;
23910+ rdmsr(MSR_EFER, l, h);
23911+ l |= EFER_NX;
23912+ wrmsr(MSR_EFER, l, h);
23913+ }
23914 #endif
23915
23916 xen_setup_features();
23917@@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(
23918
23919 machine_ops = xen_machine_ops;
23920
23921- /*
23922- * The only reliable way to retain the initial address of the
23923- * percpu gdt_page is to remember it here, so we can go and
23924- * mark it RW later, when the initial percpu area is freed.
23925- */
23926- xen_initial_gdt = &per_cpu(gdt_page, 0);
23927-
23928 xen_smp_init();
23929
23930 pgd = (pgd_t *)xen_start_info->pt_base;
23931diff -urNp linux-2.6.32.46/arch/x86/xen/mmu.c linux-2.6.32.46/arch/x86/xen/mmu.c
23932--- linux-2.6.32.46/arch/x86/xen/mmu.c 2011-07-13 17:23:04.000000000 -0400
23933+++ linux-2.6.32.46/arch/x86/xen/mmu.c 2011-08-24 18:35:52.000000000 -0400
23934@@ -1719,6 +1719,8 @@ __init pgd_t *xen_setup_kernel_pagetable
23935 convert_pfn_mfn(init_level4_pgt);
23936 convert_pfn_mfn(level3_ident_pgt);
23937 convert_pfn_mfn(level3_kernel_pgt);
23938+ convert_pfn_mfn(level3_vmalloc_pgt);
23939+ convert_pfn_mfn(level3_vmemmap_pgt);
23940
23941 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
23942 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
23943@@ -1737,7 +1739,10 @@ __init pgd_t *xen_setup_kernel_pagetable
23944 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
23945 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
23946 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
23947+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
23948+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
23949 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
23950+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
23951 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
23952 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
23953
23954@@ -1860,6 +1865,7 @@ static __init void xen_post_allocator_in
23955 pv_mmu_ops.set_pud = xen_set_pud;
23956 #if PAGETABLE_LEVELS == 4
23957 pv_mmu_ops.set_pgd = xen_set_pgd;
23958+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
23959 #endif
23960
23961 /* This will work as long as patching hasn't happened yet
23962@@ -1946,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_o
23963 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
23964 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
23965 .set_pgd = xen_set_pgd_hyper,
23966+ .set_pgd_batched = xen_set_pgd_hyper,
23967
23968 .alloc_pud = xen_alloc_pmd_init,
23969 .release_pud = xen_release_pmd_init,
23970diff -urNp linux-2.6.32.46/arch/x86/xen/smp.c linux-2.6.32.46/arch/x86/xen/smp.c
23971--- linux-2.6.32.46/arch/x86/xen/smp.c 2011-03-27 14:31:47.000000000 -0400
23972+++ linux-2.6.32.46/arch/x86/xen/smp.c 2011-05-11 18:25:15.000000000 -0400
23973@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
23974 {
23975 BUG_ON(smp_processor_id() != 0);
23976 native_smp_prepare_boot_cpu();
23977-
23978- /* We've switched to the "real" per-cpu gdt, so make sure the
23979- old memory can be recycled */
23980- make_lowmem_page_readwrite(xen_initial_gdt);
23981-
23982 xen_setup_vcpu_info_placement();
23983 }
23984
23985@@ -231,12 +226,12 @@ cpu_initialize_context(unsigned int cpu,
23986 gdt = get_cpu_gdt_table(cpu);
23987
23988 ctxt->flags = VGCF_IN_KERNEL;
23989- ctxt->user_regs.ds = __USER_DS;
23990- ctxt->user_regs.es = __USER_DS;
23991+ ctxt->user_regs.ds = __KERNEL_DS;
23992+ ctxt->user_regs.es = __KERNEL_DS;
23993 ctxt->user_regs.ss = __KERNEL_DS;
23994 #ifdef CONFIG_X86_32
23995 ctxt->user_regs.fs = __KERNEL_PERCPU;
23996- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
23997+ savesegment(gs, ctxt->user_regs.gs);
23998 #else
23999 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24000 #endif
24001@@ -287,13 +282,12 @@ static int __cpuinit xen_cpu_up(unsigned
24002 int rc;
24003
24004 per_cpu(current_task, cpu) = idle;
24005+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24006 #ifdef CONFIG_X86_32
24007 irq_ctx_init(cpu);
24008 #else
24009 clear_tsk_thread_flag(idle, TIF_FORK);
24010- per_cpu(kernel_stack, cpu) =
24011- (unsigned long)task_stack_page(idle) -
24012- KERNEL_STACK_OFFSET + THREAD_SIZE;
24013+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24014 #endif
24015 xen_setup_runstate_info(cpu);
24016 xen_setup_timer(cpu);
24017diff -urNp linux-2.6.32.46/arch/x86/xen/xen-asm_32.S linux-2.6.32.46/arch/x86/xen/xen-asm_32.S
24018--- linux-2.6.32.46/arch/x86/xen/xen-asm_32.S 2011-03-27 14:31:47.000000000 -0400
24019+++ linux-2.6.32.46/arch/x86/xen/xen-asm_32.S 2011-04-22 19:13:13.000000000 -0400
24020@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24021 ESP_OFFSET=4 # bytes pushed onto stack
24022
24023 /*
24024- * Store vcpu_info pointer for easy access. Do it this way to
24025- * avoid having to reload %fs
24026+ * Store vcpu_info pointer for easy access.
24027 */
24028 #ifdef CONFIG_SMP
24029- GET_THREAD_INFO(%eax)
24030- movl TI_cpu(%eax), %eax
24031- movl __per_cpu_offset(,%eax,4), %eax
24032- mov per_cpu__xen_vcpu(%eax), %eax
24033+ push %fs
24034+ mov $(__KERNEL_PERCPU), %eax
24035+ mov %eax, %fs
24036+ mov PER_CPU_VAR(xen_vcpu), %eax
24037+ pop %fs
24038 #else
24039 movl per_cpu__xen_vcpu, %eax
24040 #endif
24041diff -urNp linux-2.6.32.46/arch/x86/xen/xen-head.S linux-2.6.32.46/arch/x86/xen/xen-head.S
24042--- linux-2.6.32.46/arch/x86/xen/xen-head.S 2011-03-27 14:31:47.000000000 -0400
24043+++ linux-2.6.32.46/arch/x86/xen/xen-head.S 2011-04-17 15:56:46.000000000 -0400
24044@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24045 #ifdef CONFIG_X86_32
24046 mov %esi,xen_start_info
24047 mov $init_thread_union+THREAD_SIZE,%esp
24048+#ifdef CONFIG_SMP
24049+ movl $cpu_gdt_table,%edi
24050+ movl $__per_cpu_load,%eax
24051+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24052+ rorl $16,%eax
24053+ movb %al,__KERNEL_PERCPU + 4(%edi)
24054+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24055+ movl $__per_cpu_end - 1,%eax
24056+ subl $__per_cpu_start,%eax
24057+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24058+#endif
24059 #else
24060 mov %rsi,xen_start_info
24061 mov $init_thread_union+THREAD_SIZE,%rsp
24062diff -urNp linux-2.6.32.46/arch/x86/xen/xen-ops.h linux-2.6.32.46/arch/x86/xen/xen-ops.h
24063--- linux-2.6.32.46/arch/x86/xen/xen-ops.h 2011-03-27 14:31:47.000000000 -0400
24064+++ linux-2.6.32.46/arch/x86/xen/xen-ops.h 2011-04-17 15:56:46.000000000 -0400
24065@@ -10,8 +10,6 @@
24066 extern const char xen_hypervisor_callback[];
24067 extern const char xen_failsafe_callback[];
24068
24069-extern void *xen_initial_gdt;
24070-
24071 struct trap_info;
24072 void xen_copy_trap_info(struct trap_info *traps);
24073
24074diff -urNp linux-2.6.32.46/block/blk-integrity.c linux-2.6.32.46/block/blk-integrity.c
24075--- linux-2.6.32.46/block/blk-integrity.c 2011-03-27 14:31:47.000000000 -0400
24076+++ linux-2.6.32.46/block/blk-integrity.c 2011-04-17 15:56:46.000000000 -0400
24077@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
24078 NULL,
24079 };
24080
24081-static struct sysfs_ops integrity_ops = {
24082+static const struct sysfs_ops integrity_ops = {
24083 .show = &integrity_attr_show,
24084 .store = &integrity_attr_store,
24085 };
24086diff -urNp linux-2.6.32.46/block/blk-iopoll.c linux-2.6.32.46/block/blk-iopoll.c
24087--- linux-2.6.32.46/block/blk-iopoll.c 2011-03-27 14:31:47.000000000 -0400
24088+++ linux-2.6.32.46/block/blk-iopoll.c 2011-04-17 15:56:46.000000000 -0400
24089@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24090 }
24091 EXPORT_SYMBOL(blk_iopoll_complete);
24092
24093-static void blk_iopoll_softirq(struct softirq_action *h)
24094+static void blk_iopoll_softirq(void)
24095 {
24096 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24097 int rearm = 0, budget = blk_iopoll_budget;
24098diff -urNp linux-2.6.32.46/block/blk-map.c linux-2.6.32.46/block/blk-map.c
24099--- linux-2.6.32.46/block/blk-map.c 2011-03-27 14:31:47.000000000 -0400
24100+++ linux-2.6.32.46/block/blk-map.c 2011-04-18 16:57:33.000000000 -0400
24101@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
24102 * direct dma. else, set up kernel bounce buffers
24103 */
24104 uaddr = (unsigned long) ubuf;
24105- if (blk_rq_aligned(q, ubuf, len) && !map_data)
24106+ if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
24107 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
24108 else
24109 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
24110@@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_q
24111 for (i = 0; i < iov_count; i++) {
24112 unsigned long uaddr = (unsigned long)iov[i].iov_base;
24113
24114+ if (!iov[i].iov_len)
24115+ return -EINVAL;
24116+
24117 if (uaddr & queue_dma_alignment(q)) {
24118 unaligned = 1;
24119 break;
24120 }
24121- if (!iov[i].iov_len)
24122- return -EINVAL;
24123 }
24124
24125 if (unaligned || (q->dma_pad_mask & len) || map_data)
24126@@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue
24127 if (!len || !kbuf)
24128 return -EINVAL;
24129
24130- do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
24131+ do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
24132 if (do_copy)
24133 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24134 else
24135diff -urNp linux-2.6.32.46/block/blk-softirq.c linux-2.6.32.46/block/blk-softirq.c
24136--- linux-2.6.32.46/block/blk-softirq.c 2011-03-27 14:31:47.000000000 -0400
24137+++ linux-2.6.32.46/block/blk-softirq.c 2011-04-17 15:56:46.000000000 -0400
24138@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24139 * Softirq action handler - move entries to local list and loop over them
24140 * while passing them to the queue registered handler.
24141 */
24142-static void blk_done_softirq(struct softirq_action *h)
24143+static void blk_done_softirq(void)
24144 {
24145 struct list_head *cpu_list, local_list;
24146
24147diff -urNp linux-2.6.32.46/block/blk-sysfs.c linux-2.6.32.46/block/blk-sysfs.c
24148--- linux-2.6.32.46/block/blk-sysfs.c 2011-05-10 22:12:01.000000000 -0400
24149+++ linux-2.6.32.46/block/blk-sysfs.c 2011-05-10 22:12:26.000000000 -0400
24150@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
24151 kmem_cache_free(blk_requestq_cachep, q);
24152 }
24153
24154-static struct sysfs_ops queue_sysfs_ops = {
24155+static const struct sysfs_ops queue_sysfs_ops = {
24156 .show = queue_attr_show,
24157 .store = queue_attr_store,
24158 };
24159diff -urNp linux-2.6.32.46/block/bsg.c linux-2.6.32.46/block/bsg.c
24160--- linux-2.6.32.46/block/bsg.c 2011-03-27 14:31:47.000000000 -0400
24161+++ linux-2.6.32.46/block/bsg.c 2011-04-17 15:56:46.000000000 -0400
24162@@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24163 struct sg_io_v4 *hdr, struct bsg_device *bd,
24164 fmode_t has_write_perm)
24165 {
24166+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24167+ unsigned char *cmdptr;
24168+
24169 if (hdr->request_len > BLK_MAX_CDB) {
24170 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24171 if (!rq->cmd)
24172 return -ENOMEM;
24173- }
24174+ cmdptr = rq->cmd;
24175+ } else
24176+ cmdptr = tmpcmd;
24177
24178- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24179+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24180 hdr->request_len))
24181 return -EFAULT;
24182
24183+ if (cmdptr != rq->cmd)
24184+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24185+
24186 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24187 if (blk_verify_command(rq->cmd, has_write_perm))
24188 return -EPERM;
24189diff -urNp linux-2.6.32.46/block/elevator.c linux-2.6.32.46/block/elevator.c
24190--- linux-2.6.32.46/block/elevator.c 2011-03-27 14:31:47.000000000 -0400
24191+++ linux-2.6.32.46/block/elevator.c 2011-04-17 15:56:46.000000000 -0400
24192@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
24193 return error;
24194 }
24195
24196-static struct sysfs_ops elv_sysfs_ops = {
24197+static const struct sysfs_ops elv_sysfs_ops = {
24198 .show = elv_attr_show,
24199 .store = elv_attr_store,
24200 };
24201diff -urNp linux-2.6.32.46/block/scsi_ioctl.c linux-2.6.32.46/block/scsi_ioctl.c
24202--- linux-2.6.32.46/block/scsi_ioctl.c 2011-03-27 14:31:47.000000000 -0400
24203+++ linux-2.6.32.46/block/scsi_ioctl.c 2011-04-23 13:28:22.000000000 -0400
24204@@ -220,8 +220,20 @@ EXPORT_SYMBOL(blk_verify_command);
24205 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24206 struct sg_io_hdr *hdr, fmode_t mode)
24207 {
24208- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24209+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24210+ unsigned char *cmdptr;
24211+
24212+ if (rq->cmd != rq->__cmd)
24213+ cmdptr = rq->cmd;
24214+ else
24215+ cmdptr = tmpcmd;
24216+
24217+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24218 return -EFAULT;
24219+
24220+ if (cmdptr != rq->cmd)
24221+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24222+
24223 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24224 return -EPERM;
24225
24226@@ -430,6 +442,8 @@ int sg_scsi_ioctl(struct request_queue *
24227 int err;
24228 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24229 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24230+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24231+ unsigned char *cmdptr;
24232
24233 if (!sic)
24234 return -EINVAL;
24235@@ -463,9 +477,18 @@ int sg_scsi_ioctl(struct request_queue *
24236 */
24237 err = -EFAULT;
24238 rq->cmd_len = cmdlen;
24239- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24240+
24241+ if (rq->cmd != rq->__cmd)
24242+ cmdptr = rq->cmd;
24243+ else
24244+ cmdptr = tmpcmd;
24245+
24246+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24247 goto error;
24248
24249+ if (rq->cmd != cmdptr)
24250+ memcpy(rq->cmd, cmdptr, cmdlen);
24251+
24252 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24253 goto error;
24254
24255diff -urNp linux-2.6.32.46/crypto/cryptd.c linux-2.6.32.46/crypto/cryptd.c
24256--- linux-2.6.32.46/crypto/cryptd.c 2011-03-27 14:31:47.000000000 -0400
24257+++ linux-2.6.32.46/crypto/cryptd.c 2011-08-23 21:22:32.000000000 -0400
24258@@ -50,7 +50,7 @@ struct cryptd_blkcipher_ctx {
24259
24260 struct cryptd_blkcipher_request_ctx {
24261 crypto_completion_t complete;
24262-};
24263+} __no_const;
24264
24265 struct cryptd_hash_ctx {
24266 struct crypto_shash *child;
24267diff -urNp linux-2.6.32.46/crypto/gf128mul.c linux-2.6.32.46/crypto/gf128mul.c
24268--- linux-2.6.32.46/crypto/gf128mul.c 2011-03-27 14:31:47.000000000 -0400
24269+++ linux-2.6.32.46/crypto/gf128mul.c 2011-07-06 19:53:33.000000000 -0400
24270@@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
24271 for (i = 0; i < 7; ++i)
24272 gf128mul_x_lle(&p[i + 1], &p[i]);
24273
24274- memset(r, 0, sizeof(r));
24275+ memset(r, 0, sizeof(*r));
24276 for (i = 0;;) {
24277 u8 ch = ((u8 *)b)[15 - i];
24278
24279@@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
24280 for (i = 0; i < 7; ++i)
24281 gf128mul_x_bbe(&p[i + 1], &p[i]);
24282
24283- memset(r, 0, sizeof(r));
24284+ memset(r, 0, sizeof(*r));
24285 for (i = 0;;) {
24286 u8 ch = ((u8 *)b)[i];
24287
24288diff -urNp linux-2.6.32.46/crypto/serpent.c linux-2.6.32.46/crypto/serpent.c
24289--- linux-2.6.32.46/crypto/serpent.c 2011-03-27 14:31:47.000000000 -0400
24290+++ linux-2.6.32.46/crypto/serpent.c 2011-08-18 23:59:56.000000000 -0400
24291@@ -21,6 +21,7 @@
24292 #include <asm/byteorder.h>
24293 #include <linux/crypto.h>
24294 #include <linux/types.h>
24295+#include <linux/sched.h>
24296
24297 /* Key is padded to the maximum of 256 bits before round key generation.
24298 * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
24299@@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_
24300 u32 r0,r1,r2,r3,r4;
24301 int i;
24302
24303+ pax_track_stack();
24304+
24305 /* Copy key, add padding */
24306
24307 for (i = 0; i < keylen; ++i)
24308diff -urNp linux-2.6.32.46/Documentation/dontdiff linux-2.6.32.46/Documentation/dontdiff
24309--- linux-2.6.32.46/Documentation/dontdiff 2011-03-27 14:31:47.000000000 -0400
24310+++ linux-2.6.32.46/Documentation/dontdiff 2011-08-21 18:59:02.000000000 -0400
24311@@ -1,13 +1,16 @@
24312 *.a
24313 *.aux
24314 *.bin
24315+*.cis
24316 *.cpio
24317 *.csp
24318+*.dbg
24319 *.dsp
24320 *.dvi
24321 *.elf
24322 *.eps
24323 *.fw
24324+*.gcno
24325 *.gen.S
24326 *.gif
24327 *.grep
24328@@ -38,8 +41,10 @@
24329 *.tab.h
24330 *.tex
24331 *.ver
24332+*.vim
24333 *.xml
24334 *_MODULES
24335+*_reg_safe.h
24336 *_vga16.c
24337 *~
24338 *.9
24339@@ -49,11 +54,16 @@
24340 53c700_d.h
24341 CVS
24342 ChangeSet
24343+GPATH
24344+GRTAGS
24345+GSYMS
24346+GTAGS
24347 Image
24348 Kerntypes
24349 Module.markers
24350 Module.symvers
24351 PENDING
24352+PERF*
24353 SCCS
24354 System.map*
24355 TAGS
24356@@ -76,7 +86,11 @@ btfixupprep
24357 build
24358 bvmlinux
24359 bzImage*
24360+capability_names.h
24361+capflags.c
24362 classlist.h*
24363+clut_vga16.c
24364+common-cmds.h
24365 comp*.log
24366 compile.h*
24367 conf
24368@@ -97,19 +111,21 @@ elfconfig.h*
24369 fixdep
24370 fore200e_mkfirm
24371 fore200e_pca_fw.c*
24372+gate.lds
24373 gconf
24374 gen-devlist
24375 gen_crc32table
24376 gen_init_cpio
24377 genksyms
24378 *_gray256.c
24379+hash
24380 ihex2fw
24381 ikconfig.h*
24382 initramfs_data.cpio
24383+initramfs_data.cpio.bz2
24384 initramfs_data.cpio.gz
24385 initramfs_list
24386 kallsyms
24387-kconfig
24388 keywords.c
24389 ksym.c*
24390 ksym.h*
24391@@ -133,7 +149,9 @@ mkboot
24392 mkbugboot
24393 mkcpustr
24394 mkdep
24395+mkpiggy
24396 mkprep
24397+mkregtable
24398 mktables
24399 mktree
24400 modpost
24401@@ -149,6 +167,7 @@ patches*
24402 pca200e.bin
24403 pca200e_ecd.bin2
24404 piggy.gz
24405+piggy.S
24406 piggyback
24407 pnmtologo
24408 ppc_defs.h*
24409@@ -157,12 +176,15 @@ qconf
24410 raid6altivec*.c
24411 raid6int*.c
24412 raid6tables.c
24413+regdb.c
24414 relocs
24415+rlim_names.h
24416 series
24417 setup
24418 setup.bin
24419 setup.elf
24420 sImage
24421+slabinfo
24422 sm_tbl*
24423 split-include
24424 syscalltab.h
24425@@ -186,14 +208,20 @@ version.h*
24426 vmlinux
24427 vmlinux-*
24428 vmlinux.aout
24429+vmlinux.bin.all
24430+vmlinux.bin.bz2
24431 vmlinux.lds
24432+vmlinux.relocs
24433+voffset.h
24434 vsyscall.lds
24435 vsyscall_32.lds
24436 wanxlfw.inc
24437 uImage
24438 unifdef
24439+utsrelease.h
24440 wakeup.bin
24441 wakeup.elf
24442 wakeup.lds
24443 zImage*
24444 zconf.hash.c
24445+zoffset.h
24446diff -urNp linux-2.6.32.46/Documentation/kernel-parameters.txt linux-2.6.32.46/Documentation/kernel-parameters.txt
24447--- linux-2.6.32.46/Documentation/kernel-parameters.txt 2011-03-27 14:31:47.000000000 -0400
24448+++ linux-2.6.32.46/Documentation/kernel-parameters.txt 2011-04-17 15:56:45.000000000 -0400
24449@@ -1837,6 +1837,13 @@ and is between 256 and 4096 characters.
24450 the specified number of seconds. This is to be used if
24451 your oopses keep scrolling off the screen.
24452
24453+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
24454+ virtualization environments that don't cope well with the
24455+ expand down segment used by UDEREF on X86-32 or the frequent
24456+ page table updates on X86-64.
24457+
24458+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
24459+
24460 pcbit= [HW,ISDN]
24461
24462 pcd. [PARIDE]
24463diff -urNp linux-2.6.32.46/drivers/acpi/acpi_pad.c linux-2.6.32.46/drivers/acpi/acpi_pad.c
24464--- linux-2.6.32.46/drivers/acpi/acpi_pad.c 2011-03-27 14:31:47.000000000 -0400
24465+++ linux-2.6.32.46/drivers/acpi/acpi_pad.c 2011-04-17 15:56:46.000000000 -0400
24466@@ -30,7 +30,7 @@
24467 #include <acpi/acpi_bus.h>
24468 #include <acpi/acpi_drivers.h>
24469
24470-#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
24471+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
24472 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
24473 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
24474 static DEFINE_MUTEX(isolated_cpus_lock);
24475diff -urNp linux-2.6.32.46/drivers/acpi/battery.c linux-2.6.32.46/drivers/acpi/battery.c
24476--- linux-2.6.32.46/drivers/acpi/battery.c 2011-03-27 14:31:47.000000000 -0400
24477+++ linux-2.6.32.46/drivers/acpi/battery.c 2011-04-17 15:56:46.000000000 -0400
24478@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
24479 }
24480
24481 static struct battery_file {
24482- struct file_operations ops;
24483+ const struct file_operations ops;
24484 mode_t mode;
24485 const char *name;
24486 } acpi_battery_file[] = {
24487diff -urNp linux-2.6.32.46/drivers/acpi/dock.c linux-2.6.32.46/drivers/acpi/dock.c
24488--- linux-2.6.32.46/drivers/acpi/dock.c 2011-03-27 14:31:47.000000000 -0400
24489+++ linux-2.6.32.46/drivers/acpi/dock.c 2011-04-17 15:56:46.000000000 -0400
24490@@ -77,7 +77,7 @@ struct dock_dependent_device {
24491 struct list_head list;
24492 struct list_head hotplug_list;
24493 acpi_handle handle;
24494- struct acpi_dock_ops *ops;
24495+ const struct acpi_dock_ops *ops;
24496 void *context;
24497 };
24498
24499@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
24500 * the dock driver after _DCK is executed.
24501 */
24502 int
24503-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24504+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24505 void *context)
24506 {
24507 struct dock_dependent_device *dd;
24508diff -urNp linux-2.6.32.46/drivers/acpi/osl.c linux-2.6.32.46/drivers/acpi/osl.c
24509--- linux-2.6.32.46/drivers/acpi/osl.c 2011-03-27 14:31:47.000000000 -0400
24510+++ linux-2.6.32.46/drivers/acpi/osl.c 2011-04-17 15:56:46.000000000 -0400
24511@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
24512 void __iomem *virt_addr;
24513
24514 virt_addr = ioremap(phys_addr, width);
24515+ if (!virt_addr)
24516+ return AE_NO_MEMORY;
24517 if (!value)
24518 value = &dummy;
24519
24520@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
24521 void __iomem *virt_addr;
24522
24523 virt_addr = ioremap(phys_addr, width);
24524+ if (!virt_addr)
24525+ return AE_NO_MEMORY;
24526
24527 switch (width) {
24528 case 8:
24529diff -urNp linux-2.6.32.46/drivers/acpi/power_meter.c linux-2.6.32.46/drivers/acpi/power_meter.c
24530--- linux-2.6.32.46/drivers/acpi/power_meter.c 2011-03-27 14:31:47.000000000 -0400
24531+++ linux-2.6.32.46/drivers/acpi/power_meter.c 2011-04-17 15:56:46.000000000 -0400
24532@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
24533 return res;
24534
24535 temp /= 1000;
24536- if (temp < 0)
24537- return -EINVAL;
24538
24539 mutex_lock(&resource->lock);
24540 resource->trip[attr->index - 7] = temp;
24541diff -urNp linux-2.6.32.46/drivers/acpi/proc.c linux-2.6.32.46/drivers/acpi/proc.c
24542--- linux-2.6.32.46/drivers/acpi/proc.c 2011-03-27 14:31:47.000000000 -0400
24543+++ linux-2.6.32.46/drivers/acpi/proc.c 2011-04-17 15:56:46.000000000 -0400
24544@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
24545 size_t count, loff_t * ppos)
24546 {
24547 struct list_head *node, *next;
24548- char strbuf[5];
24549- char str[5] = "";
24550- unsigned int len = count;
24551+ char strbuf[5] = {0};
24552 struct acpi_device *found_dev = NULL;
24553
24554- if (len > 4)
24555- len = 4;
24556- if (len < 0)
24557- return -EFAULT;
24558+ if (count > 4)
24559+ count = 4;
24560
24561- if (copy_from_user(strbuf, buffer, len))
24562+ if (copy_from_user(strbuf, buffer, count))
24563 return -EFAULT;
24564- strbuf[len] = '\0';
24565- sscanf(strbuf, "%s", str);
24566+ strbuf[count] = '\0';
24567
24568 mutex_lock(&acpi_device_lock);
24569 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
24570@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
24571 if (!dev->wakeup.flags.valid)
24572 continue;
24573
24574- if (!strncmp(dev->pnp.bus_id, str, 4)) {
24575+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
24576 dev->wakeup.state.enabled =
24577 dev->wakeup.state.enabled ? 0 : 1;
24578 found_dev = dev;
24579diff -urNp linux-2.6.32.46/drivers/acpi/processor_core.c linux-2.6.32.46/drivers/acpi/processor_core.c
24580--- linux-2.6.32.46/drivers/acpi/processor_core.c 2011-03-27 14:31:47.000000000 -0400
24581+++ linux-2.6.32.46/drivers/acpi/processor_core.c 2011-04-17 15:56:46.000000000 -0400
24582@@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(
24583 return 0;
24584 }
24585
24586- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24587+ BUG_ON(pr->id >= nr_cpu_ids);
24588
24589 /*
24590 * Buggy BIOS check
24591diff -urNp linux-2.6.32.46/drivers/acpi/sbshc.c linux-2.6.32.46/drivers/acpi/sbshc.c
24592--- linux-2.6.32.46/drivers/acpi/sbshc.c 2011-03-27 14:31:47.000000000 -0400
24593+++ linux-2.6.32.46/drivers/acpi/sbshc.c 2011-04-17 15:56:46.000000000 -0400
24594@@ -17,7 +17,7 @@
24595
24596 #define PREFIX "ACPI: "
24597
24598-#define ACPI_SMB_HC_CLASS "smbus_host_controller"
24599+#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
24600 #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
24601
24602 struct acpi_smb_hc {
24603diff -urNp linux-2.6.32.46/drivers/acpi/sleep.c linux-2.6.32.46/drivers/acpi/sleep.c
24604--- linux-2.6.32.46/drivers/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
24605+++ linux-2.6.32.46/drivers/acpi/sleep.c 2011-04-17 15:56:46.000000000 -0400
24606@@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(susp
24607 }
24608 }
24609
24610-static struct platform_suspend_ops acpi_suspend_ops = {
24611+static const struct platform_suspend_ops acpi_suspend_ops = {
24612 .valid = acpi_suspend_state_valid,
24613 .begin = acpi_suspend_begin,
24614 .prepare_late = acpi_pm_prepare,
24615@@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspen
24616 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
24617 * been requested.
24618 */
24619-static struct platform_suspend_ops acpi_suspend_ops_old = {
24620+static const struct platform_suspend_ops acpi_suspend_ops_old = {
24621 .valid = acpi_suspend_state_valid,
24622 .begin = acpi_suspend_begin_old,
24623 .prepare_late = acpi_pm_disable_gpes,
24624@@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
24625 acpi_enable_all_runtime_gpes();
24626 }
24627
24628-static struct platform_hibernation_ops acpi_hibernation_ops = {
24629+static const struct platform_hibernation_ops acpi_hibernation_ops = {
24630 .begin = acpi_hibernation_begin,
24631 .end = acpi_pm_end,
24632 .pre_snapshot = acpi_hibernation_pre_snapshot,
24633@@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot
24634 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
24635 * been requested.
24636 */
24637-static struct platform_hibernation_ops acpi_hibernation_ops_old = {
24638+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
24639 .begin = acpi_hibernation_begin_old,
24640 .end = acpi_pm_end,
24641 .pre_snapshot = acpi_hibernation_pre_snapshot_old,
24642diff -urNp linux-2.6.32.46/drivers/acpi/video.c linux-2.6.32.46/drivers/acpi/video.c
24643--- linux-2.6.32.46/drivers/acpi/video.c 2011-03-27 14:31:47.000000000 -0400
24644+++ linux-2.6.32.46/drivers/acpi/video.c 2011-04-17 15:56:46.000000000 -0400
24645@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
24646 vd->brightness->levels[request_level]);
24647 }
24648
24649-static struct backlight_ops acpi_backlight_ops = {
24650+static const struct backlight_ops acpi_backlight_ops = {
24651 .get_brightness = acpi_video_get_brightness,
24652 .update_status = acpi_video_set_brightness,
24653 };
24654diff -urNp linux-2.6.32.46/drivers/ata/ahci.c linux-2.6.32.46/drivers/ata/ahci.c
24655--- linux-2.6.32.46/drivers/ata/ahci.c 2011-03-27 14:31:47.000000000 -0400
24656+++ linux-2.6.32.46/drivers/ata/ahci.c 2011-04-23 12:56:10.000000000 -0400
24657@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
24658 .sdev_attrs = ahci_sdev_attrs,
24659 };
24660
24661-static struct ata_port_operations ahci_ops = {
24662+static const struct ata_port_operations ahci_ops = {
24663 .inherits = &sata_pmp_port_ops,
24664
24665 .qc_defer = sata_pmp_qc_defer_cmd_switch,
24666@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
24667 .port_stop = ahci_port_stop,
24668 };
24669
24670-static struct ata_port_operations ahci_vt8251_ops = {
24671+static const struct ata_port_operations ahci_vt8251_ops = {
24672 .inherits = &ahci_ops,
24673 .hardreset = ahci_vt8251_hardreset,
24674 };
24675
24676-static struct ata_port_operations ahci_p5wdh_ops = {
24677+static const struct ata_port_operations ahci_p5wdh_ops = {
24678 .inherits = &ahci_ops,
24679 .hardreset = ahci_p5wdh_hardreset,
24680 };
24681
24682-static struct ata_port_operations ahci_sb600_ops = {
24683+static const struct ata_port_operations ahci_sb600_ops = {
24684 .inherits = &ahci_ops,
24685 .softreset = ahci_sb600_softreset,
24686 .pmp_softreset = ahci_sb600_softreset,
24687diff -urNp linux-2.6.32.46/drivers/ata/ata_generic.c linux-2.6.32.46/drivers/ata/ata_generic.c
24688--- linux-2.6.32.46/drivers/ata/ata_generic.c 2011-03-27 14:31:47.000000000 -0400
24689+++ linux-2.6.32.46/drivers/ata/ata_generic.c 2011-04-17 15:56:46.000000000 -0400
24690@@ -104,7 +104,7 @@ static struct scsi_host_template generic
24691 ATA_BMDMA_SHT(DRV_NAME),
24692 };
24693
24694-static struct ata_port_operations generic_port_ops = {
24695+static const struct ata_port_operations generic_port_ops = {
24696 .inherits = &ata_bmdma_port_ops,
24697 .cable_detect = ata_cable_unknown,
24698 .set_mode = generic_set_mode,
24699diff -urNp linux-2.6.32.46/drivers/ata/ata_piix.c linux-2.6.32.46/drivers/ata/ata_piix.c
24700--- linux-2.6.32.46/drivers/ata/ata_piix.c 2011-03-27 14:31:47.000000000 -0400
24701+++ linux-2.6.32.46/drivers/ata/ata_piix.c 2011-04-23 12:56:10.000000000 -0400
24702@@ -318,7 +318,7 @@ static struct scsi_host_template piix_sh
24703 ATA_BMDMA_SHT(DRV_NAME),
24704 };
24705
24706-static struct ata_port_operations piix_pata_ops = {
24707+static const struct ata_port_operations piix_pata_ops = {
24708 .inherits = &ata_bmdma32_port_ops,
24709 .cable_detect = ata_cable_40wire,
24710 .set_piomode = piix_set_piomode,
24711@@ -326,22 +326,22 @@ static struct ata_port_operations piix_p
24712 .prereset = piix_pata_prereset,
24713 };
24714
24715-static struct ata_port_operations piix_vmw_ops = {
24716+static const struct ata_port_operations piix_vmw_ops = {
24717 .inherits = &piix_pata_ops,
24718 .bmdma_status = piix_vmw_bmdma_status,
24719 };
24720
24721-static struct ata_port_operations ich_pata_ops = {
24722+static const struct ata_port_operations ich_pata_ops = {
24723 .inherits = &piix_pata_ops,
24724 .cable_detect = ich_pata_cable_detect,
24725 .set_dmamode = ich_set_dmamode,
24726 };
24727
24728-static struct ata_port_operations piix_sata_ops = {
24729+static const struct ata_port_operations piix_sata_ops = {
24730 .inherits = &ata_bmdma_port_ops,
24731 };
24732
24733-static struct ata_port_operations piix_sidpr_sata_ops = {
24734+static const struct ata_port_operations piix_sidpr_sata_ops = {
24735 .inherits = &piix_sata_ops,
24736 .hardreset = sata_std_hardreset,
24737 .scr_read = piix_sidpr_scr_read,
24738diff -urNp linux-2.6.32.46/drivers/ata/libata-acpi.c linux-2.6.32.46/drivers/ata/libata-acpi.c
24739--- linux-2.6.32.46/drivers/ata/libata-acpi.c 2011-03-27 14:31:47.000000000 -0400
24740+++ linux-2.6.32.46/drivers/ata/libata-acpi.c 2011-04-17 15:56:46.000000000 -0400
24741@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
24742 ata_acpi_uevent(dev->link->ap, dev, event);
24743 }
24744
24745-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24746+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24747 .handler = ata_acpi_dev_notify_dock,
24748 .uevent = ata_acpi_dev_uevent,
24749 };
24750
24751-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24752+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24753 .handler = ata_acpi_ap_notify_dock,
24754 .uevent = ata_acpi_ap_uevent,
24755 };
24756diff -urNp linux-2.6.32.46/drivers/ata/libata-core.c linux-2.6.32.46/drivers/ata/libata-core.c
24757--- linux-2.6.32.46/drivers/ata/libata-core.c 2011-03-27 14:31:47.000000000 -0400
24758+++ linux-2.6.32.46/drivers/ata/libata-core.c 2011-08-05 20:33:55.000000000 -0400
24759@@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *
24760 struct ata_port *ap;
24761 unsigned int tag;
24762
24763- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24764+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24765 ap = qc->ap;
24766
24767 qc->flags = 0;
24768@@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued
24769 struct ata_port *ap;
24770 struct ata_link *link;
24771
24772- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24773+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24774 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
24775 ap = qc->ap;
24776 link = qc->dev->link;
24777@@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device
24778 * LOCKING:
24779 * None.
24780 */
24781-static void ata_finalize_port_ops(struct ata_port_operations *ops)
24782+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
24783 {
24784 static DEFINE_SPINLOCK(lock);
24785 const struct ata_port_operations *cur;
24786@@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct
24787 return;
24788
24789 spin_lock(&lock);
24790+ pax_open_kernel();
24791
24792 for (cur = ops->inherits; cur; cur = cur->inherits) {
24793 void **inherit = (void **)cur;
24794@@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct
24795 if (IS_ERR(*pp))
24796 *pp = NULL;
24797
24798- ops->inherits = NULL;
24799+ *(struct ata_port_operations **)&ops->inherits = NULL;
24800
24801+ pax_close_kernel();
24802 spin_unlock(&lock);
24803 }
24804
24805@@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host
24806 */
24807 /* KILLME - the only user left is ipr */
24808 void ata_host_init(struct ata_host *host, struct device *dev,
24809- unsigned long flags, struct ata_port_operations *ops)
24810+ unsigned long flags, const struct ata_port_operations *ops)
24811 {
24812 spin_lock_init(&host->lock);
24813 host->dev = dev;
24814@@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(stru
24815 /* truly dummy */
24816 }
24817
24818-struct ata_port_operations ata_dummy_port_ops = {
24819+const struct ata_port_operations ata_dummy_port_ops = {
24820 .qc_prep = ata_noop_qc_prep,
24821 .qc_issue = ata_dummy_qc_issue,
24822 .error_handler = ata_dummy_error_handler,
24823diff -urNp linux-2.6.32.46/drivers/ata/libata-eh.c linux-2.6.32.46/drivers/ata/libata-eh.c
24824--- linux-2.6.32.46/drivers/ata/libata-eh.c 2011-08-09 18:35:28.000000000 -0400
24825+++ linux-2.6.32.46/drivers/ata/libata-eh.c 2011-08-09 18:33:59.000000000 -0400
24826@@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
24827 {
24828 struct ata_link *link;
24829
24830+ pax_track_stack();
24831+
24832 ata_for_each_link(link, ap, HOST_FIRST)
24833 ata_eh_link_report(link);
24834 }
24835@@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_
24836 */
24837 void ata_std_error_handler(struct ata_port *ap)
24838 {
24839- struct ata_port_operations *ops = ap->ops;
24840+ const struct ata_port_operations *ops = ap->ops;
24841 ata_reset_fn_t hardreset = ops->hardreset;
24842
24843 /* ignore built-in hardreset if SCR access is not available */
24844diff -urNp linux-2.6.32.46/drivers/ata/libata-pmp.c linux-2.6.32.46/drivers/ata/libata-pmp.c
24845--- linux-2.6.32.46/drivers/ata/libata-pmp.c 2011-03-27 14:31:47.000000000 -0400
24846+++ linux-2.6.32.46/drivers/ata/libata-pmp.c 2011-04-17 15:56:46.000000000 -0400
24847@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
24848 */
24849 static int sata_pmp_eh_recover(struct ata_port *ap)
24850 {
24851- struct ata_port_operations *ops = ap->ops;
24852+ const struct ata_port_operations *ops = ap->ops;
24853 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
24854 struct ata_link *pmp_link = &ap->link;
24855 struct ata_device *pmp_dev = pmp_link->device;
24856diff -urNp linux-2.6.32.46/drivers/ata/pata_acpi.c linux-2.6.32.46/drivers/ata/pata_acpi.c
24857--- linux-2.6.32.46/drivers/ata/pata_acpi.c 2011-03-27 14:31:47.000000000 -0400
24858+++ linux-2.6.32.46/drivers/ata/pata_acpi.c 2011-04-17 15:56:46.000000000 -0400
24859@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
24860 ATA_BMDMA_SHT(DRV_NAME),
24861 };
24862
24863-static struct ata_port_operations pacpi_ops = {
24864+static const struct ata_port_operations pacpi_ops = {
24865 .inherits = &ata_bmdma_port_ops,
24866 .qc_issue = pacpi_qc_issue,
24867 .cable_detect = pacpi_cable_detect,
24868diff -urNp linux-2.6.32.46/drivers/ata/pata_ali.c linux-2.6.32.46/drivers/ata/pata_ali.c
24869--- linux-2.6.32.46/drivers/ata/pata_ali.c 2011-03-27 14:31:47.000000000 -0400
24870+++ linux-2.6.32.46/drivers/ata/pata_ali.c 2011-04-17 15:56:46.000000000 -0400
24871@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
24872 * Port operations for PIO only ALi
24873 */
24874
24875-static struct ata_port_operations ali_early_port_ops = {
24876+static const struct ata_port_operations ali_early_port_ops = {
24877 .inherits = &ata_sff_port_ops,
24878 .cable_detect = ata_cable_40wire,
24879 .set_piomode = ali_set_piomode,
24880@@ -382,7 +382,7 @@ static const struct ata_port_operations
24881 * Port operations for DMA capable ALi without cable
24882 * detect
24883 */
24884-static struct ata_port_operations ali_20_port_ops = {
24885+static const struct ata_port_operations ali_20_port_ops = {
24886 .inherits = &ali_dma_base_ops,
24887 .cable_detect = ata_cable_40wire,
24888 .mode_filter = ali_20_filter,
24889@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
24890 /*
24891 * Port operations for DMA capable ALi with cable detect
24892 */
24893-static struct ata_port_operations ali_c2_port_ops = {
24894+static const struct ata_port_operations ali_c2_port_ops = {
24895 .inherits = &ali_dma_base_ops,
24896 .check_atapi_dma = ali_check_atapi_dma,
24897 .cable_detect = ali_c2_cable_detect,
24898@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
24899 /*
24900 * Port operations for DMA capable ALi with cable detect
24901 */
24902-static struct ata_port_operations ali_c4_port_ops = {
24903+static const struct ata_port_operations ali_c4_port_ops = {
24904 .inherits = &ali_dma_base_ops,
24905 .check_atapi_dma = ali_check_atapi_dma,
24906 .cable_detect = ali_c2_cable_detect,
24907@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
24908 /*
24909 * Port operations for DMA capable ALi with cable detect and LBA48
24910 */
24911-static struct ata_port_operations ali_c5_port_ops = {
24912+static const struct ata_port_operations ali_c5_port_ops = {
24913 .inherits = &ali_dma_base_ops,
24914 .check_atapi_dma = ali_check_atapi_dma,
24915 .dev_config = ali_warn_atapi_dma,
24916diff -urNp linux-2.6.32.46/drivers/ata/pata_amd.c linux-2.6.32.46/drivers/ata/pata_amd.c
24917--- linux-2.6.32.46/drivers/ata/pata_amd.c 2011-03-27 14:31:47.000000000 -0400
24918+++ linux-2.6.32.46/drivers/ata/pata_amd.c 2011-04-17 15:56:46.000000000 -0400
24919@@ -397,28 +397,28 @@ static const struct ata_port_operations
24920 .prereset = amd_pre_reset,
24921 };
24922
24923-static struct ata_port_operations amd33_port_ops = {
24924+static const struct ata_port_operations amd33_port_ops = {
24925 .inherits = &amd_base_port_ops,
24926 .cable_detect = ata_cable_40wire,
24927 .set_piomode = amd33_set_piomode,
24928 .set_dmamode = amd33_set_dmamode,
24929 };
24930
24931-static struct ata_port_operations amd66_port_ops = {
24932+static const struct ata_port_operations amd66_port_ops = {
24933 .inherits = &amd_base_port_ops,
24934 .cable_detect = ata_cable_unknown,
24935 .set_piomode = amd66_set_piomode,
24936 .set_dmamode = amd66_set_dmamode,
24937 };
24938
24939-static struct ata_port_operations amd100_port_ops = {
24940+static const struct ata_port_operations amd100_port_ops = {
24941 .inherits = &amd_base_port_ops,
24942 .cable_detect = ata_cable_unknown,
24943 .set_piomode = amd100_set_piomode,
24944 .set_dmamode = amd100_set_dmamode,
24945 };
24946
24947-static struct ata_port_operations amd133_port_ops = {
24948+static const struct ata_port_operations amd133_port_ops = {
24949 .inherits = &amd_base_port_ops,
24950 .cable_detect = amd_cable_detect,
24951 .set_piomode = amd133_set_piomode,
24952@@ -433,13 +433,13 @@ static const struct ata_port_operations
24953 .host_stop = nv_host_stop,
24954 };
24955
24956-static struct ata_port_operations nv100_port_ops = {
24957+static const struct ata_port_operations nv100_port_ops = {
24958 .inherits = &nv_base_port_ops,
24959 .set_piomode = nv100_set_piomode,
24960 .set_dmamode = nv100_set_dmamode,
24961 };
24962
24963-static struct ata_port_operations nv133_port_ops = {
24964+static const struct ata_port_operations nv133_port_ops = {
24965 .inherits = &nv_base_port_ops,
24966 .set_piomode = nv133_set_piomode,
24967 .set_dmamode = nv133_set_dmamode,
24968diff -urNp linux-2.6.32.46/drivers/ata/pata_artop.c linux-2.6.32.46/drivers/ata/pata_artop.c
24969--- linux-2.6.32.46/drivers/ata/pata_artop.c 2011-03-27 14:31:47.000000000 -0400
24970+++ linux-2.6.32.46/drivers/ata/pata_artop.c 2011-04-17 15:56:46.000000000 -0400
24971@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
24972 ATA_BMDMA_SHT(DRV_NAME),
24973 };
24974
24975-static struct ata_port_operations artop6210_ops = {
24976+static const struct ata_port_operations artop6210_ops = {
24977 .inherits = &ata_bmdma_port_ops,
24978 .cable_detect = ata_cable_40wire,
24979 .set_piomode = artop6210_set_piomode,
24980@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
24981 .qc_defer = artop6210_qc_defer,
24982 };
24983
24984-static struct ata_port_operations artop6260_ops = {
24985+static const struct ata_port_operations artop6260_ops = {
24986 .inherits = &ata_bmdma_port_ops,
24987 .cable_detect = artop6260_cable_detect,
24988 .set_piomode = artop6260_set_piomode,
24989diff -urNp linux-2.6.32.46/drivers/ata/pata_at32.c linux-2.6.32.46/drivers/ata/pata_at32.c
24990--- linux-2.6.32.46/drivers/ata/pata_at32.c 2011-03-27 14:31:47.000000000 -0400
24991+++ linux-2.6.32.46/drivers/ata/pata_at32.c 2011-04-17 15:56:46.000000000 -0400
24992@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
24993 ATA_PIO_SHT(DRV_NAME),
24994 };
24995
24996-static struct ata_port_operations at32_port_ops = {
24997+static const struct ata_port_operations at32_port_ops = {
24998 .inherits = &ata_sff_port_ops,
24999 .cable_detect = ata_cable_40wire,
25000 .set_piomode = pata_at32_set_piomode,
25001diff -urNp linux-2.6.32.46/drivers/ata/pata_at91.c linux-2.6.32.46/drivers/ata/pata_at91.c
25002--- linux-2.6.32.46/drivers/ata/pata_at91.c 2011-03-27 14:31:47.000000000 -0400
25003+++ linux-2.6.32.46/drivers/ata/pata_at91.c 2011-04-17 15:56:46.000000000 -0400
25004@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
25005 ATA_PIO_SHT(DRV_NAME),
25006 };
25007
25008-static struct ata_port_operations pata_at91_port_ops = {
25009+static const struct ata_port_operations pata_at91_port_ops = {
25010 .inherits = &ata_sff_port_ops,
25011
25012 .sff_data_xfer = pata_at91_data_xfer_noirq,
25013diff -urNp linux-2.6.32.46/drivers/ata/pata_atiixp.c linux-2.6.32.46/drivers/ata/pata_atiixp.c
25014--- linux-2.6.32.46/drivers/ata/pata_atiixp.c 2011-03-27 14:31:47.000000000 -0400
25015+++ linux-2.6.32.46/drivers/ata/pata_atiixp.c 2011-04-17 15:56:46.000000000 -0400
25016@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
25017 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25018 };
25019
25020-static struct ata_port_operations atiixp_port_ops = {
25021+static const struct ata_port_operations atiixp_port_ops = {
25022 .inherits = &ata_bmdma_port_ops,
25023
25024 .qc_prep = ata_sff_dumb_qc_prep,
25025diff -urNp linux-2.6.32.46/drivers/ata/pata_atp867x.c linux-2.6.32.46/drivers/ata/pata_atp867x.c
25026--- linux-2.6.32.46/drivers/ata/pata_atp867x.c 2011-03-27 14:31:47.000000000 -0400
25027+++ linux-2.6.32.46/drivers/ata/pata_atp867x.c 2011-04-17 15:56:46.000000000 -0400
25028@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
25029 ATA_BMDMA_SHT(DRV_NAME),
25030 };
25031
25032-static struct ata_port_operations atp867x_ops = {
25033+static const struct ata_port_operations atp867x_ops = {
25034 .inherits = &ata_bmdma_port_ops,
25035 .cable_detect = atp867x_cable_detect,
25036 .set_piomode = atp867x_set_piomode,
25037diff -urNp linux-2.6.32.46/drivers/ata/pata_bf54x.c linux-2.6.32.46/drivers/ata/pata_bf54x.c
25038--- linux-2.6.32.46/drivers/ata/pata_bf54x.c 2011-03-27 14:31:47.000000000 -0400
25039+++ linux-2.6.32.46/drivers/ata/pata_bf54x.c 2011-04-17 15:56:46.000000000 -0400
25040@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
25041 .dma_boundary = ATA_DMA_BOUNDARY,
25042 };
25043
25044-static struct ata_port_operations bfin_pata_ops = {
25045+static const struct ata_port_operations bfin_pata_ops = {
25046 .inherits = &ata_sff_port_ops,
25047
25048 .set_piomode = bfin_set_piomode,
25049diff -urNp linux-2.6.32.46/drivers/ata/pata_cmd640.c linux-2.6.32.46/drivers/ata/pata_cmd640.c
25050--- linux-2.6.32.46/drivers/ata/pata_cmd640.c 2011-03-27 14:31:47.000000000 -0400
25051+++ linux-2.6.32.46/drivers/ata/pata_cmd640.c 2011-04-17 15:56:46.000000000 -0400
25052@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
25053 ATA_BMDMA_SHT(DRV_NAME),
25054 };
25055
25056-static struct ata_port_operations cmd640_port_ops = {
25057+static const struct ata_port_operations cmd640_port_ops = {
25058 .inherits = &ata_bmdma_port_ops,
25059 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25060 .sff_data_xfer = ata_sff_data_xfer_noirq,
25061diff -urNp linux-2.6.32.46/drivers/ata/pata_cmd64x.c linux-2.6.32.46/drivers/ata/pata_cmd64x.c
25062--- linux-2.6.32.46/drivers/ata/pata_cmd64x.c 2011-06-25 12:55:34.000000000 -0400
25063+++ linux-2.6.32.46/drivers/ata/pata_cmd64x.c 2011-06-25 12:56:37.000000000 -0400
25064@@ -271,18 +271,18 @@ static const struct ata_port_operations
25065 .set_dmamode = cmd64x_set_dmamode,
25066 };
25067
25068-static struct ata_port_operations cmd64x_port_ops = {
25069+static const struct ata_port_operations cmd64x_port_ops = {
25070 .inherits = &cmd64x_base_ops,
25071 .cable_detect = ata_cable_40wire,
25072 };
25073
25074-static struct ata_port_operations cmd646r1_port_ops = {
25075+static const struct ata_port_operations cmd646r1_port_ops = {
25076 .inherits = &cmd64x_base_ops,
25077 .bmdma_stop = cmd646r1_bmdma_stop,
25078 .cable_detect = ata_cable_40wire,
25079 };
25080
25081-static struct ata_port_operations cmd648_port_ops = {
25082+static const struct ata_port_operations cmd648_port_ops = {
25083 .inherits = &cmd64x_base_ops,
25084 .bmdma_stop = cmd648_bmdma_stop,
25085 .cable_detect = cmd648_cable_detect,
25086diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5520.c linux-2.6.32.46/drivers/ata/pata_cs5520.c
25087--- linux-2.6.32.46/drivers/ata/pata_cs5520.c 2011-03-27 14:31:47.000000000 -0400
25088+++ linux-2.6.32.46/drivers/ata/pata_cs5520.c 2011-04-17 15:56:46.000000000 -0400
25089@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
25090 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25091 };
25092
25093-static struct ata_port_operations cs5520_port_ops = {
25094+static const struct ata_port_operations cs5520_port_ops = {
25095 .inherits = &ata_bmdma_port_ops,
25096 .qc_prep = ata_sff_dumb_qc_prep,
25097 .cable_detect = ata_cable_40wire,
25098diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5530.c linux-2.6.32.46/drivers/ata/pata_cs5530.c
25099--- linux-2.6.32.46/drivers/ata/pata_cs5530.c 2011-03-27 14:31:47.000000000 -0400
25100+++ linux-2.6.32.46/drivers/ata/pata_cs5530.c 2011-04-17 15:56:46.000000000 -0400
25101@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25102 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25103 };
25104
25105-static struct ata_port_operations cs5530_port_ops = {
25106+static const struct ata_port_operations cs5530_port_ops = {
25107 .inherits = &ata_bmdma_port_ops,
25108
25109 .qc_prep = ata_sff_dumb_qc_prep,
25110diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5535.c linux-2.6.32.46/drivers/ata/pata_cs5535.c
25111--- linux-2.6.32.46/drivers/ata/pata_cs5535.c 2011-03-27 14:31:47.000000000 -0400
25112+++ linux-2.6.32.46/drivers/ata/pata_cs5535.c 2011-04-17 15:56:46.000000000 -0400
25113@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25114 ATA_BMDMA_SHT(DRV_NAME),
25115 };
25116
25117-static struct ata_port_operations cs5535_port_ops = {
25118+static const struct ata_port_operations cs5535_port_ops = {
25119 .inherits = &ata_bmdma_port_ops,
25120 .cable_detect = cs5535_cable_detect,
25121 .set_piomode = cs5535_set_piomode,
25122diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5536.c linux-2.6.32.46/drivers/ata/pata_cs5536.c
25123--- linux-2.6.32.46/drivers/ata/pata_cs5536.c 2011-03-27 14:31:47.000000000 -0400
25124+++ linux-2.6.32.46/drivers/ata/pata_cs5536.c 2011-04-17 15:56:46.000000000 -0400
25125@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
25126 ATA_BMDMA_SHT(DRV_NAME),
25127 };
25128
25129-static struct ata_port_operations cs5536_port_ops = {
25130+static const struct ata_port_operations cs5536_port_ops = {
25131 .inherits = &ata_bmdma_port_ops,
25132 .cable_detect = cs5536_cable_detect,
25133 .set_piomode = cs5536_set_piomode,
25134diff -urNp linux-2.6.32.46/drivers/ata/pata_cypress.c linux-2.6.32.46/drivers/ata/pata_cypress.c
25135--- linux-2.6.32.46/drivers/ata/pata_cypress.c 2011-03-27 14:31:47.000000000 -0400
25136+++ linux-2.6.32.46/drivers/ata/pata_cypress.c 2011-04-17 15:56:46.000000000 -0400
25137@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
25138 ATA_BMDMA_SHT(DRV_NAME),
25139 };
25140
25141-static struct ata_port_operations cy82c693_port_ops = {
25142+static const struct ata_port_operations cy82c693_port_ops = {
25143 .inherits = &ata_bmdma_port_ops,
25144 .cable_detect = ata_cable_40wire,
25145 .set_piomode = cy82c693_set_piomode,
25146diff -urNp linux-2.6.32.46/drivers/ata/pata_efar.c linux-2.6.32.46/drivers/ata/pata_efar.c
25147--- linux-2.6.32.46/drivers/ata/pata_efar.c 2011-03-27 14:31:47.000000000 -0400
25148+++ linux-2.6.32.46/drivers/ata/pata_efar.c 2011-04-17 15:56:46.000000000 -0400
25149@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
25150 ATA_BMDMA_SHT(DRV_NAME),
25151 };
25152
25153-static struct ata_port_operations efar_ops = {
25154+static const struct ata_port_operations efar_ops = {
25155 .inherits = &ata_bmdma_port_ops,
25156 .cable_detect = efar_cable_detect,
25157 .set_piomode = efar_set_piomode,
25158diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt366.c linux-2.6.32.46/drivers/ata/pata_hpt366.c
25159--- linux-2.6.32.46/drivers/ata/pata_hpt366.c 2011-06-25 12:55:34.000000000 -0400
25160+++ linux-2.6.32.46/drivers/ata/pata_hpt366.c 2011-06-25 12:56:37.000000000 -0400
25161@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
25162 * Configuration for HPT366/68
25163 */
25164
25165-static struct ata_port_operations hpt366_port_ops = {
25166+static const struct ata_port_operations hpt366_port_ops = {
25167 .inherits = &ata_bmdma_port_ops,
25168 .cable_detect = hpt36x_cable_detect,
25169 .mode_filter = hpt366_filter,
25170diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt37x.c linux-2.6.32.46/drivers/ata/pata_hpt37x.c
25171--- linux-2.6.32.46/drivers/ata/pata_hpt37x.c 2011-06-25 12:55:34.000000000 -0400
25172+++ linux-2.6.32.46/drivers/ata/pata_hpt37x.c 2011-06-25 12:56:37.000000000 -0400
25173@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
25174 * Configuration for HPT370
25175 */
25176
25177-static struct ata_port_operations hpt370_port_ops = {
25178+static const struct ata_port_operations hpt370_port_ops = {
25179 .inherits = &ata_bmdma_port_ops,
25180
25181 .bmdma_stop = hpt370_bmdma_stop,
25182@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
25183 * Configuration for HPT370A. Close to 370 but less filters
25184 */
25185
25186-static struct ata_port_operations hpt370a_port_ops = {
25187+static const struct ata_port_operations hpt370a_port_ops = {
25188 .inherits = &hpt370_port_ops,
25189 .mode_filter = hpt370a_filter,
25190 };
25191@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
25192 * and DMA mode setting functionality.
25193 */
25194
25195-static struct ata_port_operations hpt372_port_ops = {
25196+static const struct ata_port_operations hpt372_port_ops = {
25197 .inherits = &ata_bmdma_port_ops,
25198
25199 .bmdma_stop = hpt37x_bmdma_stop,
25200@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
25201 * but we have a different cable detection procedure for function 1.
25202 */
25203
25204-static struct ata_port_operations hpt374_fn1_port_ops = {
25205+static const struct ata_port_operations hpt374_fn1_port_ops = {
25206 .inherits = &hpt372_port_ops,
25207 .prereset = hpt374_fn1_pre_reset,
25208 };
25209diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c
25210--- linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:55:34.000000000 -0400
25211+++ linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:56:37.000000000 -0400
25212@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
25213 * Configuration for HPT3x2n.
25214 */
25215
25216-static struct ata_port_operations hpt3x2n_port_ops = {
25217+static const struct ata_port_operations hpt3x2n_port_ops = {
25218 .inherits = &ata_bmdma_port_ops,
25219
25220 .bmdma_stop = hpt3x2n_bmdma_stop,
25221diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt3x3.c linux-2.6.32.46/drivers/ata/pata_hpt3x3.c
25222--- linux-2.6.32.46/drivers/ata/pata_hpt3x3.c 2011-03-27 14:31:47.000000000 -0400
25223+++ linux-2.6.32.46/drivers/ata/pata_hpt3x3.c 2011-04-17 15:56:46.000000000 -0400
25224@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25225 ATA_BMDMA_SHT(DRV_NAME),
25226 };
25227
25228-static struct ata_port_operations hpt3x3_port_ops = {
25229+static const struct ata_port_operations hpt3x3_port_ops = {
25230 .inherits = &ata_bmdma_port_ops,
25231 .cable_detect = ata_cable_40wire,
25232 .set_piomode = hpt3x3_set_piomode,
25233diff -urNp linux-2.6.32.46/drivers/ata/pata_icside.c linux-2.6.32.46/drivers/ata/pata_icside.c
25234--- linux-2.6.32.46/drivers/ata/pata_icside.c 2011-03-27 14:31:47.000000000 -0400
25235+++ linux-2.6.32.46/drivers/ata/pata_icside.c 2011-04-17 15:56:46.000000000 -0400
25236@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
25237 }
25238 }
25239
25240-static struct ata_port_operations pata_icside_port_ops = {
25241+static const struct ata_port_operations pata_icside_port_ops = {
25242 .inherits = &ata_sff_port_ops,
25243 /* no need to build any PRD tables for DMA */
25244 .qc_prep = ata_noop_qc_prep,
25245diff -urNp linux-2.6.32.46/drivers/ata/pata_isapnp.c linux-2.6.32.46/drivers/ata/pata_isapnp.c
25246--- linux-2.6.32.46/drivers/ata/pata_isapnp.c 2011-03-27 14:31:47.000000000 -0400
25247+++ linux-2.6.32.46/drivers/ata/pata_isapnp.c 2011-04-17 15:56:46.000000000 -0400
25248@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25249 ATA_PIO_SHT(DRV_NAME),
25250 };
25251
25252-static struct ata_port_operations isapnp_port_ops = {
25253+static const struct ata_port_operations isapnp_port_ops = {
25254 .inherits = &ata_sff_port_ops,
25255 .cable_detect = ata_cable_40wire,
25256 };
25257
25258-static struct ata_port_operations isapnp_noalt_port_ops = {
25259+static const struct ata_port_operations isapnp_noalt_port_ops = {
25260 .inherits = &ata_sff_port_ops,
25261 .cable_detect = ata_cable_40wire,
25262 /* No altstatus so we don't want to use the lost interrupt poll */
25263diff -urNp linux-2.6.32.46/drivers/ata/pata_it8213.c linux-2.6.32.46/drivers/ata/pata_it8213.c
25264--- linux-2.6.32.46/drivers/ata/pata_it8213.c 2011-03-27 14:31:47.000000000 -0400
25265+++ linux-2.6.32.46/drivers/ata/pata_it8213.c 2011-04-17 15:56:46.000000000 -0400
25266@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
25267 };
25268
25269
25270-static struct ata_port_operations it8213_ops = {
25271+static const struct ata_port_operations it8213_ops = {
25272 .inherits = &ata_bmdma_port_ops,
25273 .cable_detect = it8213_cable_detect,
25274 .set_piomode = it8213_set_piomode,
25275diff -urNp linux-2.6.32.46/drivers/ata/pata_it821x.c linux-2.6.32.46/drivers/ata/pata_it821x.c
25276--- linux-2.6.32.46/drivers/ata/pata_it821x.c 2011-03-27 14:31:47.000000000 -0400
25277+++ linux-2.6.32.46/drivers/ata/pata_it821x.c 2011-04-17 15:56:46.000000000 -0400
25278@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
25279 ATA_BMDMA_SHT(DRV_NAME),
25280 };
25281
25282-static struct ata_port_operations it821x_smart_port_ops = {
25283+static const struct ata_port_operations it821x_smart_port_ops = {
25284 .inherits = &ata_bmdma_port_ops,
25285
25286 .check_atapi_dma= it821x_check_atapi_dma,
25287@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
25288 .port_start = it821x_port_start,
25289 };
25290
25291-static struct ata_port_operations it821x_passthru_port_ops = {
25292+static const struct ata_port_operations it821x_passthru_port_ops = {
25293 .inherits = &ata_bmdma_port_ops,
25294
25295 .check_atapi_dma= it821x_check_atapi_dma,
25296@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
25297 .port_start = it821x_port_start,
25298 };
25299
25300-static struct ata_port_operations it821x_rdc_port_ops = {
25301+static const struct ata_port_operations it821x_rdc_port_ops = {
25302 .inherits = &ata_bmdma_port_ops,
25303
25304 .check_atapi_dma= it821x_check_atapi_dma,
25305diff -urNp linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c
25306--- linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c 2011-03-27 14:31:47.000000000 -0400
25307+++ linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c 2011-04-17 15:56:46.000000000 -0400
25308@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25309 ATA_PIO_SHT(DRV_NAME),
25310 };
25311
25312-static struct ata_port_operations ixp4xx_port_ops = {
25313+static const struct ata_port_operations ixp4xx_port_ops = {
25314 .inherits = &ata_sff_port_ops,
25315 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25316 .cable_detect = ata_cable_40wire,
25317diff -urNp linux-2.6.32.46/drivers/ata/pata_jmicron.c linux-2.6.32.46/drivers/ata/pata_jmicron.c
25318--- linux-2.6.32.46/drivers/ata/pata_jmicron.c 2011-03-27 14:31:47.000000000 -0400
25319+++ linux-2.6.32.46/drivers/ata/pata_jmicron.c 2011-04-17 15:56:46.000000000 -0400
25320@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25321 ATA_BMDMA_SHT(DRV_NAME),
25322 };
25323
25324-static struct ata_port_operations jmicron_ops = {
25325+static const struct ata_port_operations jmicron_ops = {
25326 .inherits = &ata_bmdma_port_ops,
25327 .prereset = jmicron_pre_reset,
25328 };
25329diff -urNp linux-2.6.32.46/drivers/ata/pata_legacy.c linux-2.6.32.46/drivers/ata/pata_legacy.c
25330--- linux-2.6.32.46/drivers/ata/pata_legacy.c 2011-03-27 14:31:47.000000000 -0400
25331+++ linux-2.6.32.46/drivers/ata/pata_legacy.c 2011-04-17 15:56:46.000000000 -0400
25332@@ -106,7 +106,7 @@ struct legacy_probe {
25333
25334 struct legacy_controller {
25335 const char *name;
25336- struct ata_port_operations *ops;
25337+ const struct ata_port_operations *ops;
25338 unsigned int pio_mask;
25339 unsigned int flags;
25340 unsigned int pflags;
25341@@ -223,12 +223,12 @@ static const struct ata_port_operations
25342 * pio_mask as well.
25343 */
25344
25345-static struct ata_port_operations simple_port_ops = {
25346+static const struct ata_port_operations simple_port_ops = {
25347 .inherits = &legacy_base_port_ops,
25348 .sff_data_xfer = ata_sff_data_xfer_noirq,
25349 };
25350
25351-static struct ata_port_operations legacy_port_ops = {
25352+static const struct ata_port_operations legacy_port_ops = {
25353 .inherits = &legacy_base_port_ops,
25354 .sff_data_xfer = ata_sff_data_xfer_noirq,
25355 .set_mode = legacy_set_mode,
25356@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
25357 return buflen;
25358 }
25359
25360-static struct ata_port_operations pdc20230_port_ops = {
25361+static const struct ata_port_operations pdc20230_port_ops = {
25362 .inherits = &legacy_base_port_ops,
25363 .set_piomode = pdc20230_set_piomode,
25364 .sff_data_xfer = pdc_data_xfer_vlb,
25365@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
25366 ioread8(ap->ioaddr.status_addr);
25367 }
25368
25369-static struct ata_port_operations ht6560a_port_ops = {
25370+static const struct ata_port_operations ht6560a_port_ops = {
25371 .inherits = &legacy_base_port_ops,
25372 .set_piomode = ht6560a_set_piomode,
25373 };
25374@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
25375 ioread8(ap->ioaddr.status_addr);
25376 }
25377
25378-static struct ata_port_operations ht6560b_port_ops = {
25379+static const struct ata_port_operations ht6560b_port_ops = {
25380 .inherits = &legacy_base_port_ops,
25381 .set_piomode = ht6560b_set_piomode,
25382 };
25383@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
25384 }
25385
25386
25387-static struct ata_port_operations opti82c611a_port_ops = {
25388+static const struct ata_port_operations opti82c611a_port_ops = {
25389 .inherits = &legacy_base_port_ops,
25390 .set_piomode = opti82c611a_set_piomode,
25391 };
25392@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
25393 return ata_sff_qc_issue(qc);
25394 }
25395
25396-static struct ata_port_operations opti82c46x_port_ops = {
25397+static const struct ata_port_operations opti82c46x_port_ops = {
25398 .inherits = &legacy_base_port_ops,
25399 .set_piomode = opti82c46x_set_piomode,
25400 .qc_issue = opti82c46x_qc_issue,
25401@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
25402 return 0;
25403 }
25404
25405-static struct ata_port_operations qdi6500_port_ops = {
25406+static const struct ata_port_operations qdi6500_port_ops = {
25407 .inherits = &legacy_base_port_ops,
25408 .set_piomode = qdi6500_set_piomode,
25409 .qc_issue = qdi_qc_issue,
25410 .sff_data_xfer = vlb32_data_xfer,
25411 };
25412
25413-static struct ata_port_operations qdi6580_port_ops = {
25414+static const struct ata_port_operations qdi6580_port_ops = {
25415 .inherits = &legacy_base_port_ops,
25416 .set_piomode = qdi6580_set_piomode,
25417 .sff_data_xfer = vlb32_data_xfer,
25418 };
25419
25420-static struct ata_port_operations qdi6580dp_port_ops = {
25421+static const struct ata_port_operations qdi6580dp_port_ops = {
25422 .inherits = &legacy_base_port_ops,
25423 .set_piomode = qdi6580dp_set_piomode,
25424 .sff_data_xfer = vlb32_data_xfer,
25425@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
25426 return 0;
25427 }
25428
25429-static struct ata_port_operations winbond_port_ops = {
25430+static const struct ata_port_operations winbond_port_ops = {
25431 .inherits = &legacy_base_port_ops,
25432 .set_piomode = winbond_set_piomode,
25433 .sff_data_xfer = vlb32_data_xfer,
25434@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
25435 int pio_modes = controller->pio_mask;
25436 unsigned long io = probe->port;
25437 u32 mask = (1 << probe->slot);
25438- struct ata_port_operations *ops = controller->ops;
25439+ const struct ata_port_operations *ops = controller->ops;
25440 struct legacy_data *ld = &legacy_data[probe->slot];
25441 struct ata_host *host = NULL;
25442 struct ata_port *ap;
25443diff -urNp linux-2.6.32.46/drivers/ata/pata_marvell.c linux-2.6.32.46/drivers/ata/pata_marvell.c
25444--- linux-2.6.32.46/drivers/ata/pata_marvell.c 2011-03-27 14:31:47.000000000 -0400
25445+++ linux-2.6.32.46/drivers/ata/pata_marvell.c 2011-04-17 15:56:46.000000000 -0400
25446@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25447 ATA_BMDMA_SHT(DRV_NAME),
25448 };
25449
25450-static struct ata_port_operations marvell_ops = {
25451+static const struct ata_port_operations marvell_ops = {
25452 .inherits = &ata_bmdma_port_ops,
25453 .cable_detect = marvell_cable_detect,
25454 .prereset = marvell_pre_reset,
25455diff -urNp linux-2.6.32.46/drivers/ata/pata_mpc52xx.c linux-2.6.32.46/drivers/ata/pata_mpc52xx.c
25456--- linux-2.6.32.46/drivers/ata/pata_mpc52xx.c 2011-03-27 14:31:47.000000000 -0400
25457+++ linux-2.6.32.46/drivers/ata/pata_mpc52xx.c 2011-04-17 15:56:46.000000000 -0400
25458@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25459 ATA_PIO_SHT(DRV_NAME),
25460 };
25461
25462-static struct ata_port_operations mpc52xx_ata_port_ops = {
25463+static const struct ata_port_operations mpc52xx_ata_port_ops = {
25464 .inherits = &ata_bmdma_port_ops,
25465 .sff_dev_select = mpc52xx_ata_dev_select,
25466 .set_piomode = mpc52xx_ata_set_piomode,
25467diff -urNp linux-2.6.32.46/drivers/ata/pata_mpiix.c linux-2.6.32.46/drivers/ata/pata_mpiix.c
25468--- linux-2.6.32.46/drivers/ata/pata_mpiix.c 2011-03-27 14:31:47.000000000 -0400
25469+++ linux-2.6.32.46/drivers/ata/pata_mpiix.c 2011-04-17 15:56:46.000000000 -0400
25470@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25471 ATA_PIO_SHT(DRV_NAME),
25472 };
25473
25474-static struct ata_port_operations mpiix_port_ops = {
25475+static const struct ata_port_operations mpiix_port_ops = {
25476 .inherits = &ata_sff_port_ops,
25477 .qc_issue = mpiix_qc_issue,
25478 .cable_detect = ata_cable_40wire,
25479diff -urNp linux-2.6.32.46/drivers/ata/pata_netcell.c linux-2.6.32.46/drivers/ata/pata_netcell.c
25480--- linux-2.6.32.46/drivers/ata/pata_netcell.c 2011-03-27 14:31:47.000000000 -0400
25481+++ linux-2.6.32.46/drivers/ata/pata_netcell.c 2011-04-17 15:56:46.000000000 -0400
25482@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25483 ATA_BMDMA_SHT(DRV_NAME),
25484 };
25485
25486-static struct ata_port_operations netcell_ops = {
25487+static const struct ata_port_operations netcell_ops = {
25488 .inherits = &ata_bmdma_port_ops,
25489 .cable_detect = ata_cable_80wire,
25490 .read_id = netcell_read_id,
25491diff -urNp linux-2.6.32.46/drivers/ata/pata_ninja32.c linux-2.6.32.46/drivers/ata/pata_ninja32.c
25492--- linux-2.6.32.46/drivers/ata/pata_ninja32.c 2011-03-27 14:31:47.000000000 -0400
25493+++ linux-2.6.32.46/drivers/ata/pata_ninja32.c 2011-04-17 15:56:46.000000000 -0400
25494@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25495 ATA_BMDMA_SHT(DRV_NAME),
25496 };
25497
25498-static struct ata_port_operations ninja32_port_ops = {
25499+static const struct ata_port_operations ninja32_port_ops = {
25500 .inherits = &ata_bmdma_port_ops,
25501 .sff_dev_select = ninja32_dev_select,
25502 .cable_detect = ata_cable_40wire,
25503diff -urNp linux-2.6.32.46/drivers/ata/pata_ns87410.c linux-2.6.32.46/drivers/ata/pata_ns87410.c
25504--- linux-2.6.32.46/drivers/ata/pata_ns87410.c 2011-03-27 14:31:47.000000000 -0400
25505+++ linux-2.6.32.46/drivers/ata/pata_ns87410.c 2011-04-17 15:56:46.000000000 -0400
25506@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25507 ATA_PIO_SHT(DRV_NAME),
25508 };
25509
25510-static struct ata_port_operations ns87410_port_ops = {
25511+static const struct ata_port_operations ns87410_port_ops = {
25512 .inherits = &ata_sff_port_ops,
25513 .qc_issue = ns87410_qc_issue,
25514 .cable_detect = ata_cable_40wire,
25515diff -urNp linux-2.6.32.46/drivers/ata/pata_ns87415.c linux-2.6.32.46/drivers/ata/pata_ns87415.c
25516--- linux-2.6.32.46/drivers/ata/pata_ns87415.c 2011-03-27 14:31:47.000000000 -0400
25517+++ linux-2.6.32.46/drivers/ata/pata_ns87415.c 2011-04-17 15:56:46.000000000 -0400
25518@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25519 }
25520 #endif /* 87560 SuperIO Support */
25521
25522-static struct ata_port_operations ns87415_pata_ops = {
25523+static const struct ata_port_operations ns87415_pata_ops = {
25524 .inherits = &ata_bmdma_port_ops,
25525
25526 .check_atapi_dma = ns87415_check_atapi_dma,
25527@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25528 };
25529
25530 #if defined(CONFIG_SUPERIO)
25531-static struct ata_port_operations ns87560_pata_ops = {
25532+static const struct ata_port_operations ns87560_pata_ops = {
25533 .inherits = &ns87415_pata_ops,
25534 .sff_tf_read = ns87560_tf_read,
25535 .sff_check_status = ns87560_check_status,
25536diff -urNp linux-2.6.32.46/drivers/ata/pata_octeon_cf.c linux-2.6.32.46/drivers/ata/pata_octeon_cf.c
25537--- linux-2.6.32.46/drivers/ata/pata_octeon_cf.c 2011-03-27 14:31:47.000000000 -0400
25538+++ linux-2.6.32.46/drivers/ata/pata_octeon_cf.c 2011-04-17 15:56:46.000000000 -0400
25539@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
25540 return 0;
25541 }
25542
25543+/* cannot be const */
25544 static struct ata_port_operations octeon_cf_ops = {
25545 .inherits = &ata_sff_port_ops,
25546 .check_atapi_dma = octeon_cf_check_atapi_dma,
25547diff -urNp linux-2.6.32.46/drivers/ata/pata_oldpiix.c linux-2.6.32.46/drivers/ata/pata_oldpiix.c
25548--- linux-2.6.32.46/drivers/ata/pata_oldpiix.c 2011-03-27 14:31:47.000000000 -0400
25549+++ linux-2.6.32.46/drivers/ata/pata_oldpiix.c 2011-04-17 15:56:46.000000000 -0400
25550@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
25551 ATA_BMDMA_SHT(DRV_NAME),
25552 };
25553
25554-static struct ata_port_operations oldpiix_pata_ops = {
25555+static const struct ata_port_operations oldpiix_pata_ops = {
25556 .inherits = &ata_bmdma_port_ops,
25557 .qc_issue = oldpiix_qc_issue,
25558 .cable_detect = ata_cable_40wire,
25559diff -urNp linux-2.6.32.46/drivers/ata/pata_opti.c linux-2.6.32.46/drivers/ata/pata_opti.c
25560--- linux-2.6.32.46/drivers/ata/pata_opti.c 2011-03-27 14:31:47.000000000 -0400
25561+++ linux-2.6.32.46/drivers/ata/pata_opti.c 2011-04-17 15:56:46.000000000 -0400
25562@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
25563 ATA_PIO_SHT(DRV_NAME),
25564 };
25565
25566-static struct ata_port_operations opti_port_ops = {
25567+static const struct ata_port_operations opti_port_ops = {
25568 .inherits = &ata_sff_port_ops,
25569 .cable_detect = ata_cable_40wire,
25570 .set_piomode = opti_set_piomode,
25571diff -urNp linux-2.6.32.46/drivers/ata/pata_optidma.c linux-2.6.32.46/drivers/ata/pata_optidma.c
25572--- linux-2.6.32.46/drivers/ata/pata_optidma.c 2011-03-27 14:31:47.000000000 -0400
25573+++ linux-2.6.32.46/drivers/ata/pata_optidma.c 2011-04-17 15:56:46.000000000 -0400
25574@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
25575 ATA_BMDMA_SHT(DRV_NAME),
25576 };
25577
25578-static struct ata_port_operations optidma_port_ops = {
25579+static const struct ata_port_operations optidma_port_ops = {
25580 .inherits = &ata_bmdma_port_ops,
25581 .cable_detect = ata_cable_40wire,
25582 .set_piomode = optidma_set_pio_mode,
25583@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
25584 .prereset = optidma_pre_reset,
25585 };
25586
25587-static struct ata_port_operations optiplus_port_ops = {
25588+static const struct ata_port_operations optiplus_port_ops = {
25589 .inherits = &optidma_port_ops,
25590 .set_piomode = optiplus_set_pio_mode,
25591 .set_dmamode = optiplus_set_dma_mode,
25592diff -urNp linux-2.6.32.46/drivers/ata/pata_palmld.c linux-2.6.32.46/drivers/ata/pata_palmld.c
25593--- linux-2.6.32.46/drivers/ata/pata_palmld.c 2011-03-27 14:31:47.000000000 -0400
25594+++ linux-2.6.32.46/drivers/ata/pata_palmld.c 2011-04-17 15:56:46.000000000 -0400
25595@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
25596 ATA_PIO_SHT(DRV_NAME),
25597 };
25598
25599-static struct ata_port_operations palmld_port_ops = {
25600+static const struct ata_port_operations palmld_port_ops = {
25601 .inherits = &ata_sff_port_ops,
25602 .sff_data_xfer = ata_sff_data_xfer_noirq,
25603 .cable_detect = ata_cable_40wire,
25604diff -urNp linux-2.6.32.46/drivers/ata/pata_pcmcia.c linux-2.6.32.46/drivers/ata/pata_pcmcia.c
25605--- linux-2.6.32.46/drivers/ata/pata_pcmcia.c 2011-03-27 14:31:47.000000000 -0400
25606+++ linux-2.6.32.46/drivers/ata/pata_pcmcia.c 2011-04-17 15:56:46.000000000 -0400
25607@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
25608 ATA_PIO_SHT(DRV_NAME),
25609 };
25610
25611-static struct ata_port_operations pcmcia_port_ops = {
25612+static const struct ata_port_operations pcmcia_port_ops = {
25613 .inherits = &ata_sff_port_ops,
25614 .sff_data_xfer = ata_sff_data_xfer_noirq,
25615 .cable_detect = ata_cable_40wire,
25616 .set_mode = pcmcia_set_mode,
25617 };
25618
25619-static struct ata_port_operations pcmcia_8bit_port_ops = {
25620+static const struct ata_port_operations pcmcia_8bit_port_ops = {
25621 .inherits = &ata_sff_port_ops,
25622 .sff_data_xfer = ata_data_xfer_8bit,
25623 .cable_detect = ata_cable_40wire,
25624@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
25625 unsigned long io_base, ctl_base;
25626 void __iomem *io_addr, *ctl_addr;
25627 int n_ports = 1;
25628- struct ata_port_operations *ops = &pcmcia_port_ops;
25629+ const struct ata_port_operations *ops = &pcmcia_port_ops;
25630
25631 info = kzalloc(sizeof(*info), GFP_KERNEL);
25632 if (info == NULL)
25633diff -urNp linux-2.6.32.46/drivers/ata/pata_pdc2027x.c linux-2.6.32.46/drivers/ata/pata_pdc2027x.c
25634--- linux-2.6.32.46/drivers/ata/pata_pdc2027x.c 2011-03-27 14:31:47.000000000 -0400
25635+++ linux-2.6.32.46/drivers/ata/pata_pdc2027x.c 2011-04-17 15:56:46.000000000 -0400
25636@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
25637 ATA_BMDMA_SHT(DRV_NAME),
25638 };
25639
25640-static struct ata_port_operations pdc2027x_pata100_ops = {
25641+static const struct ata_port_operations pdc2027x_pata100_ops = {
25642 .inherits = &ata_bmdma_port_ops,
25643 .check_atapi_dma = pdc2027x_check_atapi_dma,
25644 .cable_detect = pdc2027x_cable_detect,
25645 .prereset = pdc2027x_prereset,
25646 };
25647
25648-static struct ata_port_operations pdc2027x_pata133_ops = {
25649+static const struct ata_port_operations pdc2027x_pata133_ops = {
25650 .inherits = &pdc2027x_pata100_ops,
25651 .mode_filter = pdc2027x_mode_filter,
25652 .set_piomode = pdc2027x_set_piomode,
25653diff -urNp linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c
25654--- linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c 2011-03-27 14:31:47.000000000 -0400
25655+++ linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c 2011-04-17 15:56:46.000000000 -0400
25656@@ -274,7 +274,7 @@ static struct scsi_host_template pdc202x
25657 ATA_BMDMA_SHT(DRV_NAME),
25658 };
25659
25660-static struct ata_port_operations pdc2024x_port_ops = {
25661+static const struct ata_port_operations pdc2024x_port_ops = {
25662 .inherits = &ata_bmdma_port_ops,
25663
25664 .cable_detect = ata_cable_40wire,
25665@@ -284,7 +284,7 @@ static struct ata_port_operations pdc202
25666 .sff_exec_command = pdc202xx_exec_command,
25667 };
25668
25669-static struct ata_port_operations pdc2026x_port_ops = {
25670+static const struct ata_port_operations pdc2026x_port_ops = {
25671 .inherits = &pdc2024x_port_ops,
25672
25673 .check_atapi_dma = pdc2026x_check_atapi_dma,
25674diff -urNp linux-2.6.32.46/drivers/ata/pata_platform.c linux-2.6.32.46/drivers/ata/pata_platform.c
25675--- linux-2.6.32.46/drivers/ata/pata_platform.c 2011-03-27 14:31:47.000000000 -0400
25676+++ linux-2.6.32.46/drivers/ata/pata_platform.c 2011-04-17 15:56:46.000000000 -0400
25677@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
25678 ATA_PIO_SHT(DRV_NAME),
25679 };
25680
25681-static struct ata_port_operations pata_platform_port_ops = {
25682+static const struct ata_port_operations pata_platform_port_ops = {
25683 .inherits = &ata_sff_port_ops,
25684 .sff_data_xfer = ata_sff_data_xfer_noirq,
25685 .cable_detect = ata_cable_unknown,
25686diff -urNp linux-2.6.32.46/drivers/ata/pata_qdi.c linux-2.6.32.46/drivers/ata/pata_qdi.c
25687--- linux-2.6.32.46/drivers/ata/pata_qdi.c 2011-03-27 14:31:47.000000000 -0400
25688+++ linux-2.6.32.46/drivers/ata/pata_qdi.c 2011-04-17 15:56:46.000000000 -0400
25689@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
25690 ATA_PIO_SHT(DRV_NAME),
25691 };
25692
25693-static struct ata_port_operations qdi6500_port_ops = {
25694+static const struct ata_port_operations qdi6500_port_ops = {
25695 .inherits = &ata_sff_port_ops,
25696 .qc_issue = qdi_qc_issue,
25697 .sff_data_xfer = qdi_data_xfer,
25698@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
25699 .set_piomode = qdi6500_set_piomode,
25700 };
25701
25702-static struct ata_port_operations qdi6580_port_ops = {
25703+static const struct ata_port_operations qdi6580_port_ops = {
25704 .inherits = &qdi6500_port_ops,
25705 .set_piomode = qdi6580_set_piomode,
25706 };
25707diff -urNp linux-2.6.32.46/drivers/ata/pata_radisys.c linux-2.6.32.46/drivers/ata/pata_radisys.c
25708--- linux-2.6.32.46/drivers/ata/pata_radisys.c 2011-03-27 14:31:47.000000000 -0400
25709+++ linux-2.6.32.46/drivers/ata/pata_radisys.c 2011-04-17 15:56:46.000000000 -0400
25710@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
25711 ATA_BMDMA_SHT(DRV_NAME),
25712 };
25713
25714-static struct ata_port_operations radisys_pata_ops = {
25715+static const struct ata_port_operations radisys_pata_ops = {
25716 .inherits = &ata_bmdma_port_ops,
25717 .qc_issue = radisys_qc_issue,
25718 .cable_detect = ata_cable_unknown,
25719diff -urNp linux-2.6.32.46/drivers/ata/pata_rb532_cf.c linux-2.6.32.46/drivers/ata/pata_rb532_cf.c
25720--- linux-2.6.32.46/drivers/ata/pata_rb532_cf.c 2011-03-27 14:31:47.000000000 -0400
25721+++ linux-2.6.32.46/drivers/ata/pata_rb532_cf.c 2011-04-17 15:56:46.000000000 -0400
25722@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
25723 return IRQ_HANDLED;
25724 }
25725
25726-static struct ata_port_operations rb532_pata_port_ops = {
25727+static const struct ata_port_operations rb532_pata_port_ops = {
25728 .inherits = &ata_sff_port_ops,
25729 .sff_data_xfer = ata_sff_data_xfer32,
25730 };
25731diff -urNp linux-2.6.32.46/drivers/ata/pata_rdc.c linux-2.6.32.46/drivers/ata/pata_rdc.c
25732--- linux-2.6.32.46/drivers/ata/pata_rdc.c 2011-03-27 14:31:47.000000000 -0400
25733+++ linux-2.6.32.46/drivers/ata/pata_rdc.c 2011-04-17 15:56:46.000000000 -0400
25734@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
25735 pci_write_config_byte(dev, 0x48, udma_enable);
25736 }
25737
25738-static struct ata_port_operations rdc_pata_ops = {
25739+static const struct ata_port_operations rdc_pata_ops = {
25740 .inherits = &ata_bmdma32_port_ops,
25741 .cable_detect = rdc_pata_cable_detect,
25742 .set_piomode = rdc_set_piomode,
25743diff -urNp linux-2.6.32.46/drivers/ata/pata_rz1000.c linux-2.6.32.46/drivers/ata/pata_rz1000.c
25744--- linux-2.6.32.46/drivers/ata/pata_rz1000.c 2011-03-27 14:31:47.000000000 -0400
25745+++ linux-2.6.32.46/drivers/ata/pata_rz1000.c 2011-04-17 15:56:46.000000000 -0400
25746@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
25747 ATA_PIO_SHT(DRV_NAME),
25748 };
25749
25750-static struct ata_port_operations rz1000_port_ops = {
25751+static const struct ata_port_operations rz1000_port_ops = {
25752 .inherits = &ata_sff_port_ops,
25753 .cable_detect = ata_cable_40wire,
25754 .set_mode = rz1000_set_mode,
25755diff -urNp linux-2.6.32.46/drivers/ata/pata_sc1200.c linux-2.6.32.46/drivers/ata/pata_sc1200.c
25756--- linux-2.6.32.46/drivers/ata/pata_sc1200.c 2011-03-27 14:31:47.000000000 -0400
25757+++ linux-2.6.32.46/drivers/ata/pata_sc1200.c 2011-04-17 15:56:46.000000000 -0400
25758@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
25759 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25760 };
25761
25762-static struct ata_port_operations sc1200_port_ops = {
25763+static const struct ata_port_operations sc1200_port_ops = {
25764 .inherits = &ata_bmdma_port_ops,
25765 .qc_prep = ata_sff_dumb_qc_prep,
25766 .qc_issue = sc1200_qc_issue,
25767diff -urNp linux-2.6.32.46/drivers/ata/pata_scc.c linux-2.6.32.46/drivers/ata/pata_scc.c
25768--- linux-2.6.32.46/drivers/ata/pata_scc.c 2011-03-27 14:31:47.000000000 -0400
25769+++ linux-2.6.32.46/drivers/ata/pata_scc.c 2011-04-17 15:56:46.000000000 -0400
25770@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
25771 ATA_BMDMA_SHT(DRV_NAME),
25772 };
25773
25774-static struct ata_port_operations scc_pata_ops = {
25775+static const struct ata_port_operations scc_pata_ops = {
25776 .inherits = &ata_bmdma_port_ops,
25777
25778 .set_piomode = scc_set_piomode,
25779diff -urNp linux-2.6.32.46/drivers/ata/pata_sch.c linux-2.6.32.46/drivers/ata/pata_sch.c
25780--- linux-2.6.32.46/drivers/ata/pata_sch.c 2011-03-27 14:31:47.000000000 -0400
25781+++ linux-2.6.32.46/drivers/ata/pata_sch.c 2011-04-17 15:56:46.000000000 -0400
25782@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
25783 ATA_BMDMA_SHT(DRV_NAME),
25784 };
25785
25786-static struct ata_port_operations sch_pata_ops = {
25787+static const struct ata_port_operations sch_pata_ops = {
25788 .inherits = &ata_bmdma_port_ops,
25789 .cable_detect = ata_cable_unknown,
25790 .set_piomode = sch_set_piomode,
25791diff -urNp linux-2.6.32.46/drivers/ata/pata_serverworks.c linux-2.6.32.46/drivers/ata/pata_serverworks.c
25792--- linux-2.6.32.46/drivers/ata/pata_serverworks.c 2011-03-27 14:31:47.000000000 -0400
25793+++ linux-2.6.32.46/drivers/ata/pata_serverworks.c 2011-04-17 15:56:46.000000000 -0400
25794@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
25795 ATA_BMDMA_SHT(DRV_NAME),
25796 };
25797
25798-static struct ata_port_operations serverworks_osb4_port_ops = {
25799+static const struct ata_port_operations serverworks_osb4_port_ops = {
25800 .inherits = &ata_bmdma_port_ops,
25801 .cable_detect = serverworks_cable_detect,
25802 .mode_filter = serverworks_osb4_filter,
25803@@ -307,7 +307,7 @@ static struct ata_port_operations server
25804 .set_dmamode = serverworks_set_dmamode,
25805 };
25806
25807-static struct ata_port_operations serverworks_csb_port_ops = {
25808+static const struct ata_port_operations serverworks_csb_port_ops = {
25809 .inherits = &serverworks_osb4_port_ops,
25810 .mode_filter = serverworks_csb_filter,
25811 };
25812diff -urNp linux-2.6.32.46/drivers/ata/pata_sil680.c linux-2.6.32.46/drivers/ata/pata_sil680.c
25813--- linux-2.6.32.46/drivers/ata/pata_sil680.c 2011-06-25 12:55:34.000000000 -0400
25814+++ linux-2.6.32.46/drivers/ata/pata_sil680.c 2011-06-25 12:56:37.000000000 -0400
25815@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
25816 ATA_BMDMA_SHT(DRV_NAME),
25817 };
25818
25819-static struct ata_port_operations sil680_port_ops = {
25820+static const struct ata_port_operations sil680_port_ops = {
25821 .inherits = &ata_bmdma32_port_ops,
25822 .cable_detect = sil680_cable_detect,
25823 .set_piomode = sil680_set_piomode,
25824diff -urNp linux-2.6.32.46/drivers/ata/pata_sis.c linux-2.6.32.46/drivers/ata/pata_sis.c
25825--- linux-2.6.32.46/drivers/ata/pata_sis.c 2011-03-27 14:31:47.000000000 -0400
25826+++ linux-2.6.32.46/drivers/ata/pata_sis.c 2011-04-17 15:56:46.000000000 -0400
25827@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
25828 ATA_BMDMA_SHT(DRV_NAME),
25829 };
25830
25831-static struct ata_port_operations sis_133_for_sata_ops = {
25832+static const struct ata_port_operations sis_133_for_sata_ops = {
25833 .inherits = &ata_bmdma_port_ops,
25834 .set_piomode = sis_133_set_piomode,
25835 .set_dmamode = sis_133_set_dmamode,
25836 .cable_detect = sis_133_cable_detect,
25837 };
25838
25839-static struct ata_port_operations sis_base_ops = {
25840+static const struct ata_port_operations sis_base_ops = {
25841 .inherits = &ata_bmdma_port_ops,
25842 .prereset = sis_pre_reset,
25843 };
25844
25845-static struct ata_port_operations sis_133_ops = {
25846+static const struct ata_port_operations sis_133_ops = {
25847 .inherits = &sis_base_ops,
25848 .set_piomode = sis_133_set_piomode,
25849 .set_dmamode = sis_133_set_dmamode,
25850 .cable_detect = sis_133_cable_detect,
25851 };
25852
25853-static struct ata_port_operations sis_133_early_ops = {
25854+static const struct ata_port_operations sis_133_early_ops = {
25855 .inherits = &sis_base_ops,
25856 .set_piomode = sis_100_set_piomode,
25857 .set_dmamode = sis_133_early_set_dmamode,
25858 .cable_detect = sis_66_cable_detect,
25859 };
25860
25861-static struct ata_port_operations sis_100_ops = {
25862+static const struct ata_port_operations sis_100_ops = {
25863 .inherits = &sis_base_ops,
25864 .set_piomode = sis_100_set_piomode,
25865 .set_dmamode = sis_100_set_dmamode,
25866 .cable_detect = sis_66_cable_detect,
25867 };
25868
25869-static struct ata_port_operations sis_66_ops = {
25870+static const struct ata_port_operations sis_66_ops = {
25871 .inherits = &sis_base_ops,
25872 .set_piomode = sis_old_set_piomode,
25873 .set_dmamode = sis_66_set_dmamode,
25874 .cable_detect = sis_66_cable_detect,
25875 };
25876
25877-static struct ata_port_operations sis_old_ops = {
25878+static const struct ata_port_operations sis_old_ops = {
25879 .inherits = &sis_base_ops,
25880 .set_piomode = sis_old_set_piomode,
25881 .set_dmamode = sis_old_set_dmamode,
25882diff -urNp linux-2.6.32.46/drivers/ata/pata_sl82c105.c linux-2.6.32.46/drivers/ata/pata_sl82c105.c
25883--- linux-2.6.32.46/drivers/ata/pata_sl82c105.c 2011-03-27 14:31:47.000000000 -0400
25884+++ linux-2.6.32.46/drivers/ata/pata_sl82c105.c 2011-04-17 15:56:46.000000000 -0400
25885@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
25886 ATA_BMDMA_SHT(DRV_NAME),
25887 };
25888
25889-static struct ata_port_operations sl82c105_port_ops = {
25890+static const struct ata_port_operations sl82c105_port_ops = {
25891 .inherits = &ata_bmdma_port_ops,
25892 .qc_defer = sl82c105_qc_defer,
25893 .bmdma_start = sl82c105_bmdma_start,
25894diff -urNp linux-2.6.32.46/drivers/ata/pata_triflex.c linux-2.6.32.46/drivers/ata/pata_triflex.c
25895--- linux-2.6.32.46/drivers/ata/pata_triflex.c 2011-03-27 14:31:47.000000000 -0400
25896+++ linux-2.6.32.46/drivers/ata/pata_triflex.c 2011-04-17 15:56:46.000000000 -0400
25897@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
25898 ATA_BMDMA_SHT(DRV_NAME),
25899 };
25900
25901-static struct ata_port_operations triflex_port_ops = {
25902+static const struct ata_port_operations triflex_port_ops = {
25903 .inherits = &ata_bmdma_port_ops,
25904 .bmdma_start = triflex_bmdma_start,
25905 .bmdma_stop = triflex_bmdma_stop,
25906diff -urNp linux-2.6.32.46/drivers/ata/pata_via.c linux-2.6.32.46/drivers/ata/pata_via.c
25907--- linux-2.6.32.46/drivers/ata/pata_via.c 2011-03-27 14:31:47.000000000 -0400
25908+++ linux-2.6.32.46/drivers/ata/pata_via.c 2011-04-17 15:56:46.000000000 -0400
25909@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
25910 ATA_BMDMA_SHT(DRV_NAME),
25911 };
25912
25913-static struct ata_port_operations via_port_ops = {
25914+static const struct ata_port_operations via_port_ops = {
25915 .inherits = &ata_bmdma_port_ops,
25916 .cable_detect = via_cable_detect,
25917 .set_piomode = via_set_piomode,
25918@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
25919 .port_start = via_port_start,
25920 };
25921
25922-static struct ata_port_operations via_port_ops_noirq = {
25923+static const struct ata_port_operations via_port_ops_noirq = {
25924 .inherits = &via_port_ops,
25925 .sff_data_xfer = ata_sff_data_xfer_noirq,
25926 };
25927diff -urNp linux-2.6.32.46/drivers/ata/pata_winbond.c linux-2.6.32.46/drivers/ata/pata_winbond.c
25928--- linux-2.6.32.46/drivers/ata/pata_winbond.c 2011-03-27 14:31:47.000000000 -0400
25929+++ linux-2.6.32.46/drivers/ata/pata_winbond.c 2011-04-17 15:56:46.000000000 -0400
25930@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
25931 ATA_PIO_SHT(DRV_NAME),
25932 };
25933
25934-static struct ata_port_operations winbond_port_ops = {
25935+static const struct ata_port_operations winbond_port_ops = {
25936 .inherits = &ata_sff_port_ops,
25937 .sff_data_xfer = winbond_data_xfer,
25938 .cable_detect = ata_cable_40wire,
25939diff -urNp linux-2.6.32.46/drivers/ata/pdc_adma.c linux-2.6.32.46/drivers/ata/pdc_adma.c
25940--- linux-2.6.32.46/drivers/ata/pdc_adma.c 2011-03-27 14:31:47.000000000 -0400
25941+++ linux-2.6.32.46/drivers/ata/pdc_adma.c 2011-04-17 15:56:46.000000000 -0400
25942@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
25943 .dma_boundary = ADMA_DMA_BOUNDARY,
25944 };
25945
25946-static struct ata_port_operations adma_ata_ops = {
25947+static const struct ata_port_operations adma_ata_ops = {
25948 .inherits = &ata_sff_port_ops,
25949
25950 .lost_interrupt = ATA_OP_NULL,
25951diff -urNp linux-2.6.32.46/drivers/ata/sata_fsl.c linux-2.6.32.46/drivers/ata/sata_fsl.c
25952--- linux-2.6.32.46/drivers/ata/sata_fsl.c 2011-03-27 14:31:47.000000000 -0400
25953+++ linux-2.6.32.46/drivers/ata/sata_fsl.c 2011-04-17 15:56:46.000000000 -0400
25954@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
25955 .dma_boundary = ATA_DMA_BOUNDARY,
25956 };
25957
25958-static struct ata_port_operations sata_fsl_ops = {
25959+static const struct ata_port_operations sata_fsl_ops = {
25960 .inherits = &sata_pmp_port_ops,
25961
25962 .qc_defer = ata_std_qc_defer,
25963diff -urNp linux-2.6.32.46/drivers/ata/sata_inic162x.c linux-2.6.32.46/drivers/ata/sata_inic162x.c
25964--- linux-2.6.32.46/drivers/ata/sata_inic162x.c 2011-03-27 14:31:47.000000000 -0400
25965+++ linux-2.6.32.46/drivers/ata/sata_inic162x.c 2011-04-17 15:56:46.000000000 -0400
25966@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
25967 return 0;
25968 }
25969
25970-static struct ata_port_operations inic_port_ops = {
25971+static const struct ata_port_operations inic_port_ops = {
25972 .inherits = &sata_port_ops,
25973
25974 .check_atapi_dma = inic_check_atapi_dma,
25975diff -urNp linux-2.6.32.46/drivers/ata/sata_mv.c linux-2.6.32.46/drivers/ata/sata_mv.c
25976--- linux-2.6.32.46/drivers/ata/sata_mv.c 2011-03-27 14:31:47.000000000 -0400
25977+++ linux-2.6.32.46/drivers/ata/sata_mv.c 2011-04-17 15:56:46.000000000 -0400
25978@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
25979 .dma_boundary = MV_DMA_BOUNDARY,
25980 };
25981
25982-static struct ata_port_operations mv5_ops = {
25983+static const struct ata_port_operations mv5_ops = {
25984 .inherits = &ata_sff_port_ops,
25985
25986 .lost_interrupt = ATA_OP_NULL,
25987@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
25988 .port_stop = mv_port_stop,
25989 };
25990
25991-static struct ata_port_operations mv6_ops = {
25992+static const struct ata_port_operations mv6_ops = {
25993 .inherits = &mv5_ops,
25994 .dev_config = mv6_dev_config,
25995 .scr_read = mv_scr_read,
25996@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
25997 .bmdma_status = mv_bmdma_status,
25998 };
25999
26000-static struct ata_port_operations mv_iie_ops = {
26001+static const struct ata_port_operations mv_iie_ops = {
26002 .inherits = &mv6_ops,
26003 .dev_config = ATA_OP_NULL,
26004 .qc_prep = mv_qc_prep_iie,
26005diff -urNp linux-2.6.32.46/drivers/ata/sata_nv.c linux-2.6.32.46/drivers/ata/sata_nv.c
26006--- linux-2.6.32.46/drivers/ata/sata_nv.c 2011-03-27 14:31:47.000000000 -0400
26007+++ linux-2.6.32.46/drivers/ata/sata_nv.c 2011-04-17 15:56:46.000000000 -0400
26008@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
26009 * cases. Define nv_hardreset() which only kicks in for post-boot
26010 * probing and use it for all variants.
26011 */
26012-static struct ata_port_operations nv_generic_ops = {
26013+static const struct ata_port_operations nv_generic_ops = {
26014 .inherits = &ata_bmdma_port_ops,
26015 .lost_interrupt = ATA_OP_NULL,
26016 .scr_read = nv_scr_read,
26017@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
26018 .hardreset = nv_hardreset,
26019 };
26020
26021-static struct ata_port_operations nv_nf2_ops = {
26022+static const struct ata_port_operations nv_nf2_ops = {
26023 .inherits = &nv_generic_ops,
26024 .freeze = nv_nf2_freeze,
26025 .thaw = nv_nf2_thaw,
26026 };
26027
26028-static struct ata_port_operations nv_ck804_ops = {
26029+static const struct ata_port_operations nv_ck804_ops = {
26030 .inherits = &nv_generic_ops,
26031 .freeze = nv_ck804_freeze,
26032 .thaw = nv_ck804_thaw,
26033 .host_stop = nv_ck804_host_stop,
26034 };
26035
26036-static struct ata_port_operations nv_adma_ops = {
26037+static const struct ata_port_operations nv_adma_ops = {
26038 .inherits = &nv_ck804_ops,
26039
26040 .check_atapi_dma = nv_adma_check_atapi_dma,
26041@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
26042 .host_stop = nv_adma_host_stop,
26043 };
26044
26045-static struct ata_port_operations nv_swncq_ops = {
26046+static const struct ata_port_operations nv_swncq_ops = {
26047 .inherits = &nv_generic_ops,
26048
26049 .qc_defer = ata_std_qc_defer,
26050diff -urNp linux-2.6.32.46/drivers/ata/sata_promise.c linux-2.6.32.46/drivers/ata/sata_promise.c
26051--- linux-2.6.32.46/drivers/ata/sata_promise.c 2011-03-27 14:31:47.000000000 -0400
26052+++ linux-2.6.32.46/drivers/ata/sata_promise.c 2011-04-17 15:56:46.000000000 -0400
26053@@ -195,7 +195,7 @@ static const struct ata_port_operations
26054 .error_handler = pdc_error_handler,
26055 };
26056
26057-static struct ata_port_operations pdc_sata_ops = {
26058+static const struct ata_port_operations pdc_sata_ops = {
26059 .inherits = &pdc_common_ops,
26060 .cable_detect = pdc_sata_cable_detect,
26061 .freeze = pdc_sata_freeze,
26062@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
26063
26064 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26065 and ->freeze/thaw that ignore the hotplug controls. */
26066-static struct ata_port_operations pdc_old_sata_ops = {
26067+static const struct ata_port_operations pdc_old_sata_ops = {
26068 .inherits = &pdc_sata_ops,
26069 .freeze = pdc_freeze,
26070 .thaw = pdc_thaw,
26071 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26072 };
26073
26074-static struct ata_port_operations pdc_pata_ops = {
26075+static const struct ata_port_operations pdc_pata_ops = {
26076 .inherits = &pdc_common_ops,
26077 .cable_detect = pdc_pata_cable_detect,
26078 .freeze = pdc_freeze,
26079diff -urNp linux-2.6.32.46/drivers/ata/sata_qstor.c linux-2.6.32.46/drivers/ata/sata_qstor.c
26080--- linux-2.6.32.46/drivers/ata/sata_qstor.c 2011-03-27 14:31:47.000000000 -0400
26081+++ linux-2.6.32.46/drivers/ata/sata_qstor.c 2011-04-17 15:56:46.000000000 -0400
26082@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
26083 .dma_boundary = QS_DMA_BOUNDARY,
26084 };
26085
26086-static struct ata_port_operations qs_ata_ops = {
26087+static const struct ata_port_operations qs_ata_ops = {
26088 .inherits = &ata_sff_port_ops,
26089
26090 .check_atapi_dma = qs_check_atapi_dma,
26091diff -urNp linux-2.6.32.46/drivers/ata/sata_sil24.c linux-2.6.32.46/drivers/ata/sata_sil24.c
26092--- linux-2.6.32.46/drivers/ata/sata_sil24.c 2011-03-27 14:31:47.000000000 -0400
26093+++ linux-2.6.32.46/drivers/ata/sata_sil24.c 2011-04-17 15:56:46.000000000 -0400
26094@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26095 .dma_boundary = ATA_DMA_BOUNDARY,
26096 };
26097
26098-static struct ata_port_operations sil24_ops = {
26099+static const struct ata_port_operations sil24_ops = {
26100 .inherits = &sata_pmp_port_ops,
26101
26102 .qc_defer = sil24_qc_defer,
26103diff -urNp linux-2.6.32.46/drivers/ata/sata_sil.c linux-2.6.32.46/drivers/ata/sata_sil.c
26104--- linux-2.6.32.46/drivers/ata/sata_sil.c 2011-03-27 14:31:47.000000000 -0400
26105+++ linux-2.6.32.46/drivers/ata/sata_sil.c 2011-04-17 15:56:46.000000000 -0400
26106@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
26107 .sg_tablesize = ATA_MAX_PRD
26108 };
26109
26110-static struct ata_port_operations sil_ops = {
26111+static const struct ata_port_operations sil_ops = {
26112 .inherits = &ata_bmdma32_port_ops,
26113 .dev_config = sil_dev_config,
26114 .set_mode = sil_set_mode,
26115diff -urNp linux-2.6.32.46/drivers/ata/sata_sis.c linux-2.6.32.46/drivers/ata/sata_sis.c
26116--- linux-2.6.32.46/drivers/ata/sata_sis.c 2011-03-27 14:31:47.000000000 -0400
26117+++ linux-2.6.32.46/drivers/ata/sata_sis.c 2011-04-17 15:56:46.000000000 -0400
26118@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26119 ATA_BMDMA_SHT(DRV_NAME),
26120 };
26121
26122-static struct ata_port_operations sis_ops = {
26123+static const struct ata_port_operations sis_ops = {
26124 .inherits = &ata_bmdma_port_ops,
26125 .scr_read = sis_scr_read,
26126 .scr_write = sis_scr_write,
26127diff -urNp linux-2.6.32.46/drivers/ata/sata_svw.c linux-2.6.32.46/drivers/ata/sata_svw.c
26128--- linux-2.6.32.46/drivers/ata/sata_svw.c 2011-03-27 14:31:47.000000000 -0400
26129+++ linux-2.6.32.46/drivers/ata/sata_svw.c 2011-04-17 15:56:46.000000000 -0400
26130@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26131 };
26132
26133
26134-static struct ata_port_operations k2_sata_ops = {
26135+static const struct ata_port_operations k2_sata_ops = {
26136 .inherits = &ata_bmdma_port_ops,
26137 .sff_tf_load = k2_sata_tf_load,
26138 .sff_tf_read = k2_sata_tf_read,
26139diff -urNp linux-2.6.32.46/drivers/ata/sata_sx4.c linux-2.6.32.46/drivers/ata/sata_sx4.c
26140--- linux-2.6.32.46/drivers/ata/sata_sx4.c 2011-03-27 14:31:47.000000000 -0400
26141+++ linux-2.6.32.46/drivers/ata/sata_sx4.c 2011-04-17 15:56:46.000000000 -0400
26142@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
26143 };
26144
26145 /* TODO: inherit from base port_ops after converting to new EH */
26146-static struct ata_port_operations pdc_20621_ops = {
26147+static const struct ata_port_operations pdc_20621_ops = {
26148 .inherits = &ata_sff_port_ops,
26149
26150 .check_atapi_dma = pdc_check_atapi_dma,
26151diff -urNp linux-2.6.32.46/drivers/ata/sata_uli.c linux-2.6.32.46/drivers/ata/sata_uli.c
26152--- linux-2.6.32.46/drivers/ata/sata_uli.c 2011-03-27 14:31:47.000000000 -0400
26153+++ linux-2.6.32.46/drivers/ata/sata_uli.c 2011-04-17 15:56:46.000000000 -0400
26154@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
26155 ATA_BMDMA_SHT(DRV_NAME),
26156 };
26157
26158-static struct ata_port_operations uli_ops = {
26159+static const struct ata_port_operations uli_ops = {
26160 .inherits = &ata_bmdma_port_ops,
26161 .scr_read = uli_scr_read,
26162 .scr_write = uli_scr_write,
26163diff -urNp linux-2.6.32.46/drivers/ata/sata_via.c linux-2.6.32.46/drivers/ata/sata_via.c
26164--- linux-2.6.32.46/drivers/ata/sata_via.c 2011-05-10 22:12:01.000000000 -0400
26165+++ linux-2.6.32.46/drivers/ata/sata_via.c 2011-05-10 22:15:08.000000000 -0400
26166@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
26167 ATA_BMDMA_SHT(DRV_NAME),
26168 };
26169
26170-static struct ata_port_operations svia_base_ops = {
26171+static const struct ata_port_operations svia_base_ops = {
26172 .inherits = &ata_bmdma_port_ops,
26173 .sff_tf_load = svia_tf_load,
26174 };
26175
26176-static struct ata_port_operations vt6420_sata_ops = {
26177+static const struct ata_port_operations vt6420_sata_ops = {
26178 .inherits = &svia_base_ops,
26179 .freeze = svia_noop_freeze,
26180 .prereset = vt6420_prereset,
26181 .bmdma_start = vt6420_bmdma_start,
26182 };
26183
26184-static struct ata_port_operations vt6421_pata_ops = {
26185+static const struct ata_port_operations vt6421_pata_ops = {
26186 .inherits = &svia_base_ops,
26187 .cable_detect = vt6421_pata_cable_detect,
26188 .set_piomode = vt6421_set_pio_mode,
26189 .set_dmamode = vt6421_set_dma_mode,
26190 };
26191
26192-static struct ata_port_operations vt6421_sata_ops = {
26193+static const struct ata_port_operations vt6421_sata_ops = {
26194 .inherits = &svia_base_ops,
26195 .scr_read = svia_scr_read,
26196 .scr_write = svia_scr_write,
26197 };
26198
26199-static struct ata_port_operations vt8251_ops = {
26200+static const struct ata_port_operations vt8251_ops = {
26201 .inherits = &svia_base_ops,
26202 .hardreset = sata_std_hardreset,
26203 .scr_read = vt8251_scr_read,
26204diff -urNp linux-2.6.32.46/drivers/ata/sata_vsc.c linux-2.6.32.46/drivers/ata/sata_vsc.c
26205--- linux-2.6.32.46/drivers/ata/sata_vsc.c 2011-03-27 14:31:47.000000000 -0400
26206+++ linux-2.6.32.46/drivers/ata/sata_vsc.c 2011-04-17 15:56:46.000000000 -0400
26207@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
26208 };
26209
26210
26211-static struct ata_port_operations vsc_sata_ops = {
26212+static const struct ata_port_operations vsc_sata_ops = {
26213 .inherits = &ata_bmdma_port_ops,
26214 /* The IRQ handling is not quite standard SFF behaviour so we
26215 cannot use the default lost interrupt handler */
26216diff -urNp linux-2.6.32.46/drivers/atm/adummy.c linux-2.6.32.46/drivers/atm/adummy.c
26217--- linux-2.6.32.46/drivers/atm/adummy.c 2011-03-27 14:31:47.000000000 -0400
26218+++ linux-2.6.32.46/drivers/atm/adummy.c 2011-04-17 15:56:46.000000000 -0400
26219@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
26220 vcc->pop(vcc, skb);
26221 else
26222 dev_kfree_skb_any(skb);
26223- atomic_inc(&vcc->stats->tx);
26224+ atomic_inc_unchecked(&vcc->stats->tx);
26225
26226 return 0;
26227 }
26228diff -urNp linux-2.6.32.46/drivers/atm/ambassador.c linux-2.6.32.46/drivers/atm/ambassador.c
26229--- linux-2.6.32.46/drivers/atm/ambassador.c 2011-03-27 14:31:47.000000000 -0400
26230+++ linux-2.6.32.46/drivers/atm/ambassador.c 2011-04-17 15:56:46.000000000 -0400
26231@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
26232 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26233
26234 // VC layer stats
26235- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26236+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26237
26238 // free the descriptor
26239 kfree (tx_descr);
26240@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev,
26241 dump_skb ("<<<", vc, skb);
26242
26243 // VC layer stats
26244- atomic_inc(&atm_vcc->stats->rx);
26245+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26246 __net_timestamp(skb);
26247 // end of our responsability
26248 atm_vcc->push (atm_vcc, skb);
26249@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev,
26250 } else {
26251 PRINTK (KERN_INFO, "dropped over-size frame");
26252 // should we count this?
26253- atomic_inc(&atm_vcc->stats->rx_drop);
26254+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26255 }
26256
26257 } else {
26258@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
26259 }
26260
26261 if (check_area (skb->data, skb->len)) {
26262- atomic_inc(&atm_vcc->stats->tx_err);
26263+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26264 return -ENOMEM; // ?
26265 }
26266
26267diff -urNp linux-2.6.32.46/drivers/atm/atmtcp.c linux-2.6.32.46/drivers/atm/atmtcp.c
26268--- linux-2.6.32.46/drivers/atm/atmtcp.c 2011-03-27 14:31:47.000000000 -0400
26269+++ linux-2.6.32.46/drivers/atm/atmtcp.c 2011-04-17 15:56:46.000000000 -0400
26270@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
26271 if (vcc->pop) vcc->pop(vcc,skb);
26272 else dev_kfree_skb(skb);
26273 if (dev_data) return 0;
26274- atomic_inc(&vcc->stats->tx_err);
26275+ atomic_inc_unchecked(&vcc->stats->tx_err);
26276 return -ENOLINK;
26277 }
26278 size = skb->len+sizeof(struct atmtcp_hdr);
26279@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc
26280 if (!new_skb) {
26281 if (vcc->pop) vcc->pop(vcc,skb);
26282 else dev_kfree_skb(skb);
26283- atomic_inc(&vcc->stats->tx_err);
26284+ atomic_inc_unchecked(&vcc->stats->tx_err);
26285 return -ENOBUFS;
26286 }
26287 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
26288@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc
26289 if (vcc->pop) vcc->pop(vcc,skb);
26290 else dev_kfree_skb(skb);
26291 out_vcc->push(out_vcc,new_skb);
26292- atomic_inc(&vcc->stats->tx);
26293- atomic_inc(&out_vcc->stats->rx);
26294+ atomic_inc_unchecked(&vcc->stats->tx);
26295+ atomic_inc_unchecked(&out_vcc->stats->rx);
26296 return 0;
26297 }
26298
26299@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc
26300 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26301 read_unlock(&vcc_sklist_lock);
26302 if (!out_vcc) {
26303- atomic_inc(&vcc->stats->tx_err);
26304+ atomic_inc_unchecked(&vcc->stats->tx_err);
26305 goto done;
26306 }
26307 skb_pull(skb,sizeof(struct atmtcp_hdr));
26308@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc
26309 __net_timestamp(new_skb);
26310 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26311 out_vcc->push(out_vcc,new_skb);
26312- atomic_inc(&vcc->stats->tx);
26313- atomic_inc(&out_vcc->stats->rx);
26314+ atomic_inc_unchecked(&vcc->stats->tx);
26315+ atomic_inc_unchecked(&out_vcc->stats->rx);
26316 done:
26317 if (vcc->pop) vcc->pop(vcc,skb);
26318 else dev_kfree_skb(skb);
26319diff -urNp linux-2.6.32.46/drivers/atm/eni.c linux-2.6.32.46/drivers/atm/eni.c
26320--- linux-2.6.32.46/drivers/atm/eni.c 2011-03-27 14:31:47.000000000 -0400
26321+++ linux-2.6.32.46/drivers/atm/eni.c 2011-04-17 15:56:46.000000000 -0400
26322@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
26323 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26324 vcc->dev->number);
26325 length = 0;
26326- atomic_inc(&vcc->stats->rx_err);
26327+ atomic_inc_unchecked(&vcc->stats->rx_err);
26328 }
26329 else {
26330 length = ATM_CELL_SIZE-1; /* no HEC */
26331@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26332 size);
26333 }
26334 eff = length = 0;
26335- atomic_inc(&vcc->stats->rx_err);
26336+ atomic_inc_unchecked(&vcc->stats->rx_err);
26337 }
26338 else {
26339 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
26340@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26341 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26342 vcc->dev->number,vcc->vci,length,size << 2,descr);
26343 length = eff = 0;
26344- atomic_inc(&vcc->stats->rx_err);
26345+ atomic_inc_unchecked(&vcc->stats->rx_err);
26346 }
26347 }
26348 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
26349@@ -770,7 +770,7 @@ rx_dequeued++;
26350 vcc->push(vcc,skb);
26351 pushed++;
26352 }
26353- atomic_inc(&vcc->stats->rx);
26354+ atomic_inc_unchecked(&vcc->stats->rx);
26355 }
26356 wake_up(&eni_dev->rx_wait);
26357 }
26358@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
26359 PCI_DMA_TODEVICE);
26360 if (vcc->pop) vcc->pop(vcc,skb);
26361 else dev_kfree_skb_irq(skb);
26362- atomic_inc(&vcc->stats->tx);
26363+ atomic_inc_unchecked(&vcc->stats->tx);
26364 wake_up(&eni_dev->tx_wait);
26365 dma_complete++;
26366 }
26367diff -urNp linux-2.6.32.46/drivers/atm/firestream.c linux-2.6.32.46/drivers/atm/firestream.c
26368--- linux-2.6.32.46/drivers/atm/firestream.c 2011-03-27 14:31:47.000000000 -0400
26369+++ linux-2.6.32.46/drivers/atm/firestream.c 2011-04-17 15:56:46.000000000 -0400
26370@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
26371 }
26372 }
26373
26374- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26375+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26376
26377 fs_dprintk (FS_DEBUG_TXMEM, "i");
26378 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
26379@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
26380 #endif
26381 skb_put (skb, qe->p1 & 0xffff);
26382 ATM_SKB(skb)->vcc = atm_vcc;
26383- atomic_inc(&atm_vcc->stats->rx);
26384+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26385 __net_timestamp(skb);
26386 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26387 atm_vcc->push (atm_vcc, skb);
26388@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
26389 kfree (pe);
26390 }
26391 if (atm_vcc)
26392- atomic_inc(&atm_vcc->stats->rx_drop);
26393+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26394 break;
26395 case 0x1f: /* Reassembly abort: no buffers. */
26396 /* Silently increment error counter. */
26397 if (atm_vcc)
26398- atomic_inc(&atm_vcc->stats->rx_drop);
26399+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26400 break;
26401 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26402 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
26403diff -urNp linux-2.6.32.46/drivers/atm/fore200e.c linux-2.6.32.46/drivers/atm/fore200e.c
26404--- linux-2.6.32.46/drivers/atm/fore200e.c 2011-03-27 14:31:47.000000000 -0400
26405+++ linux-2.6.32.46/drivers/atm/fore200e.c 2011-04-17 15:56:46.000000000 -0400
26406@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
26407 #endif
26408 /* check error condition */
26409 if (*entry->status & STATUS_ERROR)
26410- atomic_inc(&vcc->stats->tx_err);
26411+ atomic_inc_unchecked(&vcc->stats->tx_err);
26412 else
26413- atomic_inc(&vcc->stats->tx);
26414+ atomic_inc_unchecked(&vcc->stats->tx);
26415 }
26416 }
26417
26418@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
26419 if (skb == NULL) {
26420 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26421
26422- atomic_inc(&vcc->stats->rx_drop);
26423+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26424 return -ENOMEM;
26425 }
26426
26427@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
26428
26429 dev_kfree_skb_any(skb);
26430
26431- atomic_inc(&vcc->stats->rx_drop);
26432+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26433 return -ENOMEM;
26434 }
26435
26436 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26437
26438 vcc->push(vcc, skb);
26439- atomic_inc(&vcc->stats->rx);
26440+ atomic_inc_unchecked(&vcc->stats->rx);
26441
26442 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26443
26444@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
26445 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26446 fore200e->atm_dev->number,
26447 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26448- atomic_inc(&vcc->stats->rx_err);
26449+ atomic_inc_unchecked(&vcc->stats->rx_err);
26450 }
26451 }
26452
26453@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
26454 goto retry_here;
26455 }
26456
26457- atomic_inc(&vcc->stats->tx_err);
26458+ atomic_inc_unchecked(&vcc->stats->tx_err);
26459
26460 fore200e->tx_sat++;
26461 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
26462diff -urNp linux-2.6.32.46/drivers/atm/he.c linux-2.6.32.46/drivers/atm/he.c
26463--- linux-2.6.32.46/drivers/atm/he.c 2011-03-27 14:31:47.000000000 -0400
26464+++ linux-2.6.32.46/drivers/atm/he.c 2011-04-17 15:56:46.000000000 -0400
26465@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26466
26467 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26468 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26469- atomic_inc(&vcc->stats->rx_drop);
26470+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26471 goto return_host_buffers;
26472 }
26473
26474@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26475 RBRQ_LEN_ERR(he_dev->rbrq_head)
26476 ? "LEN_ERR" : "",
26477 vcc->vpi, vcc->vci);
26478- atomic_inc(&vcc->stats->rx_err);
26479+ atomic_inc_unchecked(&vcc->stats->rx_err);
26480 goto return_host_buffers;
26481 }
26482
26483@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26484 vcc->push(vcc, skb);
26485 spin_lock(&he_dev->global_lock);
26486
26487- atomic_inc(&vcc->stats->rx);
26488+ atomic_inc_unchecked(&vcc->stats->rx);
26489
26490 return_host_buffers:
26491 ++pdus_assembled;
26492@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
26493 tpd->vcc->pop(tpd->vcc, tpd->skb);
26494 else
26495 dev_kfree_skb_any(tpd->skb);
26496- atomic_inc(&tpd->vcc->stats->tx_err);
26497+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
26498 }
26499 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
26500 return;
26501@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26502 vcc->pop(vcc, skb);
26503 else
26504 dev_kfree_skb_any(skb);
26505- atomic_inc(&vcc->stats->tx_err);
26506+ atomic_inc_unchecked(&vcc->stats->tx_err);
26507 return -EINVAL;
26508 }
26509
26510@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26511 vcc->pop(vcc, skb);
26512 else
26513 dev_kfree_skb_any(skb);
26514- atomic_inc(&vcc->stats->tx_err);
26515+ atomic_inc_unchecked(&vcc->stats->tx_err);
26516 return -EINVAL;
26517 }
26518 #endif
26519@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26520 vcc->pop(vcc, skb);
26521 else
26522 dev_kfree_skb_any(skb);
26523- atomic_inc(&vcc->stats->tx_err);
26524+ atomic_inc_unchecked(&vcc->stats->tx_err);
26525 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26526 return -ENOMEM;
26527 }
26528@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26529 vcc->pop(vcc, skb);
26530 else
26531 dev_kfree_skb_any(skb);
26532- atomic_inc(&vcc->stats->tx_err);
26533+ atomic_inc_unchecked(&vcc->stats->tx_err);
26534 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26535 return -ENOMEM;
26536 }
26537@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26538 __enqueue_tpd(he_dev, tpd, cid);
26539 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26540
26541- atomic_inc(&vcc->stats->tx);
26542+ atomic_inc_unchecked(&vcc->stats->tx);
26543
26544 return 0;
26545 }
26546diff -urNp linux-2.6.32.46/drivers/atm/horizon.c linux-2.6.32.46/drivers/atm/horizon.c
26547--- linux-2.6.32.46/drivers/atm/horizon.c 2011-03-27 14:31:47.000000000 -0400
26548+++ linux-2.6.32.46/drivers/atm/horizon.c 2011-04-17 15:56:46.000000000 -0400
26549@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
26550 {
26551 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
26552 // VC layer stats
26553- atomic_inc(&vcc->stats->rx);
26554+ atomic_inc_unchecked(&vcc->stats->rx);
26555 __net_timestamp(skb);
26556 // end of our responsability
26557 vcc->push (vcc, skb);
26558@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
26559 dev->tx_iovec = NULL;
26560
26561 // VC layer stats
26562- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26563+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26564
26565 // free the skb
26566 hrz_kfree_skb (skb);
26567diff -urNp linux-2.6.32.46/drivers/atm/idt77252.c linux-2.6.32.46/drivers/atm/idt77252.c
26568--- linux-2.6.32.46/drivers/atm/idt77252.c 2011-03-27 14:31:47.000000000 -0400
26569+++ linux-2.6.32.46/drivers/atm/idt77252.c 2011-04-17 15:56:46.000000000 -0400
26570@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
26571 else
26572 dev_kfree_skb(skb);
26573
26574- atomic_inc(&vcc->stats->tx);
26575+ atomic_inc_unchecked(&vcc->stats->tx);
26576 }
26577
26578 atomic_dec(&scq->used);
26579@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
26580 if ((sb = dev_alloc_skb(64)) == NULL) {
26581 printk("%s: Can't allocate buffers for aal0.\n",
26582 card->name);
26583- atomic_add(i, &vcc->stats->rx_drop);
26584+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
26585 break;
26586 }
26587 if (!atm_charge(vcc, sb->truesize)) {
26588 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
26589 card->name);
26590- atomic_add(i - 1, &vcc->stats->rx_drop);
26591+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
26592 dev_kfree_skb(sb);
26593 break;
26594 }
26595@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
26596 ATM_SKB(sb)->vcc = vcc;
26597 __net_timestamp(sb);
26598 vcc->push(vcc, sb);
26599- atomic_inc(&vcc->stats->rx);
26600+ atomic_inc_unchecked(&vcc->stats->rx);
26601
26602 cell += ATM_CELL_PAYLOAD;
26603 }
26604@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
26605 "(CDC: %08x)\n",
26606 card->name, len, rpp->len, readl(SAR_REG_CDC));
26607 recycle_rx_pool_skb(card, rpp);
26608- atomic_inc(&vcc->stats->rx_err);
26609+ atomic_inc_unchecked(&vcc->stats->rx_err);
26610 return;
26611 }
26612 if (stat & SAR_RSQE_CRC) {
26613 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
26614 recycle_rx_pool_skb(card, rpp);
26615- atomic_inc(&vcc->stats->rx_err);
26616+ atomic_inc_unchecked(&vcc->stats->rx_err);
26617 return;
26618 }
26619 if (skb_queue_len(&rpp->queue) > 1) {
26620@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
26621 RXPRINTK("%s: Can't alloc RX skb.\n",
26622 card->name);
26623 recycle_rx_pool_skb(card, rpp);
26624- atomic_inc(&vcc->stats->rx_err);
26625+ atomic_inc_unchecked(&vcc->stats->rx_err);
26626 return;
26627 }
26628 if (!atm_charge(vcc, skb->truesize)) {
26629@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
26630 __net_timestamp(skb);
26631
26632 vcc->push(vcc, skb);
26633- atomic_inc(&vcc->stats->rx);
26634+ atomic_inc_unchecked(&vcc->stats->rx);
26635
26636 return;
26637 }
26638@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
26639 __net_timestamp(skb);
26640
26641 vcc->push(vcc, skb);
26642- atomic_inc(&vcc->stats->rx);
26643+ atomic_inc_unchecked(&vcc->stats->rx);
26644
26645 if (skb->truesize > SAR_FB_SIZE_3)
26646 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
26647@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
26648 if (vcc->qos.aal != ATM_AAL0) {
26649 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
26650 card->name, vpi, vci);
26651- atomic_inc(&vcc->stats->rx_drop);
26652+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26653 goto drop;
26654 }
26655
26656 if ((sb = dev_alloc_skb(64)) == NULL) {
26657 printk("%s: Can't allocate buffers for AAL0.\n",
26658 card->name);
26659- atomic_inc(&vcc->stats->rx_err);
26660+ atomic_inc_unchecked(&vcc->stats->rx_err);
26661 goto drop;
26662 }
26663
26664@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
26665 ATM_SKB(sb)->vcc = vcc;
26666 __net_timestamp(sb);
26667 vcc->push(vcc, sb);
26668- atomic_inc(&vcc->stats->rx);
26669+ atomic_inc_unchecked(&vcc->stats->rx);
26670
26671 drop:
26672 skb_pull(queue, 64);
26673@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26674
26675 if (vc == NULL) {
26676 printk("%s: NULL connection in send().\n", card->name);
26677- atomic_inc(&vcc->stats->tx_err);
26678+ atomic_inc_unchecked(&vcc->stats->tx_err);
26679 dev_kfree_skb(skb);
26680 return -EINVAL;
26681 }
26682 if (!test_bit(VCF_TX, &vc->flags)) {
26683 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
26684- atomic_inc(&vcc->stats->tx_err);
26685+ atomic_inc_unchecked(&vcc->stats->tx_err);
26686 dev_kfree_skb(skb);
26687 return -EINVAL;
26688 }
26689@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26690 break;
26691 default:
26692 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
26693- atomic_inc(&vcc->stats->tx_err);
26694+ atomic_inc_unchecked(&vcc->stats->tx_err);
26695 dev_kfree_skb(skb);
26696 return -EINVAL;
26697 }
26698
26699 if (skb_shinfo(skb)->nr_frags != 0) {
26700 printk("%s: No scatter-gather yet.\n", card->name);
26701- atomic_inc(&vcc->stats->tx_err);
26702+ atomic_inc_unchecked(&vcc->stats->tx_err);
26703 dev_kfree_skb(skb);
26704 return -EINVAL;
26705 }
26706@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26707
26708 err = queue_skb(card, vc, skb, oam);
26709 if (err) {
26710- atomic_inc(&vcc->stats->tx_err);
26711+ atomic_inc_unchecked(&vcc->stats->tx_err);
26712 dev_kfree_skb(skb);
26713 return err;
26714 }
26715@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
26716 skb = dev_alloc_skb(64);
26717 if (!skb) {
26718 printk("%s: Out of memory in send_oam().\n", card->name);
26719- atomic_inc(&vcc->stats->tx_err);
26720+ atomic_inc_unchecked(&vcc->stats->tx_err);
26721 return -ENOMEM;
26722 }
26723 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
26724diff -urNp linux-2.6.32.46/drivers/atm/iphase.c linux-2.6.32.46/drivers/atm/iphase.c
26725--- linux-2.6.32.46/drivers/atm/iphase.c 2011-03-27 14:31:47.000000000 -0400
26726+++ linux-2.6.32.46/drivers/atm/iphase.c 2011-04-17 15:56:46.000000000 -0400
26727@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
26728 status = (u_short) (buf_desc_ptr->desc_mode);
26729 if (status & (RX_CER | RX_PTE | RX_OFL))
26730 {
26731- atomic_inc(&vcc->stats->rx_err);
26732+ atomic_inc_unchecked(&vcc->stats->rx_err);
26733 IF_ERR(printk("IA: bad packet, dropping it");)
26734 if (status & RX_CER) {
26735 IF_ERR(printk(" cause: packet CRC error\n");)
26736@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
26737 len = dma_addr - buf_addr;
26738 if (len > iadev->rx_buf_sz) {
26739 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
26740- atomic_inc(&vcc->stats->rx_err);
26741+ atomic_inc_unchecked(&vcc->stats->rx_err);
26742 goto out_free_desc;
26743 }
26744
26745@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
26746 ia_vcc = INPH_IA_VCC(vcc);
26747 if (ia_vcc == NULL)
26748 {
26749- atomic_inc(&vcc->stats->rx_err);
26750+ atomic_inc_unchecked(&vcc->stats->rx_err);
26751 dev_kfree_skb_any(skb);
26752 atm_return(vcc, atm_guess_pdu2truesize(len));
26753 goto INCR_DLE;
26754@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
26755 if ((length > iadev->rx_buf_sz) || (length >
26756 (skb->len - sizeof(struct cpcs_trailer))))
26757 {
26758- atomic_inc(&vcc->stats->rx_err);
26759+ atomic_inc_unchecked(&vcc->stats->rx_err);
26760 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
26761 length, skb->len);)
26762 dev_kfree_skb_any(skb);
26763@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
26764
26765 IF_RX(printk("rx_dle_intr: skb push");)
26766 vcc->push(vcc,skb);
26767- atomic_inc(&vcc->stats->rx);
26768+ atomic_inc_unchecked(&vcc->stats->rx);
26769 iadev->rx_pkt_cnt++;
26770 }
26771 INCR_DLE:
26772@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
26773 {
26774 struct k_sonet_stats *stats;
26775 stats = &PRIV(_ia_dev[board])->sonet_stats;
26776- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
26777- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
26778- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
26779- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
26780- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
26781- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
26782- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
26783- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
26784- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
26785+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
26786+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
26787+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
26788+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
26789+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
26790+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
26791+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
26792+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
26793+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
26794 }
26795 ia_cmds.status = 0;
26796 break;
26797@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
26798 if ((desc == 0) || (desc > iadev->num_tx_desc))
26799 {
26800 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
26801- atomic_inc(&vcc->stats->tx);
26802+ atomic_inc_unchecked(&vcc->stats->tx);
26803 if (vcc->pop)
26804 vcc->pop(vcc, skb);
26805 else
26806@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
26807 ATM_DESC(skb) = vcc->vci;
26808 skb_queue_tail(&iadev->tx_dma_q, skb);
26809
26810- atomic_inc(&vcc->stats->tx);
26811+ atomic_inc_unchecked(&vcc->stats->tx);
26812 iadev->tx_pkt_cnt++;
26813 /* Increment transaction counter */
26814 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
26815
26816 #if 0
26817 /* add flow control logic */
26818- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
26819+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
26820 if (iavcc->vc_desc_cnt > 10) {
26821 vcc->tx_quota = vcc->tx_quota * 3 / 4;
26822 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
26823diff -urNp linux-2.6.32.46/drivers/atm/lanai.c linux-2.6.32.46/drivers/atm/lanai.c
26824--- linux-2.6.32.46/drivers/atm/lanai.c 2011-03-27 14:31:47.000000000 -0400
26825+++ linux-2.6.32.46/drivers/atm/lanai.c 2011-04-17 15:56:46.000000000 -0400
26826@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
26827 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
26828 lanai_endtx(lanai, lvcc);
26829 lanai_free_skb(lvcc->tx.atmvcc, skb);
26830- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
26831+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
26832 }
26833
26834 /* Try to fill the buffer - don't call unless there is backlog */
26835@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
26836 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
26837 __net_timestamp(skb);
26838 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
26839- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
26840+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
26841 out:
26842 lvcc->rx.buf.ptr = end;
26843 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
26844@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
26845 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
26846 "vcc %d\n", lanai->number, (unsigned int) s, vci);
26847 lanai->stats.service_rxnotaal5++;
26848- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
26849+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
26850 return 0;
26851 }
26852 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
26853@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
26854 int bytes;
26855 read_unlock(&vcc_sklist_lock);
26856 DPRINTK("got trashed rx pdu on vci %d\n", vci);
26857- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
26858+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
26859 lvcc->stats.x.aal5.service_trash++;
26860 bytes = (SERVICE_GET_END(s) * 16) -
26861 (((unsigned long) lvcc->rx.buf.ptr) -
26862@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
26863 }
26864 if (s & SERVICE_STREAM) {
26865 read_unlock(&vcc_sklist_lock);
26866- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
26867+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
26868 lvcc->stats.x.aal5.service_stream++;
26869 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
26870 "PDU on VCI %d!\n", lanai->number, vci);
26871@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
26872 return 0;
26873 }
26874 DPRINTK("got rx crc error on vci %d\n", vci);
26875- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
26876+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
26877 lvcc->stats.x.aal5.service_rxcrc++;
26878 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
26879 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
26880diff -urNp linux-2.6.32.46/drivers/atm/nicstar.c linux-2.6.32.46/drivers/atm/nicstar.c
26881--- linux-2.6.32.46/drivers/atm/nicstar.c 2011-03-27 14:31:47.000000000 -0400
26882+++ linux-2.6.32.46/drivers/atm/nicstar.c 2011-04-17 15:56:46.000000000 -0400
26883@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
26884 if ((vc = (vc_map *) vcc->dev_data) == NULL)
26885 {
26886 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
26887- atomic_inc(&vcc->stats->tx_err);
26888+ atomic_inc_unchecked(&vcc->stats->tx_err);
26889 dev_kfree_skb_any(skb);
26890 return -EINVAL;
26891 }
26892@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc,
26893 if (!vc->tx)
26894 {
26895 printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
26896- atomic_inc(&vcc->stats->tx_err);
26897+ atomic_inc_unchecked(&vcc->stats->tx_err);
26898 dev_kfree_skb_any(skb);
26899 return -EINVAL;
26900 }
26901@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc,
26902 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
26903 {
26904 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
26905- atomic_inc(&vcc->stats->tx_err);
26906+ atomic_inc_unchecked(&vcc->stats->tx_err);
26907 dev_kfree_skb_any(skb);
26908 return -EINVAL;
26909 }
26910@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc,
26911 if (skb_shinfo(skb)->nr_frags != 0)
26912 {
26913 printk("nicstar%d: No scatter-gather yet.\n", card->index);
26914- atomic_inc(&vcc->stats->tx_err);
26915+ atomic_inc_unchecked(&vcc->stats->tx_err);
26916 dev_kfree_skb_any(skb);
26917 return -EINVAL;
26918 }
26919@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc,
26920
26921 if (push_scqe(card, vc, scq, &scqe, skb) != 0)
26922 {
26923- atomic_inc(&vcc->stats->tx_err);
26924+ atomic_inc_unchecked(&vcc->stats->tx_err);
26925 dev_kfree_skb_any(skb);
26926 return -EIO;
26927 }
26928- atomic_inc(&vcc->stats->tx);
26929+ atomic_inc_unchecked(&vcc->stats->tx);
26930
26931 return 0;
26932 }
26933@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
26934 {
26935 printk("nicstar%d: Can't allocate buffers for aal0.\n",
26936 card->index);
26937- atomic_add(i,&vcc->stats->rx_drop);
26938+ atomic_add_unchecked(i,&vcc->stats->rx_drop);
26939 break;
26940 }
26941 if (!atm_charge(vcc, sb->truesize))
26942 {
26943 RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
26944 card->index);
26945- atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
26946+ atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
26947 dev_kfree_skb_any(sb);
26948 break;
26949 }
26950@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
26951 ATM_SKB(sb)->vcc = vcc;
26952 __net_timestamp(sb);
26953 vcc->push(vcc, sb);
26954- atomic_inc(&vcc->stats->rx);
26955+ atomic_inc_unchecked(&vcc->stats->rx);
26956 cell += ATM_CELL_PAYLOAD;
26957 }
26958
26959@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
26960 if (iovb == NULL)
26961 {
26962 printk("nicstar%d: Out of iovec buffers.\n", card->index);
26963- atomic_inc(&vcc->stats->rx_drop);
26964+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26965 recycle_rx_buf(card, skb);
26966 return;
26967 }
26968@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
26969 else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
26970 {
26971 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
26972- atomic_inc(&vcc->stats->rx_err);
26973+ atomic_inc_unchecked(&vcc->stats->rx_err);
26974 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
26975 NS_SKB(iovb)->iovcnt = 0;
26976 iovb->len = 0;
26977@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
26978 printk("nicstar%d: Expected a small buffer, and this is not one.\n",
26979 card->index);
26980 which_list(card, skb);
26981- atomic_inc(&vcc->stats->rx_err);
26982+ atomic_inc_unchecked(&vcc->stats->rx_err);
26983 recycle_rx_buf(card, skb);
26984 vc->rx_iov = NULL;
26985 recycle_iov_buf(card, iovb);
26986@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
26987 printk("nicstar%d: Expected a large buffer, and this is not one.\n",
26988 card->index);
26989 which_list(card, skb);
26990- atomic_inc(&vcc->stats->rx_err);
26991+ atomic_inc_unchecked(&vcc->stats->rx_err);
26992 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
26993 NS_SKB(iovb)->iovcnt);
26994 vc->rx_iov = NULL;
26995@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
26996 printk(" - PDU size mismatch.\n");
26997 else
26998 printk(".\n");
26999- atomic_inc(&vcc->stats->rx_err);
27000+ atomic_inc_unchecked(&vcc->stats->rx_err);
27001 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
27002 NS_SKB(iovb)->iovcnt);
27003 vc->rx_iov = NULL;
27004@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
27005 if (!atm_charge(vcc, skb->truesize))
27006 {
27007 push_rxbufs(card, skb);
27008- atomic_inc(&vcc->stats->rx_drop);
27009+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27010 }
27011 else
27012 {
27013@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
27014 ATM_SKB(skb)->vcc = vcc;
27015 __net_timestamp(skb);
27016 vcc->push(vcc, skb);
27017- atomic_inc(&vcc->stats->rx);
27018+ atomic_inc_unchecked(&vcc->stats->rx);
27019 }
27020 }
27021 else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
27022@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
27023 if (!atm_charge(vcc, sb->truesize))
27024 {
27025 push_rxbufs(card, sb);
27026- atomic_inc(&vcc->stats->rx_drop);
27027+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27028 }
27029 else
27030 {
27031@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
27032 ATM_SKB(sb)->vcc = vcc;
27033 __net_timestamp(sb);
27034 vcc->push(vcc, sb);
27035- atomic_inc(&vcc->stats->rx);
27036+ atomic_inc_unchecked(&vcc->stats->rx);
27037 }
27038
27039 push_rxbufs(card, skb);
27040@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
27041 if (!atm_charge(vcc, skb->truesize))
27042 {
27043 push_rxbufs(card, skb);
27044- atomic_inc(&vcc->stats->rx_drop);
27045+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27046 }
27047 else
27048 {
27049@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
27050 ATM_SKB(skb)->vcc = vcc;
27051 __net_timestamp(skb);
27052 vcc->push(vcc, skb);
27053- atomic_inc(&vcc->stats->rx);
27054+ atomic_inc_unchecked(&vcc->stats->rx);
27055 }
27056
27057 push_rxbufs(card, sb);
27058@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
27059 if (hb == NULL)
27060 {
27061 printk("nicstar%d: Out of huge buffers.\n", card->index);
27062- atomic_inc(&vcc->stats->rx_drop);
27063+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27064 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
27065 NS_SKB(iovb)->iovcnt);
27066 vc->rx_iov = NULL;
27067@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
27068 }
27069 else
27070 dev_kfree_skb_any(hb);
27071- atomic_inc(&vcc->stats->rx_drop);
27072+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27073 }
27074 else
27075 {
27076@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
27077 #endif /* NS_USE_DESTRUCTORS */
27078 __net_timestamp(hb);
27079 vcc->push(vcc, hb);
27080- atomic_inc(&vcc->stats->rx);
27081+ atomic_inc_unchecked(&vcc->stats->rx);
27082 }
27083 }
27084
27085diff -urNp linux-2.6.32.46/drivers/atm/solos-pci.c linux-2.6.32.46/drivers/atm/solos-pci.c
27086--- linux-2.6.32.46/drivers/atm/solos-pci.c 2011-04-17 17:00:52.000000000 -0400
27087+++ linux-2.6.32.46/drivers/atm/solos-pci.c 2011-05-16 21:46:57.000000000 -0400
27088@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
27089 }
27090 atm_charge(vcc, skb->truesize);
27091 vcc->push(vcc, skb);
27092- atomic_inc(&vcc->stats->rx);
27093+ atomic_inc_unchecked(&vcc->stats->rx);
27094 break;
27095
27096 case PKT_STATUS:
27097@@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *
27098 char msg[500];
27099 char item[10];
27100
27101+ pax_track_stack();
27102+
27103 len = buf->len;
27104 for (i = 0; i < len; i++){
27105 if(i % 8 == 0)
27106@@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_car
27107 vcc = SKB_CB(oldskb)->vcc;
27108
27109 if (vcc) {
27110- atomic_inc(&vcc->stats->tx);
27111+ atomic_inc_unchecked(&vcc->stats->tx);
27112 solos_pop(vcc, oldskb);
27113 } else
27114 dev_kfree_skb_irq(oldskb);
27115diff -urNp linux-2.6.32.46/drivers/atm/suni.c linux-2.6.32.46/drivers/atm/suni.c
27116--- linux-2.6.32.46/drivers/atm/suni.c 2011-03-27 14:31:47.000000000 -0400
27117+++ linux-2.6.32.46/drivers/atm/suni.c 2011-04-17 15:56:46.000000000 -0400
27118@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27119
27120
27121 #define ADD_LIMITED(s,v) \
27122- atomic_add((v),&stats->s); \
27123- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27124+ atomic_add_unchecked((v),&stats->s); \
27125+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27126
27127
27128 static void suni_hz(unsigned long from_timer)
27129diff -urNp linux-2.6.32.46/drivers/atm/uPD98402.c linux-2.6.32.46/drivers/atm/uPD98402.c
27130--- linux-2.6.32.46/drivers/atm/uPD98402.c 2011-03-27 14:31:47.000000000 -0400
27131+++ linux-2.6.32.46/drivers/atm/uPD98402.c 2011-04-17 15:56:46.000000000 -0400
27132@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
27133 struct sonet_stats tmp;
27134 int error = 0;
27135
27136- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27137+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27138 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27139 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27140 if (zero && !error) {
27141@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
27142
27143
27144 #define ADD_LIMITED(s,v) \
27145- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27146- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27147- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27148+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27149+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27150+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27151
27152
27153 static void stat_event(struct atm_dev *dev)
27154@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev
27155 if (reason & uPD98402_INT_PFM) stat_event(dev);
27156 if (reason & uPD98402_INT_PCO) {
27157 (void) GET(PCOCR); /* clear interrupt cause */
27158- atomic_add(GET(HECCT),
27159+ atomic_add_unchecked(GET(HECCT),
27160 &PRIV(dev)->sonet_stats.uncorr_hcs);
27161 }
27162 if ((reason & uPD98402_INT_RFO) &&
27163@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
27164 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27165 uPD98402_INT_LOS),PIMR); /* enable them */
27166 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27167- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27168- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27169- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27170+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27171+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27172+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27173 return 0;
27174 }
27175
27176diff -urNp linux-2.6.32.46/drivers/atm/zatm.c linux-2.6.32.46/drivers/atm/zatm.c
27177--- linux-2.6.32.46/drivers/atm/zatm.c 2011-03-27 14:31:47.000000000 -0400
27178+++ linux-2.6.32.46/drivers/atm/zatm.c 2011-04-17 15:56:46.000000000 -0400
27179@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27180 }
27181 if (!size) {
27182 dev_kfree_skb_irq(skb);
27183- if (vcc) atomic_inc(&vcc->stats->rx_err);
27184+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27185 continue;
27186 }
27187 if (!atm_charge(vcc,skb->truesize)) {
27188@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27189 skb->len = size;
27190 ATM_SKB(skb)->vcc = vcc;
27191 vcc->push(vcc,skb);
27192- atomic_inc(&vcc->stats->rx);
27193+ atomic_inc_unchecked(&vcc->stats->rx);
27194 }
27195 zout(pos & 0xffff,MTA(mbx));
27196 #if 0 /* probably a stupid idea */
27197@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
27198 skb_queue_head(&zatm_vcc->backlog,skb);
27199 break;
27200 }
27201- atomic_inc(&vcc->stats->tx);
27202+ atomic_inc_unchecked(&vcc->stats->tx);
27203 wake_up(&zatm_vcc->tx_wait);
27204 }
27205
27206diff -urNp linux-2.6.32.46/drivers/base/bus.c linux-2.6.32.46/drivers/base/bus.c
27207--- linux-2.6.32.46/drivers/base/bus.c 2011-03-27 14:31:47.000000000 -0400
27208+++ linux-2.6.32.46/drivers/base/bus.c 2011-04-17 15:56:46.000000000 -0400
27209@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
27210 return ret;
27211 }
27212
27213-static struct sysfs_ops driver_sysfs_ops = {
27214+static const struct sysfs_ops driver_sysfs_ops = {
27215 .show = drv_attr_show,
27216 .store = drv_attr_store,
27217 };
27218@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
27219 return ret;
27220 }
27221
27222-static struct sysfs_ops bus_sysfs_ops = {
27223+static const struct sysfs_ops bus_sysfs_ops = {
27224 .show = bus_attr_show,
27225 .store = bus_attr_store,
27226 };
27227@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
27228 return 0;
27229 }
27230
27231-static struct kset_uevent_ops bus_uevent_ops = {
27232+static const struct kset_uevent_ops bus_uevent_ops = {
27233 .filter = bus_uevent_filter,
27234 };
27235
27236diff -urNp linux-2.6.32.46/drivers/base/class.c linux-2.6.32.46/drivers/base/class.c
27237--- linux-2.6.32.46/drivers/base/class.c 2011-03-27 14:31:47.000000000 -0400
27238+++ linux-2.6.32.46/drivers/base/class.c 2011-04-17 15:56:46.000000000 -0400
27239@@ -63,7 +63,7 @@ static void class_release(struct kobject
27240 kfree(cp);
27241 }
27242
27243-static struct sysfs_ops class_sysfs_ops = {
27244+static const struct sysfs_ops class_sysfs_ops = {
27245 .show = class_attr_show,
27246 .store = class_attr_store,
27247 };
27248diff -urNp linux-2.6.32.46/drivers/base/core.c linux-2.6.32.46/drivers/base/core.c
27249--- linux-2.6.32.46/drivers/base/core.c 2011-03-27 14:31:47.000000000 -0400
27250+++ linux-2.6.32.46/drivers/base/core.c 2011-04-17 15:56:46.000000000 -0400
27251@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
27252 return ret;
27253 }
27254
27255-static struct sysfs_ops dev_sysfs_ops = {
27256+static const struct sysfs_ops dev_sysfs_ops = {
27257 .show = dev_attr_show,
27258 .store = dev_attr_store,
27259 };
27260@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
27261 return retval;
27262 }
27263
27264-static struct kset_uevent_ops device_uevent_ops = {
27265+static const struct kset_uevent_ops device_uevent_ops = {
27266 .filter = dev_uevent_filter,
27267 .name = dev_uevent_name,
27268 .uevent = dev_uevent,
27269diff -urNp linux-2.6.32.46/drivers/base/memory.c linux-2.6.32.46/drivers/base/memory.c
27270--- linux-2.6.32.46/drivers/base/memory.c 2011-03-27 14:31:47.000000000 -0400
27271+++ linux-2.6.32.46/drivers/base/memory.c 2011-04-17 15:56:46.000000000 -0400
27272@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
27273 return retval;
27274 }
27275
27276-static struct kset_uevent_ops memory_uevent_ops = {
27277+static const struct kset_uevent_ops memory_uevent_ops = {
27278 .name = memory_uevent_name,
27279 .uevent = memory_uevent,
27280 };
27281diff -urNp linux-2.6.32.46/drivers/base/sys.c linux-2.6.32.46/drivers/base/sys.c
27282--- linux-2.6.32.46/drivers/base/sys.c 2011-03-27 14:31:47.000000000 -0400
27283+++ linux-2.6.32.46/drivers/base/sys.c 2011-04-17 15:56:46.000000000 -0400
27284@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
27285 return -EIO;
27286 }
27287
27288-static struct sysfs_ops sysfs_ops = {
27289+static const struct sysfs_ops sysfs_ops = {
27290 .show = sysdev_show,
27291 .store = sysdev_store,
27292 };
27293@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
27294 return -EIO;
27295 }
27296
27297-static struct sysfs_ops sysfs_class_ops = {
27298+static const struct sysfs_ops sysfs_class_ops = {
27299 .show = sysdev_class_show,
27300 .store = sysdev_class_store,
27301 };
27302diff -urNp linux-2.6.32.46/drivers/block/cciss.c linux-2.6.32.46/drivers/block/cciss.c
27303--- linux-2.6.32.46/drivers/block/cciss.c 2011-03-27 14:31:47.000000000 -0400
27304+++ linux-2.6.32.46/drivers/block/cciss.c 2011-08-05 20:33:55.000000000 -0400
27305@@ -1011,6 +1011,8 @@ static int cciss_ioctl32_passthru(struct
27306 int err;
27307 u32 cp;
27308
27309+ memset(&arg64, 0, sizeof(arg64));
27310+
27311 err = 0;
27312 err |=
27313 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
27314@@ -2852,7 +2854,7 @@ static unsigned long pollcomplete(int ct
27315 /* Wait (up to 20 seconds) for a command to complete */
27316
27317 for (i = 20 * HZ; i > 0; i--) {
27318- done = hba[ctlr]->access.command_completed(hba[ctlr]);
27319+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
27320 if (done == FIFO_EMPTY)
27321 schedule_timeout_uninterruptible(1);
27322 else
27323@@ -2876,7 +2878,7 @@ static int sendcmd_core(ctlr_info_t *h,
27324 resend_cmd1:
27325
27326 /* Disable interrupt on the board. */
27327- h->access.set_intr_mask(h, CCISS_INTR_OFF);
27328+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
27329
27330 /* Make sure there is room in the command FIFO */
27331 /* Actually it should be completely empty at this time */
27332@@ -2884,13 +2886,13 @@ resend_cmd1:
27333 /* tape side of the driver. */
27334 for (i = 200000; i > 0; i--) {
27335 /* if fifo isn't full go */
27336- if (!(h->access.fifo_full(h)))
27337+ if (!(h->access->fifo_full(h)))
27338 break;
27339 udelay(10);
27340 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
27341 " waiting!\n", h->ctlr);
27342 }
27343- h->access.submit_command(h, c); /* Send the cmd */
27344+ h->access->submit_command(h, c); /* Send the cmd */
27345 do {
27346 complete = pollcomplete(h->ctlr);
27347
27348@@ -3023,7 +3025,7 @@ static void start_io(ctlr_info_t *h)
27349 while (!hlist_empty(&h->reqQ)) {
27350 c = hlist_entry(h->reqQ.first, CommandList_struct, list);
27351 /* can't do anything if fifo is full */
27352- if ((h->access.fifo_full(h))) {
27353+ if ((h->access->fifo_full(h))) {
27354 printk(KERN_WARNING "cciss: fifo full\n");
27355 break;
27356 }
27357@@ -3033,7 +3035,7 @@ static void start_io(ctlr_info_t *h)
27358 h->Qdepth--;
27359
27360 /* Tell the controller execute command */
27361- h->access.submit_command(h, c);
27362+ h->access->submit_command(h, c);
27363
27364 /* Put job onto the completed Q */
27365 addQ(&h->cmpQ, c);
27366@@ -3393,17 +3395,17 @@ startio:
27367
27368 static inline unsigned long get_next_completion(ctlr_info_t *h)
27369 {
27370- return h->access.command_completed(h);
27371+ return h->access->command_completed(h);
27372 }
27373
27374 static inline int interrupt_pending(ctlr_info_t *h)
27375 {
27376- return h->access.intr_pending(h);
27377+ return h->access->intr_pending(h);
27378 }
27379
27380 static inline long interrupt_not_for_us(ctlr_info_t *h)
27381 {
27382- return (((h->access.intr_pending(h) == 0) ||
27383+ return (((h->access->intr_pending(h) == 0) ||
27384 (h->interrupts_enabled == 0)));
27385 }
27386
27387@@ -3892,7 +3894,7 @@ static int __devinit cciss_pci_init(ctlr
27388 */
27389 c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
27390 c->product_name = products[prod_index].product_name;
27391- c->access = *(products[prod_index].access);
27392+ c->access = products[prod_index].access;
27393 c->nr_cmds = c->max_commands - 4;
27394 if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
27395 (readb(&c->cfgtable->Signature[1]) != 'I') ||
27396@@ -4291,7 +4293,7 @@ static int __devinit cciss_init_one(stru
27397 }
27398
27399 /* make sure the board interrupts are off */
27400- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
27401+ hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_OFF);
27402 if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
27403 IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
27404 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
27405@@ -4341,7 +4343,7 @@ static int __devinit cciss_init_one(stru
27406 cciss_scsi_setup(i);
27407
27408 /* Turn the interrupts on so we can service requests */
27409- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
27410+ hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_ON);
27411
27412 /* Get the firmware version */
27413 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
27414diff -urNp linux-2.6.32.46/drivers/block/cciss.h linux-2.6.32.46/drivers/block/cciss.h
27415--- linux-2.6.32.46/drivers/block/cciss.h 2011-08-09 18:35:28.000000000 -0400
27416+++ linux-2.6.32.46/drivers/block/cciss.h 2011-08-09 18:33:59.000000000 -0400
27417@@ -90,7 +90,7 @@ struct ctlr_info
27418 // information about each logical volume
27419 drive_info_struct *drv[CISS_MAX_LUN];
27420
27421- struct access_method access;
27422+ struct access_method *access;
27423
27424 /* queue and queue Info */
27425 struct hlist_head reqQ;
27426diff -urNp linux-2.6.32.46/drivers/block/cpqarray.c linux-2.6.32.46/drivers/block/cpqarray.c
27427--- linux-2.6.32.46/drivers/block/cpqarray.c 2011-03-27 14:31:47.000000000 -0400
27428+++ linux-2.6.32.46/drivers/block/cpqarray.c 2011-08-05 20:33:55.000000000 -0400
27429@@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr
27430 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
27431 goto Enomem4;
27432 }
27433- hba[i]->access.set_intr_mask(hba[i], 0);
27434+ hba[i]->access->set_intr_mask(hba[i], 0);
27435 if (request_irq(hba[i]->intr, do_ida_intr,
27436 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
27437 {
27438@@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr
27439 add_timer(&hba[i]->timer);
27440
27441 /* Enable IRQ now that spinlock and rate limit timer are set up */
27442- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
27443+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
27444
27445 for(j=0; j<NWD; j++) {
27446 struct gendisk *disk = ida_gendisk[i][j];
27447@@ -695,7 +695,7 @@ DBGINFO(
27448 for(i=0; i<NR_PRODUCTS; i++) {
27449 if (board_id == products[i].board_id) {
27450 c->product_name = products[i].product_name;
27451- c->access = *(products[i].access);
27452+ c->access = products[i].access;
27453 break;
27454 }
27455 }
27456@@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(v
27457 hba[ctlr]->intr = intr;
27458 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
27459 hba[ctlr]->product_name = products[j].product_name;
27460- hba[ctlr]->access = *(products[j].access);
27461+ hba[ctlr]->access = products[j].access;
27462 hba[ctlr]->ctlr = ctlr;
27463 hba[ctlr]->board_id = board_id;
27464 hba[ctlr]->pci_dev = NULL; /* not PCI */
27465@@ -896,6 +896,8 @@ static void do_ida_request(struct reques
27466 struct scatterlist tmp_sg[SG_MAX];
27467 int i, dir, seg;
27468
27469+ pax_track_stack();
27470+
27471 if (blk_queue_plugged(q))
27472 goto startio;
27473
27474@@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
27475
27476 while((c = h->reqQ) != NULL) {
27477 /* Can't do anything if we're busy */
27478- if (h->access.fifo_full(h) == 0)
27479+ if (h->access->fifo_full(h) == 0)
27480 return;
27481
27482 /* Get the first entry from the request Q */
27483@@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
27484 h->Qdepth--;
27485
27486 /* Tell the controller to do our bidding */
27487- h->access.submit_command(h, c);
27488+ h->access->submit_command(h, c);
27489
27490 /* Get onto the completion Q */
27491 addQ(&h->cmpQ, c);
27492@@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq,
27493 unsigned long flags;
27494 __u32 a,a1;
27495
27496- istat = h->access.intr_pending(h);
27497+ istat = h->access->intr_pending(h);
27498 /* Is this interrupt for us? */
27499 if (istat == 0)
27500 return IRQ_NONE;
27501@@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq,
27502 */
27503 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
27504 if (istat & FIFO_NOT_EMPTY) {
27505- while((a = h->access.command_completed(h))) {
27506+ while((a = h->access->command_completed(h))) {
27507 a1 = a; a &= ~3;
27508 if ((c = h->cmpQ) == NULL)
27509 {
27510@@ -1434,11 +1436,11 @@ static int sendcmd(
27511 /*
27512 * Disable interrupt
27513 */
27514- info_p->access.set_intr_mask(info_p, 0);
27515+ info_p->access->set_intr_mask(info_p, 0);
27516 /* Make sure there is room in the command FIFO */
27517 /* Actually it should be completely empty at this time. */
27518 for (i = 200000; i > 0; i--) {
27519- temp = info_p->access.fifo_full(info_p);
27520+ temp = info_p->access->fifo_full(info_p);
27521 if (temp != 0) {
27522 break;
27523 }
27524@@ -1451,7 +1453,7 @@ DBG(
27525 /*
27526 * Send the cmd
27527 */
27528- info_p->access.submit_command(info_p, c);
27529+ info_p->access->submit_command(info_p, c);
27530 complete = pollcomplete(ctlr);
27531
27532 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
27533@@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t
27534 * we check the new geometry. Then turn interrupts back on when
27535 * we're done.
27536 */
27537- host->access.set_intr_mask(host, 0);
27538+ host->access->set_intr_mask(host, 0);
27539 getgeometry(ctlr);
27540- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
27541+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
27542
27543 for(i=0; i<NWD; i++) {
27544 struct gendisk *disk = ida_gendisk[ctlr][i];
27545@@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
27546 /* Wait (up to 2 seconds) for a command to complete */
27547
27548 for (i = 200000; i > 0; i--) {
27549- done = hba[ctlr]->access.command_completed(hba[ctlr]);
27550+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
27551 if (done == 0) {
27552 udelay(10); /* a short fixed delay */
27553 } else
27554diff -urNp linux-2.6.32.46/drivers/block/cpqarray.h linux-2.6.32.46/drivers/block/cpqarray.h
27555--- linux-2.6.32.46/drivers/block/cpqarray.h 2011-03-27 14:31:47.000000000 -0400
27556+++ linux-2.6.32.46/drivers/block/cpqarray.h 2011-08-05 20:33:55.000000000 -0400
27557@@ -99,7 +99,7 @@ struct ctlr_info {
27558 drv_info_t drv[NWD];
27559 struct proc_dir_entry *proc;
27560
27561- struct access_method access;
27562+ struct access_method *access;
27563
27564 cmdlist_t *reqQ;
27565 cmdlist_t *cmpQ;
27566diff -urNp linux-2.6.32.46/drivers/block/DAC960.c linux-2.6.32.46/drivers/block/DAC960.c
27567--- linux-2.6.32.46/drivers/block/DAC960.c 2011-03-27 14:31:47.000000000 -0400
27568+++ linux-2.6.32.46/drivers/block/DAC960.c 2011-05-16 21:46:57.000000000 -0400
27569@@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27570 unsigned long flags;
27571 int Channel, TargetID;
27572
27573+ pax_track_stack();
27574+
27575 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27576 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27577 sizeof(DAC960_SCSI_Inquiry_T) +
27578diff -urNp linux-2.6.32.46/drivers/block/nbd.c linux-2.6.32.46/drivers/block/nbd.c
27579--- linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400
27580+++ linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400
27581@@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *
27582 struct kvec iov;
27583 sigset_t blocked, oldset;
27584
27585+ pax_track_stack();
27586+
27587 if (unlikely(!sock)) {
27588 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
27589 lo->disk->disk_name, (send ? "send" : "recv"));
27590@@ -569,6 +571,8 @@ static void do_nbd_request(struct reques
27591 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
27592 unsigned int cmd, unsigned long arg)
27593 {
27594+ pax_track_stack();
27595+
27596 switch (cmd) {
27597 case NBD_DISCONNECT: {
27598 struct request sreq;
27599diff -urNp linux-2.6.32.46/drivers/block/pktcdvd.c linux-2.6.32.46/drivers/block/pktcdvd.c
27600--- linux-2.6.32.46/drivers/block/pktcdvd.c 2011-03-27 14:31:47.000000000 -0400
27601+++ linux-2.6.32.46/drivers/block/pktcdvd.c 2011-04-17 15:56:46.000000000 -0400
27602@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
27603 return len;
27604 }
27605
27606-static struct sysfs_ops kobj_pkt_ops = {
27607+static const struct sysfs_ops kobj_pkt_ops = {
27608 .show = kobj_pkt_show,
27609 .store = kobj_pkt_store
27610 };
27611diff -urNp linux-2.6.32.46/drivers/char/agp/frontend.c linux-2.6.32.46/drivers/char/agp/frontend.c
27612--- linux-2.6.32.46/drivers/char/agp/frontend.c 2011-03-27 14:31:47.000000000 -0400
27613+++ linux-2.6.32.46/drivers/char/agp/frontend.c 2011-04-17 15:56:46.000000000 -0400
27614@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
27615 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27616 return -EFAULT;
27617
27618- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27619+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27620 return -EFAULT;
27621
27622 client = agp_find_client_by_pid(reserve.pid);
27623diff -urNp linux-2.6.32.46/drivers/char/briq_panel.c linux-2.6.32.46/drivers/char/briq_panel.c
27624--- linux-2.6.32.46/drivers/char/briq_panel.c 2011-03-27 14:31:47.000000000 -0400
27625+++ linux-2.6.32.46/drivers/char/briq_panel.c 2011-04-18 19:48:57.000000000 -0400
27626@@ -10,6 +10,7 @@
27627 #include <linux/types.h>
27628 #include <linux/errno.h>
27629 #include <linux/tty.h>
27630+#include <linux/mutex.h>
27631 #include <linux/timer.h>
27632 #include <linux/kernel.h>
27633 #include <linux/wait.h>
27634@@ -36,6 +37,7 @@ static int vfd_is_open;
27635 static unsigned char vfd[40];
27636 static int vfd_cursor;
27637 static unsigned char ledpb, led;
27638+static DEFINE_MUTEX(vfd_mutex);
27639
27640 static void update_vfd(void)
27641 {
27642@@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct f
27643 if (!vfd_is_open)
27644 return -EBUSY;
27645
27646+ mutex_lock(&vfd_mutex);
27647 for (;;) {
27648 char c;
27649 if (!indx)
27650 break;
27651- if (get_user(c, buf))
27652+ if (get_user(c, buf)) {
27653+ mutex_unlock(&vfd_mutex);
27654 return -EFAULT;
27655+ }
27656 if (esc) {
27657 set_led(c);
27658 esc = 0;
27659@@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct f
27660 buf++;
27661 }
27662 update_vfd();
27663+ mutex_unlock(&vfd_mutex);
27664
27665 return len;
27666 }
27667diff -urNp linux-2.6.32.46/drivers/char/genrtc.c linux-2.6.32.46/drivers/char/genrtc.c
27668--- linux-2.6.32.46/drivers/char/genrtc.c 2011-03-27 14:31:47.000000000 -0400
27669+++ linux-2.6.32.46/drivers/char/genrtc.c 2011-04-18 19:45:42.000000000 -0400
27670@@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *i
27671 switch (cmd) {
27672
27673 case RTC_PLL_GET:
27674+ memset(&pll, 0, sizeof(pll));
27675 if (get_rtc_pll(&pll))
27676 return -EINVAL;
27677 else
27678diff -urNp linux-2.6.32.46/drivers/char/hpet.c linux-2.6.32.46/drivers/char/hpet.c
27679--- linux-2.6.32.46/drivers/char/hpet.c 2011-03-27 14:31:47.000000000 -0400
27680+++ linux-2.6.32.46/drivers/char/hpet.c 2011-04-23 12:56:11.000000000 -0400
27681@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
27682 return 0;
27683 }
27684
27685-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
27686+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
27687
27688 static int
27689 hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
27690@@ -565,7 +565,7 @@ static inline unsigned long hpet_time_di
27691 }
27692
27693 static int
27694-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
27695+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
27696 {
27697 struct hpet_timer __iomem *timer;
27698 struct hpet __iomem *hpet;
27699@@ -608,11 +608,11 @@ hpet_ioctl_common(struct hpet_dev *devp,
27700 {
27701 struct hpet_info info;
27702
27703+ memset(&info, 0, sizeof(info));
27704+
27705 if (devp->hd_ireqfreq)
27706 info.hi_ireqfreq =
27707 hpet_time_div(hpetp, devp->hd_ireqfreq);
27708- else
27709- info.hi_ireqfreq = 0;
27710 info.hi_flags =
27711 readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
27712 info.hi_hpet = hpetp->hp_which;
27713diff -urNp linux-2.6.32.46/drivers/char/hvc_beat.c linux-2.6.32.46/drivers/char/hvc_beat.c
27714--- linux-2.6.32.46/drivers/char/hvc_beat.c 2011-03-27 14:31:47.000000000 -0400
27715+++ linux-2.6.32.46/drivers/char/hvc_beat.c 2011-04-17 15:56:46.000000000 -0400
27716@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
27717 return cnt;
27718 }
27719
27720-static struct hv_ops hvc_beat_get_put_ops = {
27721+static const struct hv_ops hvc_beat_get_put_ops = {
27722 .get_chars = hvc_beat_get_chars,
27723 .put_chars = hvc_beat_put_chars,
27724 };
27725diff -urNp linux-2.6.32.46/drivers/char/hvc_console.c linux-2.6.32.46/drivers/char/hvc_console.c
27726--- linux-2.6.32.46/drivers/char/hvc_console.c 2011-03-27 14:31:47.000000000 -0400
27727+++ linux-2.6.32.46/drivers/char/hvc_console.c 2011-04-17 15:56:46.000000000 -0400
27728@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
27729 * console interfaces but can still be used as a tty device. This has to be
27730 * static because kmalloc will not work during early console init.
27731 */
27732-static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
27733+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
27734 static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
27735 {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
27736
27737@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
27738 * vty adapters do NOT get an hvc_instantiate() callback since they
27739 * appear after early console init.
27740 */
27741-int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
27742+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
27743 {
27744 struct hvc_struct *hp;
27745
27746@@ -756,7 +756,7 @@ static const struct tty_operations hvc_o
27747 };
27748
27749 struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
27750- struct hv_ops *ops, int outbuf_size)
27751+ const struct hv_ops *ops, int outbuf_size)
27752 {
27753 struct hvc_struct *hp;
27754 int i;
27755diff -urNp linux-2.6.32.46/drivers/char/hvc_console.h linux-2.6.32.46/drivers/char/hvc_console.h
27756--- linux-2.6.32.46/drivers/char/hvc_console.h 2011-03-27 14:31:47.000000000 -0400
27757+++ linux-2.6.32.46/drivers/char/hvc_console.h 2011-04-17 15:56:46.000000000 -0400
27758@@ -55,7 +55,7 @@ struct hvc_struct {
27759 int outbuf_size;
27760 int n_outbuf;
27761 uint32_t vtermno;
27762- struct hv_ops *ops;
27763+ const struct hv_ops *ops;
27764 int irq_requested;
27765 int data;
27766 struct winsize ws;
27767@@ -76,11 +76,11 @@ struct hv_ops {
27768 };
27769
27770 /* Register a vterm and a slot index for use as a console (console_init) */
27771-extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
27772+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
27773
27774 /* register a vterm for hvc tty operation (module_init or hotplug add) */
27775 extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
27776- struct hv_ops *ops, int outbuf_size);
27777+ const struct hv_ops *ops, int outbuf_size);
27778 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
27779 extern int hvc_remove(struct hvc_struct *hp);
27780
27781diff -urNp linux-2.6.32.46/drivers/char/hvc_iseries.c linux-2.6.32.46/drivers/char/hvc_iseries.c
27782--- linux-2.6.32.46/drivers/char/hvc_iseries.c 2011-03-27 14:31:47.000000000 -0400
27783+++ linux-2.6.32.46/drivers/char/hvc_iseries.c 2011-04-17 15:56:46.000000000 -0400
27784@@ -197,7 +197,7 @@ done:
27785 return sent;
27786 }
27787
27788-static struct hv_ops hvc_get_put_ops = {
27789+static const struct hv_ops hvc_get_put_ops = {
27790 .get_chars = get_chars,
27791 .put_chars = put_chars,
27792 .notifier_add = notifier_add_irq,
27793diff -urNp linux-2.6.32.46/drivers/char/hvc_iucv.c linux-2.6.32.46/drivers/char/hvc_iucv.c
27794--- linux-2.6.32.46/drivers/char/hvc_iucv.c 2011-03-27 14:31:47.000000000 -0400
27795+++ linux-2.6.32.46/drivers/char/hvc_iucv.c 2011-04-17 15:56:46.000000000 -0400
27796@@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(stru
27797
27798
27799 /* HVC operations */
27800-static struct hv_ops hvc_iucv_ops = {
27801+static const struct hv_ops hvc_iucv_ops = {
27802 .get_chars = hvc_iucv_get_chars,
27803 .put_chars = hvc_iucv_put_chars,
27804 .notifier_add = hvc_iucv_notifier_add,
27805diff -urNp linux-2.6.32.46/drivers/char/hvc_rtas.c linux-2.6.32.46/drivers/char/hvc_rtas.c
27806--- linux-2.6.32.46/drivers/char/hvc_rtas.c 2011-03-27 14:31:47.000000000 -0400
27807+++ linux-2.6.32.46/drivers/char/hvc_rtas.c 2011-04-17 15:56:46.000000000 -0400
27808@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
27809 return i;
27810 }
27811
27812-static struct hv_ops hvc_rtas_get_put_ops = {
27813+static const struct hv_ops hvc_rtas_get_put_ops = {
27814 .get_chars = hvc_rtas_read_console,
27815 .put_chars = hvc_rtas_write_console,
27816 };
27817diff -urNp linux-2.6.32.46/drivers/char/hvcs.c linux-2.6.32.46/drivers/char/hvcs.c
27818--- linux-2.6.32.46/drivers/char/hvcs.c 2011-03-27 14:31:47.000000000 -0400
27819+++ linux-2.6.32.46/drivers/char/hvcs.c 2011-04-17 15:56:46.000000000 -0400
27820@@ -82,6 +82,7 @@
27821 #include <asm/hvcserver.h>
27822 #include <asm/uaccess.h>
27823 #include <asm/vio.h>
27824+#include <asm/local.h>
27825
27826 /*
27827 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
27828@@ -269,7 +270,7 @@ struct hvcs_struct {
27829 unsigned int index;
27830
27831 struct tty_struct *tty;
27832- int open_count;
27833+ local_t open_count;
27834
27835 /*
27836 * Used to tell the driver kernel_thread what operations need to take
27837@@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
27838
27839 spin_lock_irqsave(&hvcsd->lock, flags);
27840
27841- if (hvcsd->open_count > 0) {
27842+ if (local_read(&hvcsd->open_count) > 0) {
27843 spin_unlock_irqrestore(&hvcsd->lock, flags);
27844 printk(KERN_INFO "HVCS: vterm state unchanged. "
27845 "The hvcs device node is still in use.\n");
27846@@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
27847 if ((retval = hvcs_partner_connect(hvcsd)))
27848 goto error_release;
27849
27850- hvcsd->open_count = 1;
27851+ local_set(&hvcsd->open_count, 1);
27852 hvcsd->tty = tty;
27853 tty->driver_data = hvcsd;
27854
27855@@ -1169,7 +1170,7 @@ fast_open:
27856
27857 spin_lock_irqsave(&hvcsd->lock, flags);
27858 kref_get(&hvcsd->kref);
27859- hvcsd->open_count++;
27860+ local_inc(&hvcsd->open_count);
27861 hvcsd->todo_mask |= HVCS_SCHED_READ;
27862 spin_unlock_irqrestore(&hvcsd->lock, flags);
27863
27864@@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct
27865 hvcsd = tty->driver_data;
27866
27867 spin_lock_irqsave(&hvcsd->lock, flags);
27868- if (--hvcsd->open_count == 0) {
27869+ if (local_dec_and_test(&hvcsd->open_count)) {
27870
27871 vio_disable_interrupts(hvcsd->vdev);
27872
27873@@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct
27874 free_irq(irq, hvcsd);
27875 kref_put(&hvcsd->kref, destroy_hvcs_struct);
27876 return;
27877- } else if (hvcsd->open_count < 0) {
27878+ } else if (local_read(&hvcsd->open_count) < 0) {
27879 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
27880 " is missmanaged.\n",
27881- hvcsd->vdev->unit_address, hvcsd->open_count);
27882+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
27883 }
27884
27885 spin_unlock_irqrestore(&hvcsd->lock, flags);
27886@@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
27887
27888 spin_lock_irqsave(&hvcsd->lock, flags);
27889 /* Preserve this so that we know how many kref refs to put */
27890- temp_open_count = hvcsd->open_count;
27891+ temp_open_count = local_read(&hvcsd->open_count);
27892
27893 /*
27894 * Don't kref put inside the spinlock because the destruction
27895@@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
27896 hvcsd->tty->driver_data = NULL;
27897 hvcsd->tty = NULL;
27898
27899- hvcsd->open_count = 0;
27900+ local_set(&hvcsd->open_count, 0);
27901
27902 /* This will drop any buffered data on the floor which is OK in a hangup
27903 * scenario. */
27904@@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct
27905 * the middle of a write operation? This is a crummy place to do this
27906 * but we want to keep it all in the spinlock.
27907 */
27908- if (hvcsd->open_count <= 0) {
27909+ if (local_read(&hvcsd->open_count) <= 0) {
27910 spin_unlock_irqrestore(&hvcsd->lock, flags);
27911 return -ENODEV;
27912 }
27913@@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
27914 {
27915 struct hvcs_struct *hvcsd = tty->driver_data;
27916
27917- if (!hvcsd || hvcsd->open_count <= 0)
27918+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
27919 return 0;
27920
27921 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
27922diff -urNp linux-2.6.32.46/drivers/char/hvc_udbg.c linux-2.6.32.46/drivers/char/hvc_udbg.c
27923--- linux-2.6.32.46/drivers/char/hvc_udbg.c 2011-03-27 14:31:47.000000000 -0400
27924+++ linux-2.6.32.46/drivers/char/hvc_udbg.c 2011-04-17 15:56:46.000000000 -0400
27925@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
27926 return i;
27927 }
27928
27929-static struct hv_ops hvc_udbg_ops = {
27930+static const struct hv_ops hvc_udbg_ops = {
27931 .get_chars = hvc_udbg_get,
27932 .put_chars = hvc_udbg_put,
27933 };
27934diff -urNp linux-2.6.32.46/drivers/char/hvc_vio.c linux-2.6.32.46/drivers/char/hvc_vio.c
27935--- linux-2.6.32.46/drivers/char/hvc_vio.c 2011-03-27 14:31:47.000000000 -0400
27936+++ linux-2.6.32.46/drivers/char/hvc_vio.c 2011-04-17 15:56:46.000000000 -0400
27937@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
27938 return got;
27939 }
27940
27941-static struct hv_ops hvc_get_put_ops = {
27942+static const struct hv_ops hvc_get_put_ops = {
27943 .get_chars = filtered_get_chars,
27944 .put_chars = hvc_put_chars,
27945 .notifier_add = notifier_add_irq,
27946diff -urNp linux-2.6.32.46/drivers/char/hvc_xen.c linux-2.6.32.46/drivers/char/hvc_xen.c
27947--- linux-2.6.32.46/drivers/char/hvc_xen.c 2011-03-27 14:31:47.000000000 -0400
27948+++ linux-2.6.32.46/drivers/char/hvc_xen.c 2011-04-17 15:56:46.000000000 -0400
27949@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
27950 return recv;
27951 }
27952
27953-static struct hv_ops hvc_ops = {
27954+static const struct hv_ops hvc_ops = {
27955 .get_chars = read_console,
27956 .put_chars = write_console,
27957 .notifier_add = notifier_add_irq,
27958diff -urNp linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c
27959--- linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c 2011-03-27 14:31:47.000000000 -0400
27960+++ linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c 2011-05-16 21:46:57.000000000 -0400
27961@@ -414,7 +414,7 @@ struct ipmi_smi {
27962 struct proc_dir_entry *proc_dir;
27963 char proc_dir_name[10];
27964
27965- atomic_t stats[IPMI_NUM_STATS];
27966+ atomic_unchecked_t stats[IPMI_NUM_STATS];
27967
27968 /*
27969 * run_to_completion duplicate of smb_info, smi_info
27970@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
27971
27972
27973 #define ipmi_inc_stat(intf, stat) \
27974- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
27975+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
27976 #define ipmi_get_stat(intf, stat) \
27977- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
27978+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
27979
27980 static int is_lan_addr(struct ipmi_addr *addr)
27981 {
27982@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
27983 INIT_LIST_HEAD(&intf->cmd_rcvrs);
27984 init_waitqueue_head(&intf->waitq);
27985 for (i = 0; i < IPMI_NUM_STATS; i++)
27986- atomic_set(&intf->stats[i], 0);
27987+ atomic_set_unchecked(&intf->stats[i], 0);
27988
27989 intf->proc_dir = NULL;
27990
27991@@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
27992 struct ipmi_smi_msg smi_msg;
27993 struct ipmi_recv_msg recv_msg;
27994
27995+ pax_track_stack();
27996+
27997 si = (struct ipmi_system_interface_addr *) &addr;
27998 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
27999 si->channel = IPMI_BMC_CHANNEL;
28000diff -urNp linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c
28001--- linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c 2011-03-27 14:31:47.000000000 -0400
28002+++ linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c 2011-04-17 15:56:46.000000000 -0400
28003@@ -277,7 +277,7 @@ struct smi_info {
28004 unsigned char slave_addr;
28005
28006 /* Counters and things for the proc filesystem. */
28007- atomic_t stats[SI_NUM_STATS];
28008+ atomic_unchecked_t stats[SI_NUM_STATS];
28009
28010 struct task_struct *thread;
28011
28012@@ -285,9 +285,9 @@ struct smi_info {
28013 };
28014
28015 #define smi_inc_stat(smi, stat) \
28016- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28017+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28018 #define smi_get_stat(smi, stat) \
28019- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28020+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28021
28022 #define SI_MAX_PARMS 4
28023
28024@@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info
28025 atomic_set(&new_smi->req_events, 0);
28026 new_smi->run_to_completion = 0;
28027 for (i = 0; i < SI_NUM_STATS; i++)
28028- atomic_set(&new_smi->stats[i], 0);
28029+ atomic_set_unchecked(&new_smi->stats[i], 0);
28030
28031 new_smi->interrupt_disabled = 0;
28032 atomic_set(&new_smi->stop_operation, 0);
28033diff -urNp linux-2.6.32.46/drivers/char/istallion.c linux-2.6.32.46/drivers/char/istallion.c
28034--- linux-2.6.32.46/drivers/char/istallion.c 2011-03-27 14:31:47.000000000 -0400
28035+++ linux-2.6.32.46/drivers/char/istallion.c 2011-05-16 21:46:57.000000000 -0400
28036@@ -187,7 +187,6 @@ static struct ktermios stli_deftermios
28037 * re-used for each stats call.
28038 */
28039 static comstats_t stli_comstats;
28040-static combrd_t stli_brdstats;
28041 static struct asystats stli_cdkstats;
28042
28043 /*****************************************************************************/
28044@@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __u
28045 {
28046 struct stlibrd *brdp;
28047 unsigned int i;
28048+ combrd_t stli_brdstats;
28049
28050 if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
28051 return -EFAULT;
28052@@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stl
28053 struct stliport stli_dummyport;
28054 struct stliport *portp;
28055
28056+ pax_track_stack();
28057+
28058 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
28059 return -EFAULT;
28060 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
28061@@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stli
28062 struct stlibrd stli_dummybrd;
28063 struct stlibrd *brdp;
28064
28065+ pax_track_stack();
28066+
28067 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
28068 return -EFAULT;
28069 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
28070diff -urNp linux-2.6.32.46/drivers/char/Kconfig linux-2.6.32.46/drivers/char/Kconfig
28071--- linux-2.6.32.46/drivers/char/Kconfig 2011-03-27 14:31:47.000000000 -0400
28072+++ linux-2.6.32.46/drivers/char/Kconfig 2011-04-18 19:20:15.000000000 -0400
28073@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
28074
28075 config DEVKMEM
28076 bool "/dev/kmem virtual device support"
28077- default y
28078+ default n
28079+ depends on !GRKERNSEC_KMEM
28080 help
28081 Say Y here if you want to support the /dev/kmem device. The
28082 /dev/kmem device is rarely used, but can be used for certain
28083@@ -1114,6 +1115,7 @@ config DEVPORT
28084 bool
28085 depends on !M68K
28086 depends on ISA || PCI
28087+ depends on !GRKERNSEC_KMEM
28088 default y
28089
28090 source "drivers/s390/char/Kconfig"
28091diff -urNp linux-2.6.32.46/drivers/char/keyboard.c linux-2.6.32.46/drivers/char/keyboard.c
28092--- linux-2.6.32.46/drivers/char/keyboard.c 2011-03-27 14:31:47.000000000 -0400
28093+++ linux-2.6.32.46/drivers/char/keyboard.c 2011-04-17 15:56:46.000000000 -0400
28094@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
28095 kbd->kbdmode == VC_MEDIUMRAW) &&
28096 value != KVAL(K_SAK))
28097 return; /* SAK is allowed even in raw mode */
28098+
28099+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
28100+ {
28101+ void *func = fn_handler[value];
28102+ if (func == fn_show_state || func == fn_show_ptregs ||
28103+ func == fn_show_mem)
28104+ return;
28105+ }
28106+#endif
28107+
28108 fn_handler[value](vc);
28109 }
28110
28111@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
28112 .evbit = { BIT_MASK(EV_SND) },
28113 },
28114
28115- { }, /* Terminating entry */
28116+ { 0 }, /* Terminating entry */
28117 };
28118
28119 MODULE_DEVICE_TABLE(input, kbd_ids);
28120diff -urNp linux-2.6.32.46/drivers/char/mem.c linux-2.6.32.46/drivers/char/mem.c
28121--- linux-2.6.32.46/drivers/char/mem.c 2011-03-27 14:31:47.000000000 -0400
28122+++ linux-2.6.32.46/drivers/char/mem.c 2011-04-17 15:56:46.000000000 -0400
28123@@ -18,6 +18,7 @@
28124 #include <linux/raw.h>
28125 #include <linux/tty.h>
28126 #include <linux/capability.h>
28127+#include <linux/security.h>
28128 #include <linux/ptrace.h>
28129 #include <linux/device.h>
28130 #include <linux/highmem.h>
28131@@ -35,6 +36,10 @@
28132 # include <linux/efi.h>
28133 #endif
28134
28135+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28136+extern struct file_operations grsec_fops;
28137+#endif
28138+
28139 static inline unsigned long size_inside_page(unsigned long start,
28140 unsigned long size)
28141 {
28142@@ -102,9 +107,13 @@ static inline int range_is_allowed(unsig
28143
28144 while (cursor < to) {
28145 if (!devmem_is_allowed(pfn)) {
28146+#ifdef CONFIG_GRKERNSEC_KMEM
28147+ gr_handle_mem_readwrite(from, to);
28148+#else
28149 printk(KERN_INFO
28150 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28151 current->comm, from, to);
28152+#endif
28153 return 0;
28154 }
28155 cursor += PAGE_SIZE;
28156@@ -112,6 +121,11 @@ static inline int range_is_allowed(unsig
28157 }
28158 return 1;
28159 }
28160+#elif defined(CONFIG_GRKERNSEC_KMEM)
28161+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28162+{
28163+ return 0;
28164+}
28165 #else
28166 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28167 {
28168@@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * fi
28169 #endif
28170
28171 while (count > 0) {
28172+ char *temp;
28173+
28174 /*
28175 * Handle first page in case it's not aligned
28176 */
28177@@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * fi
28178 if (!ptr)
28179 return -EFAULT;
28180
28181- if (copy_to_user(buf, ptr, sz)) {
28182+#ifdef CONFIG_PAX_USERCOPY
28183+ temp = kmalloc(sz, GFP_KERNEL);
28184+ if (!temp) {
28185+ unxlate_dev_mem_ptr(p, ptr);
28186+ return -ENOMEM;
28187+ }
28188+ memcpy(temp, ptr, sz);
28189+#else
28190+ temp = ptr;
28191+#endif
28192+
28193+ if (copy_to_user(buf, temp, sz)) {
28194+
28195+#ifdef CONFIG_PAX_USERCOPY
28196+ kfree(temp);
28197+#endif
28198+
28199 unxlate_dev_mem_ptr(p, ptr);
28200 return -EFAULT;
28201 }
28202
28203+#ifdef CONFIG_PAX_USERCOPY
28204+ kfree(temp);
28205+#endif
28206+
28207 unxlate_dev_mem_ptr(p, ptr);
28208
28209 buf += sz;
28210@@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *fi
28211 size_t count, loff_t *ppos)
28212 {
28213 unsigned long p = *ppos;
28214- ssize_t low_count, read, sz;
28215+ ssize_t low_count, read, sz, err = 0;
28216 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28217- int err = 0;
28218
28219 read = 0;
28220 if (p < (unsigned long) high_memory) {
28221@@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *fi
28222 }
28223 #endif
28224 while (low_count > 0) {
28225+ char *temp;
28226+
28227 sz = size_inside_page(p, low_count);
28228
28229 /*
28230@@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *fi
28231 */
28232 kbuf = xlate_dev_kmem_ptr((char *)p);
28233
28234- if (copy_to_user(buf, kbuf, sz))
28235+#ifdef CONFIG_PAX_USERCOPY
28236+ temp = kmalloc(sz, GFP_KERNEL);
28237+ if (!temp)
28238+ return -ENOMEM;
28239+ memcpy(temp, kbuf, sz);
28240+#else
28241+ temp = kbuf;
28242+#endif
28243+
28244+ err = copy_to_user(buf, temp, sz);
28245+
28246+#ifdef CONFIG_PAX_USERCOPY
28247+ kfree(temp);
28248+#endif
28249+
28250+ if (err)
28251 return -EFAULT;
28252 buf += sz;
28253 p += sz;
28254@@ -889,6 +941,9 @@ static const struct memdev {
28255 #ifdef CONFIG_CRASH_DUMP
28256 [12] = { "oldmem", 0, &oldmem_fops, NULL },
28257 #endif
28258+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28259+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
28260+#endif
28261 };
28262
28263 static int memory_open(struct inode *inode, struct file *filp)
28264diff -urNp linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c
28265--- linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c 2011-03-27 14:31:47.000000000 -0400
28266+++ linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c 2011-04-17 15:56:46.000000000 -0400
28267@@ -29,6 +29,7 @@
28268 #include <linux/tty_driver.h>
28269 #include <linux/tty_flip.h>
28270 #include <linux/uaccess.h>
28271+#include <asm/local.h>
28272
28273 #include "tty.h"
28274 #include "network.h"
28275@@ -51,7 +52,7 @@ struct ipw_tty {
28276 int tty_type;
28277 struct ipw_network *network;
28278 struct tty_struct *linux_tty;
28279- int open_count;
28280+ local_t open_count;
28281 unsigned int control_lines;
28282 struct mutex ipw_tty_mutex;
28283 int tx_bytes_queued;
28284@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
28285 mutex_unlock(&tty->ipw_tty_mutex);
28286 return -ENODEV;
28287 }
28288- if (tty->open_count == 0)
28289+ if (local_read(&tty->open_count) == 0)
28290 tty->tx_bytes_queued = 0;
28291
28292- tty->open_count++;
28293+ local_inc(&tty->open_count);
28294
28295 tty->linux_tty = linux_tty;
28296 linux_tty->driver_data = tty;
28297@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
28298
28299 static void do_ipw_close(struct ipw_tty *tty)
28300 {
28301- tty->open_count--;
28302-
28303- if (tty->open_count == 0) {
28304+ if (local_dec_return(&tty->open_count) == 0) {
28305 struct tty_struct *linux_tty = tty->linux_tty;
28306
28307 if (linux_tty != NULL) {
28308@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
28309 return;
28310
28311 mutex_lock(&tty->ipw_tty_mutex);
28312- if (tty->open_count == 0) {
28313+ if (local_read(&tty->open_count) == 0) {
28314 mutex_unlock(&tty->ipw_tty_mutex);
28315 return;
28316 }
28317@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
28318 return;
28319 }
28320
28321- if (!tty->open_count) {
28322+ if (!local_read(&tty->open_count)) {
28323 mutex_unlock(&tty->ipw_tty_mutex);
28324 return;
28325 }
28326@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
28327 return -ENODEV;
28328
28329 mutex_lock(&tty->ipw_tty_mutex);
28330- if (!tty->open_count) {
28331+ if (!local_read(&tty->open_count)) {
28332 mutex_unlock(&tty->ipw_tty_mutex);
28333 return -EINVAL;
28334 }
28335@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
28336 if (!tty)
28337 return -ENODEV;
28338
28339- if (!tty->open_count)
28340+ if (!local_read(&tty->open_count))
28341 return -EINVAL;
28342
28343 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
28344@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
28345 if (!tty)
28346 return 0;
28347
28348- if (!tty->open_count)
28349+ if (!local_read(&tty->open_count))
28350 return 0;
28351
28352 return tty->tx_bytes_queued;
28353@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
28354 if (!tty)
28355 return -ENODEV;
28356
28357- if (!tty->open_count)
28358+ if (!local_read(&tty->open_count))
28359 return -EINVAL;
28360
28361 return get_control_lines(tty);
28362@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
28363 if (!tty)
28364 return -ENODEV;
28365
28366- if (!tty->open_count)
28367+ if (!local_read(&tty->open_count))
28368 return -EINVAL;
28369
28370 return set_control_lines(tty, set, clear);
28371@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
28372 if (!tty)
28373 return -ENODEV;
28374
28375- if (!tty->open_count)
28376+ if (!local_read(&tty->open_count))
28377 return -EINVAL;
28378
28379 /* FIXME: Exactly how is the tty object locked here .. */
28380@@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty
28381 against a parallel ioctl etc */
28382 mutex_lock(&ttyj->ipw_tty_mutex);
28383 }
28384- while (ttyj->open_count)
28385+ while (local_read(&ttyj->open_count))
28386 do_ipw_close(ttyj);
28387 ipwireless_disassociate_network_ttys(network,
28388 ttyj->channel_idx);
28389diff -urNp linux-2.6.32.46/drivers/char/pty.c linux-2.6.32.46/drivers/char/pty.c
28390--- linux-2.6.32.46/drivers/char/pty.c 2011-03-27 14:31:47.000000000 -0400
28391+++ linux-2.6.32.46/drivers/char/pty.c 2011-08-05 20:33:55.000000000 -0400
28392@@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
28393 register_sysctl_table(pty_root_table);
28394
28395 /* Now create the /dev/ptmx special device */
28396+ pax_open_kernel();
28397 tty_default_fops(&ptmx_fops);
28398- ptmx_fops.open = ptmx_open;
28399+ *(void **)&ptmx_fops.open = ptmx_open;
28400+ pax_close_kernel();
28401
28402 cdev_init(&ptmx_cdev, &ptmx_fops);
28403 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
28404diff -urNp linux-2.6.32.46/drivers/char/random.c linux-2.6.32.46/drivers/char/random.c
28405--- linux-2.6.32.46/drivers/char/random.c 2011-08-16 20:37:25.000000000 -0400
28406+++ linux-2.6.32.46/drivers/char/random.c 2011-08-16 20:43:23.000000000 -0400
28407@@ -254,8 +254,13 @@
28408 /*
28409 * Configuration information
28410 */
28411+#ifdef CONFIG_GRKERNSEC_RANDNET
28412+#define INPUT_POOL_WORDS 512
28413+#define OUTPUT_POOL_WORDS 128
28414+#else
28415 #define INPUT_POOL_WORDS 128
28416 #define OUTPUT_POOL_WORDS 32
28417+#endif
28418 #define SEC_XFER_SIZE 512
28419
28420 /*
28421@@ -292,10 +297,17 @@ static struct poolinfo {
28422 int poolwords;
28423 int tap1, tap2, tap3, tap4, tap5;
28424 } poolinfo_table[] = {
28425+#ifdef CONFIG_GRKERNSEC_RANDNET
28426+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28427+ { 512, 411, 308, 208, 104, 1 },
28428+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28429+ { 128, 103, 76, 51, 25, 1 },
28430+#else
28431 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28432 { 128, 103, 76, 51, 25, 1 },
28433 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28434 { 32, 26, 20, 14, 7, 1 },
28435+#endif
28436 #if 0
28437 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28438 { 2048, 1638, 1231, 819, 411, 1 },
28439@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
28440 #include <linux/sysctl.h>
28441
28442 static int min_read_thresh = 8, min_write_thresh;
28443-static int max_read_thresh = INPUT_POOL_WORDS * 32;
28444+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28445 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28446 static char sysctl_bootid[16];
28447
28448diff -urNp linux-2.6.32.46/drivers/char/rocket.c linux-2.6.32.46/drivers/char/rocket.c
28449--- linux-2.6.32.46/drivers/char/rocket.c 2011-03-27 14:31:47.000000000 -0400
28450+++ linux-2.6.32.46/drivers/char/rocket.c 2011-05-16 21:46:57.000000000 -0400
28451@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info
28452 struct rocket_ports tmp;
28453 int board;
28454
28455+ pax_track_stack();
28456+
28457 if (!retports)
28458 return -EFAULT;
28459 memset(&tmp, 0, sizeof (tmp));
28460diff -urNp linux-2.6.32.46/drivers/char/sonypi.c linux-2.6.32.46/drivers/char/sonypi.c
28461--- linux-2.6.32.46/drivers/char/sonypi.c 2011-03-27 14:31:47.000000000 -0400
28462+++ linux-2.6.32.46/drivers/char/sonypi.c 2011-04-17 15:56:46.000000000 -0400
28463@@ -55,6 +55,7 @@
28464 #include <asm/uaccess.h>
28465 #include <asm/io.h>
28466 #include <asm/system.h>
28467+#include <asm/local.h>
28468
28469 #include <linux/sonypi.h>
28470
28471@@ -491,7 +492,7 @@ static struct sonypi_device {
28472 spinlock_t fifo_lock;
28473 wait_queue_head_t fifo_proc_list;
28474 struct fasync_struct *fifo_async;
28475- int open_count;
28476+ local_t open_count;
28477 int model;
28478 struct input_dev *input_jog_dev;
28479 struct input_dev *input_key_dev;
28480@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, st
28481 static int sonypi_misc_release(struct inode *inode, struct file *file)
28482 {
28483 mutex_lock(&sonypi_device.lock);
28484- sonypi_device.open_count--;
28485+ local_dec(&sonypi_device.open_count);
28486 mutex_unlock(&sonypi_device.lock);
28487 return 0;
28488 }
28489@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode
28490 lock_kernel();
28491 mutex_lock(&sonypi_device.lock);
28492 /* Flush input queue on first open */
28493- if (!sonypi_device.open_count)
28494+ if (!local_read(&sonypi_device.open_count))
28495 kfifo_reset(sonypi_device.fifo);
28496- sonypi_device.open_count++;
28497+ local_inc(&sonypi_device.open_count);
28498 mutex_unlock(&sonypi_device.lock);
28499 unlock_kernel();
28500 return 0;
28501diff -urNp linux-2.6.32.46/drivers/char/stallion.c linux-2.6.32.46/drivers/char/stallion.c
28502--- linux-2.6.32.46/drivers/char/stallion.c 2011-03-27 14:31:47.000000000 -0400
28503+++ linux-2.6.32.46/drivers/char/stallion.c 2011-05-16 21:46:57.000000000 -0400
28504@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlp
28505 struct stlport stl_dummyport;
28506 struct stlport *portp;
28507
28508+ pax_track_stack();
28509+
28510 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
28511 return -EFAULT;
28512 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
28513diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm_bios.c linux-2.6.32.46/drivers/char/tpm/tpm_bios.c
28514--- linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400
28515+++ linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-04-17 15:56:46.000000000 -0400
28516@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
28517 event = addr;
28518
28519 if ((event->event_type == 0 && event->event_size == 0) ||
28520- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28521+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28522 return NULL;
28523
28524 return addr;
28525@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
28526 return NULL;
28527
28528 if ((event->event_type == 0 && event->event_size == 0) ||
28529- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28530+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28531 return NULL;
28532
28533 (*pos)++;
28534@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
28535 int i;
28536
28537 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28538- seq_putc(m, data[i]);
28539+ if (!seq_putc(m, data[i]))
28540+ return -EFAULT;
28541
28542 return 0;
28543 }
28544@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log
28545 log->bios_event_log_end = log->bios_event_log + len;
28546
28547 virt = acpi_os_map_memory(start, len);
28548+ if (!virt) {
28549+ kfree(log->bios_event_log);
28550+ log->bios_event_log = NULL;
28551+ return -EFAULT;
28552+ }
28553
28554 memcpy(log->bios_event_log, virt, len);
28555
28556diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm.c linux-2.6.32.46/drivers/char/tpm/tpm.c
28557--- linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400
28558+++ linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-05-16 21:46:57.000000000 -0400
28559@@ -402,7 +402,7 @@ static ssize_t tpm_transmit(struct tpm_c
28560 chip->vendor.req_complete_val)
28561 goto out_recv;
28562
28563- if ((status == chip->vendor.req_canceled)) {
28564+ if (status == chip->vendor.req_canceled) {
28565 dev_err(chip->dev, "Operation Canceled\n");
28566 rc = -ECANCELED;
28567 goto out;
28568@@ -821,6 +821,8 @@ ssize_t tpm_show_pubek(struct device *de
28569
28570 struct tpm_chip *chip = dev_get_drvdata(dev);
28571
28572+ pax_track_stack();
28573+
28574 tpm_cmd.header.in = tpm_readpubek_header;
28575 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28576 "attempting to read the PUBEK");
28577diff -urNp linux-2.6.32.46/drivers/char/tty_io.c linux-2.6.32.46/drivers/char/tty_io.c
28578--- linux-2.6.32.46/drivers/char/tty_io.c 2011-03-27 14:31:47.000000000 -0400
28579+++ linux-2.6.32.46/drivers/char/tty_io.c 2011-08-05 20:33:55.000000000 -0400
28580@@ -2582,8 +2582,10 @@ long tty_ioctl(struct file *file, unsign
28581 return retval;
28582 }
28583
28584+EXPORT_SYMBOL(tty_ioctl);
28585+
28586 #ifdef CONFIG_COMPAT
28587-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
28588+long tty_compat_ioctl(struct file *file, unsigned int cmd,
28589 unsigned long arg)
28590 {
28591 struct inode *inode = file->f_dentry->d_inode;
28592@@ -2607,6 +2609,8 @@ static long tty_compat_ioctl(struct file
28593
28594 return retval;
28595 }
28596+
28597+EXPORT_SYMBOL(tty_compat_ioctl);
28598 #endif
28599
28600 /*
28601@@ -3052,7 +3056,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
28602
28603 void tty_default_fops(struct file_operations *fops)
28604 {
28605- *fops = tty_fops;
28606+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
28607 }
28608
28609 /*
28610diff -urNp linux-2.6.32.46/drivers/char/tty_ldisc.c linux-2.6.32.46/drivers/char/tty_ldisc.c
28611--- linux-2.6.32.46/drivers/char/tty_ldisc.c 2011-07-13 17:23:04.000000000 -0400
28612+++ linux-2.6.32.46/drivers/char/tty_ldisc.c 2011-07-13 17:23:18.000000000 -0400
28613@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
28614 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
28615 struct tty_ldisc_ops *ldo = ld->ops;
28616
28617- ldo->refcount--;
28618+ atomic_dec(&ldo->refcount);
28619 module_put(ldo->owner);
28620 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
28621
28622@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
28623 spin_lock_irqsave(&tty_ldisc_lock, flags);
28624 tty_ldiscs[disc] = new_ldisc;
28625 new_ldisc->num = disc;
28626- new_ldisc->refcount = 0;
28627+ atomic_set(&new_ldisc->refcount, 0);
28628 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
28629
28630 return ret;
28631@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
28632 return -EINVAL;
28633
28634 spin_lock_irqsave(&tty_ldisc_lock, flags);
28635- if (tty_ldiscs[disc]->refcount)
28636+ if (atomic_read(&tty_ldiscs[disc]->refcount))
28637 ret = -EBUSY;
28638 else
28639 tty_ldiscs[disc] = NULL;
28640@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
28641 if (ldops) {
28642 ret = ERR_PTR(-EAGAIN);
28643 if (try_module_get(ldops->owner)) {
28644- ldops->refcount++;
28645+ atomic_inc(&ldops->refcount);
28646 ret = ldops;
28647 }
28648 }
28649@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
28650 unsigned long flags;
28651
28652 spin_lock_irqsave(&tty_ldisc_lock, flags);
28653- ldops->refcount--;
28654+ atomic_dec(&ldops->refcount);
28655 module_put(ldops->owner);
28656 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
28657 }
28658diff -urNp linux-2.6.32.46/drivers/char/virtio_console.c linux-2.6.32.46/drivers/char/virtio_console.c
28659--- linux-2.6.32.46/drivers/char/virtio_console.c 2011-03-27 14:31:47.000000000 -0400
28660+++ linux-2.6.32.46/drivers/char/virtio_console.c 2011-08-05 20:33:55.000000000 -0400
28661@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *
28662 * virtqueue, so we let the drivers do some boutique early-output thing. */
28663 int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
28664 {
28665- virtio_cons.put_chars = put_chars;
28666+ pax_open_kernel();
28667+ *(void **)&virtio_cons.put_chars = put_chars;
28668+ pax_close_kernel();
28669 return hvc_instantiate(0, 0, &virtio_cons);
28670 }
28671
28672@@ -213,11 +215,13 @@ static int __devinit virtcons_probe(stru
28673 out_vq = vqs[1];
28674
28675 /* Start using the new console output. */
28676- virtio_cons.get_chars = get_chars;
28677- virtio_cons.put_chars = put_chars;
28678- virtio_cons.notifier_add = notifier_add_vio;
28679- virtio_cons.notifier_del = notifier_del_vio;
28680- virtio_cons.notifier_hangup = notifier_del_vio;
28681+ pax_open_kernel();
28682+ *(void **)&virtio_cons.get_chars = get_chars;
28683+ *(void **)&virtio_cons.put_chars = put_chars;
28684+ *(void **)&virtio_cons.notifier_add = notifier_add_vio;
28685+ *(void **)&virtio_cons.notifier_del = notifier_del_vio;
28686+ *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
28687+ pax_close_kernel();
28688
28689 /* The first argument of hvc_alloc() is the virtual console number, so
28690 * we use zero. The second argument is the parameter for the
28691diff -urNp linux-2.6.32.46/drivers/char/vt.c linux-2.6.32.46/drivers/char/vt.c
28692--- linux-2.6.32.46/drivers/char/vt.c 2011-03-27 14:31:47.000000000 -0400
28693+++ linux-2.6.32.46/drivers/char/vt.c 2011-04-17 15:56:46.000000000 -0400
28694@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
28695
28696 static void notify_write(struct vc_data *vc, unsigned int unicode)
28697 {
28698- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
28699+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
28700 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
28701 }
28702
28703diff -urNp linux-2.6.32.46/drivers/char/vt_ioctl.c linux-2.6.32.46/drivers/char/vt_ioctl.c
28704--- linux-2.6.32.46/drivers/char/vt_ioctl.c 2011-03-27 14:31:47.000000000 -0400
28705+++ linux-2.6.32.46/drivers/char/vt_ioctl.c 2011-04-17 15:56:46.000000000 -0400
28706@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
28707 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
28708 return -EFAULT;
28709
28710- if (!capable(CAP_SYS_TTY_CONFIG))
28711- perm = 0;
28712-
28713 switch (cmd) {
28714 case KDGKBENT:
28715 key_map = key_maps[s];
28716@@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
28717 val = (i ? K_HOLE : K_NOSUCHMAP);
28718 return put_user(val, &user_kbe->kb_value);
28719 case KDSKBENT:
28720+ if (!capable(CAP_SYS_TTY_CONFIG))
28721+ perm = 0;
28722+
28723 if (!perm)
28724 return -EPERM;
28725+
28726 if (!i && v == K_NOSUCHMAP) {
28727 /* deallocate map */
28728 key_map = key_maps[s];
28729@@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
28730 int i, j, k;
28731 int ret;
28732
28733- if (!capable(CAP_SYS_TTY_CONFIG))
28734- perm = 0;
28735-
28736 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
28737 if (!kbs) {
28738 ret = -ENOMEM;
28739@@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
28740 kfree(kbs);
28741 return ((p && *p) ? -EOVERFLOW : 0);
28742 case KDSKBSENT:
28743+ if (!capable(CAP_SYS_TTY_CONFIG))
28744+ perm = 0;
28745+
28746 if (!perm) {
28747 ret = -EPERM;
28748 goto reterr;
28749diff -urNp linux-2.6.32.46/drivers/cpufreq/cpufreq.c linux-2.6.32.46/drivers/cpufreq/cpufreq.c
28750--- linux-2.6.32.46/drivers/cpufreq/cpufreq.c 2011-06-25 12:55:34.000000000 -0400
28751+++ linux-2.6.32.46/drivers/cpufreq/cpufreq.c 2011-06-25 12:56:37.000000000 -0400
28752@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
28753 complete(&policy->kobj_unregister);
28754 }
28755
28756-static struct sysfs_ops sysfs_ops = {
28757+static const struct sysfs_ops sysfs_ops = {
28758 .show = show,
28759 .store = store,
28760 };
28761diff -urNp linux-2.6.32.46/drivers/cpuidle/sysfs.c linux-2.6.32.46/drivers/cpuidle/sysfs.c
28762--- linux-2.6.32.46/drivers/cpuidle/sysfs.c 2011-03-27 14:31:47.000000000 -0400
28763+++ linux-2.6.32.46/drivers/cpuidle/sysfs.c 2011-04-17 15:56:46.000000000 -0400
28764@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
28765 return ret;
28766 }
28767
28768-static struct sysfs_ops cpuidle_sysfs_ops = {
28769+static const struct sysfs_ops cpuidle_sysfs_ops = {
28770 .show = cpuidle_show,
28771 .store = cpuidle_store,
28772 };
28773@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
28774 return ret;
28775 }
28776
28777-static struct sysfs_ops cpuidle_state_sysfs_ops = {
28778+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
28779 .show = cpuidle_state_show,
28780 };
28781
28782@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
28783 .release = cpuidle_state_sysfs_release,
28784 };
28785
28786-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
28787+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
28788 {
28789 kobject_put(&device->kobjs[i]->kobj);
28790 wait_for_completion(&device->kobjs[i]->kobj_unregister);
28791diff -urNp linux-2.6.32.46/drivers/crypto/hifn_795x.c linux-2.6.32.46/drivers/crypto/hifn_795x.c
28792--- linux-2.6.32.46/drivers/crypto/hifn_795x.c 2011-03-27 14:31:47.000000000 -0400
28793+++ linux-2.6.32.46/drivers/crypto/hifn_795x.c 2011-05-16 21:46:57.000000000 -0400
28794@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28795 0xCA, 0x34, 0x2B, 0x2E};
28796 struct scatterlist sg;
28797
28798+ pax_track_stack();
28799+
28800 memset(src, 0, sizeof(src));
28801 memset(ctx.key, 0, sizeof(ctx.key));
28802
28803diff -urNp linux-2.6.32.46/drivers/crypto/padlock-aes.c linux-2.6.32.46/drivers/crypto/padlock-aes.c
28804--- linux-2.6.32.46/drivers/crypto/padlock-aes.c 2011-03-27 14:31:47.000000000 -0400
28805+++ linux-2.6.32.46/drivers/crypto/padlock-aes.c 2011-05-16 21:46:57.000000000 -0400
28806@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm
28807 struct crypto_aes_ctx gen_aes;
28808 int cpu;
28809
28810+ pax_track_stack();
28811+
28812 if (key_len % 8) {
28813 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28814 return -EINVAL;
28815diff -urNp linux-2.6.32.46/drivers/dma/ioat/dma.c linux-2.6.32.46/drivers/dma/ioat/dma.c
28816--- linux-2.6.32.46/drivers/dma/ioat/dma.c 2011-03-27 14:31:47.000000000 -0400
28817+++ linux-2.6.32.46/drivers/dma/ioat/dma.c 2011-04-17 15:56:46.000000000 -0400
28818@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
28819 return entry->show(&chan->common, page);
28820 }
28821
28822-struct sysfs_ops ioat_sysfs_ops = {
28823+const struct sysfs_ops ioat_sysfs_ops = {
28824 .show = ioat_attr_show,
28825 };
28826
28827diff -urNp linux-2.6.32.46/drivers/dma/ioat/dma.h linux-2.6.32.46/drivers/dma/ioat/dma.h
28828--- linux-2.6.32.46/drivers/dma/ioat/dma.h 2011-03-27 14:31:47.000000000 -0400
28829+++ linux-2.6.32.46/drivers/dma/ioat/dma.h 2011-04-17 15:56:46.000000000 -0400
28830@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
28831 unsigned long *phys_complete);
28832 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
28833 void ioat_kobject_del(struct ioatdma_device *device);
28834-extern struct sysfs_ops ioat_sysfs_ops;
28835+extern const struct sysfs_ops ioat_sysfs_ops;
28836 extern struct ioat_sysfs_entry ioat_version_attr;
28837 extern struct ioat_sysfs_entry ioat_cap_attr;
28838 #endif /* IOATDMA_H */
28839diff -urNp linux-2.6.32.46/drivers/edac/edac_device_sysfs.c linux-2.6.32.46/drivers/edac/edac_device_sysfs.c
28840--- linux-2.6.32.46/drivers/edac/edac_device_sysfs.c 2011-03-27 14:31:47.000000000 -0400
28841+++ linux-2.6.32.46/drivers/edac/edac_device_sysfs.c 2011-04-17 15:56:46.000000000 -0400
28842@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
28843 }
28844
28845 /* edac_dev file operations for an 'ctl_info' */
28846-static struct sysfs_ops device_ctl_info_ops = {
28847+static const struct sysfs_ops device_ctl_info_ops = {
28848 .show = edac_dev_ctl_info_show,
28849 .store = edac_dev_ctl_info_store
28850 };
28851@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
28852 }
28853
28854 /* edac_dev file operations for an 'instance' */
28855-static struct sysfs_ops device_instance_ops = {
28856+static const struct sysfs_ops device_instance_ops = {
28857 .show = edac_dev_instance_show,
28858 .store = edac_dev_instance_store
28859 };
28860@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
28861 }
28862
28863 /* edac_dev file operations for a 'block' */
28864-static struct sysfs_ops device_block_ops = {
28865+static const struct sysfs_ops device_block_ops = {
28866 .show = edac_dev_block_show,
28867 .store = edac_dev_block_store
28868 };
28869diff -urNp linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c
28870--- linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c 2011-03-27 14:31:47.000000000 -0400
28871+++ linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c 2011-04-17 15:56:46.000000000 -0400
28872@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
28873 return -EIO;
28874 }
28875
28876-static struct sysfs_ops csrowfs_ops = {
28877+static const struct sysfs_ops csrowfs_ops = {
28878 .show = csrowdev_show,
28879 .store = csrowdev_store
28880 };
28881@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
28882 }
28883
28884 /* Intermediate show/store table */
28885-static struct sysfs_ops mci_ops = {
28886+static const struct sysfs_ops mci_ops = {
28887 .show = mcidev_show,
28888 .store = mcidev_store
28889 };
28890diff -urNp linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c
28891--- linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c 2011-03-27 14:31:47.000000000 -0400
28892+++ linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c 2011-05-04 17:56:20.000000000 -0400
28893@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log
28894 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28895 static int edac_pci_poll_msec = 1000; /* one second workq period */
28896
28897-static atomic_t pci_parity_count = ATOMIC_INIT(0);
28898-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28899+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28900+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28901
28902 static struct kobject *edac_pci_top_main_kobj;
28903 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28904@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
28905 }
28906
28907 /* fs_ops table */
28908-static struct sysfs_ops pci_instance_ops = {
28909+static const struct sysfs_ops pci_instance_ops = {
28910 .show = edac_pci_instance_show,
28911 .store = edac_pci_instance_store
28912 };
28913@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
28914 return -EIO;
28915 }
28916
28917-static struct sysfs_ops edac_pci_sysfs_ops = {
28918+static const struct sysfs_ops edac_pci_sysfs_ops = {
28919 .show = edac_pci_dev_show,
28920 .store = edac_pci_dev_store
28921 };
28922@@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(str
28923 edac_printk(KERN_CRIT, EDAC_PCI,
28924 "Signaled System Error on %s\n",
28925 pci_name(dev));
28926- atomic_inc(&pci_nonparity_count);
28927+ atomic_inc_unchecked(&pci_nonparity_count);
28928 }
28929
28930 if (status & (PCI_STATUS_PARITY)) {
28931@@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(str
28932 "Master Data Parity Error on %s\n",
28933 pci_name(dev));
28934
28935- atomic_inc(&pci_parity_count);
28936+ atomic_inc_unchecked(&pci_parity_count);
28937 }
28938
28939 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28940@@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(str
28941 "Detected Parity Error on %s\n",
28942 pci_name(dev));
28943
28944- atomic_inc(&pci_parity_count);
28945+ atomic_inc_unchecked(&pci_parity_count);
28946 }
28947 }
28948
28949@@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(str
28950 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28951 "Signaled System Error on %s\n",
28952 pci_name(dev));
28953- atomic_inc(&pci_nonparity_count);
28954+ atomic_inc_unchecked(&pci_nonparity_count);
28955 }
28956
28957 if (status & (PCI_STATUS_PARITY)) {
28958@@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(str
28959 "Master Data Parity Error on "
28960 "%s\n", pci_name(dev));
28961
28962- atomic_inc(&pci_parity_count);
28963+ atomic_inc_unchecked(&pci_parity_count);
28964 }
28965
28966 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28967@@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(str
28968 "Detected Parity Error on %s\n",
28969 pci_name(dev));
28970
28971- atomic_inc(&pci_parity_count);
28972+ atomic_inc_unchecked(&pci_parity_count);
28973 }
28974 }
28975 }
28976@@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
28977 if (!check_pci_errors)
28978 return;
28979
28980- before_count = atomic_read(&pci_parity_count);
28981+ before_count = atomic_read_unchecked(&pci_parity_count);
28982
28983 /* scan all PCI devices looking for a Parity Error on devices and
28984 * bridges.
28985@@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
28986 /* Only if operator has selected panic on PCI Error */
28987 if (edac_pci_get_panic_on_pe()) {
28988 /* If the count is different 'after' from 'before' */
28989- if (before_count != atomic_read(&pci_parity_count))
28990+ if (before_count != atomic_read_unchecked(&pci_parity_count))
28991 panic("EDAC: PCI Parity Error");
28992 }
28993 }
28994diff -urNp linux-2.6.32.46/drivers/firewire/core-card.c linux-2.6.32.46/drivers/firewire/core-card.c
28995--- linux-2.6.32.46/drivers/firewire/core-card.c 2011-03-27 14:31:47.000000000 -0400
28996+++ linux-2.6.32.46/drivers/firewire/core-card.c 2011-08-23 21:22:32.000000000 -0400
28997@@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
28998
28999 void fw_core_remove_card(struct fw_card *card)
29000 {
29001- struct fw_card_driver dummy_driver = dummy_driver_template;
29002+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
29003
29004 card->driver->update_phy_reg(card, 4,
29005 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
29006diff -urNp linux-2.6.32.46/drivers/firewire/core-cdev.c linux-2.6.32.46/drivers/firewire/core-cdev.c
29007--- linux-2.6.32.46/drivers/firewire/core-cdev.c 2011-03-27 14:31:47.000000000 -0400
29008+++ linux-2.6.32.46/drivers/firewire/core-cdev.c 2011-04-17 15:56:46.000000000 -0400
29009@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
29010 int ret;
29011
29012 if ((request->channels == 0 && request->bandwidth == 0) ||
29013- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
29014- request->bandwidth < 0)
29015+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
29016 return -EINVAL;
29017
29018 r = kmalloc(sizeof(*r), GFP_KERNEL);
29019diff -urNp linux-2.6.32.46/drivers/firewire/core.h linux-2.6.32.46/drivers/firewire/core.h
29020--- linux-2.6.32.46/drivers/firewire/core.h 2011-03-27 14:31:47.000000000 -0400
29021+++ linux-2.6.32.46/drivers/firewire/core.h 2011-08-23 20:24:26.000000000 -0400
29022@@ -86,6 +86,7 @@ struct fw_card_driver {
29023
29024 int (*stop_iso)(struct fw_iso_context *ctx);
29025 };
29026+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
29027
29028 void fw_card_initialize(struct fw_card *card,
29029 const struct fw_card_driver *driver, struct device *device);
29030diff -urNp linux-2.6.32.46/drivers/firewire/core-transaction.c linux-2.6.32.46/drivers/firewire/core-transaction.c
29031--- linux-2.6.32.46/drivers/firewire/core-transaction.c 2011-03-27 14:31:47.000000000 -0400
29032+++ linux-2.6.32.46/drivers/firewire/core-transaction.c 2011-05-16 21:46:57.000000000 -0400
29033@@ -36,6 +36,7 @@
29034 #include <linux/string.h>
29035 #include <linux/timer.h>
29036 #include <linux/types.h>
29037+#include <linux/sched.h>
29038
29039 #include <asm/byteorder.h>
29040
29041@@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *c
29042 struct transaction_callback_data d;
29043 struct fw_transaction t;
29044
29045+ pax_track_stack();
29046+
29047 init_completion(&d.done);
29048 d.payload = payload;
29049 fw_send_request(card, &t, tcode, destination_id, generation, speed,
29050diff -urNp linux-2.6.32.46/drivers/firmware/dmi_scan.c linux-2.6.32.46/drivers/firmware/dmi_scan.c
29051--- linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400
29052+++ linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-04-17 15:56:46.000000000 -0400
29053@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
29054 }
29055 }
29056 else {
29057- /*
29058- * no iounmap() for that ioremap(); it would be a no-op, but
29059- * it's so early in setup that sucker gets confused into doing
29060- * what it shouldn't if we actually call it.
29061- */
29062 p = dmi_ioremap(0xF0000, 0x10000);
29063 if (p == NULL)
29064 goto error;
29065diff -urNp linux-2.6.32.46/drivers/firmware/edd.c linux-2.6.32.46/drivers/firmware/edd.c
29066--- linux-2.6.32.46/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400
29067+++ linux-2.6.32.46/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400
29068@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
29069 return ret;
29070 }
29071
29072-static struct sysfs_ops edd_attr_ops = {
29073+static const struct sysfs_ops edd_attr_ops = {
29074 .show = edd_attr_show,
29075 };
29076
29077diff -urNp linux-2.6.32.46/drivers/firmware/efivars.c linux-2.6.32.46/drivers/firmware/efivars.c
29078--- linux-2.6.32.46/drivers/firmware/efivars.c 2011-03-27 14:31:47.000000000 -0400
29079+++ linux-2.6.32.46/drivers/firmware/efivars.c 2011-04-17 15:56:46.000000000 -0400
29080@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
29081 return ret;
29082 }
29083
29084-static struct sysfs_ops efivar_attr_ops = {
29085+static const struct sysfs_ops efivar_attr_ops = {
29086 .show = efivar_attr_show,
29087 .store = efivar_attr_store,
29088 };
29089diff -urNp linux-2.6.32.46/drivers/firmware/iscsi_ibft.c linux-2.6.32.46/drivers/firmware/iscsi_ibft.c
29090--- linux-2.6.32.46/drivers/firmware/iscsi_ibft.c 2011-03-27 14:31:47.000000000 -0400
29091+++ linux-2.6.32.46/drivers/firmware/iscsi_ibft.c 2011-04-17 15:56:46.000000000 -0400
29092@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
29093 return ret;
29094 }
29095
29096-static struct sysfs_ops ibft_attr_ops = {
29097+static const struct sysfs_ops ibft_attr_ops = {
29098 .show = ibft_show_attribute,
29099 };
29100
29101diff -urNp linux-2.6.32.46/drivers/firmware/memmap.c linux-2.6.32.46/drivers/firmware/memmap.c
29102--- linux-2.6.32.46/drivers/firmware/memmap.c 2011-03-27 14:31:47.000000000 -0400
29103+++ linux-2.6.32.46/drivers/firmware/memmap.c 2011-04-17 15:56:46.000000000 -0400
29104@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
29105 NULL
29106 };
29107
29108-static struct sysfs_ops memmap_attr_ops = {
29109+static const struct sysfs_ops memmap_attr_ops = {
29110 .show = memmap_attr_show,
29111 };
29112
29113diff -urNp linux-2.6.32.46/drivers/gpio/vr41xx_giu.c linux-2.6.32.46/drivers/gpio/vr41xx_giu.c
29114--- linux-2.6.32.46/drivers/gpio/vr41xx_giu.c 2011-03-27 14:31:47.000000000 -0400
29115+++ linux-2.6.32.46/drivers/gpio/vr41xx_giu.c 2011-05-04 17:56:28.000000000 -0400
29116@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
29117 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
29118 maskl, pendl, maskh, pendh);
29119
29120- atomic_inc(&irq_err_count);
29121+ atomic_inc_unchecked(&irq_err_count);
29122
29123 return -EINVAL;
29124 }
29125diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c
29126--- linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400
29127+++ linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400
29128@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct d
29129 struct drm_crtc *tmp;
29130 int crtc_mask = 1;
29131
29132- WARN(!crtc, "checking null crtc?");
29133+ BUG_ON(!crtc);
29134
29135 dev = crtc->dev;
29136
29137@@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm
29138
29139 adjusted_mode = drm_mode_duplicate(dev, mode);
29140
29141+ pax_track_stack();
29142+
29143 crtc->enabled = drm_helper_crtc_in_use(crtc);
29144
29145 if (!crtc->enabled)
29146diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_drv.c linux-2.6.32.46/drivers/gpu/drm/drm_drv.c
29147--- linux-2.6.32.46/drivers/gpu/drm/drm_drv.c 2011-03-27 14:31:47.000000000 -0400
29148+++ linux-2.6.32.46/drivers/gpu/drm/drm_drv.c 2011-04-17 15:56:46.000000000 -0400
29149@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
29150 char *kdata = NULL;
29151
29152 atomic_inc(&dev->ioctl_count);
29153- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
29154+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
29155 ++file_priv->ioctl_count;
29156
29157 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
29158diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_fops.c linux-2.6.32.46/drivers/gpu/drm/drm_fops.c
29159--- linux-2.6.32.46/drivers/gpu/drm/drm_fops.c 2011-03-27 14:31:47.000000000 -0400
29160+++ linux-2.6.32.46/drivers/gpu/drm/drm_fops.c 2011-04-17 15:56:46.000000000 -0400
29161@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
29162 }
29163
29164 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
29165- atomic_set(&dev->counts[i], 0);
29166+ atomic_set_unchecked(&dev->counts[i], 0);
29167
29168 dev->sigdata.lock = NULL;
29169
29170@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
29171
29172 retcode = drm_open_helper(inode, filp, dev);
29173 if (!retcode) {
29174- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
29175+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
29176 spin_lock(&dev->count_lock);
29177- if (!dev->open_count++) {
29178+ if (local_inc_return(&dev->open_count) == 1) {
29179 spin_unlock(&dev->count_lock);
29180 retcode = drm_setup(dev);
29181 goto out;
29182@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
29183
29184 lock_kernel();
29185
29186- DRM_DEBUG("open_count = %d\n", dev->open_count);
29187+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
29188
29189 if (dev->driver->preclose)
29190 dev->driver->preclose(dev, file_priv);
29191@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
29192 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
29193 task_pid_nr(current),
29194 (long)old_encode_dev(file_priv->minor->device),
29195- dev->open_count);
29196+ local_read(&dev->open_count));
29197
29198 /* if the master has gone away we can't do anything with the lock */
29199 if (file_priv->minor->master)
29200@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
29201 * End inline drm_release
29202 */
29203
29204- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
29205+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
29206 spin_lock(&dev->count_lock);
29207- if (!--dev->open_count) {
29208+ if (local_dec_and_test(&dev->open_count)) {
29209 if (atomic_read(&dev->ioctl_count)) {
29210 DRM_ERROR("Device busy: %d\n",
29211 atomic_read(&dev->ioctl_count));
29212diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_gem.c linux-2.6.32.46/drivers/gpu/drm/drm_gem.c
29213--- linux-2.6.32.46/drivers/gpu/drm/drm_gem.c 2011-03-27 14:31:47.000000000 -0400
29214+++ linux-2.6.32.46/drivers/gpu/drm/drm_gem.c 2011-04-17 15:56:46.000000000 -0400
29215@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
29216 spin_lock_init(&dev->object_name_lock);
29217 idr_init(&dev->object_name_idr);
29218 atomic_set(&dev->object_count, 0);
29219- atomic_set(&dev->object_memory, 0);
29220+ atomic_set_unchecked(&dev->object_memory, 0);
29221 atomic_set(&dev->pin_count, 0);
29222- atomic_set(&dev->pin_memory, 0);
29223+ atomic_set_unchecked(&dev->pin_memory, 0);
29224 atomic_set(&dev->gtt_count, 0);
29225- atomic_set(&dev->gtt_memory, 0);
29226+ atomic_set_unchecked(&dev->gtt_memory, 0);
29227
29228 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
29229 if (!mm) {
29230@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *
29231 goto fput;
29232 }
29233 atomic_inc(&dev->object_count);
29234- atomic_add(obj->size, &dev->object_memory);
29235+ atomic_add_unchecked(obj->size, &dev->object_memory);
29236 return obj;
29237 fput:
29238 fput(obj->filp);
29239@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
29240
29241 fput(obj->filp);
29242 atomic_dec(&dev->object_count);
29243- atomic_sub(obj->size, &dev->object_memory);
29244+ atomic_sub_unchecked(obj->size, &dev->object_memory);
29245 kfree(obj);
29246 }
29247 EXPORT_SYMBOL(drm_gem_object_free);
29248diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_info.c linux-2.6.32.46/drivers/gpu/drm/drm_info.c
29249--- linux-2.6.32.46/drivers/gpu/drm/drm_info.c 2011-03-27 14:31:47.000000000 -0400
29250+++ linux-2.6.32.46/drivers/gpu/drm/drm_info.c 2011-04-17 15:56:46.000000000 -0400
29251@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
29252 struct drm_local_map *map;
29253 struct drm_map_list *r_list;
29254
29255- /* Hardcoded from _DRM_FRAME_BUFFER,
29256- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
29257- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
29258- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
29259+ static const char * const types[] = {
29260+ [_DRM_FRAME_BUFFER] = "FB",
29261+ [_DRM_REGISTERS] = "REG",
29262+ [_DRM_SHM] = "SHM",
29263+ [_DRM_AGP] = "AGP",
29264+ [_DRM_SCATTER_GATHER] = "SG",
29265+ [_DRM_CONSISTENT] = "PCI",
29266+ [_DRM_GEM] = "GEM" };
29267 const char *type;
29268 int i;
29269
29270@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
29271 map = r_list->map;
29272 if (!map)
29273 continue;
29274- if (map->type < 0 || map->type > 5)
29275+ if (map->type >= ARRAY_SIZE(types))
29276 type = "??";
29277 else
29278 type = types[map->type];
29279@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file
29280 struct drm_device *dev = node->minor->dev;
29281
29282 seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
29283- seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
29284+ seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
29285 seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
29286- seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
29287- seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
29288+ seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
29289+ seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
29290 seq_printf(m, "%d gtt total\n", dev->gtt_total);
29291 return 0;
29292 }
29293@@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, voi
29294 mutex_lock(&dev->struct_mutex);
29295 seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
29296 atomic_read(&dev->vma_count),
29297+#ifdef CONFIG_GRKERNSEC_HIDESYM
29298+ NULL, 0);
29299+#else
29300 high_memory, (u64)virt_to_phys(high_memory));
29301+#endif
29302
29303 list_for_each_entry(pt, &dev->vmalist, head) {
29304 vma = pt->vma;
29305@@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, voi
29306 continue;
29307 seq_printf(m,
29308 "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
29309- pt->pid, vma->vm_start, vma->vm_end,
29310+ pt->pid,
29311+#ifdef CONFIG_GRKERNSEC_HIDESYM
29312+ 0, 0,
29313+#else
29314+ vma->vm_start, vma->vm_end,
29315+#endif
29316 vma->vm_flags & VM_READ ? 'r' : '-',
29317 vma->vm_flags & VM_WRITE ? 'w' : '-',
29318 vma->vm_flags & VM_EXEC ? 'x' : '-',
29319 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
29320 vma->vm_flags & VM_LOCKED ? 'l' : '-',
29321 vma->vm_flags & VM_IO ? 'i' : '-',
29322+#ifdef CONFIG_GRKERNSEC_HIDESYM
29323+ 0);
29324+#else
29325 vma->vm_pgoff);
29326+#endif
29327
29328 #if defined(__i386__)
29329 pgprot = pgprot_val(vma->vm_page_prot);
29330diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c
29331--- linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400
29332+++ linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400
29333@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
29334 stats->data[i].value =
29335 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
29336 else
29337- stats->data[i].value = atomic_read(&dev->counts[i]);
29338+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
29339 stats->data[i].type = dev->types[i];
29340 }
29341
29342diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_lock.c linux-2.6.32.46/drivers/gpu/drm/drm_lock.c
29343--- linux-2.6.32.46/drivers/gpu/drm/drm_lock.c 2011-03-27 14:31:47.000000000 -0400
29344+++ linux-2.6.32.46/drivers/gpu/drm/drm_lock.c 2011-04-17 15:56:46.000000000 -0400
29345@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
29346 if (drm_lock_take(&master->lock, lock->context)) {
29347 master->lock.file_priv = file_priv;
29348 master->lock.lock_time = jiffies;
29349- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
29350+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
29351 break; /* Got lock */
29352 }
29353
29354@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
29355 return -EINVAL;
29356 }
29357
29358- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
29359+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
29360
29361 /* kernel_context_switch isn't used by any of the x86 drm
29362 * modules but is required by the Sparc driver.
29363diff -urNp linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c
29364--- linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c 2011-03-27 14:31:47.000000000 -0400
29365+++ linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c 2011-04-17 15:56:46.000000000 -0400
29366@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
29367 dma->buflist[vertex->idx],
29368 vertex->discard, vertex->used);
29369
29370- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29371- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29372+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29373+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29374 sarea_priv->last_enqueue = dev_priv->counter - 1;
29375 sarea_priv->last_dispatch = (int)hw_status[5];
29376
29377@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
29378 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
29379 mc->last_render);
29380
29381- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29382- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29383+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29384+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29385 sarea_priv->last_enqueue = dev_priv->counter - 1;
29386 sarea_priv->last_dispatch = (int)hw_status[5];
29387
29388diff -urNp linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h
29389--- linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h 2011-03-27 14:31:47.000000000 -0400
29390+++ linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h 2011-05-04 17:56:28.000000000 -0400
29391@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
29392 int page_flipping;
29393
29394 wait_queue_head_t irq_queue;
29395- atomic_t irq_received;
29396- atomic_t irq_emitted;
29397+ atomic_unchecked_t irq_received;
29398+ atomic_unchecked_t irq_emitted;
29399
29400 int front_offset;
29401 } drm_i810_private_t;
29402diff -urNp linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h
29403--- linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h 2011-03-27 14:31:47.000000000 -0400
29404+++ linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h 2011-05-04 17:56:28.000000000 -0400
29405@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
29406 int page_flipping;
29407
29408 wait_queue_head_t irq_queue;
29409- atomic_t irq_received;
29410- atomic_t irq_emitted;
29411+ atomic_unchecked_t irq_received;
29412+ atomic_unchecked_t irq_emitted;
29413
29414 int use_mi_batchbuffer_start;
29415
29416diff -urNp linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c
29417--- linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c 2011-03-27 14:31:47.000000000 -0400
29418+++ linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c 2011-05-04 17:56:28.000000000 -0400
29419@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
29420
29421 I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
29422
29423- atomic_inc(&dev_priv->irq_received);
29424+ atomic_inc_unchecked(&dev_priv->irq_received);
29425 wake_up_interruptible(&dev_priv->irq_queue);
29426
29427 return IRQ_HANDLED;
29428@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_devi
29429
29430 DRM_DEBUG("%s\n", __func__);
29431
29432- atomic_inc(&dev_priv->irq_emitted);
29433+ atomic_inc_unchecked(&dev_priv->irq_emitted);
29434
29435 BEGIN_LP_RING(2);
29436 OUT_RING(0);
29437 OUT_RING(GFX_OP_USER_INTERRUPT);
29438 ADVANCE_LP_RING();
29439
29440- return atomic_read(&dev_priv->irq_emitted);
29441+ return atomic_read_unchecked(&dev_priv->irq_emitted);
29442 }
29443
29444 static int i830_wait_irq(struct drm_device * dev, int irq_nr)
29445@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_devi
29446
29447 DRM_DEBUG("%s\n", __func__);
29448
29449- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
29450+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
29451 return 0;
29452
29453 dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
29454@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_devi
29455
29456 for (;;) {
29457 __set_current_state(TASK_INTERRUPTIBLE);
29458- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
29459+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
29460 break;
29461 if ((signed)(end - jiffies) <= 0) {
29462 DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
29463@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct d
29464 I830_WRITE16(I830REG_HWSTAM, 0xffff);
29465 I830_WRITE16(I830REG_INT_MASK_R, 0x0);
29466 I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
29467- atomic_set(&dev_priv->irq_received, 0);
29468- atomic_set(&dev_priv->irq_emitted, 0);
29469+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29470+ atomic_set_unchecked(&dev_priv->irq_emitted, 0);
29471 init_waitqueue_head(&dev_priv->irq_queue);
29472 }
29473
29474diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c
29475--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c 2011-03-27 14:31:47.000000000 -0400
29476+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c 2011-04-17 15:56:46.000000000 -0400
29477@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
29478 }
29479 }
29480
29481-struct intel_dvo_dev_ops ch7017_ops = {
29482+const struct intel_dvo_dev_ops ch7017_ops = {
29483 .init = ch7017_init,
29484 .detect = ch7017_detect,
29485 .mode_valid = ch7017_mode_valid,
29486diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c
29487--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-03-27 14:31:47.000000000 -0400
29488+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-04-17 15:56:46.000000000 -0400
29489@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
29490 }
29491 }
29492
29493-struct intel_dvo_dev_ops ch7xxx_ops = {
29494+const struct intel_dvo_dev_ops ch7xxx_ops = {
29495 .init = ch7xxx_init,
29496 .detect = ch7xxx_detect,
29497 .mode_valid = ch7xxx_mode_valid,
29498diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h
29499--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h 2011-03-27 14:31:47.000000000 -0400
29500+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h 2011-04-17 15:56:46.000000000 -0400
29501@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
29502 *
29503 * \return singly-linked list of modes or NULL if no modes found.
29504 */
29505- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
29506+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
29507
29508 /**
29509 * Clean up driver-specific bits of the output
29510 */
29511- void (*destroy) (struct intel_dvo_device *dvo);
29512+ void (* const destroy) (struct intel_dvo_device *dvo);
29513
29514 /**
29515 * Debugging hook to dump device registers to log file
29516 */
29517- void (*dump_regs)(struct intel_dvo_device *dvo);
29518+ void (* const dump_regs)(struct intel_dvo_device *dvo);
29519 };
29520
29521-extern struct intel_dvo_dev_ops sil164_ops;
29522-extern struct intel_dvo_dev_ops ch7xxx_ops;
29523-extern struct intel_dvo_dev_ops ivch_ops;
29524-extern struct intel_dvo_dev_ops tfp410_ops;
29525-extern struct intel_dvo_dev_ops ch7017_ops;
29526+extern const struct intel_dvo_dev_ops sil164_ops;
29527+extern const struct intel_dvo_dev_ops ch7xxx_ops;
29528+extern const struct intel_dvo_dev_ops ivch_ops;
29529+extern const struct intel_dvo_dev_ops tfp410_ops;
29530+extern const struct intel_dvo_dev_ops ch7017_ops;
29531
29532 #endif /* _INTEL_DVO_H */
29533diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c
29534--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c 2011-03-27 14:31:47.000000000 -0400
29535+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c 2011-04-17 15:56:46.000000000 -0400
29536@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
29537 }
29538 }
29539
29540-struct intel_dvo_dev_ops ivch_ops= {
29541+const struct intel_dvo_dev_ops ivch_ops= {
29542 .init = ivch_init,
29543 .dpms = ivch_dpms,
29544 .save = ivch_save,
29545diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c
29546--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c 2011-03-27 14:31:47.000000000 -0400
29547+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c 2011-04-17 15:56:46.000000000 -0400
29548@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
29549 }
29550 }
29551
29552-struct intel_dvo_dev_ops sil164_ops = {
29553+const struct intel_dvo_dev_ops sil164_ops = {
29554 .init = sil164_init,
29555 .detect = sil164_detect,
29556 .mode_valid = sil164_mode_valid,
29557diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c
29558--- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c 2011-03-27 14:31:47.000000000 -0400
29559+++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c 2011-04-17 15:56:46.000000000 -0400
29560@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
29561 }
29562 }
29563
29564-struct intel_dvo_dev_ops tfp410_ops = {
29565+const struct intel_dvo_dev_ops tfp410_ops = {
29566 .init = tfp410_init,
29567 .detect = tfp410_detect,
29568 .mode_valid = tfp410_mode_valid,
29569diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c
29570--- linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c 2011-03-27 14:31:47.000000000 -0400
29571+++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-04 17:56:28.000000000 -0400
29572@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct se
29573 I915_READ(GTIMR));
29574 }
29575 seq_printf(m, "Interrupts received: %d\n",
29576- atomic_read(&dev_priv->irq_received));
29577+ atomic_read_unchecked(&dev_priv->irq_received));
29578 if (dev_priv->hw_status_page != NULL) {
29579 seq_printf(m, "Current sequence: %d\n",
29580 i915_get_gem_seqno(dev));
29581diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c
29582--- linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c 2011-03-27 14:31:47.000000000 -0400
29583+++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c 2011-04-17 15:56:46.000000000 -0400
29584@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
29585 return i915_resume(dev);
29586 }
29587
29588-static struct vm_operations_struct i915_gem_vm_ops = {
29589+static const struct vm_operations_struct i915_gem_vm_ops = {
29590 .fault = i915_gem_fault,
29591 .open = drm_gem_vm_open,
29592 .close = drm_gem_vm_close,
29593diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h
29594--- linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h 2011-03-27 14:31:47.000000000 -0400
29595+++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h 2011-08-05 20:33:55.000000000 -0400
29596@@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
29597 /* display clock increase/decrease */
29598 /* pll clock increase/decrease */
29599 /* clock gating init */
29600-};
29601+} __no_const;
29602
29603 typedef struct drm_i915_private {
29604 struct drm_device *dev;
29605@@ -197,7 +197,7 @@ typedef struct drm_i915_private {
29606 int page_flipping;
29607
29608 wait_queue_head_t irq_queue;
29609- atomic_t irq_received;
29610+ atomic_unchecked_t irq_received;
29611 /** Protects user_irq_refcount and irq_mask_reg */
29612 spinlock_t user_irq_lock;
29613 /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
29614diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c
29615--- linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c 2011-03-27 14:31:47.000000000 -0400
29616+++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c 2011-04-17 15:56:46.000000000 -0400
29617@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
29618
29619 args->aper_size = dev->gtt_total;
29620 args->aper_available_size = (args->aper_size -
29621- atomic_read(&dev->pin_memory));
29622+ atomic_read_unchecked(&dev->pin_memory));
29623
29624 return 0;
29625 }
29626@@ -492,6 +492,11 @@ i915_gem_pread_ioctl(struct drm_device *
29627 return -EINVAL;
29628 }
29629
29630+ if (!access_ok(VERIFY_WRITE, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
29631+ drm_gem_object_unreference(obj);
29632+ return -EFAULT;
29633+ }
29634+
29635 if (i915_gem_object_needs_bit17_swizzle(obj)) {
29636 ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
29637 } else {
29638@@ -965,6 +970,11 @@ i915_gem_pwrite_ioctl(struct drm_device
29639 return -EINVAL;
29640 }
29641
29642+ if (!access_ok(VERIFY_READ, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
29643+ drm_gem_object_unreference(obj);
29644+ return -EFAULT;
29645+ }
29646+
29647 /* We can only do the GTT pwrite on untiled buffers, as otherwise
29648 * it would end up going through the fenced access, and we'll get
29649 * different detiling behavior between reading and writing.
29650@@ -2054,7 +2064,7 @@ i915_gem_object_unbind(struct drm_gem_ob
29651
29652 if (obj_priv->gtt_space) {
29653 atomic_dec(&dev->gtt_count);
29654- atomic_sub(obj->size, &dev->gtt_memory);
29655+ atomic_sub_unchecked(obj->size, &dev->gtt_memory);
29656
29657 drm_mm_put_block(obj_priv->gtt_space);
29658 obj_priv->gtt_space = NULL;
29659@@ -2697,7 +2707,7 @@ i915_gem_object_bind_to_gtt(struct drm_g
29660 goto search_free;
29661 }
29662 atomic_inc(&dev->gtt_count);
29663- atomic_add(obj->size, &dev->gtt_memory);
29664+ atomic_add_unchecked(obj->size, &dev->gtt_memory);
29665
29666 /* Assert that the object is not currently in any GPU domain. As it
29667 * wasn't in the GTT, there shouldn't be any way it could have been in
29668@@ -3751,9 +3761,9 @@ i915_gem_execbuffer(struct drm_device *d
29669 "%d/%d gtt bytes\n",
29670 atomic_read(&dev->object_count),
29671 atomic_read(&dev->pin_count),
29672- atomic_read(&dev->object_memory),
29673- atomic_read(&dev->pin_memory),
29674- atomic_read(&dev->gtt_memory),
29675+ atomic_read_unchecked(&dev->object_memory),
29676+ atomic_read_unchecked(&dev->pin_memory),
29677+ atomic_read_unchecked(&dev->gtt_memory),
29678 dev->gtt_total);
29679 }
29680 goto err;
29681@@ -3985,7 +3995,7 @@ i915_gem_object_pin(struct drm_gem_objec
29682 */
29683 if (obj_priv->pin_count == 1) {
29684 atomic_inc(&dev->pin_count);
29685- atomic_add(obj->size, &dev->pin_memory);
29686+ atomic_add_unchecked(obj->size, &dev->pin_memory);
29687 if (!obj_priv->active &&
29688 (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
29689 !list_empty(&obj_priv->list))
29690@@ -4018,7 +4028,7 @@ i915_gem_object_unpin(struct drm_gem_obj
29691 list_move_tail(&obj_priv->list,
29692 &dev_priv->mm.inactive_list);
29693 atomic_dec(&dev->pin_count);
29694- atomic_sub(obj->size, &dev->pin_memory);
29695+ atomic_sub_unchecked(obj->size, &dev->pin_memory);
29696 }
29697 i915_verify_inactive(dev, __FILE__, __LINE__);
29698 }
29699diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c
29700--- linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c 2011-03-27 14:31:47.000000000 -0400
29701+++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c 2011-05-04 17:56:28.000000000 -0400
29702@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29703 int irq_received;
29704 int ret = IRQ_NONE;
29705
29706- atomic_inc(&dev_priv->irq_received);
29707+ atomic_inc_unchecked(&dev_priv->irq_received);
29708
29709 if (IS_IGDNG(dev))
29710 return igdng_irq_handler(dev);
29711@@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct d
29712 {
29713 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
29714
29715- atomic_set(&dev_priv->irq_received, 0);
29716+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29717
29718 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29719 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
29720diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c
29721--- linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c 2011-03-27 14:31:47.000000000 -0400
29722+++ linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c 2011-08-05 20:33:55.000000000 -0400
29723@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *
29724 sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
29725
29726 /* Save the bit-banging i2c functionality for use by the DDC wrapper */
29727- intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
29728+ pax_open_kernel();
29729+ *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
29730+ pax_close_kernel();
29731
29732 /* Read the regs to test if we can talk to the device */
29733 for (i = 0; i < 0x40; i++) {
29734diff -urNp linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h
29735--- linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h 2011-03-27 14:31:47.000000000 -0400
29736+++ linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h 2011-05-04 17:56:28.000000000 -0400
29737@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29738 u32 clear_cmd;
29739 u32 maccess;
29740
29741- atomic_t vbl_received; /**< Number of vblanks received. */
29742+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29743 wait_queue_head_t fence_queue;
29744- atomic_t last_fence_retired;
29745+ atomic_unchecked_t last_fence_retired;
29746 u32 next_fence_to_post;
29747
29748 unsigned int fb_cpp;
29749diff -urNp linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c
29750--- linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c 2011-03-27 14:31:47.000000000 -0400
29751+++ linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c 2011-05-04 17:56:28.000000000 -0400
29752@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29753 if (crtc != 0)
29754 return 0;
29755
29756- return atomic_read(&dev_priv->vbl_received);
29757+ return atomic_read_unchecked(&dev_priv->vbl_received);
29758 }
29759
29760
29761@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29762 /* VBLANK interrupt */
29763 if (status & MGA_VLINEPEN) {
29764 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29765- atomic_inc(&dev_priv->vbl_received);
29766+ atomic_inc_unchecked(&dev_priv->vbl_received);
29767 drm_handle_vblank(dev, 0);
29768 handled = 1;
29769 }
29770@@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29771 MGA_WRITE(MGA_PRIMEND, prim_end);
29772 }
29773
29774- atomic_inc(&dev_priv->last_fence_retired);
29775+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
29776 DRM_WAKEUP(&dev_priv->fence_queue);
29777 handled = 1;
29778 }
29779@@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_dev
29780 * using fences.
29781 */
29782 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29783- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29784+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29785 - *sequence) <= (1 << 23)));
29786
29787 *sequence = cur_fence;
29788diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c
29789--- linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c 2011-03-27 14:31:47.000000000 -0400
29790+++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c 2011-05-04 17:56:28.000000000 -0400
29791@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29792
29793 /* GH: Simple idle check.
29794 */
29795- atomic_set(&dev_priv->idle_count, 0);
29796+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29797
29798 /* We don't support anything other than bus-mastering ring mode,
29799 * but the ring can be in either AGP or PCI space for the ring
29800diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h
29801--- linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h 2011-03-27 14:31:47.000000000 -0400
29802+++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h 2011-05-04 17:56:28.000000000 -0400
29803@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29804 int is_pci;
29805 unsigned long cce_buffers_offset;
29806
29807- atomic_t idle_count;
29808+ atomic_unchecked_t idle_count;
29809
29810 int page_flipping;
29811 int current_page;
29812 u32 crtc_offset;
29813 u32 crtc_offset_cntl;
29814
29815- atomic_t vbl_received;
29816+ atomic_unchecked_t vbl_received;
29817
29818 u32 color_fmt;
29819 unsigned int front_offset;
29820diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c
29821--- linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c 2011-03-27 14:31:47.000000000 -0400
29822+++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c 2011-05-04 17:56:28.000000000 -0400
29823@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29824 if (crtc != 0)
29825 return 0;
29826
29827- return atomic_read(&dev_priv->vbl_received);
29828+ return atomic_read_unchecked(&dev_priv->vbl_received);
29829 }
29830
29831 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29832@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29833 /* VBLANK interrupt */
29834 if (status & R128_CRTC_VBLANK_INT) {
29835 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29836- atomic_inc(&dev_priv->vbl_received);
29837+ atomic_inc_unchecked(&dev_priv->vbl_received);
29838 drm_handle_vblank(dev, 0);
29839 return IRQ_HANDLED;
29840 }
29841diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c
29842--- linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c 2011-03-27 14:31:47.000000000 -0400
29843+++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c 2011-05-04 17:56:28.000000000 -0400
29844@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_priv
29845
29846 static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
29847 {
29848- if (atomic_read(&dev_priv->idle_count) == 0) {
29849+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
29850 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29851 } else {
29852- atomic_set(&dev_priv->idle_count, 0);
29853+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29854 }
29855 }
29856
29857diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c
29858--- linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c 2011-05-10 22:12:01.000000000 -0400
29859+++ linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c 2011-05-16 21:46:57.000000000 -0400
29860@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct c
29861 char name[512];
29862 int i;
29863
29864+ pax_track_stack();
29865+
29866 ctx->card = card;
29867 ctx->bios = bios;
29868
29869diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c
29870--- linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c 2011-03-27 14:31:47.000000000 -0400
29871+++ linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c 2011-04-17 15:56:46.000000000 -0400
29872@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29873 regex_t mask_rex;
29874 regmatch_t match[4];
29875 char buf[1024];
29876- size_t end;
29877+ long end;
29878 int len;
29879 int done = 0;
29880 int r;
29881 unsigned o;
29882 struct offset *offset;
29883 char last_reg_s[10];
29884- int last_reg;
29885+ unsigned long last_reg;
29886
29887 if (regcomp
29888 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
29889diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c
29890--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c 2011-03-27 14:31:47.000000000 -0400
29891+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-16 21:46:57.000000000 -0400
29892@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from
29893 bool linkb;
29894 struct radeon_i2c_bus_rec ddc_bus;
29895
29896+ pax_track_stack();
29897+
29898 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
29899
29900 if (data_offset == 0)
29901@@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_o
29902 }
29903 }
29904
29905-struct bios_connector {
29906+static struct bios_connector {
29907 bool valid;
29908 uint16_t line_mux;
29909 uint16_t devices;
29910 int connector_type;
29911 struct radeon_i2c_bus_rec ddc_bus;
29912-};
29913+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
29914
29915 bool radeon_get_atom_connector_info_from_supported_devices_table(struct
29916 drm_device
29917@@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from
29918 uint8_t dac;
29919 union atom_supported_devices *supported_devices;
29920 int i, j;
29921- struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
29922
29923 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
29924
29925diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c
29926--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c 2011-03-27 14:31:47.000000000 -0400
29927+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c 2011-04-17 15:56:46.000000000 -0400
29928@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
29929
29930 if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
29931 error = freq - current_freq;
29932- error = error < 0 ? 0xffffffff : error;
29933+ error = (int32_t)error < 0 ? 0xffffffff : error;
29934 } else
29935 error = abs(current_freq - freq);
29936 vco_diff = abs(vco - best_vco);
29937diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h
29938--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h 2011-03-27 14:31:47.000000000 -0400
29939+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-04 17:56:28.000000000 -0400
29940@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
29941
29942 /* SW interrupt */
29943 wait_queue_head_t swi_queue;
29944- atomic_t swi_emitted;
29945+ atomic_unchecked_t swi_emitted;
29946 int vblank_crtc;
29947 uint32_t irq_enable_reg;
29948 uint32_t r500_disp_irq_reg;
29949diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c
29950--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c 2011-03-27 14:31:47.000000000 -0400
29951+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-04 17:56:28.000000000 -0400
29952@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_devi
29953 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29954 return 0;
29955 }
29956- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29957+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29958 if (!rdev->cp.ready) {
29959 /* FIXME: cp is not running assume everythings is done right
29960 * away
29961@@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct rade
29962 return r;
29963 }
29964 WREG32(rdev->fence_drv.scratch_reg, 0);
29965- atomic_set(&rdev->fence_drv.seq, 0);
29966+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29967 INIT_LIST_HEAD(&rdev->fence_drv.created);
29968 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29969 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
29970diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h
29971--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h 2011-03-27 14:31:47.000000000 -0400
29972+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h 2011-08-05 20:33:55.000000000 -0400
29973@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device
29974 */
29975 struct radeon_fence_driver {
29976 uint32_t scratch_reg;
29977- atomic_t seq;
29978+ atomic_unchecked_t seq;
29979 uint32_t last_seq;
29980 unsigned long count_timeout;
29981 wait_queue_head_t queue;
29982@@ -640,7 +640,7 @@ struct radeon_asic {
29983 uint32_t offset, uint32_t obj_size);
29984 int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
29985 void (*bandwidth_update)(struct radeon_device *rdev);
29986-};
29987+} __no_const;
29988
29989 /*
29990 * Asic structures
29991diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c
29992--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-03-27 14:31:47.000000000 -0400
29993+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-04-23 13:57:24.000000000 -0400
29994@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(str
29995 request = compat_alloc_user_space(sizeof(*request));
29996 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29997 || __put_user(req32.param, &request->param)
29998- || __put_user((void __user *)(unsigned long)req32.value,
29999+ || __put_user((unsigned long)req32.value,
30000 &request->value))
30001 return -EFAULT;
30002
30003diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c
30004--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c 2011-03-27 14:31:47.000000000 -0400
30005+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-04 17:56:28.000000000 -0400
30006@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
30007 unsigned int ret;
30008 RING_LOCALS;
30009
30010- atomic_inc(&dev_priv->swi_emitted);
30011- ret = atomic_read(&dev_priv->swi_emitted);
30012+ atomic_inc_unchecked(&dev_priv->swi_emitted);
30013+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
30014
30015 BEGIN_RING(4);
30016 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
30017@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
30018 drm_radeon_private_t *dev_priv =
30019 (drm_radeon_private_t *) dev->dev_private;
30020
30021- atomic_set(&dev_priv->swi_emitted, 0);
30022+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
30023 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
30024
30025 dev->max_vblank_count = 0x001fffff;
30026diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c
30027--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c 2011-03-27 14:31:47.000000000 -0400
30028+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c 2011-04-17 15:56:46.000000000 -0400
30029@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm
30030 {
30031 drm_radeon_private_t *dev_priv = dev->dev_private;
30032 drm_radeon_getparam_t *param = data;
30033- int value;
30034+ int value = 0;
30035
30036 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
30037
30038diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c
30039--- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c 2011-03-27 14:31:47.000000000 -0400
30040+++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c 2011-04-17 15:56:46.000000000 -0400
30041@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
30042 DRM_INFO("radeon: ttm finalized\n");
30043 }
30044
30045-static struct vm_operations_struct radeon_ttm_vm_ops;
30046-static const struct vm_operations_struct *ttm_vm_ops = NULL;
30047-
30048-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
30049-{
30050- struct ttm_buffer_object *bo;
30051- int r;
30052-
30053- bo = (struct ttm_buffer_object *)vma->vm_private_data;
30054- if (bo == NULL) {
30055- return VM_FAULT_NOPAGE;
30056- }
30057- r = ttm_vm_ops->fault(vma, vmf);
30058- return r;
30059-}
30060-
30061 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
30062 {
30063 struct drm_file *file_priv;
30064 struct radeon_device *rdev;
30065- int r;
30066
30067 if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
30068 return drm_mmap(filp, vma);
30069@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
30070
30071 file_priv = (struct drm_file *)filp->private_data;
30072 rdev = file_priv->minor->dev->dev_private;
30073- if (rdev == NULL) {
30074+ if (!rdev)
30075 return -EINVAL;
30076- }
30077- r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
30078- if (unlikely(r != 0)) {
30079- return r;
30080- }
30081- if (unlikely(ttm_vm_ops == NULL)) {
30082- ttm_vm_ops = vma->vm_ops;
30083- radeon_ttm_vm_ops = *ttm_vm_ops;
30084- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
30085- }
30086- vma->vm_ops = &radeon_ttm_vm_ops;
30087- return 0;
30088+ return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
30089 }
30090
30091
30092diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c
30093--- linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c 2011-03-27 14:31:47.000000000 -0400
30094+++ linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c 2011-04-17 15:56:46.000000000 -0400
30095@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct
30096 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
30097 rdev->pm.sideport_bandwidth.full)
30098 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
30099- read_delay_latency.full = rfixed_const(370 * 800 * 1000);
30100+ read_delay_latency.full = rfixed_const(800 * 1000);
30101 read_delay_latency.full = rfixed_div(read_delay_latency,
30102 rdev->pm.igp_sideport_mclk);
30103+ a.full = rfixed_const(370);
30104+ read_delay_latency.full = rfixed_mul(read_delay_latency, a);
30105 } else {
30106 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
30107 rdev->pm.k8_bandwidth.full)
30108diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c
30109--- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c 2011-08-29 22:24:44.000000000 -0400
30110+++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c 2011-08-29 22:25:07.000000000 -0400
30111@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
30112 NULL
30113 };
30114
30115-static struct sysfs_ops ttm_bo_global_ops = {
30116+static const struct sysfs_ops ttm_bo_global_ops = {
30117 .show = &ttm_bo_global_show
30118 };
30119
30120diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c
30121--- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-03-27 14:31:47.000000000 -0400
30122+++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-04-17 15:56:46.000000000 -0400
30123@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
30124 {
30125 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
30126 vma->vm_private_data;
30127- struct ttm_bo_device *bdev = bo->bdev;
30128+ struct ttm_bo_device *bdev;
30129 unsigned long bus_base;
30130 unsigned long bus_offset;
30131 unsigned long bus_size;
30132@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
30133 unsigned long address = (unsigned long)vmf->virtual_address;
30134 int retval = VM_FAULT_NOPAGE;
30135
30136+ if (!bo)
30137+ return VM_FAULT_NOPAGE;
30138+ bdev = bo->bdev;
30139+
30140 /*
30141 * Work around locking order reversal in fault / nopfn
30142 * between mmap_sem and bo_reserve: Perform a trylock operation
30143diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c
30144--- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c 2011-03-27 14:31:47.000000000 -0400
30145+++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c 2011-04-17 15:56:46.000000000 -0400
30146@@ -36,7 +36,7 @@
30147 struct ttm_global_item {
30148 struct mutex mutex;
30149 void *object;
30150- int refcount;
30151+ atomic_t refcount;
30152 };
30153
30154 static struct ttm_global_item glob[TTM_GLOBAL_NUM];
30155@@ -49,7 +49,7 @@ void ttm_global_init(void)
30156 struct ttm_global_item *item = &glob[i];
30157 mutex_init(&item->mutex);
30158 item->object = NULL;
30159- item->refcount = 0;
30160+ atomic_set(&item->refcount, 0);
30161 }
30162 }
30163
30164@@ -59,7 +59,7 @@ void ttm_global_release(void)
30165 for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
30166 struct ttm_global_item *item = &glob[i];
30167 BUG_ON(item->object != NULL);
30168- BUG_ON(item->refcount != 0);
30169+ BUG_ON(atomic_read(&item->refcount) != 0);
30170 }
30171 }
30172
30173@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
30174 void *object;
30175
30176 mutex_lock(&item->mutex);
30177- if (item->refcount == 0) {
30178+ if (atomic_read(&item->refcount) == 0) {
30179 item->object = kzalloc(ref->size, GFP_KERNEL);
30180 if (unlikely(item->object == NULL)) {
30181 ret = -ENOMEM;
30182@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
30183 goto out_err;
30184
30185 }
30186- ++item->refcount;
30187+ atomic_inc(&item->refcount);
30188 ref->object = item->object;
30189 object = item->object;
30190 mutex_unlock(&item->mutex);
30191@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
30192 struct ttm_global_item *item = &glob[ref->global_type];
30193
30194 mutex_lock(&item->mutex);
30195- BUG_ON(item->refcount == 0);
30196+ BUG_ON(atomic_read(&item->refcount) == 0);
30197 BUG_ON(ref->object != item->object);
30198- if (--item->refcount == 0) {
30199+ if (atomic_dec_and_test(&item->refcount)) {
30200 ref->release(ref);
30201 item->object = NULL;
30202 }
30203diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c
30204--- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c 2011-03-27 14:31:47.000000000 -0400
30205+++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c 2011-04-17 15:56:46.000000000 -0400
30206@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
30207 NULL
30208 };
30209
30210-static struct sysfs_ops ttm_mem_zone_ops = {
30211+static const struct sysfs_ops ttm_mem_zone_ops = {
30212 .show = &ttm_mem_zone_show,
30213 .store = &ttm_mem_zone_store
30214 };
30215diff -urNp linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h
30216--- linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h 2011-03-27 14:31:47.000000000 -0400
30217+++ linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h 2011-05-04 17:56:28.000000000 -0400
30218@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
30219 typedef uint32_t maskarray_t[5];
30220
30221 typedef struct drm_via_irq {
30222- atomic_t irq_received;
30223+ atomic_unchecked_t irq_received;
30224 uint32_t pending_mask;
30225 uint32_t enable_mask;
30226 wait_queue_head_t irq_queue;
30227@@ -75,7 +75,7 @@ typedef struct drm_via_private {
30228 struct timeval last_vblank;
30229 int last_vblank_valid;
30230 unsigned usec_per_vblank;
30231- atomic_t vbl_received;
30232+ atomic_unchecked_t vbl_received;
30233 drm_via_state_t hc_state;
30234 char pci_buf[VIA_PCI_BUF_SIZE];
30235 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
30236diff -urNp linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c
30237--- linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c 2011-03-27 14:31:47.000000000 -0400
30238+++ linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c 2011-05-04 17:56:28.000000000 -0400
30239@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
30240 if (crtc != 0)
30241 return 0;
30242
30243- return atomic_read(&dev_priv->vbl_received);
30244+ return atomic_read_unchecked(&dev_priv->vbl_received);
30245 }
30246
30247 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
30248@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
30249
30250 status = VIA_READ(VIA_REG_INTERRUPT);
30251 if (status & VIA_IRQ_VBLANK_PENDING) {
30252- atomic_inc(&dev_priv->vbl_received);
30253- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
30254+ atomic_inc_unchecked(&dev_priv->vbl_received);
30255+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
30256 do_gettimeofday(&cur_vblank);
30257 if (dev_priv->last_vblank_valid) {
30258 dev_priv->usec_per_vblank =
30259@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
30260 dev_priv->last_vblank = cur_vblank;
30261 dev_priv->last_vblank_valid = 1;
30262 }
30263- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
30264+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
30265 DRM_DEBUG("US per vblank is: %u\n",
30266 dev_priv->usec_per_vblank);
30267 }
30268@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
30269
30270 for (i = 0; i < dev_priv->num_irqs; ++i) {
30271 if (status & cur_irq->pending_mask) {
30272- atomic_inc(&cur_irq->irq_received);
30273+ atomic_inc_unchecked(&cur_irq->irq_received);
30274 DRM_WAKEUP(&cur_irq->irq_queue);
30275 handled = 1;
30276 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
30277@@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device *
30278 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
30279 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
30280 masks[irq][4]));
30281- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
30282+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
30283 } else {
30284 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
30285 (((cur_irq_sequence =
30286- atomic_read(&cur_irq->irq_received)) -
30287+ atomic_read_unchecked(&cur_irq->irq_received)) -
30288 *sequence) <= (1 << 23)));
30289 }
30290 *sequence = cur_irq_sequence;
30291@@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct dr
30292 }
30293
30294 for (i = 0; i < dev_priv->num_irqs; ++i) {
30295- atomic_set(&cur_irq->irq_received, 0);
30296+ atomic_set_unchecked(&cur_irq->irq_received, 0);
30297 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
30298 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
30299 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
30300@@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev,
30301 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
30302 case VIA_IRQ_RELATIVE:
30303 irqwait->request.sequence +=
30304- atomic_read(&cur_irq->irq_received);
30305+ atomic_read_unchecked(&cur_irq->irq_received);
30306 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
30307 case VIA_IRQ_ABSOLUTE:
30308 break;
30309diff -urNp linux-2.6.32.46/drivers/hid/hid-core.c linux-2.6.32.46/drivers/hid/hid-core.c
30310--- linux-2.6.32.46/drivers/hid/hid-core.c 2011-05-10 22:12:01.000000000 -0400
30311+++ linux-2.6.32.46/drivers/hid/hid-core.c 2011-05-10 22:12:32.000000000 -0400
30312@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device
30313
30314 int hid_add_device(struct hid_device *hdev)
30315 {
30316- static atomic_t id = ATOMIC_INIT(0);
30317+ static atomic_unchecked_t id = ATOMIC_INIT(0);
30318 int ret;
30319
30320 if (WARN_ON(hdev->status & HID_STAT_ADDED))
30321@@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hd
30322 /* XXX hack, any other cleaner solution after the driver core
30323 * is converted to allow more than 20 bytes as the device name? */
30324 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
30325- hdev->vendor, hdev->product, atomic_inc_return(&id));
30326+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
30327
30328 ret = device_add(&hdev->dev);
30329 if (!ret)
30330diff -urNp linux-2.6.32.46/drivers/hid/usbhid/hiddev.c linux-2.6.32.46/drivers/hid/usbhid/hiddev.c
30331--- linux-2.6.32.46/drivers/hid/usbhid/hiddev.c 2011-03-27 14:31:47.000000000 -0400
30332+++ linux-2.6.32.46/drivers/hid/usbhid/hiddev.c 2011-04-17 15:56:46.000000000 -0400
30333@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
30334 return put_user(HID_VERSION, (int __user *)arg);
30335
30336 case HIDIOCAPPLICATION:
30337- if (arg < 0 || arg >= hid->maxapplication)
30338+ if (arg >= hid->maxapplication)
30339 return -EINVAL;
30340
30341 for (i = 0; i < hid->maxcollection; i++)
30342diff -urNp linux-2.6.32.46/drivers/hwmon/lis3lv02d.c linux-2.6.32.46/drivers/hwmon/lis3lv02d.c
30343--- linux-2.6.32.46/drivers/hwmon/lis3lv02d.c 2011-03-27 14:31:47.000000000 -0400
30344+++ linux-2.6.32.46/drivers/hwmon/lis3lv02d.c 2011-05-04 17:56:28.000000000 -0400
30345@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(in
30346 * the lid is closed. This leads to interrupts as soon as a little move
30347 * is done.
30348 */
30349- atomic_inc(&lis3_dev.count);
30350+ atomic_inc_unchecked(&lis3_dev.count);
30351
30352 wake_up_interruptible(&lis3_dev.misc_wait);
30353 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
30354@@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct in
30355 if (test_and_set_bit(0, &lis3_dev.misc_opened))
30356 return -EBUSY; /* already open */
30357
30358- atomic_set(&lis3_dev.count, 0);
30359+ atomic_set_unchecked(&lis3_dev.count, 0);
30360
30361 /*
30362 * The sensor can generate interrupts for free-fall and direction
30363@@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struc
30364 add_wait_queue(&lis3_dev.misc_wait, &wait);
30365 while (true) {
30366 set_current_state(TASK_INTERRUPTIBLE);
30367- data = atomic_xchg(&lis3_dev.count, 0);
30368+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
30369 if (data)
30370 break;
30371
30372@@ -244,7 +244,7 @@ out:
30373 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
30374 {
30375 poll_wait(file, &lis3_dev.misc_wait, wait);
30376- if (atomic_read(&lis3_dev.count))
30377+ if (atomic_read_unchecked(&lis3_dev.count))
30378 return POLLIN | POLLRDNORM;
30379 return 0;
30380 }
30381diff -urNp linux-2.6.32.46/drivers/hwmon/lis3lv02d.h linux-2.6.32.46/drivers/hwmon/lis3lv02d.h
30382--- linux-2.6.32.46/drivers/hwmon/lis3lv02d.h 2011-03-27 14:31:47.000000000 -0400
30383+++ linux-2.6.32.46/drivers/hwmon/lis3lv02d.h 2011-05-04 17:56:28.000000000 -0400
30384@@ -201,7 +201,7 @@ struct lis3lv02d {
30385
30386 struct input_polled_dev *idev; /* input device */
30387 struct platform_device *pdev; /* platform device */
30388- atomic_t count; /* interrupt count after last read */
30389+ atomic_unchecked_t count; /* interrupt count after last read */
30390 int xcalib; /* calibrated null value for x */
30391 int ycalib; /* calibrated null value for y */
30392 int zcalib; /* calibrated null value for z */
30393diff -urNp linux-2.6.32.46/drivers/hwmon/sht15.c linux-2.6.32.46/drivers/hwmon/sht15.c
30394--- linux-2.6.32.46/drivers/hwmon/sht15.c 2011-03-27 14:31:47.000000000 -0400
30395+++ linux-2.6.32.46/drivers/hwmon/sht15.c 2011-05-04 17:56:28.000000000 -0400
30396@@ -112,7 +112,7 @@ struct sht15_data {
30397 int supply_uV;
30398 int supply_uV_valid;
30399 struct work_struct update_supply_work;
30400- atomic_t interrupt_handled;
30401+ atomic_unchecked_t interrupt_handled;
30402 };
30403
30404 /**
30405@@ -245,13 +245,13 @@ static inline int sht15_update_single_va
30406 return ret;
30407
30408 gpio_direction_input(data->pdata->gpio_data);
30409- atomic_set(&data->interrupt_handled, 0);
30410+ atomic_set_unchecked(&data->interrupt_handled, 0);
30411
30412 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30413 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30414 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
30415 /* Only relevant if the interrupt hasn't occured. */
30416- if (!atomic_read(&data->interrupt_handled))
30417+ if (!atomic_read_unchecked(&data->interrupt_handled))
30418 schedule_work(&data->read_work);
30419 }
30420 ret = wait_event_timeout(data->wait_queue,
30421@@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired
30422 struct sht15_data *data = d;
30423 /* First disable the interrupt */
30424 disable_irq_nosync(irq);
30425- atomic_inc(&data->interrupt_handled);
30426+ atomic_inc_unchecked(&data->interrupt_handled);
30427 /* Then schedule a reading work struct */
30428 if (data->flag != SHT15_READING_NOTHING)
30429 schedule_work(&data->read_work);
30430@@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct wo
30431 here as could have gone low in meantime so verify
30432 it hasn't!
30433 */
30434- atomic_set(&data->interrupt_handled, 0);
30435+ atomic_set_unchecked(&data->interrupt_handled, 0);
30436 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30437 /* If still not occured or another handler has been scheduled */
30438 if (gpio_get_value(data->pdata->gpio_data)
30439- || atomic_read(&data->interrupt_handled))
30440+ || atomic_read_unchecked(&data->interrupt_handled))
30441 return;
30442 }
30443 /* Read the data back from the device */
30444diff -urNp linux-2.6.32.46/drivers/hwmon/w83791d.c linux-2.6.32.46/drivers/hwmon/w83791d.c
30445--- linux-2.6.32.46/drivers/hwmon/w83791d.c 2011-03-27 14:31:47.000000000 -0400
30446+++ linux-2.6.32.46/drivers/hwmon/w83791d.c 2011-04-17 15:56:46.000000000 -0400
30447@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
30448 struct i2c_board_info *info);
30449 static int w83791d_remove(struct i2c_client *client);
30450
30451-static int w83791d_read(struct i2c_client *client, u8 register);
30452-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30453+static int w83791d_read(struct i2c_client *client, u8 reg);
30454+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30455 static struct w83791d_data *w83791d_update_device(struct device *dev);
30456
30457 #ifdef DEBUG
30458diff -urNp linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c
30459--- linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c 2011-03-27 14:31:47.000000000 -0400
30460+++ linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-23 21:22:32.000000000 -0400
30461@@ -43,7 +43,7 @@
30462 extern struct i2c_adapter amd756_smbus;
30463
30464 static struct i2c_adapter *s4882_adapter;
30465-static struct i2c_algorithm *s4882_algo;
30466+static i2c_algorithm_no_const *s4882_algo;
30467
30468 /* Wrapper access functions for multiplexed SMBus */
30469 static DEFINE_MUTEX(amd756_lock);
30470diff -urNp linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c
30471--- linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-03-27 14:31:47.000000000 -0400
30472+++ linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-23 21:22:32.000000000 -0400
30473@@ -41,7 +41,7 @@
30474 extern struct i2c_adapter *nforce2_smbus;
30475
30476 static struct i2c_adapter *s4985_adapter;
30477-static struct i2c_algorithm *s4985_algo;
30478+static i2c_algorithm_no_const *s4985_algo;
30479
30480 /* Wrapper access functions for multiplexed SMBus */
30481 static DEFINE_MUTEX(nforce2_lock);
30482diff -urNp linux-2.6.32.46/drivers/ide/ide-cd.c linux-2.6.32.46/drivers/ide/ide-cd.c
30483--- linux-2.6.32.46/drivers/ide/ide-cd.c 2011-03-27 14:31:47.000000000 -0400
30484+++ linux-2.6.32.46/drivers/ide/ide-cd.c 2011-04-17 15:56:46.000000000 -0400
30485@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_
30486 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30487 if ((unsigned long)buf & alignment
30488 || blk_rq_bytes(rq) & q->dma_pad_mask
30489- || object_is_on_stack(buf))
30490+ || object_starts_on_stack(buf))
30491 drive->dma = 0;
30492 }
30493 }
30494diff -urNp linux-2.6.32.46/drivers/ide/ide-floppy.c linux-2.6.32.46/drivers/ide/ide-floppy.c
30495--- linux-2.6.32.46/drivers/ide/ide-floppy.c 2011-03-27 14:31:47.000000000 -0400
30496+++ linux-2.6.32.46/drivers/ide/ide-floppy.c 2011-05-16 21:46:57.000000000 -0400
30497@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_d
30498 u8 pc_buf[256], header_len, desc_cnt;
30499 int i, rc = 1, blocks, length;
30500
30501+ pax_track_stack();
30502+
30503 ide_debug_log(IDE_DBG_FUNC, "enter");
30504
30505 drive->bios_cyl = 0;
30506diff -urNp linux-2.6.32.46/drivers/ide/setup-pci.c linux-2.6.32.46/drivers/ide/setup-pci.c
30507--- linux-2.6.32.46/drivers/ide/setup-pci.c 2011-03-27 14:31:47.000000000 -0400
30508+++ linux-2.6.32.46/drivers/ide/setup-pci.c 2011-05-16 21:46:57.000000000 -0400
30509@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30510 int ret, i, n_ports = dev2 ? 4 : 2;
30511 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30512
30513+ pax_track_stack();
30514+
30515 for (i = 0; i < n_ports / 2; i++) {
30516 ret = ide_setup_pci_controller(pdev[i], d, !i);
30517 if (ret < 0)
30518diff -urNp linux-2.6.32.46/drivers/ieee1394/dv1394.c linux-2.6.32.46/drivers/ieee1394/dv1394.c
30519--- linux-2.6.32.46/drivers/ieee1394/dv1394.c 2011-03-27 14:31:47.000000000 -0400
30520+++ linux-2.6.32.46/drivers/ieee1394/dv1394.c 2011-04-23 12:56:11.000000000 -0400
30521@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
30522 based upon DIF section and sequence
30523 */
30524
30525-static void inline
30526+static inline void
30527 frame_put_packet (struct frame *f, struct packet *p)
30528 {
30529 int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
30530diff -urNp linux-2.6.32.46/drivers/ieee1394/hosts.c linux-2.6.32.46/drivers/ieee1394/hosts.c
30531--- linux-2.6.32.46/drivers/ieee1394/hosts.c 2011-03-27 14:31:47.000000000 -0400
30532+++ linux-2.6.32.46/drivers/ieee1394/hosts.c 2011-04-17 15:56:46.000000000 -0400
30533@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
30534 }
30535
30536 static struct hpsb_host_driver dummy_driver = {
30537+ .name = "dummy",
30538 .transmit_packet = dummy_transmit_packet,
30539 .devctl = dummy_devctl,
30540 .isoctl = dummy_isoctl
30541diff -urNp linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c
30542--- linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c 2011-03-27 14:31:47.000000000 -0400
30543+++ linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c 2011-04-17 15:56:46.000000000 -0400
30544@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_con
30545 for (func = 0; func < 8; func++) {
30546 u32 class = read_pci_config(num,slot,func,
30547 PCI_CLASS_REVISION);
30548- if ((class == 0xffffffff))
30549+ if (class == 0xffffffff)
30550 continue; /* No device at this func */
30551
30552 if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
30553diff -urNp linux-2.6.32.46/drivers/ieee1394/ohci1394.c linux-2.6.32.46/drivers/ieee1394/ohci1394.c
30554--- linux-2.6.32.46/drivers/ieee1394/ohci1394.c 2011-03-27 14:31:47.000000000 -0400
30555+++ linux-2.6.32.46/drivers/ieee1394/ohci1394.c 2011-04-23 12:56:11.000000000 -0400
30556@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
30557 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
30558
30559 /* Module Parameters */
30560-static int phys_dma = 1;
30561+static int phys_dma;
30562 module_param(phys_dma, int, 0444);
30563-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
30564+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
30565
30566 static void dma_trm_tasklet(unsigned long data);
30567 static void dma_trm_reset(struct dma_trm_ctx *d);
30568diff -urNp linux-2.6.32.46/drivers/ieee1394/sbp2.c linux-2.6.32.46/drivers/ieee1394/sbp2.c
30569--- linux-2.6.32.46/drivers/ieee1394/sbp2.c 2011-03-27 14:31:47.000000000 -0400
30570+++ linux-2.6.32.46/drivers/ieee1394/sbp2.c 2011-04-23 12:56:11.000000000 -0400
30571@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
30572 MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
30573 MODULE_LICENSE("GPL");
30574
30575-static int sbp2_module_init(void)
30576+static int __init sbp2_module_init(void)
30577 {
30578 int ret;
30579
30580diff -urNp linux-2.6.32.46/drivers/infiniband/core/cm.c linux-2.6.32.46/drivers/infiniband/core/cm.c
30581--- linux-2.6.32.46/drivers/infiniband/core/cm.c 2011-03-27 14:31:47.000000000 -0400
30582+++ linux-2.6.32.46/drivers/infiniband/core/cm.c 2011-04-17 15:56:46.000000000 -0400
30583@@ -112,7 +112,7 @@ static char const counter_group_names[CM
30584
30585 struct cm_counter_group {
30586 struct kobject obj;
30587- atomic_long_t counter[CM_ATTR_COUNT];
30588+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30589 };
30590
30591 struct cm_counter_attribute {
30592@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
30593 struct ib_mad_send_buf *msg = NULL;
30594 int ret;
30595
30596- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30597+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30598 counter[CM_REQ_COUNTER]);
30599
30600 /* Quick state check to discard duplicate REQs. */
30601@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
30602 if (!cm_id_priv)
30603 return;
30604
30605- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30606+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30607 counter[CM_REP_COUNTER]);
30608 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30609 if (ret)
30610@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
30611 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30612 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30613 spin_unlock_irq(&cm_id_priv->lock);
30614- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30615+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30616 counter[CM_RTU_COUNTER]);
30617 goto out;
30618 }
30619@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
30620 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30621 dreq_msg->local_comm_id);
30622 if (!cm_id_priv) {
30623- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30624+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30625 counter[CM_DREQ_COUNTER]);
30626 cm_issue_drep(work->port, work->mad_recv_wc);
30627 return -EINVAL;
30628@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
30629 case IB_CM_MRA_REP_RCVD:
30630 break;
30631 case IB_CM_TIMEWAIT:
30632- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30633+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30634 counter[CM_DREQ_COUNTER]);
30635 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30636 goto unlock;
30637@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
30638 cm_free_msg(msg);
30639 goto deref;
30640 case IB_CM_DREQ_RCVD:
30641- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30642+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30643 counter[CM_DREQ_COUNTER]);
30644 goto unlock;
30645 default:
30646@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
30647 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30648 cm_id_priv->msg, timeout)) {
30649 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30650- atomic_long_inc(&work->port->
30651+ atomic_long_inc_unchecked(&work->port->
30652 counter_group[CM_RECV_DUPLICATES].
30653 counter[CM_MRA_COUNTER]);
30654 goto out;
30655@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
30656 break;
30657 case IB_CM_MRA_REQ_RCVD:
30658 case IB_CM_MRA_REP_RCVD:
30659- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30660+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30661 counter[CM_MRA_COUNTER]);
30662 /* fall through */
30663 default:
30664@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
30665 case IB_CM_LAP_IDLE:
30666 break;
30667 case IB_CM_MRA_LAP_SENT:
30668- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30669+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30670 counter[CM_LAP_COUNTER]);
30671 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30672 goto unlock;
30673@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
30674 cm_free_msg(msg);
30675 goto deref;
30676 case IB_CM_LAP_RCVD:
30677- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30678+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30679 counter[CM_LAP_COUNTER]);
30680 goto unlock;
30681 default:
30682@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
30683 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30684 if (cur_cm_id_priv) {
30685 spin_unlock_irq(&cm.lock);
30686- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30687+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30688 counter[CM_SIDR_REQ_COUNTER]);
30689 goto out; /* Duplicate message. */
30690 }
30691@@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_ma
30692 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30693 msg->retries = 1;
30694
30695- atomic_long_add(1 + msg->retries,
30696+ atomic_long_add_unchecked(1 + msg->retries,
30697 &port->counter_group[CM_XMIT].counter[attr_index]);
30698 if (msg->retries)
30699- atomic_long_add(msg->retries,
30700+ atomic_long_add_unchecked(msg->retries,
30701 &port->counter_group[CM_XMIT_RETRIES].
30702 counter[attr_index]);
30703
30704@@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_ma
30705 }
30706
30707 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30708- atomic_long_inc(&port->counter_group[CM_RECV].
30709+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30710 counter[attr_id - CM_ATTR_ID_OFFSET]);
30711
30712 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30713@@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct ko
30714 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30715
30716 return sprintf(buf, "%ld\n",
30717- atomic_long_read(&group->counter[cm_attr->index]));
30718+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30719 }
30720
30721-static struct sysfs_ops cm_counter_ops = {
30722+static const struct sysfs_ops cm_counter_ops = {
30723 .show = cm_show_counter
30724 };
30725
30726diff -urNp linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c
30727--- linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c 2011-03-27 14:31:47.000000000 -0400
30728+++ linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c 2011-05-04 17:56:28.000000000 -0400
30729@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30730
30731 struct task_struct *thread;
30732
30733- atomic_t req_ser;
30734- atomic_t flush_ser;
30735+ atomic_unchecked_t req_ser;
30736+ atomic_unchecked_t flush_ser;
30737
30738 wait_queue_head_t force_wait;
30739 };
30740@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30741 struct ib_fmr_pool *pool = pool_ptr;
30742
30743 do {
30744- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30745+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30746 ib_fmr_batch_release(pool);
30747
30748- atomic_inc(&pool->flush_ser);
30749+ atomic_inc_unchecked(&pool->flush_ser);
30750 wake_up_interruptible(&pool->force_wait);
30751
30752 if (pool->flush_function)
30753@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30754 }
30755
30756 set_current_state(TASK_INTERRUPTIBLE);
30757- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30758+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30759 !kthread_should_stop())
30760 schedule();
30761 __set_current_state(TASK_RUNNING);
30762@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30763 pool->dirty_watermark = params->dirty_watermark;
30764 pool->dirty_len = 0;
30765 spin_lock_init(&pool->pool_lock);
30766- atomic_set(&pool->req_ser, 0);
30767- atomic_set(&pool->flush_ser, 0);
30768+ atomic_set_unchecked(&pool->req_ser, 0);
30769+ atomic_set_unchecked(&pool->flush_ser, 0);
30770 init_waitqueue_head(&pool->force_wait);
30771
30772 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30773@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30774 }
30775 spin_unlock_irq(&pool->pool_lock);
30776
30777- serial = atomic_inc_return(&pool->req_ser);
30778+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30779 wake_up_process(pool->thread);
30780
30781 if (wait_event_interruptible(pool->force_wait,
30782- atomic_read(&pool->flush_ser) - serial >= 0))
30783+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30784 return -EINTR;
30785
30786 return 0;
30787@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30788 } else {
30789 list_add_tail(&fmr->list, &pool->dirty_list);
30790 if (++pool->dirty_len >= pool->dirty_watermark) {
30791- atomic_inc(&pool->req_ser);
30792+ atomic_inc_unchecked(&pool->req_ser);
30793 wake_up_process(pool->thread);
30794 }
30795 }
30796diff -urNp linux-2.6.32.46/drivers/infiniband/core/sysfs.c linux-2.6.32.46/drivers/infiniband/core/sysfs.c
30797--- linux-2.6.32.46/drivers/infiniband/core/sysfs.c 2011-03-27 14:31:47.000000000 -0400
30798+++ linux-2.6.32.46/drivers/infiniband/core/sysfs.c 2011-04-17 15:56:46.000000000 -0400
30799@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
30800 return port_attr->show(p, port_attr, buf);
30801 }
30802
30803-static struct sysfs_ops port_sysfs_ops = {
30804+static const struct sysfs_ops port_sysfs_ops = {
30805 .show = port_attr_show
30806 };
30807
30808diff -urNp linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c
30809--- linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c 2011-03-27 14:31:47.000000000 -0400
30810+++ linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c 2011-04-17 15:56:46.000000000 -0400
30811@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_u
30812 dst->grh.sgid_index = src->grh.sgid_index;
30813 dst->grh.hop_limit = src->grh.hop_limit;
30814 dst->grh.traffic_class = src->grh.traffic_class;
30815+ memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
30816 dst->dlid = src->dlid;
30817 dst->sl = src->sl;
30818 dst->src_path_bits = src->src_path_bits;
30819 dst->static_rate = src->static_rate;
30820 dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
30821 dst->port_num = src->port_num;
30822+ dst->reserved = 0;
30823 }
30824 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
30825
30826 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
30827 struct ib_qp_attr *src)
30828 {
30829+ dst->qp_state = src->qp_state;
30830 dst->cur_qp_state = src->cur_qp_state;
30831 dst->path_mtu = src->path_mtu;
30832 dst->path_mig_state = src->path_mig_state;
30833@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_u
30834 dst->rnr_retry = src->rnr_retry;
30835 dst->alt_port_num = src->alt_port_num;
30836 dst->alt_timeout = src->alt_timeout;
30837+ memset(dst->reserved, 0, sizeof(dst->reserved));
30838 }
30839 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
30840
30841diff -urNp linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c
30842--- linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c 2011-03-27 14:31:47.000000000 -0400
30843+++ linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-16 21:46:57.000000000 -0400
30844@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(stru
30845 struct infinipath_counters counters;
30846 struct ipath_devdata *dd;
30847
30848+ pax_track_stack();
30849+
30850 dd = file->f_path.dentry->d_inode->i_private;
30851 dd->ipath_f_read_counters(dd, &counters);
30852
30853diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c
30854--- linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c 2011-03-27 14:31:47.000000000 -0400
30855+++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c 2011-05-04 17:56:28.000000000 -0400
30856@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30857 LIST_HEAD(nes_adapter_list);
30858 static LIST_HEAD(nes_dev_list);
30859
30860-atomic_t qps_destroyed;
30861+atomic_unchecked_t qps_destroyed;
30862
30863 static unsigned int ee_flsh_adapter;
30864 static unsigned int sysfs_nonidx_addr;
30865@@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(str
30866 struct nes_adapter *nesadapter = nesdev->nesadapter;
30867 u32 qp_id;
30868
30869- atomic_inc(&qps_destroyed);
30870+ atomic_inc_unchecked(&qps_destroyed);
30871
30872 /* Free the control structures */
30873
30874diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c
30875--- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c 2011-03-27 14:31:47.000000000 -0400
30876+++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c 2011-05-04 17:56:28.000000000 -0400
30877@@ -69,11 +69,11 @@ u32 cm_packets_received;
30878 u32 cm_listens_created;
30879 u32 cm_listens_destroyed;
30880 u32 cm_backlog_drops;
30881-atomic_t cm_loopbacks;
30882-atomic_t cm_nodes_created;
30883-atomic_t cm_nodes_destroyed;
30884-atomic_t cm_accel_dropped_pkts;
30885-atomic_t cm_resets_recvd;
30886+atomic_unchecked_t cm_loopbacks;
30887+atomic_unchecked_t cm_nodes_created;
30888+atomic_unchecked_t cm_nodes_destroyed;
30889+atomic_unchecked_t cm_accel_dropped_pkts;
30890+atomic_unchecked_t cm_resets_recvd;
30891
30892 static inline int mini_cm_accelerated(struct nes_cm_core *,
30893 struct nes_cm_node *);
30894@@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
30895
30896 static struct nes_cm_core *g_cm_core;
30897
30898-atomic_t cm_connects;
30899-atomic_t cm_accepts;
30900-atomic_t cm_disconnects;
30901-atomic_t cm_closes;
30902-atomic_t cm_connecteds;
30903-atomic_t cm_connect_reqs;
30904-atomic_t cm_rejects;
30905+atomic_unchecked_t cm_connects;
30906+atomic_unchecked_t cm_accepts;
30907+atomic_unchecked_t cm_disconnects;
30908+atomic_unchecked_t cm_closes;
30909+atomic_unchecked_t cm_connecteds;
30910+atomic_unchecked_t cm_connect_reqs;
30911+atomic_unchecked_t cm_rejects;
30912
30913
30914 /**
30915@@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(
30916 cm_node->rem_mac);
30917
30918 add_hte_node(cm_core, cm_node);
30919- atomic_inc(&cm_nodes_created);
30920+ atomic_inc_unchecked(&cm_nodes_created);
30921
30922 return cm_node;
30923 }
30924@@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm
30925 }
30926
30927 atomic_dec(&cm_core->node_cnt);
30928- atomic_inc(&cm_nodes_destroyed);
30929+ atomic_inc_unchecked(&cm_nodes_destroyed);
30930 nesqp = cm_node->nesqp;
30931 if (nesqp) {
30932 nesqp->cm_node = NULL;
30933@@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm
30934
30935 static void drop_packet(struct sk_buff *skb)
30936 {
30937- atomic_inc(&cm_accel_dropped_pkts);
30938+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30939 dev_kfree_skb_any(skb);
30940 }
30941
30942@@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm
30943
30944 int reset = 0; /* whether to send reset in case of err.. */
30945 int passive_state;
30946- atomic_inc(&cm_resets_recvd);
30947+ atomic_inc_unchecked(&cm_resets_recvd);
30948 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30949 " refcnt=%d\n", cm_node, cm_node->state,
30950 atomic_read(&cm_node->ref_count));
30951@@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_conne
30952 rem_ref_cm_node(cm_node->cm_core, cm_node);
30953 return NULL;
30954 }
30955- atomic_inc(&cm_loopbacks);
30956+ atomic_inc_unchecked(&cm_loopbacks);
30957 loopbackremotenode->loopbackpartner = cm_node;
30958 loopbackremotenode->tcp_cntxt.rcv_wscale =
30959 NES_CM_DEFAULT_RCV_WND_SCALE;
30960@@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_c
30961 add_ref_cm_node(cm_node);
30962 } else if (cm_node->state == NES_CM_STATE_TSA) {
30963 rem_ref_cm_node(cm_core, cm_node);
30964- atomic_inc(&cm_accel_dropped_pkts);
30965+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30966 dev_kfree_skb_any(skb);
30967 break;
30968 }
30969@@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct ne
30970
30971 if ((cm_id) && (cm_id->event_handler)) {
30972 if (issue_disconn) {
30973- atomic_inc(&cm_disconnects);
30974+ atomic_inc_unchecked(&cm_disconnects);
30975 cm_event.event = IW_CM_EVENT_DISCONNECT;
30976 cm_event.status = disconn_status;
30977 cm_event.local_addr = cm_id->local_addr;
30978@@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct ne
30979 }
30980
30981 if (issue_close) {
30982- atomic_inc(&cm_closes);
30983+ atomic_inc_unchecked(&cm_closes);
30984 nes_disconnect(nesqp, 1);
30985
30986 cm_id->provider_data = nesqp;
30987@@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
30988
30989 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30990 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30991- atomic_inc(&cm_accepts);
30992+ atomic_inc_unchecked(&cm_accepts);
30993
30994 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30995 atomic_read(&nesvnic->netdev->refcnt));
30996@@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
30997
30998 struct nes_cm_core *cm_core;
30999
31000- atomic_inc(&cm_rejects);
31001+ atomic_inc_unchecked(&cm_rejects);
31002 cm_node = (struct nes_cm_node *) cm_id->provider_data;
31003 loopback = cm_node->loopbackpartner;
31004 cm_core = cm_node->cm_core;
31005@@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id,
31006 ntohl(cm_id->local_addr.sin_addr.s_addr),
31007 ntohs(cm_id->local_addr.sin_port));
31008
31009- atomic_inc(&cm_connects);
31010+ atomic_inc_unchecked(&cm_connects);
31011 nesqp->active_conn = 1;
31012
31013 /* cache the cm_id in the qp */
31014@@ -3195,7 +3195,7 @@ static void cm_event_connected(struct ne
31015 if (nesqp->destroyed) {
31016 return;
31017 }
31018- atomic_inc(&cm_connecteds);
31019+ atomic_inc_unchecked(&cm_connecteds);
31020 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
31021 " local port 0x%04X. jiffies = %lu.\n",
31022 nesqp->hwqp.qp_id,
31023@@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm
31024
31025 ret = cm_id->event_handler(cm_id, &cm_event);
31026 cm_id->add_ref(cm_id);
31027- atomic_inc(&cm_closes);
31028+ atomic_inc_unchecked(&cm_closes);
31029 cm_event.event = IW_CM_EVENT_CLOSE;
31030 cm_event.status = IW_CM_EVENT_STATUS_OK;
31031 cm_event.provider_data = cm_id->provider_data;
31032@@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_
31033 return;
31034 cm_id = cm_node->cm_id;
31035
31036- atomic_inc(&cm_connect_reqs);
31037+ atomic_inc_unchecked(&cm_connect_reqs);
31038 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
31039 cm_node, cm_id, jiffies);
31040
31041@@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct n
31042 return;
31043 cm_id = cm_node->cm_id;
31044
31045- atomic_inc(&cm_connect_reqs);
31046+ atomic_inc_unchecked(&cm_connect_reqs);
31047 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
31048 cm_node, cm_id, jiffies);
31049
31050diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h
31051--- linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h 2011-03-27 14:31:47.000000000 -0400
31052+++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h 2011-05-04 17:56:28.000000000 -0400
31053@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
31054 extern unsigned int wqm_quanta;
31055 extern struct list_head nes_adapter_list;
31056
31057-extern atomic_t cm_connects;
31058-extern atomic_t cm_accepts;
31059-extern atomic_t cm_disconnects;
31060-extern atomic_t cm_closes;
31061-extern atomic_t cm_connecteds;
31062-extern atomic_t cm_connect_reqs;
31063-extern atomic_t cm_rejects;
31064-extern atomic_t mod_qp_timouts;
31065-extern atomic_t qps_created;
31066-extern atomic_t qps_destroyed;
31067-extern atomic_t sw_qps_destroyed;
31068+extern atomic_unchecked_t cm_connects;
31069+extern atomic_unchecked_t cm_accepts;
31070+extern atomic_unchecked_t cm_disconnects;
31071+extern atomic_unchecked_t cm_closes;
31072+extern atomic_unchecked_t cm_connecteds;
31073+extern atomic_unchecked_t cm_connect_reqs;
31074+extern atomic_unchecked_t cm_rejects;
31075+extern atomic_unchecked_t mod_qp_timouts;
31076+extern atomic_unchecked_t qps_created;
31077+extern atomic_unchecked_t qps_destroyed;
31078+extern atomic_unchecked_t sw_qps_destroyed;
31079 extern u32 mh_detected;
31080 extern u32 mh_pauses_sent;
31081 extern u32 cm_packets_sent;
31082@@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
31083 extern u32 cm_listens_created;
31084 extern u32 cm_listens_destroyed;
31085 extern u32 cm_backlog_drops;
31086-extern atomic_t cm_loopbacks;
31087-extern atomic_t cm_nodes_created;
31088-extern atomic_t cm_nodes_destroyed;
31089-extern atomic_t cm_accel_dropped_pkts;
31090-extern atomic_t cm_resets_recvd;
31091+extern atomic_unchecked_t cm_loopbacks;
31092+extern atomic_unchecked_t cm_nodes_created;
31093+extern atomic_unchecked_t cm_nodes_destroyed;
31094+extern atomic_unchecked_t cm_accel_dropped_pkts;
31095+extern atomic_unchecked_t cm_resets_recvd;
31096
31097 extern u32 int_mod_timer_init;
31098 extern u32 int_mod_cq_depth_256;
31099diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c
31100--- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c 2011-03-27 14:31:47.000000000 -0400
31101+++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c 2011-05-04 17:56:28.000000000 -0400
31102@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats
31103 target_stat_values[++index] = mh_detected;
31104 target_stat_values[++index] = mh_pauses_sent;
31105 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
31106- target_stat_values[++index] = atomic_read(&cm_connects);
31107- target_stat_values[++index] = atomic_read(&cm_accepts);
31108- target_stat_values[++index] = atomic_read(&cm_disconnects);
31109- target_stat_values[++index] = atomic_read(&cm_connecteds);
31110- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
31111- target_stat_values[++index] = atomic_read(&cm_rejects);
31112- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
31113- target_stat_values[++index] = atomic_read(&qps_created);
31114- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
31115- target_stat_values[++index] = atomic_read(&qps_destroyed);
31116- target_stat_values[++index] = atomic_read(&cm_closes);
31117+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
31118+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
31119+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
31120+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
31121+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
31122+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
31123+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
31124+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
31125+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
31126+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
31127+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
31128 target_stat_values[++index] = cm_packets_sent;
31129 target_stat_values[++index] = cm_packets_bounced;
31130 target_stat_values[++index] = cm_packets_created;
31131@@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats
31132 target_stat_values[++index] = cm_listens_created;
31133 target_stat_values[++index] = cm_listens_destroyed;
31134 target_stat_values[++index] = cm_backlog_drops;
31135- target_stat_values[++index] = atomic_read(&cm_loopbacks);
31136- target_stat_values[++index] = atomic_read(&cm_nodes_created);
31137- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
31138- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
31139- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
31140+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
31141+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
31142+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
31143+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
31144+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
31145 target_stat_values[++index] = int_mod_timer_init;
31146 target_stat_values[++index] = int_mod_cq_depth_1;
31147 target_stat_values[++index] = int_mod_cq_depth_4;
31148diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c
31149--- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c 2011-03-27 14:31:47.000000000 -0400
31150+++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-04 17:56:28.000000000 -0400
31151@@ -45,9 +45,9 @@
31152
31153 #include <rdma/ib_umem.h>
31154
31155-atomic_t mod_qp_timouts;
31156-atomic_t qps_created;
31157-atomic_t sw_qps_destroyed;
31158+atomic_unchecked_t mod_qp_timouts;
31159+atomic_unchecked_t qps_created;
31160+atomic_unchecked_t sw_qps_destroyed;
31161
31162 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
31163
31164@@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struc
31165 if (init_attr->create_flags)
31166 return ERR_PTR(-EINVAL);
31167
31168- atomic_inc(&qps_created);
31169+ atomic_inc_unchecked(&qps_created);
31170 switch (init_attr->qp_type) {
31171 case IB_QPT_RC:
31172 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
31173@@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *
31174 struct iw_cm_event cm_event;
31175 int ret;
31176
31177- atomic_inc(&sw_qps_destroyed);
31178+ atomic_inc_unchecked(&sw_qps_destroyed);
31179 nesqp->destroyed = 1;
31180
31181 /* Blow away the connection if it exists. */
31182diff -urNp linux-2.6.32.46/drivers/input/gameport/gameport.c linux-2.6.32.46/drivers/input/gameport/gameport.c
31183--- linux-2.6.32.46/drivers/input/gameport/gameport.c 2011-03-27 14:31:47.000000000 -0400
31184+++ linux-2.6.32.46/drivers/input/gameport/gameport.c 2011-05-04 17:56:28.000000000 -0400
31185@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
31186 */
31187 static void gameport_init_port(struct gameport *gameport)
31188 {
31189- static atomic_t gameport_no = ATOMIC_INIT(0);
31190+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31191
31192 __module_get(THIS_MODULE);
31193
31194 mutex_init(&gameport->drv_mutex);
31195 device_initialize(&gameport->dev);
31196- dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
31197+ dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31198 gameport->dev.bus = &gameport_bus;
31199 gameport->dev.release = gameport_release_port;
31200 if (gameport->parent)
31201diff -urNp linux-2.6.32.46/drivers/input/input.c linux-2.6.32.46/drivers/input/input.c
31202--- linux-2.6.32.46/drivers/input/input.c 2011-03-27 14:31:47.000000000 -0400
31203+++ linux-2.6.32.46/drivers/input/input.c 2011-05-04 17:56:28.000000000 -0400
31204@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
31205 */
31206 int input_register_device(struct input_dev *dev)
31207 {
31208- static atomic_t input_no = ATOMIC_INIT(0);
31209+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31210 struct input_handler *handler;
31211 const char *path;
31212 int error;
31213@@ -1585,7 +1585,7 @@ int input_register_device(struct input_d
31214 dev->setkeycode = input_default_setkeycode;
31215
31216 dev_set_name(&dev->dev, "input%ld",
31217- (unsigned long) atomic_inc_return(&input_no) - 1);
31218+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31219
31220 error = device_add(&dev->dev);
31221 if (error)
31222diff -urNp linux-2.6.32.46/drivers/input/joystick/sidewinder.c linux-2.6.32.46/drivers/input/joystick/sidewinder.c
31223--- linux-2.6.32.46/drivers/input/joystick/sidewinder.c 2011-03-27 14:31:47.000000000 -0400
31224+++ linux-2.6.32.46/drivers/input/joystick/sidewinder.c 2011-05-18 20:09:36.000000000 -0400
31225@@ -30,6 +30,7 @@
31226 #include <linux/kernel.h>
31227 #include <linux/module.h>
31228 #include <linux/slab.h>
31229+#include <linux/sched.h>
31230 #include <linux/init.h>
31231 #include <linux/input.h>
31232 #include <linux/gameport.h>
31233@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31234 unsigned char buf[SW_LENGTH];
31235 int i;
31236
31237+ pax_track_stack();
31238+
31239 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31240
31241 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31242diff -urNp linux-2.6.32.46/drivers/input/joystick/xpad.c linux-2.6.32.46/drivers/input/joystick/xpad.c
31243--- linux-2.6.32.46/drivers/input/joystick/xpad.c 2011-03-27 14:31:47.000000000 -0400
31244+++ linux-2.6.32.46/drivers/input/joystick/xpad.c 2011-05-04 17:56:28.000000000 -0400
31245@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_clas
31246
31247 static int xpad_led_probe(struct usb_xpad *xpad)
31248 {
31249- static atomic_t led_seq = ATOMIC_INIT(0);
31250+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31251 long led_no;
31252 struct xpad_led *led;
31253 struct led_classdev *led_cdev;
31254@@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpa
31255 if (!led)
31256 return -ENOMEM;
31257
31258- led_no = (long)atomic_inc_return(&led_seq) - 1;
31259+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31260
31261 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31262 led->xpad = xpad;
31263diff -urNp linux-2.6.32.46/drivers/input/serio/serio.c linux-2.6.32.46/drivers/input/serio/serio.c
31264--- linux-2.6.32.46/drivers/input/serio/serio.c 2011-03-27 14:31:47.000000000 -0400
31265+++ linux-2.6.32.46/drivers/input/serio/serio.c 2011-05-04 17:56:28.000000000 -0400
31266@@ -527,7 +527,7 @@ static void serio_release_port(struct de
31267 */
31268 static void serio_init_port(struct serio *serio)
31269 {
31270- static atomic_t serio_no = ATOMIC_INIT(0);
31271+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31272
31273 __module_get(THIS_MODULE);
31274
31275@@ -536,7 +536,7 @@ static void serio_init_port(struct serio
31276 mutex_init(&serio->drv_mutex);
31277 device_initialize(&serio->dev);
31278 dev_set_name(&serio->dev, "serio%ld",
31279- (long)atomic_inc_return(&serio_no) - 1);
31280+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
31281 serio->dev.bus = &serio_bus;
31282 serio->dev.release = serio_release_port;
31283 if (serio->parent) {
31284diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/common.c linux-2.6.32.46/drivers/isdn/gigaset/common.c
31285--- linux-2.6.32.46/drivers/isdn/gigaset/common.c 2011-03-27 14:31:47.000000000 -0400
31286+++ linux-2.6.32.46/drivers/isdn/gigaset/common.c 2011-04-17 15:56:46.000000000 -0400
31287@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct
31288 cs->commands_pending = 0;
31289 cs->cur_at_seq = 0;
31290 cs->gotfwver = -1;
31291- cs->open_count = 0;
31292+ local_set(&cs->open_count, 0);
31293 cs->dev = NULL;
31294 cs->tty = NULL;
31295 cs->tty_dev = NULL;
31296diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h
31297--- linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h 2011-03-27 14:31:47.000000000 -0400
31298+++ linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h 2011-04-17 15:56:46.000000000 -0400
31299@@ -34,6 +34,7 @@
31300 #include <linux/tty_driver.h>
31301 #include <linux/list.h>
31302 #include <asm/atomic.h>
31303+#include <asm/local.h>
31304
31305 #define GIG_VERSION {0,5,0,0}
31306 #define GIG_COMPAT {0,4,0,0}
31307@@ -446,7 +447,7 @@ struct cardstate {
31308 spinlock_t cmdlock;
31309 unsigned curlen, cmdbytes;
31310
31311- unsigned open_count;
31312+ local_t open_count;
31313 struct tty_struct *tty;
31314 struct tasklet_struct if_wake_tasklet;
31315 unsigned control_state;
31316diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/interface.c linux-2.6.32.46/drivers/isdn/gigaset/interface.c
31317--- linux-2.6.32.46/drivers/isdn/gigaset/interface.c 2011-03-27 14:31:47.000000000 -0400
31318+++ linux-2.6.32.46/drivers/isdn/gigaset/interface.c 2011-04-17 15:56:46.000000000 -0400
31319@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
31320 return -ERESTARTSYS; // FIXME -EINTR?
31321 tty->driver_data = cs;
31322
31323- ++cs->open_count;
31324-
31325- if (cs->open_count == 1) {
31326+ if (local_inc_return(&cs->open_count) == 1) {
31327 spin_lock_irqsave(&cs->lock, flags);
31328 cs->tty = tty;
31329 spin_unlock_irqrestore(&cs->lock, flags);
31330@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
31331
31332 if (!cs->connected)
31333 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31334- else if (!cs->open_count)
31335+ else if (!local_read(&cs->open_count))
31336 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31337 else {
31338- if (!--cs->open_count) {
31339+ if (!local_dec_return(&cs->open_count)) {
31340 spin_lock_irqsave(&cs->lock, flags);
31341 cs->tty = NULL;
31342 spin_unlock_irqrestore(&cs->lock, flags);
31343@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
31344 if (!cs->connected) {
31345 gig_dbg(DEBUG_IF, "not connected");
31346 retval = -ENODEV;
31347- } else if (!cs->open_count)
31348+ } else if (!local_read(&cs->open_count))
31349 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31350 else {
31351 retval = 0;
31352@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
31353 if (!cs->connected) {
31354 gig_dbg(DEBUG_IF, "not connected");
31355 retval = -ENODEV;
31356- } else if (!cs->open_count)
31357+ } else if (!local_read(&cs->open_count))
31358 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31359 else if (cs->mstate != MS_LOCKED) {
31360 dev_warn(cs->dev, "can't write to unlocked device\n");
31361@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
31362 if (!cs->connected) {
31363 gig_dbg(DEBUG_IF, "not connected");
31364 retval = -ENODEV;
31365- } else if (!cs->open_count)
31366+ } else if (!local_read(&cs->open_count))
31367 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31368 else if (cs->mstate != MS_LOCKED) {
31369 dev_warn(cs->dev, "can't write to unlocked device\n");
31370@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
31371
31372 if (!cs->connected)
31373 gig_dbg(DEBUG_IF, "not connected");
31374- else if (!cs->open_count)
31375+ else if (!local_read(&cs->open_count))
31376 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31377 else if (cs->mstate != MS_LOCKED)
31378 dev_warn(cs->dev, "can't write to unlocked device\n");
31379@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
31380
31381 if (!cs->connected)
31382 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31383- else if (!cs->open_count)
31384+ else if (!local_read(&cs->open_count))
31385 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31386 else {
31387 //FIXME
31388@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
31389
31390 if (!cs->connected)
31391 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31392- else if (!cs->open_count)
31393+ else if (!local_read(&cs->open_count))
31394 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31395 else {
31396 //FIXME
31397@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
31398 goto out;
31399 }
31400
31401- if (!cs->open_count) {
31402+ if (!local_read(&cs->open_count)) {
31403 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31404 goto out;
31405 }
31406diff -urNp linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c
31407--- linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c 2011-03-27 14:31:47.000000000 -0400
31408+++ linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c 2011-04-17 15:56:46.000000000 -0400
31409@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
31410 }
31411 if (left) {
31412 if (t4file->user) {
31413- if (copy_from_user(buf, dp, left))
31414+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31415 return -EFAULT;
31416 } else {
31417 memcpy(buf, dp, left);
31418@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
31419 }
31420 if (left) {
31421 if (config->user) {
31422- if (copy_from_user(buf, dp, left))
31423+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31424 return -EFAULT;
31425 } else {
31426 memcpy(buf, dp, left);
31427diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c
31428--- linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c 2011-03-27 14:31:47.000000000 -0400
31429+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-16 21:46:57.000000000 -0400
31430@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31431 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31432 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31433
31434+ pax_track_stack();
31435
31436 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31437 {
31438diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c
31439--- linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c 2011-03-27 14:31:47.000000000 -0400
31440+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c 2011-05-16 21:46:57.000000000 -0400
31441@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31442 IDI_SYNC_REQ req;
31443 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31444
31445+ pax_track_stack();
31446+
31447 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31448
31449 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31450diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c
31451--- linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c 2011-03-27 14:31:47.000000000 -0400
31452+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-16 21:46:57.000000000 -0400
31453@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31454 IDI_SYNC_REQ req;
31455 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31456
31457+ pax_track_stack();
31458+
31459 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31460
31461 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31462diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c
31463--- linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c 2011-03-27 14:31:47.000000000 -0400
31464+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-16 21:46:57.000000000 -0400
31465@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31466 IDI_SYNC_REQ req;
31467 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31468
31469+ pax_track_stack();
31470+
31471 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31472
31473 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31474diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h
31475--- linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h 2011-03-27 14:31:47.000000000 -0400
31476+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h 2011-08-05 20:33:55.000000000 -0400
31477@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
31478 } diva_didd_add_adapter_t;
31479 typedef struct _diva_didd_remove_adapter {
31480 IDI_CALL p_request;
31481-} diva_didd_remove_adapter_t;
31482+} __no_const diva_didd_remove_adapter_t;
31483 typedef struct _diva_didd_read_adapter_array {
31484 void * buffer;
31485 dword length;
31486diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c
31487--- linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c 2011-03-27 14:31:47.000000000 -0400
31488+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c 2011-05-16 21:46:57.000000000 -0400
31489@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31490 IDI_SYNC_REQ req;
31491 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31492
31493+ pax_track_stack();
31494+
31495 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31496
31497 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31498diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c
31499--- linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c 2011-03-27 14:31:47.000000000 -0400
31500+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c 2011-05-16 21:46:57.000000000 -0400
31501@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31502 dword d;
31503 word w;
31504
31505+ pax_track_stack();
31506+
31507 a = plci->adapter;
31508 Id = ((word)plci->Id<<8)|a->Id;
31509 PUT_WORD(&SS_Ind[4],0x0000);
31510@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31511 word j, n, w;
31512 dword d;
31513
31514+ pax_track_stack();
31515+
31516
31517 for(i=0;i<8;i++) bp_parms[i].length = 0;
31518 for(i=0;i<2;i++) global_config[i].length = 0;
31519@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31520 const byte llc3[] = {4,3,2,2,6,6,0};
31521 const byte header[] = {0,2,3,3,0,0,0};
31522
31523+ pax_track_stack();
31524+
31525 for(i=0;i<8;i++) bp_parms[i].length = 0;
31526 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31527 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31528@@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI
31529 word appl_number_group_type[MAX_APPL];
31530 PLCI *auxplci;
31531
31532+ pax_track_stack();
31533+
31534 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31535
31536 if(!a->group_optimization_enabled)
31537diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c
31538--- linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c 2011-03-27 14:31:47.000000000 -0400
31539+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-16 21:46:57.000000000 -0400
31540@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31541 IDI_SYNC_REQ req;
31542 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31543
31544+ pax_track_stack();
31545+
31546 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31547
31548 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31549diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h
31550--- linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-03-27 14:31:47.000000000 -0400
31551+++ linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-05 20:33:55.000000000 -0400
31552@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
31553 typedef struct _diva_os_idi_adapter_interface {
31554 diva_init_card_proc_t cleanup_adapter_proc;
31555 diva_cmd_card_proc_t cmd_proc;
31556-} diva_os_idi_adapter_interface_t;
31557+} __no_const diva_os_idi_adapter_interface_t;
31558
31559 typedef struct _diva_os_xdi_adapter {
31560 struct list_head link;
31561diff -urNp linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c
31562--- linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c 2011-03-27 14:31:47.000000000 -0400
31563+++ linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c 2011-05-16 21:46:57.000000000 -0400
31564@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct f
31565 } iocpar;
31566 void __user *argp = (void __user *)arg;
31567
31568+ pax_track_stack();
31569+
31570 #define name iocpar.name
31571 #define bname iocpar.bname
31572 #define iocts iocpar.iocts
31573diff -urNp linux-2.6.32.46/drivers/isdn/icn/icn.c linux-2.6.32.46/drivers/isdn/icn/icn.c
31574--- linux-2.6.32.46/drivers/isdn/icn/icn.c 2011-03-27 14:31:47.000000000 -0400
31575+++ linux-2.6.32.46/drivers/isdn/icn/icn.c 2011-04-17 15:56:46.000000000 -0400
31576@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
31577 if (count > len)
31578 count = len;
31579 if (user) {
31580- if (copy_from_user(msg, buf, count))
31581+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31582 return -EFAULT;
31583 } else
31584 memcpy(msg, buf, count);
31585diff -urNp linux-2.6.32.46/drivers/isdn/mISDN/socket.c linux-2.6.32.46/drivers/isdn/mISDN/socket.c
31586--- linux-2.6.32.46/drivers/isdn/mISDN/socket.c 2011-03-27 14:31:47.000000000 -0400
31587+++ linux-2.6.32.46/drivers/isdn/mISDN/socket.c 2011-04-17 15:56:46.000000000 -0400
31588@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, uns
31589 if (dev) {
31590 struct mISDN_devinfo di;
31591
31592+ memset(&di, 0, sizeof(di));
31593 di.id = dev->id;
31594 di.Dprotocols = dev->Dprotocols;
31595 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
31596@@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, uns
31597 if (dev) {
31598 struct mISDN_devinfo di;
31599
31600+ memset(&di, 0, sizeof(di));
31601 di.id = dev->id;
31602 di.Dprotocols = dev->Dprotocols;
31603 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
31604diff -urNp linux-2.6.32.46/drivers/isdn/sc/interrupt.c linux-2.6.32.46/drivers/isdn/sc/interrupt.c
31605--- linux-2.6.32.46/drivers/isdn/sc/interrupt.c 2011-03-27 14:31:47.000000000 -0400
31606+++ linux-2.6.32.46/drivers/isdn/sc/interrupt.c 2011-04-17 15:56:46.000000000 -0400
31607@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy,
31608 }
31609 else if(callid>=0x0000 && callid<=0x7FFF)
31610 {
31611+ int len;
31612+
31613 pr_debug("%s: Got Incoming Call\n",
31614 sc_adapter[card]->devicename);
31615- strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
31616- strcpy(setup.eazmsn,
31617- sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
31618+ len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
31619+ sizeof(setup.phone));
31620+ if (len >= sizeof(setup.phone))
31621+ continue;
31622+ len = strlcpy(setup.eazmsn,
31623+ sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
31624+ sizeof(setup.eazmsn));
31625+ if (len >= sizeof(setup.eazmsn))
31626+ continue;
31627 setup.si1 = 7;
31628 setup.si2 = 0;
31629 setup.plan = 0;
31630@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy,
31631 * Handle a GetMyNumber Rsp
31632 */
31633 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
31634- strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
31635+ strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
31636+ rcvmsg.msg_data.byte_array,
31637+ sizeof(rcvmsg.msg_data.byte_array));
31638 continue;
31639 }
31640
31641diff -urNp linux-2.6.32.46/drivers/lguest/core.c linux-2.6.32.46/drivers/lguest/core.c
31642--- linux-2.6.32.46/drivers/lguest/core.c 2011-03-27 14:31:47.000000000 -0400
31643+++ linux-2.6.32.46/drivers/lguest/core.c 2011-04-17 15:56:46.000000000 -0400
31644@@ -91,9 +91,17 @@ static __init int map_switcher(void)
31645 * it's worked so far. The end address needs +1 because __get_vm_area
31646 * allocates an extra guard page, so we need space for that.
31647 */
31648+
31649+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31650+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31651+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31652+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31653+#else
31654 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31655 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31656 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31657+#endif
31658+
31659 if (!switcher_vma) {
31660 err = -ENOMEM;
31661 printk("lguest: could not map switcher pages high\n");
31662@@ -118,7 +126,7 @@ static __init int map_switcher(void)
31663 * Now the Switcher is mapped at the right address, we can't fail!
31664 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31665 */
31666- memcpy(switcher_vma->addr, start_switcher_text,
31667+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31668 end_switcher_text - start_switcher_text);
31669
31670 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31671diff -urNp linux-2.6.32.46/drivers/lguest/x86/core.c linux-2.6.32.46/drivers/lguest/x86/core.c
31672--- linux-2.6.32.46/drivers/lguest/x86/core.c 2011-03-27 14:31:47.000000000 -0400
31673+++ linux-2.6.32.46/drivers/lguest/x86/core.c 2011-04-17 15:56:46.000000000 -0400
31674@@ -59,7 +59,7 @@ static struct {
31675 /* Offset from where switcher.S was compiled to where we've copied it */
31676 static unsigned long switcher_offset(void)
31677 {
31678- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31679+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31680 }
31681
31682 /* This cpu's struct lguest_pages. */
31683@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31684 * These copies are pretty cheap, so we do them unconditionally: */
31685 /* Save the current Host top-level page directory.
31686 */
31687+
31688+#ifdef CONFIG_PAX_PER_CPU_PGD
31689+ pages->state.host_cr3 = read_cr3();
31690+#else
31691 pages->state.host_cr3 = __pa(current->mm->pgd);
31692+#endif
31693+
31694 /*
31695 * Set up the Guest's page tables to see this CPU's pages (and no
31696 * other CPU's pages).
31697@@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
31698 * compiled-in switcher code and the high-mapped copy we just made.
31699 */
31700 for (i = 0; i < IDT_ENTRIES; i++)
31701- default_idt_entries[i] += switcher_offset();
31702+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31703
31704 /*
31705 * Set up the Switcher's per-cpu areas.
31706@@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
31707 * it will be undisturbed when we switch. To change %cs and jump we
31708 * need this structure to feed to Intel's "lcall" instruction.
31709 */
31710- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31711+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31712 lguest_entry.segment = LGUEST_CS;
31713
31714 /*
31715diff -urNp linux-2.6.32.46/drivers/lguest/x86/switcher_32.S linux-2.6.32.46/drivers/lguest/x86/switcher_32.S
31716--- linux-2.6.32.46/drivers/lguest/x86/switcher_32.S 2011-03-27 14:31:47.000000000 -0400
31717+++ linux-2.6.32.46/drivers/lguest/x86/switcher_32.S 2011-04-17 15:56:46.000000000 -0400
31718@@ -87,6 +87,7 @@
31719 #include <asm/page.h>
31720 #include <asm/segment.h>
31721 #include <asm/lguest.h>
31722+#include <asm/processor-flags.h>
31723
31724 // We mark the start of the code to copy
31725 // It's placed in .text tho it's never run here
31726@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31727 // Changes type when we load it: damn Intel!
31728 // For after we switch over our page tables
31729 // That entry will be read-only: we'd crash.
31730+
31731+#ifdef CONFIG_PAX_KERNEXEC
31732+ mov %cr0, %edx
31733+ xor $X86_CR0_WP, %edx
31734+ mov %edx, %cr0
31735+#endif
31736+
31737 movl $(GDT_ENTRY_TSS*8), %edx
31738 ltr %dx
31739
31740@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31741 // Let's clear it again for our return.
31742 // The GDT descriptor of the Host
31743 // Points to the table after two "size" bytes
31744- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31745+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31746 // Clear "used" from type field (byte 5, bit 2)
31747- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31748+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31749+
31750+#ifdef CONFIG_PAX_KERNEXEC
31751+ mov %cr0, %eax
31752+ xor $X86_CR0_WP, %eax
31753+ mov %eax, %cr0
31754+#endif
31755
31756 // Once our page table's switched, the Guest is live!
31757 // The Host fades as we run this final step.
31758@@ -295,13 +309,12 @@ deliver_to_host:
31759 // I consulted gcc, and it gave
31760 // These instructions, which I gladly credit:
31761 leal (%edx,%ebx,8), %eax
31762- movzwl (%eax),%edx
31763- movl 4(%eax), %eax
31764- xorw %ax, %ax
31765- orl %eax, %edx
31766+ movl 4(%eax), %edx
31767+ movw (%eax), %dx
31768 // Now the address of the handler's in %edx
31769 // We call it now: its "iret" drops us home.
31770- jmp *%edx
31771+ ljmp $__KERNEL_CS, $1f
31772+1: jmp *%edx
31773
31774 // Every interrupt can come to us here
31775 // But we must truly tell each apart.
31776diff -urNp linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c
31777--- linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c 2011-03-27 14:31:47.000000000 -0400
31778+++ linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c 2011-04-17 15:56:46.000000000 -0400
31779@@ -15,7 +15,7 @@
31780
31781 #define MAX_PMU_LEVEL 0xFF
31782
31783-static struct backlight_ops pmu_backlight_data;
31784+static const struct backlight_ops pmu_backlight_data;
31785 static DEFINE_SPINLOCK(pmu_backlight_lock);
31786 static int sleeping, uses_pmu_bl;
31787 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
31788@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
31789 return bd->props.brightness;
31790 }
31791
31792-static struct backlight_ops pmu_backlight_data = {
31793+static const struct backlight_ops pmu_backlight_data = {
31794 .get_brightness = pmu_backlight_get_brightness,
31795 .update_status = pmu_backlight_update_status,
31796
31797diff -urNp linux-2.6.32.46/drivers/macintosh/via-pmu.c linux-2.6.32.46/drivers/macintosh/via-pmu.c
31798--- linux-2.6.32.46/drivers/macintosh/via-pmu.c 2011-03-27 14:31:47.000000000 -0400
31799+++ linux-2.6.32.46/drivers/macintosh/via-pmu.c 2011-04-17 15:56:46.000000000 -0400
31800@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
31801 && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
31802 }
31803
31804-static struct platform_suspend_ops pmu_pm_ops = {
31805+static const struct platform_suspend_ops pmu_pm_ops = {
31806 .enter = powerbook_sleep,
31807 .valid = pmu_sleep_valid,
31808 };
31809diff -urNp linux-2.6.32.46/drivers/md/dm.c linux-2.6.32.46/drivers/md/dm.c
31810--- linux-2.6.32.46/drivers/md/dm.c 2011-08-09 18:35:29.000000000 -0400
31811+++ linux-2.6.32.46/drivers/md/dm.c 2011-08-09 18:33:59.000000000 -0400
31812@@ -165,9 +165,9 @@ struct mapped_device {
31813 /*
31814 * Event handling.
31815 */
31816- atomic_t event_nr;
31817+ atomic_unchecked_t event_nr;
31818 wait_queue_head_t eventq;
31819- atomic_t uevent_seq;
31820+ atomic_unchecked_t uevent_seq;
31821 struct list_head uevent_list;
31822 spinlock_t uevent_lock; /* Protect access to uevent_list */
31823
31824@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(i
31825 rwlock_init(&md->map_lock);
31826 atomic_set(&md->holders, 1);
31827 atomic_set(&md->open_count, 0);
31828- atomic_set(&md->event_nr, 0);
31829- atomic_set(&md->uevent_seq, 0);
31830+ atomic_set_unchecked(&md->event_nr, 0);
31831+ atomic_set_unchecked(&md->uevent_seq, 0);
31832 INIT_LIST_HEAD(&md->uevent_list);
31833 spin_lock_init(&md->uevent_lock);
31834
31835@@ -1927,7 +1927,7 @@ static void event_callback(void *context
31836
31837 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31838
31839- atomic_inc(&md->event_nr);
31840+ atomic_inc_unchecked(&md->event_nr);
31841 wake_up(&md->eventq);
31842 }
31843
31844@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_dev
31845
31846 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31847 {
31848- return atomic_add_return(1, &md->uevent_seq);
31849+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31850 }
31851
31852 uint32_t dm_get_event_nr(struct mapped_device *md)
31853 {
31854- return atomic_read(&md->event_nr);
31855+ return atomic_read_unchecked(&md->event_nr);
31856 }
31857
31858 int dm_wait_event(struct mapped_device *md, int event_nr)
31859 {
31860 return wait_event_interruptible(md->eventq,
31861- (event_nr != atomic_read(&md->event_nr)));
31862+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31863 }
31864
31865 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31866diff -urNp linux-2.6.32.46/drivers/md/dm-ioctl.c linux-2.6.32.46/drivers/md/dm-ioctl.c
31867--- linux-2.6.32.46/drivers/md/dm-ioctl.c 2011-03-27 14:31:47.000000000 -0400
31868+++ linux-2.6.32.46/drivers/md/dm-ioctl.c 2011-04-17 15:56:46.000000000 -0400
31869@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, str
31870 cmd == DM_LIST_VERSIONS_CMD)
31871 return 0;
31872
31873- if ((cmd == DM_DEV_CREATE_CMD)) {
31874+ if (cmd == DM_DEV_CREATE_CMD) {
31875 if (!*param->name) {
31876 DMWARN("name not supplied when creating device");
31877 return -EINVAL;
31878diff -urNp linux-2.6.32.46/drivers/md/dm-raid1.c linux-2.6.32.46/drivers/md/dm-raid1.c
31879--- linux-2.6.32.46/drivers/md/dm-raid1.c 2011-03-27 14:31:47.000000000 -0400
31880+++ linux-2.6.32.46/drivers/md/dm-raid1.c 2011-05-04 17:56:28.000000000 -0400
31881@@ -41,7 +41,7 @@ enum dm_raid1_error {
31882
31883 struct mirror {
31884 struct mirror_set *ms;
31885- atomic_t error_count;
31886+ atomic_unchecked_t error_count;
31887 unsigned long error_type;
31888 struct dm_dev *dev;
31889 sector_t offset;
31890@@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m
31891 * simple way to tell if a device has encountered
31892 * errors.
31893 */
31894- atomic_inc(&m->error_count);
31895+ atomic_inc_unchecked(&m->error_count);
31896
31897 if (test_and_set_bit(error_type, &m->error_type))
31898 return;
31899@@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m
31900 }
31901
31902 for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
31903- if (!atomic_read(&new->error_count)) {
31904+ if (!atomic_read_unchecked(&new->error_count)) {
31905 set_default_mirror(new);
31906 break;
31907 }
31908@@ -363,7 +363,7 @@ static struct mirror *choose_mirror(stru
31909 struct mirror *m = get_default_mirror(ms);
31910
31911 do {
31912- if (likely(!atomic_read(&m->error_count)))
31913+ if (likely(!atomic_read_unchecked(&m->error_count)))
31914 return m;
31915
31916 if (m-- == ms->mirror)
31917@@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
31918 {
31919 struct mirror *default_mirror = get_default_mirror(m->ms);
31920
31921- return !atomic_read(&default_mirror->error_count);
31922+ return !atomic_read_unchecked(&default_mirror->error_count);
31923 }
31924
31925 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31926@@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *
31927 */
31928 if (likely(region_in_sync(ms, region, 1)))
31929 m = choose_mirror(ms, bio->bi_sector);
31930- else if (m && atomic_read(&m->error_count))
31931+ else if (m && atomic_read_unchecked(&m->error_count))
31932 m = NULL;
31933
31934 if (likely(m))
31935@@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set
31936 }
31937
31938 ms->mirror[mirror].ms = ms;
31939- atomic_set(&(ms->mirror[mirror].error_count), 0);
31940+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31941 ms->mirror[mirror].error_type = 0;
31942 ms->mirror[mirror].offset = offset;
31943
31944@@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_targ
31945 */
31946 static char device_status_char(struct mirror *m)
31947 {
31948- if (!atomic_read(&(m->error_count)))
31949+ if (!atomic_read_unchecked(&(m->error_count)))
31950 return 'A';
31951
31952 return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
31953diff -urNp linux-2.6.32.46/drivers/md/dm-stripe.c linux-2.6.32.46/drivers/md/dm-stripe.c
31954--- linux-2.6.32.46/drivers/md/dm-stripe.c 2011-03-27 14:31:47.000000000 -0400
31955+++ linux-2.6.32.46/drivers/md/dm-stripe.c 2011-05-04 17:56:28.000000000 -0400
31956@@ -20,7 +20,7 @@ struct stripe {
31957 struct dm_dev *dev;
31958 sector_t physical_start;
31959
31960- atomic_t error_count;
31961+ atomic_unchecked_t error_count;
31962 };
31963
31964 struct stripe_c {
31965@@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *
31966 kfree(sc);
31967 return r;
31968 }
31969- atomic_set(&(sc->stripe[i].error_count), 0);
31970+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31971 }
31972
31973 ti->private = sc;
31974@@ -257,7 +257,7 @@ static int stripe_status(struct dm_targe
31975 DMEMIT("%d ", sc->stripes);
31976 for (i = 0; i < sc->stripes; i++) {
31977 DMEMIT("%s ", sc->stripe[i].dev->name);
31978- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31979+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31980 'D' : 'A';
31981 }
31982 buffer[i] = '\0';
31983@@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_targe
31984 */
31985 for (i = 0; i < sc->stripes; i++)
31986 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31987- atomic_inc(&(sc->stripe[i].error_count));
31988- if (atomic_read(&(sc->stripe[i].error_count)) <
31989+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31990+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31991 DM_IO_ERROR_THRESHOLD)
31992 queue_work(kstriped, &sc->kstriped_ws);
31993 }
31994diff -urNp linux-2.6.32.46/drivers/md/dm-sysfs.c linux-2.6.32.46/drivers/md/dm-sysfs.c
31995--- linux-2.6.32.46/drivers/md/dm-sysfs.c 2011-03-27 14:31:47.000000000 -0400
31996+++ linux-2.6.32.46/drivers/md/dm-sysfs.c 2011-04-17 15:56:46.000000000 -0400
31997@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
31998 NULL,
31999 };
32000
32001-static struct sysfs_ops dm_sysfs_ops = {
32002+static const struct sysfs_ops dm_sysfs_ops = {
32003 .show = dm_attr_show,
32004 };
32005
32006diff -urNp linux-2.6.32.46/drivers/md/dm-table.c linux-2.6.32.46/drivers/md/dm-table.c
32007--- linux-2.6.32.46/drivers/md/dm-table.c 2011-06-25 12:55:34.000000000 -0400
32008+++ linux-2.6.32.46/drivers/md/dm-table.c 2011-06-25 12:56:37.000000000 -0400
32009@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct
32010 if (!dev_size)
32011 return 0;
32012
32013- if ((start >= dev_size) || (start + len > dev_size)) {
32014+ if ((start >= dev_size) || (len > dev_size - start)) {
32015 DMWARN("%s: %s too small for target: "
32016 "start=%llu, len=%llu, dev_size=%llu",
32017 dm_device_name(ti->table->md), bdevname(bdev, b),
32018diff -urNp linux-2.6.32.46/drivers/md/md.c linux-2.6.32.46/drivers/md/md.c
32019--- linux-2.6.32.46/drivers/md/md.c 2011-07-13 17:23:04.000000000 -0400
32020+++ linux-2.6.32.46/drivers/md/md.c 2011-07-13 17:23:18.000000000 -0400
32021@@ -153,10 +153,10 @@ static int start_readonly;
32022 * start build, activate spare
32023 */
32024 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
32025-static atomic_t md_event_count;
32026+static atomic_unchecked_t md_event_count;
32027 void md_new_event(mddev_t *mddev)
32028 {
32029- atomic_inc(&md_event_count);
32030+ atomic_inc_unchecked(&md_event_count);
32031 wake_up(&md_event_waiters);
32032 }
32033 EXPORT_SYMBOL_GPL(md_new_event);
32034@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
32035 */
32036 static void md_new_event_inintr(mddev_t *mddev)
32037 {
32038- atomic_inc(&md_event_count);
32039+ atomic_inc_unchecked(&md_event_count);
32040 wake_up(&md_event_waiters);
32041 }
32042
32043@@ -1218,7 +1218,7 @@ static int super_1_load(mdk_rdev_t *rdev
32044
32045 rdev->preferred_minor = 0xffff;
32046 rdev->data_offset = le64_to_cpu(sb->data_offset);
32047- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32048+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32049
32050 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
32051 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
32052@@ -1392,7 +1392,7 @@ static void super_1_sync(mddev_t *mddev,
32053 else
32054 sb->resync_offset = cpu_to_le64(0);
32055
32056- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
32057+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
32058
32059 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
32060 sb->size = cpu_to_le64(mddev->dev_sectors);
32061@@ -2214,7 +2214,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
32062 static ssize_t
32063 errors_show(mdk_rdev_t *rdev, char *page)
32064 {
32065- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
32066+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
32067 }
32068
32069 static ssize_t
32070@@ -2223,7 +2223,7 @@ errors_store(mdk_rdev_t *rdev, const cha
32071 char *e;
32072 unsigned long n = simple_strtoul(buf, &e, 10);
32073 if (*buf && (*e == 0 || *e == '\n')) {
32074- atomic_set(&rdev->corrected_errors, n);
32075+ atomic_set_unchecked(&rdev->corrected_errors, n);
32076 return len;
32077 }
32078 return -EINVAL;
32079@@ -2517,7 +2517,7 @@ static void rdev_free(struct kobject *ko
32080 mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
32081 kfree(rdev);
32082 }
32083-static struct sysfs_ops rdev_sysfs_ops = {
32084+static const struct sysfs_ops rdev_sysfs_ops = {
32085 .show = rdev_attr_show,
32086 .store = rdev_attr_store,
32087 };
32088@@ -2566,8 +2566,8 @@ static mdk_rdev_t *md_import_device(dev_
32089 rdev->data_offset = 0;
32090 rdev->sb_events = 0;
32091 atomic_set(&rdev->nr_pending, 0);
32092- atomic_set(&rdev->read_errors, 0);
32093- atomic_set(&rdev->corrected_errors, 0);
32094+ atomic_set_unchecked(&rdev->read_errors, 0);
32095+ atomic_set_unchecked(&rdev->corrected_errors, 0);
32096
32097 size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
32098 if (!size) {
32099@@ -3887,7 +3887,7 @@ static void md_free(struct kobject *ko)
32100 kfree(mddev);
32101 }
32102
32103-static struct sysfs_ops md_sysfs_ops = {
32104+static const struct sysfs_ops md_sysfs_ops = {
32105 .show = md_attr_show,
32106 .store = md_attr_store,
32107 };
32108@@ -4474,7 +4474,8 @@ out:
32109 err = 0;
32110 blk_integrity_unregister(disk);
32111 md_new_event(mddev);
32112- sysfs_notify_dirent(mddev->sysfs_state);
32113+ if (mddev->sysfs_state)
32114+ sysfs_notify_dirent(mddev->sysfs_state);
32115 return err;
32116 }
32117
32118@@ -5954,7 +5955,7 @@ static int md_seq_show(struct seq_file *
32119
32120 spin_unlock(&pers_lock);
32121 seq_printf(seq, "\n");
32122- mi->event = atomic_read(&md_event_count);
32123+ mi->event = atomic_read_unchecked(&md_event_count);
32124 return 0;
32125 }
32126 if (v == (void*)2) {
32127@@ -6043,7 +6044,7 @@ static int md_seq_show(struct seq_file *
32128 chunk_kb ? "KB" : "B");
32129 if (bitmap->file) {
32130 seq_printf(seq, ", file: ");
32131- seq_path(seq, &bitmap->file->f_path, " \t\n");
32132+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
32133 }
32134
32135 seq_printf(seq, "\n");
32136@@ -6077,7 +6078,7 @@ static int md_seq_open(struct inode *ino
32137 else {
32138 struct seq_file *p = file->private_data;
32139 p->private = mi;
32140- mi->event = atomic_read(&md_event_count);
32141+ mi->event = atomic_read_unchecked(&md_event_count);
32142 }
32143 return error;
32144 }
32145@@ -6093,7 +6094,7 @@ static unsigned int mdstat_poll(struct f
32146 /* always allow read */
32147 mask = POLLIN | POLLRDNORM;
32148
32149- if (mi->event != atomic_read(&md_event_count))
32150+ if (mi->event != atomic_read_unchecked(&md_event_count))
32151 mask |= POLLERR | POLLPRI;
32152 return mask;
32153 }
32154@@ -6137,7 +6138,7 @@ static int is_mddev_idle(mddev_t *mddev,
32155 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
32156 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
32157 (int)part_stat_read(&disk->part0, sectors[1]) -
32158- atomic_read(&disk->sync_io);
32159+ atomic_read_unchecked(&disk->sync_io);
32160 /* sync IO will cause sync_io to increase before the disk_stats
32161 * as sync_io is counted when a request starts, and
32162 * disk_stats is counted when it completes.
32163diff -urNp linux-2.6.32.46/drivers/md/md.h linux-2.6.32.46/drivers/md/md.h
32164--- linux-2.6.32.46/drivers/md/md.h 2011-03-27 14:31:47.000000000 -0400
32165+++ linux-2.6.32.46/drivers/md/md.h 2011-05-04 17:56:20.000000000 -0400
32166@@ -94,10 +94,10 @@ struct mdk_rdev_s
32167 * only maintained for arrays that
32168 * support hot removal
32169 */
32170- atomic_t read_errors; /* number of consecutive read errors that
32171+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
32172 * we have tried to ignore.
32173 */
32174- atomic_t corrected_errors; /* number of corrected read errors,
32175+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32176 * for reporting to userspace and storing
32177 * in superblock.
32178 */
32179@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
32180
32181 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32182 {
32183- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32184+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32185 }
32186
32187 struct mdk_personality
32188diff -urNp linux-2.6.32.46/drivers/md/raid10.c linux-2.6.32.46/drivers/md/raid10.c
32189--- linux-2.6.32.46/drivers/md/raid10.c 2011-03-27 14:31:47.000000000 -0400
32190+++ linux-2.6.32.46/drivers/md/raid10.c 2011-05-04 17:56:28.000000000 -0400
32191@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bi
32192 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32193 set_bit(R10BIO_Uptodate, &r10_bio->state);
32194 else {
32195- atomic_add(r10_bio->sectors,
32196+ atomic_add_unchecked(r10_bio->sectors,
32197 &conf->mirrors[d].rdev->corrected_errors);
32198 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32199 md_error(r10_bio->mddev,
32200@@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
32201 test_bit(In_sync, &rdev->flags)) {
32202 atomic_inc(&rdev->nr_pending);
32203 rcu_read_unlock();
32204- atomic_add(s, &rdev->corrected_errors);
32205+ atomic_add_unchecked(s, &rdev->corrected_errors);
32206 if (sync_page_io(rdev->bdev,
32207 r10_bio->devs[sl].addr +
32208 sect + rdev->data_offset,
32209diff -urNp linux-2.6.32.46/drivers/md/raid1.c linux-2.6.32.46/drivers/md/raid1.c
32210--- linux-2.6.32.46/drivers/md/raid1.c 2011-03-27 14:31:47.000000000 -0400
32211+++ linux-2.6.32.46/drivers/md/raid1.c 2011-05-04 17:56:28.000000000 -0400
32212@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *
32213 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32214 continue;
32215 rdev = conf->mirrors[d].rdev;
32216- atomic_add(s, &rdev->corrected_errors);
32217+ atomic_add_unchecked(s, &rdev->corrected_errors);
32218 if (sync_page_io(rdev->bdev,
32219 sect + rdev->data_offset,
32220 s<<9,
32221@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf,
32222 /* Well, this device is dead */
32223 md_error(mddev, rdev);
32224 else {
32225- atomic_add(s, &rdev->corrected_errors);
32226+ atomic_add_unchecked(s, &rdev->corrected_errors);
32227 printk(KERN_INFO
32228 "raid1:%s: read error corrected "
32229 "(%d sectors at %llu on %s)\n",
32230diff -urNp linux-2.6.32.46/drivers/md/raid5.c linux-2.6.32.46/drivers/md/raid5.c
32231--- linux-2.6.32.46/drivers/md/raid5.c 2011-06-25 12:55:34.000000000 -0400
32232+++ linux-2.6.32.46/drivers/md/raid5.c 2011-06-25 12:58:39.000000000 -0400
32233@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_hea
32234 bi->bi_next = NULL;
32235 if ((rw & WRITE) &&
32236 test_bit(R5_ReWrite, &sh->dev[i].flags))
32237- atomic_add(STRIPE_SECTORS,
32238+ atomic_add_unchecked(STRIPE_SECTORS,
32239 &rdev->corrected_errors);
32240 generic_make_request(bi);
32241 } else {
32242@@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struc
32243 clear_bit(R5_ReadError, &sh->dev[i].flags);
32244 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32245 }
32246- if (atomic_read(&conf->disks[i].rdev->read_errors))
32247- atomic_set(&conf->disks[i].rdev->read_errors, 0);
32248+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32249+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32250 } else {
32251 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32252 int retry = 0;
32253 rdev = conf->disks[i].rdev;
32254
32255 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32256- atomic_inc(&rdev->read_errors);
32257+ atomic_inc_unchecked(&rdev->read_errors);
32258 if (conf->mddev->degraded >= conf->max_degraded)
32259 printk_rl(KERN_WARNING
32260 "raid5:%s: read error not correctable "
32261@@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struc
32262 (unsigned long long)(sh->sector
32263 + rdev->data_offset),
32264 bdn);
32265- else if (atomic_read(&rdev->read_errors)
32266+ else if (atomic_read_unchecked(&rdev->read_errors)
32267 > conf->max_nr_stripes)
32268 printk(KERN_WARNING
32269 "raid5:%s: Too many read errors, failing device %s.\n",
32270@@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct s
32271 sector_t r_sector;
32272 struct stripe_head sh2;
32273
32274+ pax_track_stack();
32275
32276 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32277 stripe = new_sector;
32278diff -urNp linux-2.6.32.46/drivers/media/common/saa7146_hlp.c linux-2.6.32.46/drivers/media/common/saa7146_hlp.c
32279--- linux-2.6.32.46/drivers/media/common/saa7146_hlp.c 2011-03-27 14:31:47.000000000 -0400
32280+++ linux-2.6.32.46/drivers/media/common/saa7146_hlp.c 2011-05-16 21:46:57.000000000 -0400
32281@@ -353,6 +353,8 @@ static void calculate_clipping_registers
32282
32283 int x[32], y[32], w[32], h[32];
32284
32285+ pax_track_stack();
32286+
32287 /* clear out memory */
32288 memset(&line_list[0], 0x00, sizeof(u32)*32);
32289 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32290diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32291--- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-03-27 14:31:47.000000000 -0400
32292+++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-16 21:46:57.000000000 -0400
32293@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32294 u8 buf[HOST_LINK_BUF_SIZE];
32295 int i;
32296
32297+ pax_track_stack();
32298+
32299 dprintk("%s\n", __func__);
32300
32301 /* check if we have space for a link buf in the rx_buffer */
32302@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32303 unsigned long timeout;
32304 int written;
32305
32306+ pax_track_stack();
32307+
32308 dprintk("%s\n", __func__);
32309
32310 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32311diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h
32312--- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h 2011-03-27 14:31:47.000000000 -0400
32313+++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-05 20:33:55.000000000 -0400
32314@@ -71,7 +71,7 @@ struct dvb_demux_feed {
32315 union {
32316 dmx_ts_cb ts;
32317 dmx_section_cb sec;
32318- } cb;
32319+ } __no_const cb;
32320
32321 struct dvb_demux *demux;
32322 void *priv;
32323diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c
32324--- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c 2011-03-27 14:31:47.000000000 -0400
32325+++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-23 21:22:32.000000000 -0400
32326@@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapt
32327 const struct dvb_device *template, void *priv, int type)
32328 {
32329 struct dvb_device *dvbdev;
32330- struct file_operations *dvbdevfops;
32331+ file_operations_no_const *dvbdevfops;
32332 struct device *clsdev;
32333 int minor;
32334 int id;
32335diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c
32336--- linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c 2011-03-27 14:31:47.000000000 -0400
32337+++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-05 20:33:55.000000000 -0400
32338@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_di
32339 struct dib0700_adapter_state {
32340 int (*set_param_save) (struct dvb_frontend *,
32341 struct dvb_frontend_parameters *);
32342-};
32343+} __no_const;
32344
32345 static int dib7070_set_param_override(struct dvb_frontend *fe,
32346 struct dvb_frontend_parameters *fep)
32347diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c
32348--- linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-03-27 14:31:47.000000000 -0400
32349+++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-16 21:46:57.000000000 -0400
32350@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb
32351
32352 u8 buf[260];
32353
32354+ pax_track_stack();
32355+
32356 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32357 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
32358
32359diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c
32360--- linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-05-10 22:12:01.000000000 -0400
32361+++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-08-05 20:33:55.000000000 -0400
32362@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "
32363
32364 struct dib0700_adapter_state {
32365 int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
32366-};
32367+} __no_const;
32368
32369 /* Hauppauge Nova-T 500 (aka Bristol)
32370 * has a LNA on GPIO0 which is enabled by setting 1 */
32371diff -urNp linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h
32372--- linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h 2011-03-27 14:31:47.000000000 -0400
32373+++ linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h 2011-08-05 20:33:55.000000000 -0400
32374@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
32375 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
32376 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
32377 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
32378-};
32379+} __no_const;
32380
32381 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
32382 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
32383diff -urNp linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c
32384--- linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c 2011-03-27 14:31:47.000000000 -0400
32385+++ linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c 2011-05-16 21:46:57.000000000 -0400
32386@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32387 u8 tudata[585];
32388 int i;
32389
32390+ pax_track_stack();
32391+
32392 dprintk("Firmware is %zd bytes\n",fw->size);
32393
32394 /* Get eprom data */
32395diff -urNp linux-2.6.32.46/drivers/media/radio/radio-cadet.c linux-2.6.32.46/drivers/media/radio/radio-cadet.c
32396--- linux-2.6.32.46/drivers/media/radio/radio-cadet.c 2011-03-27 14:31:47.000000000 -0400
32397+++ linux-2.6.32.46/drivers/media/radio/radio-cadet.c 2011-04-17 15:56:46.000000000 -0400
32398@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
32399 while (i < count && dev->rdsin != dev->rdsout)
32400 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32401
32402- if (copy_to_user(data, readbuf, i))
32403+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32404 return -EFAULT;
32405 return i;
32406 }
32407diff -urNp linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c
32408--- linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c 2011-03-27 14:31:47.000000000 -0400
32409+++ linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c 2011-05-16 21:46:57.000000000 -0400
32410@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl
32411
32412 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32413
32414-static atomic_t cx18_instance = ATOMIC_INIT(0);
32415+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32416
32417 /* Parameter declarations */
32418 static int cardtype[CX18_MAX_CARDS];
32419@@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32420 struct i2c_client c;
32421 u8 eedata[256];
32422
32423+ pax_track_stack();
32424+
32425 memset(&c, 0, sizeof(c));
32426 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32427 c.adapter = &cx->i2c_adap[0];
32428@@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct p
32429 struct cx18 *cx;
32430
32431 /* FIXME - module parameter arrays constrain max instances */
32432- i = atomic_inc_return(&cx18_instance) - 1;
32433+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32434 if (i >= CX18_MAX_CARDS) {
32435 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32436 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
32437diff -urNp linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c
32438--- linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c 2011-03-27 14:31:47.000000000 -0400
32439+++ linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c 2011-05-04 17:56:28.000000000 -0400
32440@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl
32441 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32442
32443 /* ivtv instance counter */
32444-static atomic_t ivtv_instance = ATOMIC_INIT(0);
32445+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32446
32447 /* Parameter declarations */
32448 static int cardtype[IVTV_MAX_CARDS];
32449diff -urNp linux-2.6.32.46/drivers/media/video/omap24xxcam.c linux-2.6.32.46/drivers/media/video/omap24xxcam.c
32450--- linux-2.6.32.46/drivers/media/video/omap24xxcam.c 2011-03-27 14:31:47.000000000 -0400
32451+++ linux-2.6.32.46/drivers/media/video/omap24xxcam.c 2011-05-04 17:56:28.000000000 -0400
32452@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(str
32453 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
32454
32455 do_gettimeofday(&vb->ts);
32456- vb->field_count = atomic_add_return(2, &fh->field_count);
32457+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
32458 if (csr & csr_error) {
32459 vb->state = VIDEOBUF_ERROR;
32460 if (!atomic_read(&fh->cam->in_reset)) {
32461diff -urNp linux-2.6.32.46/drivers/media/video/omap24xxcam.h linux-2.6.32.46/drivers/media/video/omap24xxcam.h
32462--- linux-2.6.32.46/drivers/media/video/omap24xxcam.h 2011-03-27 14:31:47.000000000 -0400
32463+++ linux-2.6.32.46/drivers/media/video/omap24xxcam.h 2011-05-04 17:56:28.000000000 -0400
32464@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
32465 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
32466 struct videobuf_queue vbq;
32467 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
32468- atomic_t field_count; /* field counter for videobuf_buffer */
32469+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
32470 /* accessing cam here doesn't need serialisation: it's constant */
32471 struct omap24xxcam_device *cam;
32472 };
32473diff -urNp linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32474--- linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-03-27 14:31:47.000000000 -0400
32475+++ linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-16 21:46:57.000000000 -0400
32476@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
32477 u8 *eeprom;
32478 struct tveeprom tvdata;
32479
32480+ pax_track_stack();
32481+
32482 memset(&tvdata,0,sizeof(tvdata));
32483
32484 eeprom = pvr2_eeprom_fetch(hdw);
32485diff -urNp linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
32486--- linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-03-27 14:31:47.000000000 -0400
32487+++ linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-08-23 21:22:38.000000000 -0400
32488@@ -195,7 +195,7 @@ struct pvr2_hdw {
32489
32490 /* I2C stuff */
32491 struct i2c_adapter i2c_adap;
32492- struct i2c_algorithm i2c_algo;
32493+ i2c_algorithm_no_const i2c_algo;
32494 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
32495 int i2c_cx25840_hack_state;
32496 int i2c_linked;
32497diff -urNp linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c
32498--- linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c 2011-03-27 14:31:47.000000000 -0400
32499+++ linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c 2011-05-16 21:46:57.000000000 -0400
32500@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_su
32501 unsigned char localPAT[256];
32502 unsigned char localPMT[256];
32503
32504+ pax_track_stack();
32505+
32506 /* Set video format - must be done first as it resets other settings */
32507 set_reg8(client, 0x41, h->video_format);
32508
32509diff -urNp linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c
32510--- linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c 2011-03-27 14:31:47.000000000 -0400
32511+++ linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-16 21:46:57.000000000 -0400
32512@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_d
32513 wait_queue_head_t *q = 0;
32514 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32515
32516+ pax_track_stack();
32517+
32518 /* While any outstand message on the bus exists... */
32519 do {
32520
32521@@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
32522 u8 tmp[512];
32523 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32524
32525+ pax_track_stack();
32526+
32527 while (loop) {
32528
32529 tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
32530diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c
32531--- linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c 2011-03-27 14:31:47.000000000 -0400
32532+++ linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c 2011-08-05 20:33:55.000000000 -0400
32533@@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] =
32534 static int __init ibmcam_init(void)
32535 {
32536 struct usbvideo_cb cbTbl;
32537- memset(&cbTbl, 0, sizeof(cbTbl));
32538- cbTbl.probe = ibmcam_probe;
32539- cbTbl.setupOnOpen = ibmcam_setup_on_open;
32540- cbTbl.videoStart = ibmcam_video_start;
32541- cbTbl.videoStop = ibmcam_video_stop;
32542- cbTbl.processData = ibmcam_ProcessIsocData;
32543- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
32544- cbTbl.adjustPicture = ibmcam_adjust_picture;
32545- cbTbl.getFPS = ibmcam_calculate_fps;
32546+ memset((void *)&cbTbl, 0, sizeof(cbTbl));
32547+ *(void **)&cbTbl.probe = ibmcam_probe;
32548+ *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
32549+ *(void **)&cbTbl.videoStart = ibmcam_video_start;
32550+ *(void **)&cbTbl.videoStop = ibmcam_video_stop;
32551+ *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
32552+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
32553+ *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
32554+ *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
32555 return usbvideo_register(
32556 &cams,
32557 MAX_IBMCAM,
32558diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c
32559--- linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c 2011-03-27 14:31:47.000000000 -0400
32560+++ linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c 2011-08-05 20:33:55.000000000 -0400
32561@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
32562 int error;
32563
32564 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
32565- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
32566+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
32567
32568 cam->input = input_dev = input_allocate_device();
32569 if (!input_dev) {
32570@@ -935,16 +935,16 @@ static int __init konicawc_init(void)
32571 struct usbvideo_cb cbTbl;
32572 printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
32573 DRIVER_DESC "\n");
32574- memset(&cbTbl, 0, sizeof(cbTbl));
32575- cbTbl.probe = konicawc_probe;
32576- cbTbl.setupOnOpen = konicawc_setup_on_open;
32577- cbTbl.processData = konicawc_process_isoc;
32578- cbTbl.getFPS = konicawc_calculate_fps;
32579- cbTbl.setVideoMode = konicawc_set_video_mode;
32580- cbTbl.startDataPump = konicawc_start_data;
32581- cbTbl.stopDataPump = konicawc_stop_data;
32582- cbTbl.adjustPicture = konicawc_adjust_picture;
32583- cbTbl.userFree = konicawc_free_uvd;
32584+ memset((void * )&cbTbl, 0, sizeof(cbTbl));
32585+ *(void **)&cbTbl.probe = konicawc_probe;
32586+ *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
32587+ *(void **)&cbTbl.processData = konicawc_process_isoc;
32588+ *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
32589+ *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
32590+ *(void **)&cbTbl.startDataPump = konicawc_start_data;
32591+ *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
32592+ *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
32593+ *(void **)&cbTbl.userFree = konicawc_free_uvd;
32594 return usbvideo_register(
32595 &cams,
32596 MAX_CAMERAS,
32597diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c
32598--- linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c 2011-03-27 14:31:47.000000000 -0400
32599+++ linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c 2011-04-17 15:56:46.000000000 -0400
32600@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
32601 int error;
32602
32603 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
32604- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
32605+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
32606
32607 cam->input = input_dev = input_allocate_device();
32608 if (!input_dev) {
32609diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c
32610--- linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c 2011-03-27 14:31:47.000000000 -0400
32611+++ linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c 2011-08-05 20:33:55.000000000 -0400
32612@@ -655,14 +655,14 @@ static int __init ultracam_init(void)
32613 {
32614 struct usbvideo_cb cbTbl;
32615 memset(&cbTbl, 0, sizeof(cbTbl));
32616- cbTbl.probe = ultracam_probe;
32617- cbTbl.setupOnOpen = ultracam_setup_on_open;
32618- cbTbl.videoStart = ultracam_video_start;
32619- cbTbl.videoStop = ultracam_video_stop;
32620- cbTbl.processData = ultracam_ProcessIsocData;
32621- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
32622- cbTbl.adjustPicture = ultracam_adjust_picture;
32623- cbTbl.getFPS = ultracam_calculate_fps;
32624+ *(void **)&cbTbl.probe = ultracam_probe;
32625+ *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
32626+ *(void **)&cbTbl.videoStart = ultracam_video_start;
32627+ *(void **)&cbTbl.videoStop = ultracam_video_stop;
32628+ *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
32629+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
32630+ *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
32631+ *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
32632 return usbvideo_register(
32633 &cams,
32634 MAX_CAMERAS,
32635diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c
32636--- linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c 2011-03-27 14:31:47.000000000 -0400
32637+++ linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c 2011-08-05 20:33:55.000000000 -0400
32638@@ -697,15 +697,15 @@ int usbvideo_register(
32639 __func__, cams, base_size, num_cams);
32640
32641 /* Copy callbacks, apply defaults for those that are not set */
32642- memmove(&cams->cb, cbTbl, sizeof(cams->cb));
32643+ memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
32644 if (cams->cb.getFrame == NULL)
32645- cams->cb.getFrame = usbvideo_GetFrame;
32646+ *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
32647 if (cams->cb.disconnect == NULL)
32648- cams->cb.disconnect = usbvideo_Disconnect;
32649+ *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
32650 if (cams->cb.startDataPump == NULL)
32651- cams->cb.startDataPump = usbvideo_StartDataPump;
32652+ *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
32653 if (cams->cb.stopDataPump == NULL)
32654- cams->cb.stopDataPump = usbvideo_StopDataPump;
32655+ *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
32656
32657 cams->num_cameras = num_cams;
32658 cams->cam = (struct uvd *) &cams[1];
32659diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h
32660--- linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h 2011-03-27 14:31:47.000000000 -0400
32661+++ linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h 2011-08-30 18:20:06.000000000 -0400
32662@@ -268,7 +268,7 @@ struct usbvideo_cb {
32663 int (*startDataPump)(struct uvd *uvd);
32664 void (*stopDataPump)(struct uvd *uvd);
32665 int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
32666-};
32667+} __no_const;
32668
32669 struct usbvideo {
32670 int num_cameras; /* As allocated */
32671diff -urNp linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c
32672--- linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c 2011-03-27 14:31:47.000000000 -0400
32673+++ linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c 2011-05-16 21:46:57.000000000 -0400
32674@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_c
32675 unsigned char rv, gv, bv;
32676 static unsigned char *Y, *U, *V;
32677
32678+ pax_track_stack();
32679+
32680 frame = usbvision->curFrame;
32681 imageSize = frame->frmwidth * frame->frmheight;
32682 if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
32683diff -urNp linux-2.6.32.46/drivers/media/video/v4l2-device.c linux-2.6.32.46/drivers/media/video/v4l2-device.c
32684--- linux-2.6.32.46/drivers/media/video/v4l2-device.c 2011-03-27 14:31:47.000000000 -0400
32685+++ linux-2.6.32.46/drivers/media/video/v4l2-device.c 2011-05-04 17:56:28.000000000 -0400
32686@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *
32687 EXPORT_SYMBOL_GPL(v4l2_device_register);
32688
32689 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
32690- atomic_t *instance)
32691+ atomic_unchecked_t *instance)
32692 {
32693- int num = atomic_inc_return(instance) - 1;
32694+ int num = atomic_inc_return_unchecked(instance) - 1;
32695 int len = strlen(basename);
32696
32697 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
32698diff -urNp linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c
32699--- linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c 2011-03-27 14:31:47.000000000 -0400
32700+++ linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c 2011-05-16 21:46:57.000000000 -0400
32701@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
32702 {
32703 struct videobuf_queue q;
32704
32705+ pax_track_stack();
32706+
32707 /* Required to make generic handler to call __videobuf_alloc */
32708 q.int_ops = &sg_ops;
32709
32710diff -urNp linux-2.6.32.46/drivers/message/fusion/mptbase.c linux-2.6.32.46/drivers/message/fusion/mptbase.c
32711--- linux-2.6.32.46/drivers/message/fusion/mptbase.c 2011-03-27 14:31:47.000000000 -0400
32712+++ linux-2.6.32.46/drivers/message/fusion/mptbase.c 2011-04-17 15:56:46.000000000 -0400
32713@@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **s
32714 len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
32715 len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
32716
32717+#ifdef CONFIG_GRKERNSEC_HIDESYM
32718+ len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
32719+ NULL, NULL);
32720+#else
32721 len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
32722 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
32723+#endif
32724+
32725 /*
32726 * Rounding UP to nearest 4-kB boundary here...
32727 */
32728diff -urNp linux-2.6.32.46/drivers/message/fusion/mptsas.c linux-2.6.32.46/drivers/message/fusion/mptsas.c
32729--- linux-2.6.32.46/drivers/message/fusion/mptsas.c 2011-03-27 14:31:47.000000000 -0400
32730+++ linux-2.6.32.46/drivers/message/fusion/mptsas.c 2011-04-17 15:56:46.000000000 -0400
32731@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
32732 return 0;
32733 }
32734
32735+static inline void
32736+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32737+{
32738+ if (phy_info->port_details) {
32739+ phy_info->port_details->rphy = rphy;
32740+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32741+ ioc->name, rphy));
32742+ }
32743+
32744+ if (rphy) {
32745+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32746+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32747+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32748+ ioc->name, rphy, rphy->dev.release));
32749+ }
32750+}
32751+
32752 /* no mutex */
32753 static void
32754 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
32755@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
32756 return NULL;
32757 }
32758
32759-static inline void
32760-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
32761-{
32762- if (phy_info->port_details) {
32763- phy_info->port_details->rphy = rphy;
32764- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
32765- ioc->name, rphy));
32766- }
32767-
32768- if (rphy) {
32769- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
32770- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
32771- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
32772- ioc->name, rphy, rphy->dev.release));
32773- }
32774-}
32775-
32776 static inline struct sas_port *
32777 mptsas_get_port(struct mptsas_phyinfo *phy_info)
32778 {
32779diff -urNp linux-2.6.32.46/drivers/message/fusion/mptscsih.c linux-2.6.32.46/drivers/message/fusion/mptscsih.c
32780--- linux-2.6.32.46/drivers/message/fusion/mptscsih.c 2011-03-27 14:31:47.000000000 -0400
32781+++ linux-2.6.32.46/drivers/message/fusion/mptscsih.c 2011-04-17 15:56:46.000000000 -0400
32782@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
32783
32784 h = shost_priv(SChost);
32785
32786- if (h) {
32787- if (h->info_kbuf == NULL)
32788- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32789- return h->info_kbuf;
32790- h->info_kbuf[0] = '\0';
32791+ if (!h)
32792+ return NULL;
32793
32794- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32795- h->info_kbuf[size-1] = '\0';
32796- }
32797+ if (h->info_kbuf == NULL)
32798+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
32799+ return h->info_kbuf;
32800+ h->info_kbuf[0] = '\0';
32801+
32802+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
32803+ h->info_kbuf[size-1] = '\0';
32804
32805 return h->info_kbuf;
32806 }
32807diff -urNp linux-2.6.32.46/drivers/message/i2o/i2o_config.c linux-2.6.32.46/drivers/message/i2o/i2o_config.c
32808--- linux-2.6.32.46/drivers/message/i2o/i2o_config.c 2011-03-27 14:31:47.000000000 -0400
32809+++ linux-2.6.32.46/drivers/message/i2o/i2o_config.c 2011-05-16 21:46:57.000000000 -0400
32810@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned lon
32811 struct i2o_message *msg;
32812 unsigned int iop;
32813
32814+ pax_track_stack();
32815+
32816 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
32817 return -EFAULT;
32818
32819diff -urNp linux-2.6.32.46/drivers/message/i2o/i2o_proc.c linux-2.6.32.46/drivers/message/i2o/i2o_proc.c
32820--- linux-2.6.32.46/drivers/message/i2o/i2o_proc.c 2011-03-27 14:31:47.000000000 -0400
32821+++ linux-2.6.32.46/drivers/message/i2o/i2o_proc.c 2011-04-17 15:56:46.000000000 -0400
32822@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
32823 "Array Controller Device"
32824 };
32825
32826-static char *chtostr(u8 * chars, int n)
32827-{
32828- char tmp[256];
32829- tmp[0] = 0;
32830- return strncat(tmp, (char *)chars, n);
32831-}
32832-
32833 static int i2o_report_query_status(struct seq_file *seq, int block_status,
32834 char *group)
32835 {
32836@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
32837
32838 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
32839 seq_printf(seq, "%-#8x", ddm_table.module_id);
32840- seq_printf(seq, "%-29s",
32841- chtostr(ddm_table.module_name_version, 28));
32842+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
32843 seq_printf(seq, "%9d ", ddm_table.data_size);
32844 seq_printf(seq, "%8d", ddm_table.code_size);
32845
32846@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
32847
32848 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
32849 seq_printf(seq, "%-#8x", dst->module_id);
32850- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
32851- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
32852+ seq_printf(seq, "%-.28s", dst->module_name_version);
32853+ seq_printf(seq, "%-.8s", dst->date);
32854 seq_printf(seq, "%8d ", dst->module_size);
32855 seq_printf(seq, "%8d ", dst->mpb_size);
32856 seq_printf(seq, "0x%04x", dst->module_flags);
32857@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
32858 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
32859 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
32860 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
32861- seq_printf(seq, "Vendor info : %s\n",
32862- chtostr((u8 *) (work32 + 2), 16));
32863- seq_printf(seq, "Product info : %s\n",
32864- chtostr((u8 *) (work32 + 6), 16));
32865- seq_printf(seq, "Description : %s\n",
32866- chtostr((u8 *) (work32 + 10), 16));
32867- seq_printf(seq, "Product rev. : %s\n",
32868- chtostr((u8 *) (work32 + 14), 8));
32869+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
32870+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
32871+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
32872+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
32873
32874 seq_printf(seq, "Serial number : ");
32875 print_serial_number(seq, (u8 *) (work32 + 16),
32876@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
32877 }
32878
32879 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
32880- seq_printf(seq, "Module name : %s\n",
32881- chtostr(result.module_name, 24));
32882- seq_printf(seq, "Module revision : %s\n",
32883- chtostr(result.module_rev, 8));
32884+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
32885+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
32886
32887 seq_printf(seq, "Serial number : ");
32888 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
32889@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
32890 return 0;
32891 }
32892
32893- seq_printf(seq, "Device name : %s\n",
32894- chtostr(result.device_name, 64));
32895- seq_printf(seq, "Service name : %s\n",
32896- chtostr(result.service_name, 64));
32897- seq_printf(seq, "Physical name : %s\n",
32898- chtostr(result.physical_location, 64));
32899- seq_printf(seq, "Instance number : %s\n",
32900- chtostr(result.instance_number, 4));
32901+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
32902+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
32903+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
32904+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
32905
32906 return 0;
32907 }
32908diff -urNp linux-2.6.32.46/drivers/message/i2o/iop.c linux-2.6.32.46/drivers/message/i2o/iop.c
32909--- linux-2.6.32.46/drivers/message/i2o/iop.c 2011-03-27 14:31:47.000000000 -0400
32910+++ linux-2.6.32.46/drivers/message/i2o/iop.c 2011-05-04 17:56:28.000000000 -0400
32911@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
32912
32913 spin_lock_irqsave(&c->context_list_lock, flags);
32914
32915- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
32916- atomic_inc(&c->context_list_counter);
32917+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
32918+ atomic_inc_unchecked(&c->context_list_counter);
32919
32920- entry->context = atomic_read(&c->context_list_counter);
32921+ entry->context = atomic_read_unchecked(&c->context_list_counter);
32922
32923 list_add(&entry->list, &c->context_list);
32924
32925@@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(voi
32926
32927 #if BITS_PER_LONG == 64
32928 spin_lock_init(&c->context_list_lock);
32929- atomic_set(&c->context_list_counter, 0);
32930+ atomic_set_unchecked(&c->context_list_counter, 0);
32931 INIT_LIST_HEAD(&c->context_list);
32932 #endif
32933
32934diff -urNp linux-2.6.32.46/drivers/mfd/wm8350-i2c.c linux-2.6.32.46/drivers/mfd/wm8350-i2c.c
32935--- linux-2.6.32.46/drivers/mfd/wm8350-i2c.c 2011-03-27 14:31:47.000000000 -0400
32936+++ linux-2.6.32.46/drivers/mfd/wm8350-i2c.c 2011-05-16 21:46:57.000000000 -0400
32937@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struc
32938 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
32939 int ret;
32940
32941+ pax_track_stack();
32942+
32943 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
32944 return -EINVAL;
32945
32946diff -urNp linux-2.6.32.46/drivers/misc/kgdbts.c linux-2.6.32.46/drivers/misc/kgdbts.c
32947--- linux-2.6.32.46/drivers/misc/kgdbts.c 2011-03-27 14:31:47.000000000 -0400
32948+++ linux-2.6.32.46/drivers/misc/kgdbts.c 2011-04-17 15:56:46.000000000 -0400
32949@@ -118,7 +118,7 @@
32950 } while (0)
32951 #define MAX_CONFIG_LEN 40
32952
32953-static struct kgdb_io kgdbts_io_ops;
32954+static const struct kgdb_io kgdbts_io_ops;
32955 static char get_buf[BUFMAX];
32956 static int get_buf_cnt;
32957 static char put_buf[BUFMAX];
32958@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
32959 module_put(THIS_MODULE);
32960 }
32961
32962-static struct kgdb_io kgdbts_io_ops = {
32963+static const struct kgdb_io kgdbts_io_ops = {
32964 .name = "kgdbts",
32965 .read_char = kgdbts_get_char,
32966 .write_char = kgdbts_put_char,
32967diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c
32968--- linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c 2011-03-27 14:31:47.000000000 -0400
32969+++ linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c 2011-04-17 15:56:46.000000000 -0400
32970@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
32971
32972 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
32973 {
32974- atomic_long_inc(&mcs_op_statistics[op].count);
32975- atomic_long_add(clks, &mcs_op_statistics[op].total);
32976+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
32977+ atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
32978 if (mcs_op_statistics[op].max < clks)
32979 mcs_op_statistics[op].max = clks;
32980 }
32981diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c
32982--- linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c 2011-03-27 14:31:47.000000000 -0400
32983+++ linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c 2011-04-17 15:56:46.000000000 -0400
32984@@ -32,9 +32,9 @@
32985
32986 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
32987
32988-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
32989+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
32990 {
32991- unsigned long val = atomic_long_read(v);
32992+ unsigned long val = atomic_long_read_unchecked(v);
32993
32994 if (val)
32995 seq_printf(s, "%16lu %s\n", val, id);
32996@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
32997 "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
32998
32999 for (op = 0; op < mcsop_last; op++) {
33000- count = atomic_long_read(&mcs_op_statistics[op].count);
33001- total = atomic_long_read(&mcs_op_statistics[op].total);
33002+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33003+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33004 max = mcs_op_statistics[op].max;
33005 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33006 count ? total / count : 0, max);
33007diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h
33008--- linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h 2011-03-27 14:31:47.000000000 -0400
33009+++ linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h 2011-04-17 15:56:46.000000000 -0400
33010@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
33011 * GRU statistics.
33012 */
33013 struct gru_stats_s {
33014- atomic_long_t vdata_alloc;
33015- atomic_long_t vdata_free;
33016- atomic_long_t gts_alloc;
33017- atomic_long_t gts_free;
33018- atomic_long_t vdata_double_alloc;
33019- atomic_long_t gts_double_allocate;
33020- atomic_long_t assign_context;
33021- atomic_long_t assign_context_failed;
33022- atomic_long_t free_context;
33023- atomic_long_t load_user_context;
33024- atomic_long_t load_kernel_context;
33025- atomic_long_t lock_kernel_context;
33026- atomic_long_t unlock_kernel_context;
33027- atomic_long_t steal_user_context;
33028- atomic_long_t steal_kernel_context;
33029- atomic_long_t steal_context_failed;
33030- atomic_long_t nopfn;
33031- atomic_long_t break_cow;
33032- atomic_long_t asid_new;
33033- atomic_long_t asid_next;
33034- atomic_long_t asid_wrap;
33035- atomic_long_t asid_reuse;
33036- atomic_long_t intr;
33037- atomic_long_t intr_mm_lock_failed;
33038- atomic_long_t call_os;
33039- atomic_long_t call_os_offnode_reference;
33040- atomic_long_t call_os_check_for_bug;
33041- atomic_long_t call_os_wait_queue;
33042- atomic_long_t user_flush_tlb;
33043- atomic_long_t user_unload_context;
33044- atomic_long_t user_exception;
33045- atomic_long_t set_context_option;
33046- atomic_long_t migrate_check;
33047- atomic_long_t migrated_retarget;
33048- atomic_long_t migrated_unload;
33049- atomic_long_t migrated_unload_delay;
33050- atomic_long_t migrated_nopfn_retarget;
33051- atomic_long_t migrated_nopfn_unload;
33052- atomic_long_t tlb_dropin;
33053- atomic_long_t tlb_dropin_fail_no_asid;
33054- atomic_long_t tlb_dropin_fail_upm;
33055- atomic_long_t tlb_dropin_fail_invalid;
33056- atomic_long_t tlb_dropin_fail_range_active;
33057- atomic_long_t tlb_dropin_fail_idle;
33058- atomic_long_t tlb_dropin_fail_fmm;
33059- atomic_long_t tlb_dropin_fail_no_exception;
33060- atomic_long_t tlb_dropin_fail_no_exception_war;
33061- atomic_long_t tfh_stale_on_fault;
33062- atomic_long_t mmu_invalidate_range;
33063- atomic_long_t mmu_invalidate_page;
33064- atomic_long_t mmu_clear_flush_young;
33065- atomic_long_t flush_tlb;
33066- atomic_long_t flush_tlb_gru;
33067- atomic_long_t flush_tlb_gru_tgh;
33068- atomic_long_t flush_tlb_gru_zero_asid;
33069-
33070- atomic_long_t copy_gpa;
33071-
33072- atomic_long_t mesq_receive;
33073- atomic_long_t mesq_receive_none;
33074- atomic_long_t mesq_send;
33075- atomic_long_t mesq_send_failed;
33076- atomic_long_t mesq_noop;
33077- atomic_long_t mesq_send_unexpected_error;
33078- atomic_long_t mesq_send_lb_overflow;
33079- atomic_long_t mesq_send_qlimit_reached;
33080- atomic_long_t mesq_send_amo_nacked;
33081- atomic_long_t mesq_send_put_nacked;
33082- atomic_long_t mesq_qf_not_full;
33083- atomic_long_t mesq_qf_locked;
33084- atomic_long_t mesq_qf_noop_not_full;
33085- atomic_long_t mesq_qf_switch_head_failed;
33086- atomic_long_t mesq_qf_unexpected_error;
33087- atomic_long_t mesq_noop_unexpected_error;
33088- atomic_long_t mesq_noop_lb_overflow;
33089- atomic_long_t mesq_noop_qlimit_reached;
33090- atomic_long_t mesq_noop_amo_nacked;
33091- atomic_long_t mesq_noop_put_nacked;
33092+ atomic_long_unchecked_t vdata_alloc;
33093+ atomic_long_unchecked_t vdata_free;
33094+ atomic_long_unchecked_t gts_alloc;
33095+ atomic_long_unchecked_t gts_free;
33096+ atomic_long_unchecked_t vdata_double_alloc;
33097+ atomic_long_unchecked_t gts_double_allocate;
33098+ atomic_long_unchecked_t assign_context;
33099+ atomic_long_unchecked_t assign_context_failed;
33100+ atomic_long_unchecked_t free_context;
33101+ atomic_long_unchecked_t load_user_context;
33102+ atomic_long_unchecked_t load_kernel_context;
33103+ atomic_long_unchecked_t lock_kernel_context;
33104+ atomic_long_unchecked_t unlock_kernel_context;
33105+ atomic_long_unchecked_t steal_user_context;
33106+ atomic_long_unchecked_t steal_kernel_context;
33107+ atomic_long_unchecked_t steal_context_failed;
33108+ atomic_long_unchecked_t nopfn;
33109+ atomic_long_unchecked_t break_cow;
33110+ atomic_long_unchecked_t asid_new;
33111+ atomic_long_unchecked_t asid_next;
33112+ atomic_long_unchecked_t asid_wrap;
33113+ atomic_long_unchecked_t asid_reuse;
33114+ atomic_long_unchecked_t intr;
33115+ atomic_long_unchecked_t intr_mm_lock_failed;
33116+ atomic_long_unchecked_t call_os;
33117+ atomic_long_unchecked_t call_os_offnode_reference;
33118+ atomic_long_unchecked_t call_os_check_for_bug;
33119+ atomic_long_unchecked_t call_os_wait_queue;
33120+ atomic_long_unchecked_t user_flush_tlb;
33121+ atomic_long_unchecked_t user_unload_context;
33122+ atomic_long_unchecked_t user_exception;
33123+ atomic_long_unchecked_t set_context_option;
33124+ atomic_long_unchecked_t migrate_check;
33125+ atomic_long_unchecked_t migrated_retarget;
33126+ atomic_long_unchecked_t migrated_unload;
33127+ atomic_long_unchecked_t migrated_unload_delay;
33128+ atomic_long_unchecked_t migrated_nopfn_retarget;
33129+ atomic_long_unchecked_t migrated_nopfn_unload;
33130+ atomic_long_unchecked_t tlb_dropin;
33131+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
33132+ atomic_long_unchecked_t tlb_dropin_fail_upm;
33133+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
33134+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
33135+ atomic_long_unchecked_t tlb_dropin_fail_idle;
33136+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
33137+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
33138+ atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
33139+ atomic_long_unchecked_t tfh_stale_on_fault;
33140+ atomic_long_unchecked_t mmu_invalidate_range;
33141+ atomic_long_unchecked_t mmu_invalidate_page;
33142+ atomic_long_unchecked_t mmu_clear_flush_young;
33143+ atomic_long_unchecked_t flush_tlb;
33144+ atomic_long_unchecked_t flush_tlb_gru;
33145+ atomic_long_unchecked_t flush_tlb_gru_tgh;
33146+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
33147+
33148+ atomic_long_unchecked_t copy_gpa;
33149+
33150+ atomic_long_unchecked_t mesq_receive;
33151+ atomic_long_unchecked_t mesq_receive_none;
33152+ atomic_long_unchecked_t mesq_send;
33153+ atomic_long_unchecked_t mesq_send_failed;
33154+ atomic_long_unchecked_t mesq_noop;
33155+ atomic_long_unchecked_t mesq_send_unexpected_error;
33156+ atomic_long_unchecked_t mesq_send_lb_overflow;
33157+ atomic_long_unchecked_t mesq_send_qlimit_reached;
33158+ atomic_long_unchecked_t mesq_send_amo_nacked;
33159+ atomic_long_unchecked_t mesq_send_put_nacked;
33160+ atomic_long_unchecked_t mesq_qf_not_full;
33161+ atomic_long_unchecked_t mesq_qf_locked;
33162+ atomic_long_unchecked_t mesq_qf_noop_not_full;
33163+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
33164+ atomic_long_unchecked_t mesq_qf_unexpected_error;
33165+ atomic_long_unchecked_t mesq_noop_unexpected_error;
33166+ atomic_long_unchecked_t mesq_noop_lb_overflow;
33167+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
33168+ atomic_long_unchecked_t mesq_noop_amo_nacked;
33169+ atomic_long_unchecked_t mesq_noop_put_nacked;
33170
33171 };
33172
33173@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
33174 cchop_deallocate, tghop_invalidate, mcsop_last};
33175
33176 struct mcs_op_statistic {
33177- atomic_long_t count;
33178- atomic_long_t total;
33179+ atomic_long_unchecked_t count;
33180+ atomic_long_unchecked_t total;
33181 unsigned long max;
33182 };
33183
33184@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
33185
33186 #define STAT(id) do { \
33187 if (gru_options & OPT_STATS) \
33188- atomic_long_inc(&gru_stats.id); \
33189+ atomic_long_inc_unchecked(&gru_stats.id); \
33190 } while (0)
33191
33192 #ifdef CONFIG_SGI_GRU_DEBUG
33193diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h
33194--- linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h 2011-03-27 14:31:47.000000000 -0400
33195+++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h 2011-08-05 20:33:55.000000000 -0400
33196@@ -876,7 +876,7 @@ extern struct xpc_registration xpc_regis
33197 /* found in xpc_main.c */
33198 extern struct device *xpc_part;
33199 extern struct device *xpc_chan;
33200-extern struct xpc_arch_operations xpc_arch_ops;
33201+extern const struct xpc_arch_operations xpc_arch_ops;
33202 extern int xpc_disengage_timelimit;
33203 extern int xpc_disengage_timedout;
33204 extern int xpc_activate_IRQ_rcvd;
33205diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c
33206--- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c 2011-03-27 14:31:47.000000000 -0400
33207+++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c 2011-08-05 20:33:55.000000000 -0400
33208@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_not
33209 .notifier_call = xpc_system_die,
33210 };
33211
33212-struct xpc_arch_operations xpc_arch_ops;
33213+const struct xpc_arch_operations xpc_arch_ops;
33214
33215 /*
33216 * Timer function to enforce the timelimit on the partition disengage.
33217diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c
33218--- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c 2011-03-27 14:31:47.000000000 -0400
33219+++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c 2011-08-05 20:33:55.000000000 -0400
33220@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_chan
33221 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
33222 }
33223
33224-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
33225+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
33226 .setup_partitions = xpc_setup_partitions_sn2,
33227 .teardown_partitions = xpc_teardown_partitions_sn2,
33228 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
33229@@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
33230 int ret;
33231 size_t buf_size;
33232
33233- xpc_arch_ops = xpc_arch_ops_sn2;
33234+ pax_open_kernel();
33235+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
33236+ pax_close_kernel();
33237
33238 if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
33239 dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
33240diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c
33241--- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c 2011-03-27 14:31:47.000000000 -0400
33242+++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c 2011-08-05 20:33:55.000000000 -0400
33243@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_chann
33244 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
33245 }
33246
33247-static struct xpc_arch_operations xpc_arch_ops_uv = {
33248+static const struct xpc_arch_operations xpc_arch_ops_uv = {
33249 .setup_partitions = xpc_setup_partitions_uv,
33250 .teardown_partitions = xpc_teardown_partitions_uv,
33251 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
33252@@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_ar
33253 int
33254 xpc_init_uv(void)
33255 {
33256- xpc_arch_ops = xpc_arch_ops_uv;
33257+ pax_open_kernel();
33258+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
33259+ pax_close_kernel();
33260
33261 if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
33262 dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
33263diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xp.h linux-2.6.32.46/drivers/misc/sgi-xp/xp.h
33264--- linux-2.6.32.46/drivers/misc/sgi-xp/xp.h 2011-03-27 14:31:47.000000000 -0400
33265+++ linux-2.6.32.46/drivers/misc/sgi-xp/xp.h 2011-08-05 20:33:55.000000000 -0400
33266@@ -289,7 +289,7 @@ struct xpc_interface {
33267 xpc_notify_func, void *);
33268 void (*received) (short, int, void *);
33269 enum xp_retval (*partid_to_nasids) (short, void *);
33270-};
33271+} __no_const;
33272
33273 extern struct xpc_interface xpc_interface;
33274
33275diff -urNp linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c
33276--- linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c 2011-03-27 14:31:47.000000000 -0400
33277+++ linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-16 21:46:57.000000000 -0400
33278@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *
33279 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
33280 unsigned long timeo = jiffies + HZ;
33281
33282+ pax_track_stack();
33283+
33284 /* Prevent setting state FL_SYNCING for chip in suspended state. */
33285 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
33286 goto sleep;
33287@@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(stru
33288 unsigned long initial_adr;
33289 int initial_len = len;
33290
33291+ pax_track_stack();
33292+
33293 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
33294 adr += chip->start;
33295 initial_adr = adr;
33296@@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(st
33297 int retries = 3;
33298 int ret;
33299
33300+ pax_track_stack();
33301+
33302 adr += chip->start;
33303
33304 retry:
33305diff -urNp linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c
33306--- linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c 2011-03-27 14:31:47.000000000 -0400
33307+++ linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-16 21:46:57.000000000 -0400
33308@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
33309 unsigned long cmd_addr;
33310 struct cfi_private *cfi = map->fldrv_priv;
33311
33312+ pax_track_stack();
33313+
33314 adr += chip->start;
33315
33316 /* Ensure cmd read/writes are aligned. */
33317@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
33318 DECLARE_WAITQUEUE(wait, current);
33319 int wbufsize, z;
33320
33321+ pax_track_stack();
33322+
33323 /* M58LW064A requires bus alignment for buffer wriets -- saw */
33324 if (adr & (map_bankwidth(map)-1))
33325 return -EINVAL;
33326@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
33327 DECLARE_WAITQUEUE(wait, current);
33328 int ret = 0;
33329
33330+ pax_track_stack();
33331+
33332 adr += chip->start;
33333
33334 /* Let's determine this according to the interleave only once */
33335@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
33336 unsigned long timeo = jiffies + HZ;
33337 DECLARE_WAITQUEUE(wait, current);
33338
33339+ pax_track_stack();
33340+
33341 adr += chip->start;
33342
33343 /* Let's determine this according to the interleave only once */
33344@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
33345 unsigned long timeo = jiffies + HZ;
33346 DECLARE_WAITQUEUE(wait, current);
33347
33348+ pax_track_stack();
33349+
33350 adr += chip->start;
33351
33352 /* Let's determine this according to the interleave only once */
33353diff -urNp linux-2.6.32.46/drivers/mtd/devices/doc2000.c linux-2.6.32.46/drivers/mtd/devices/doc2000.c
33354--- linux-2.6.32.46/drivers/mtd/devices/doc2000.c 2011-03-27 14:31:47.000000000 -0400
33355+++ linux-2.6.32.46/drivers/mtd/devices/doc2000.c 2011-04-17 15:56:46.000000000 -0400
33356@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
33357
33358 /* The ECC will not be calculated correctly if less than 512 is written */
33359 /* DBB-
33360- if (len != 0x200 && eccbuf)
33361+ if (len != 0x200)
33362 printk(KERN_WARNING
33363 "ECC needs a full sector write (adr: %lx size %lx)\n",
33364 (long) to, (long) len);
33365diff -urNp linux-2.6.32.46/drivers/mtd/devices/doc2001.c linux-2.6.32.46/drivers/mtd/devices/doc2001.c
33366--- linux-2.6.32.46/drivers/mtd/devices/doc2001.c 2011-03-27 14:31:47.000000000 -0400
33367+++ linux-2.6.32.46/drivers/mtd/devices/doc2001.c 2011-04-17 15:56:46.000000000 -0400
33368@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
33369 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
33370
33371 /* Don't allow read past end of device */
33372- if (from >= this->totlen)
33373+ if (from >= this->totlen || !len)
33374 return -EINVAL;
33375
33376 /* Don't allow a single read to cross a 512-byte block boundary */
33377diff -urNp linux-2.6.32.46/drivers/mtd/ftl.c linux-2.6.32.46/drivers/mtd/ftl.c
33378--- linux-2.6.32.46/drivers/mtd/ftl.c 2011-03-27 14:31:47.000000000 -0400
33379+++ linux-2.6.32.46/drivers/mtd/ftl.c 2011-05-16 21:46:57.000000000 -0400
33380@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
33381 loff_t offset;
33382 uint16_t srcunitswap = cpu_to_le16(srcunit);
33383
33384+ pax_track_stack();
33385+
33386 eun = &part->EUNInfo[srcunit];
33387 xfer = &part->XferInfo[xferunit];
33388 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
33389diff -urNp linux-2.6.32.46/drivers/mtd/inftlcore.c linux-2.6.32.46/drivers/mtd/inftlcore.c
33390--- linux-2.6.32.46/drivers/mtd/inftlcore.c 2011-03-27 14:31:47.000000000 -0400
33391+++ linux-2.6.32.46/drivers/mtd/inftlcore.c 2011-05-16 21:46:57.000000000 -0400
33392@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLr
33393 struct inftl_oob oob;
33394 size_t retlen;
33395
33396+ pax_track_stack();
33397+
33398 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
33399 "pending=%d)\n", inftl, thisVUC, pendingblock);
33400
33401diff -urNp linux-2.6.32.46/drivers/mtd/inftlmount.c linux-2.6.32.46/drivers/mtd/inftlmount.c
33402--- linux-2.6.32.46/drivers/mtd/inftlmount.c 2011-03-27 14:31:47.000000000 -0400
33403+++ linux-2.6.32.46/drivers/mtd/inftlmount.c 2011-05-16 21:46:57.000000000 -0400
33404@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTL
33405 struct INFTLPartition *ip;
33406 size_t retlen;
33407
33408+ pax_track_stack();
33409+
33410 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
33411
33412 /*
33413diff -urNp linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c
33414--- linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c 2011-03-27 14:31:47.000000000 -0400
33415+++ linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c 2011-05-16 21:46:57.000000000 -0400
33416@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
33417 {
33418 map_word pfow_val[4];
33419
33420+ pax_track_stack();
33421+
33422 /* Check identification string */
33423 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
33424 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
33425diff -urNp linux-2.6.32.46/drivers/mtd/mtdchar.c linux-2.6.32.46/drivers/mtd/mtdchar.c
33426--- linux-2.6.32.46/drivers/mtd/mtdchar.c 2011-03-27 14:31:47.000000000 -0400
33427+++ linux-2.6.32.46/drivers/mtd/mtdchar.c 2011-05-16 21:46:57.000000000 -0400
33428@@ -460,6 +460,8 @@ static int mtd_ioctl(struct inode *inode
33429 u_long size;
33430 struct mtd_info_user info;
33431
33432+ pax_track_stack();
33433+
33434 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
33435
33436 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
33437diff -urNp linux-2.6.32.46/drivers/mtd/nftlcore.c linux-2.6.32.46/drivers/mtd/nftlcore.c
33438--- linux-2.6.32.46/drivers/mtd/nftlcore.c 2011-03-27 14:31:47.000000000 -0400
33439+++ linux-2.6.32.46/drivers/mtd/nftlcore.c 2011-05-16 21:46:57.000000000 -0400
33440@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLre
33441 int inplace = 1;
33442 size_t retlen;
33443
33444+ pax_track_stack();
33445+
33446 memset(BlockMap, 0xff, sizeof(BlockMap));
33447 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
33448
33449diff -urNp linux-2.6.32.46/drivers/mtd/nftlmount.c linux-2.6.32.46/drivers/mtd/nftlmount.c
33450--- linux-2.6.32.46/drivers/mtd/nftlmount.c 2011-03-27 14:31:47.000000000 -0400
33451+++ linux-2.6.32.46/drivers/mtd/nftlmount.c 2011-05-18 20:09:37.000000000 -0400
33452@@ -23,6 +23,7 @@
33453 #include <asm/errno.h>
33454 #include <linux/delay.h>
33455 #include <linux/slab.h>
33456+#include <linux/sched.h>
33457 #include <linux/mtd/mtd.h>
33458 #include <linux/mtd/nand.h>
33459 #include <linux/mtd/nftl.h>
33460@@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLr
33461 struct mtd_info *mtd = nftl->mbd.mtd;
33462 unsigned int i;
33463
33464+ pax_track_stack();
33465+
33466 /* Assume logical EraseSize == physical erasesize for starting the scan.
33467 We'll sort it out later if we find a MediaHeader which says otherwise */
33468 /* Actually, we won't. The new DiskOnChip driver has already scanned
33469diff -urNp linux-2.6.32.46/drivers/mtd/ubi/build.c linux-2.6.32.46/drivers/mtd/ubi/build.c
33470--- linux-2.6.32.46/drivers/mtd/ubi/build.c 2011-03-27 14:31:47.000000000 -0400
33471+++ linux-2.6.32.46/drivers/mtd/ubi/build.c 2011-04-17 15:56:46.000000000 -0400
33472@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
33473 static int __init bytes_str_to_int(const char *str)
33474 {
33475 char *endp;
33476- unsigned long result;
33477+ unsigned long result, scale = 1;
33478
33479 result = simple_strtoul(str, &endp, 0);
33480 if (str == endp || result >= INT_MAX) {
33481@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
33482
33483 switch (*endp) {
33484 case 'G':
33485- result *= 1024;
33486+ scale *= 1024;
33487 case 'M':
33488- result *= 1024;
33489+ scale *= 1024;
33490 case 'K':
33491- result *= 1024;
33492+ scale *= 1024;
33493 if (endp[1] == 'i' && endp[2] == 'B')
33494 endp += 2;
33495 case '\0':
33496@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
33497 return -EINVAL;
33498 }
33499
33500- return result;
33501+ if ((intoverflow_t)result*scale >= INT_MAX) {
33502+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
33503+ str);
33504+ return -EINVAL;
33505+ }
33506+
33507+ return result*scale;
33508 }
33509
33510 /**
33511diff -urNp linux-2.6.32.46/drivers/net/bnx2.c linux-2.6.32.46/drivers/net/bnx2.c
33512--- linux-2.6.32.46/drivers/net/bnx2.c 2011-03-27 14:31:47.000000000 -0400
33513+++ linux-2.6.32.46/drivers/net/bnx2.c 2011-05-16 21:46:57.000000000 -0400
33514@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
33515 int rc = 0;
33516 u32 magic, csum;
33517
33518+ pax_track_stack();
33519+
33520 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
33521 goto test_nvram_done;
33522
33523diff -urNp linux-2.6.32.46/drivers/net/cxgb3/l2t.h linux-2.6.32.46/drivers/net/cxgb3/l2t.h
33524--- linux-2.6.32.46/drivers/net/cxgb3/l2t.h 2011-03-27 14:31:47.000000000 -0400
33525+++ linux-2.6.32.46/drivers/net/cxgb3/l2t.h 2011-08-05 20:33:55.000000000 -0400
33526@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)
33527 */
33528 struct l2t_skb_cb {
33529 arp_failure_handler_func arp_failure_handler;
33530-};
33531+} __no_const;
33532
33533 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
33534
33535diff -urNp linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c
33536--- linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c 2011-03-27 14:31:47.000000000 -0400
33537+++ linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c 2011-05-16 21:46:57.000000000 -0400
33538@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter
33539 int i, addr, ret;
33540 struct t3_vpd vpd;
33541
33542+ pax_track_stack();
33543+
33544 /*
33545 * Card information is normally at VPD_BASE but some early cards had
33546 * it at 0.
33547diff -urNp linux-2.6.32.46/drivers/net/e1000e/82571.c linux-2.6.32.46/drivers/net/e1000e/82571.c
33548--- linux-2.6.32.46/drivers/net/e1000e/82571.c 2011-03-27 14:31:47.000000000 -0400
33549+++ linux-2.6.32.46/drivers/net/e1000e/82571.c 2011-08-23 21:22:32.000000000 -0400
33550@@ -212,7 +212,7 @@ static s32 e1000_init_mac_params_82571(s
33551 {
33552 struct e1000_hw *hw = &adapter->hw;
33553 struct e1000_mac_info *mac = &hw->mac;
33554- struct e1000_mac_operations *func = &mac->ops;
33555+ e1000_mac_operations_no_const *func = &mac->ops;
33556 u32 swsm = 0;
33557 u32 swsm2 = 0;
33558 bool force_clear_smbi = false;
33559@@ -1656,7 +1656,7 @@ static void e1000_clear_hw_cntrs_82571(s
33560 temp = er32(ICRXDMTC);
33561 }
33562
33563-static struct e1000_mac_operations e82571_mac_ops = {
33564+static const struct e1000_mac_operations e82571_mac_ops = {
33565 /* .check_mng_mode: mac type dependent */
33566 /* .check_for_link: media type dependent */
33567 .id_led_init = e1000e_id_led_init,
33568@@ -1674,7 +1674,7 @@ static struct e1000_mac_operations e8257
33569 .setup_led = e1000e_setup_led_generic,
33570 };
33571
33572-static struct e1000_phy_operations e82_phy_ops_igp = {
33573+static const struct e1000_phy_operations e82_phy_ops_igp = {
33574 .acquire_phy = e1000_get_hw_semaphore_82571,
33575 .check_reset_block = e1000e_check_reset_block_generic,
33576 .commit_phy = NULL,
33577@@ -1691,7 +1691,7 @@ static struct e1000_phy_operations e82_p
33578 .cfg_on_link_up = NULL,
33579 };
33580
33581-static struct e1000_phy_operations e82_phy_ops_m88 = {
33582+static const struct e1000_phy_operations e82_phy_ops_m88 = {
33583 .acquire_phy = e1000_get_hw_semaphore_82571,
33584 .check_reset_block = e1000e_check_reset_block_generic,
33585 .commit_phy = e1000e_phy_sw_reset,
33586@@ -1708,7 +1708,7 @@ static struct e1000_phy_operations e82_p
33587 .cfg_on_link_up = NULL,
33588 };
33589
33590-static struct e1000_phy_operations e82_phy_ops_bm = {
33591+static const struct e1000_phy_operations e82_phy_ops_bm = {
33592 .acquire_phy = e1000_get_hw_semaphore_82571,
33593 .check_reset_block = e1000e_check_reset_block_generic,
33594 .commit_phy = e1000e_phy_sw_reset,
33595@@ -1725,7 +1725,7 @@ static struct e1000_phy_operations e82_p
33596 .cfg_on_link_up = NULL,
33597 };
33598
33599-static struct e1000_nvm_operations e82571_nvm_ops = {
33600+static const struct e1000_nvm_operations e82571_nvm_ops = {
33601 .acquire_nvm = e1000_acquire_nvm_82571,
33602 .read_nvm = e1000e_read_nvm_eerd,
33603 .release_nvm = e1000_release_nvm_82571,
33604diff -urNp linux-2.6.32.46/drivers/net/e1000e/e1000.h linux-2.6.32.46/drivers/net/e1000e/e1000.h
33605--- linux-2.6.32.46/drivers/net/e1000e/e1000.h 2011-03-27 14:31:47.000000000 -0400
33606+++ linux-2.6.32.46/drivers/net/e1000e/e1000.h 2011-04-17 15:56:46.000000000 -0400
33607@@ -375,9 +375,9 @@ struct e1000_info {
33608 u32 pba;
33609 u32 max_hw_frame_size;
33610 s32 (*get_variants)(struct e1000_adapter *);
33611- struct e1000_mac_operations *mac_ops;
33612- struct e1000_phy_operations *phy_ops;
33613- struct e1000_nvm_operations *nvm_ops;
33614+ const struct e1000_mac_operations *mac_ops;
33615+ const struct e1000_phy_operations *phy_ops;
33616+ const struct e1000_nvm_operations *nvm_ops;
33617 };
33618
33619 /* hardware capability, feature, and workaround flags */
33620diff -urNp linux-2.6.32.46/drivers/net/e1000e/es2lan.c linux-2.6.32.46/drivers/net/e1000e/es2lan.c
33621--- linux-2.6.32.46/drivers/net/e1000e/es2lan.c 2011-03-27 14:31:47.000000000 -0400
33622+++ linux-2.6.32.46/drivers/net/e1000e/es2lan.c 2011-08-23 21:22:32.000000000 -0400
33623@@ -207,7 +207,7 @@ static s32 e1000_init_mac_params_80003es
33624 {
33625 struct e1000_hw *hw = &adapter->hw;
33626 struct e1000_mac_info *mac = &hw->mac;
33627- struct e1000_mac_operations *func = &mac->ops;
33628+ e1000_mac_operations_no_const *func = &mac->ops;
33629
33630 /* Set media type */
33631 switch (adapter->pdev->device) {
33632@@ -1365,7 +1365,7 @@ static void e1000_clear_hw_cntrs_80003es
33633 temp = er32(ICRXDMTC);
33634 }
33635
33636-static struct e1000_mac_operations es2_mac_ops = {
33637+static const struct e1000_mac_operations es2_mac_ops = {
33638 .id_led_init = e1000e_id_led_init,
33639 .check_mng_mode = e1000e_check_mng_mode_generic,
33640 /* check_for_link dependent on media type */
33641@@ -1383,7 +1383,7 @@ static struct e1000_mac_operations es2_m
33642 .setup_led = e1000e_setup_led_generic,
33643 };
33644
33645-static struct e1000_phy_operations es2_phy_ops = {
33646+static const struct e1000_phy_operations es2_phy_ops = {
33647 .acquire_phy = e1000_acquire_phy_80003es2lan,
33648 .check_reset_block = e1000e_check_reset_block_generic,
33649 .commit_phy = e1000e_phy_sw_reset,
33650@@ -1400,7 +1400,7 @@ static struct e1000_phy_operations es2_p
33651 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
33652 };
33653
33654-static struct e1000_nvm_operations es2_nvm_ops = {
33655+static const struct e1000_nvm_operations es2_nvm_ops = {
33656 .acquire_nvm = e1000_acquire_nvm_80003es2lan,
33657 .read_nvm = e1000e_read_nvm_eerd,
33658 .release_nvm = e1000_release_nvm_80003es2lan,
33659diff -urNp linux-2.6.32.46/drivers/net/e1000e/hw.h linux-2.6.32.46/drivers/net/e1000e/hw.h
33660--- linux-2.6.32.46/drivers/net/e1000e/hw.h 2011-03-27 14:31:47.000000000 -0400
33661+++ linux-2.6.32.46/drivers/net/e1000e/hw.h 2011-08-23 21:27:38.000000000 -0400
33662@@ -753,6 +753,7 @@ struct e1000_mac_operations {
33663 s32 (*setup_physical_interface)(struct e1000_hw *);
33664 s32 (*setup_led)(struct e1000_hw *);
33665 };
33666+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33667
33668 /* Function pointers for the PHY. */
33669 struct e1000_phy_operations {
33670@@ -774,6 +775,7 @@ struct e1000_phy_operations {
33671 s32 (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
33672 s32 (*cfg_on_link_up)(struct e1000_hw *);
33673 };
33674+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33675
33676 /* Function pointers for the NVM. */
33677 struct e1000_nvm_operations {
33678@@ -785,9 +787,10 @@ struct e1000_nvm_operations {
33679 s32 (*validate_nvm)(struct e1000_hw *);
33680 s32 (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
33681 };
33682+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33683
33684 struct e1000_mac_info {
33685- struct e1000_mac_operations ops;
33686+ e1000_mac_operations_no_const ops;
33687
33688 u8 addr[6];
33689 u8 perm_addr[6];
33690@@ -823,7 +826,7 @@ struct e1000_mac_info {
33691 };
33692
33693 struct e1000_phy_info {
33694- struct e1000_phy_operations ops;
33695+ e1000_phy_operations_no_const ops;
33696
33697 enum e1000_phy_type type;
33698
33699@@ -857,7 +860,7 @@ struct e1000_phy_info {
33700 };
33701
33702 struct e1000_nvm_info {
33703- struct e1000_nvm_operations ops;
33704+ e1000_nvm_operations_no_const ops;
33705
33706 enum e1000_nvm_type type;
33707 enum e1000_nvm_override override;
33708diff -urNp linux-2.6.32.46/drivers/net/e1000e/ich8lan.c linux-2.6.32.46/drivers/net/e1000e/ich8lan.c
33709--- linux-2.6.32.46/drivers/net/e1000e/ich8lan.c 2011-05-10 22:12:01.000000000 -0400
33710+++ linux-2.6.32.46/drivers/net/e1000e/ich8lan.c 2011-08-23 21:22:32.000000000 -0400
33711@@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan
33712 }
33713 }
33714
33715-static struct e1000_mac_operations ich8_mac_ops = {
33716+static const struct e1000_mac_operations ich8_mac_ops = {
33717 .id_led_init = e1000e_id_led_init,
33718 .check_mng_mode = e1000_check_mng_mode_ich8lan,
33719 .check_for_link = e1000_check_for_copper_link_ich8lan,
33720@@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_
33721 /* id_led_init dependent on mac type */
33722 };
33723
33724-static struct e1000_phy_operations ich8_phy_ops = {
33725+static const struct e1000_phy_operations ich8_phy_ops = {
33726 .acquire_phy = e1000_acquire_swflag_ich8lan,
33727 .check_reset_block = e1000_check_reset_block_ich8lan,
33728 .commit_phy = NULL,
33729@@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_
33730 .write_phy_reg = e1000e_write_phy_reg_igp,
33731 };
33732
33733-static struct e1000_nvm_operations ich8_nvm_ops = {
33734+static const struct e1000_nvm_operations ich8_nvm_ops = {
33735 .acquire_nvm = e1000_acquire_nvm_ich8lan,
33736 .read_nvm = e1000_read_nvm_ich8lan,
33737 .release_nvm = e1000_release_nvm_ich8lan,
33738diff -urNp linux-2.6.32.46/drivers/net/hamradio/6pack.c linux-2.6.32.46/drivers/net/hamradio/6pack.c
33739--- linux-2.6.32.46/drivers/net/hamradio/6pack.c 2011-07-13 17:23:04.000000000 -0400
33740+++ linux-2.6.32.46/drivers/net/hamradio/6pack.c 2011-07-13 17:23:18.000000000 -0400
33741@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct t
33742 unsigned char buf[512];
33743 int count1;
33744
33745+ pax_track_stack();
33746+
33747 if (!count)
33748 return;
33749
33750diff -urNp linux-2.6.32.46/drivers/net/ibmveth.c linux-2.6.32.46/drivers/net/ibmveth.c
33751--- linux-2.6.32.46/drivers/net/ibmveth.c 2011-03-27 14:31:47.000000000 -0400
33752+++ linux-2.6.32.46/drivers/net/ibmveth.c 2011-04-17 15:56:46.000000000 -0400
33753@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
33754 NULL,
33755 };
33756
33757-static struct sysfs_ops veth_pool_ops = {
33758+static const struct sysfs_ops veth_pool_ops = {
33759 .show = veth_pool_show,
33760 .store = veth_pool_store,
33761 };
33762diff -urNp linux-2.6.32.46/drivers/net/igb/e1000_82575.c linux-2.6.32.46/drivers/net/igb/e1000_82575.c
33763--- linux-2.6.32.46/drivers/net/igb/e1000_82575.c 2011-08-29 22:24:44.000000000 -0400
33764+++ linux-2.6.32.46/drivers/net/igb/e1000_82575.c 2011-08-29 22:25:07.000000000 -0400
33765@@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct
33766 wr32(E1000_VT_CTL, vt_ctl);
33767 }
33768
33769-static struct e1000_mac_operations e1000_mac_ops_82575 = {
33770+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
33771 .reset_hw = igb_reset_hw_82575,
33772 .init_hw = igb_init_hw_82575,
33773 .check_for_link = igb_check_for_link_82575,
33774@@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000
33775 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
33776 };
33777
33778-static struct e1000_phy_operations e1000_phy_ops_82575 = {
33779+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
33780 .acquire = igb_acquire_phy_82575,
33781 .get_cfg_done = igb_get_cfg_done_82575,
33782 .release = igb_release_phy_82575,
33783 };
33784
33785-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
33786+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
33787 .acquire = igb_acquire_nvm_82575,
33788 .read = igb_read_nvm_eerd,
33789 .release = igb_release_nvm_82575,
33790diff -urNp linux-2.6.32.46/drivers/net/igb/e1000_hw.h linux-2.6.32.46/drivers/net/igb/e1000_hw.h
33791--- linux-2.6.32.46/drivers/net/igb/e1000_hw.h 2011-03-27 14:31:47.000000000 -0400
33792+++ linux-2.6.32.46/drivers/net/igb/e1000_hw.h 2011-08-23 21:28:01.000000000 -0400
33793@@ -288,6 +288,7 @@ struct e1000_mac_operations {
33794 s32 (*read_mac_addr)(struct e1000_hw *);
33795 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
33796 };
33797+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33798
33799 struct e1000_phy_operations {
33800 s32 (*acquire)(struct e1000_hw *);
33801@@ -303,6 +304,7 @@ struct e1000_phy_operations {
33802 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
33803 s32 (*write_reg)(struct e1000_hw *, u32, u16);
33804 };
33805+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
33806
33807 struct e1000_nvm_operations {
33808 s32 (*acquire)(struct e1000_hw *);
33809@@ -310,6 +312,7 @@ struct e1000_nvm_operations {
33810 void (*release)(struct e1000_hw *);
33811 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
33812 };
33813+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
33814
33815 struct e1000_info {
33816 s32 (*get_invariants)(struct e1000_hw *);
33817@@ -321,7 +324,7 @@ struct e1000_info {
33818 extern const struct e1000_info e1000_82575_info;
33819
33820 struct e1000_mac_info {
33821- struct e1000_mac_operations ops;
33822+ e1000_mac_operations_no_const ops;
33823
33824 u8 addr[6];
33825 u8 perm_addr[6];
33826@@ -365,7 +368,7 @@ struct e1000_mac_info {
33827 };
33828
33829 struct e1000_phy_info {
33830- struct e1000_phy_operations ops;
33831+ e1000_phy_operations_no_const ops;
33832
33833 enum e1000_phy_type type;
33834
33835@@ -400,7 +403,7 @@ struct e1000_phy_info {
33836 };
33837
33838 struct e1000_nvm_info {
33839- struct e1000_nvm_operations ops;
33840+ e1000_nvm_operations_no_const ops;
33841
33842 enum e1000_nvm_type type;
33843 enum e1000_nvm_override override;
33844@@ -446,6 +449,7 @@ struct e1000_mbx_operations {
33845 s32 (*check_for_ack)(struct e1000_hw *, u16);
33846 s32 (*check_for_rst)(struct e1000_hw *, u16);
33847 };
33848+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33849
33850 struct e1000_mbx_stats {
33851 u32 msgs_tx;
33852@@ -457,7 +461,7 @@ struct e1000_mbx_stats {
33853 };
33854
33855 struct e1000_mbx_info {
33856- struct e1000_mbx_operations ops;
33857+ e1000_mbx_operations_no_const ops;
33858 struct e1000_mbx_stats stats;
33859 u32 timeout;
33860 u32 usec_delay;
33861diff -urNp linux-2.6.32.46/drivers/net/igbvf/vf.h linux-2.6.32.46/drivers/net/igbvf/vf.h
33862--- linux-2.6.32.46/drivers/net/igbvf/vf.h 2011-03-27 14:31:47.000000000 -0400
33863+++ linux-2.6.32.46/drivers/net/igbvf/vf.h 2011-08-23 21:22:38.000000000 -0400
33864@@ -187,9 +187,10 @@ struct e1000_mac_operations {
33865 s32 (*read_mac_addr)(struct e1000_hw *);
33866 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
33867 };
33868+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
33869
33870 struct e1000_mac_info {
33871- struct e1000_mac_operations ops;
33872+ e1000_mac_operations_no_const ops;
33873 u8 addr[6];
33874 u8 perm_addr[6];
33875
33876@@ -211,6 +212,7 @@ struct e1000_mbx_operations {
33877 s32 (*check_for_ack)(struct e1000_hw *);
33878 s32 (*check_for_rst)(struct e1000_hw *);
33879 };
33880+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
33881
33882 struct e1000_mbx_stats {
33883 u32 msgs_tx;
33884@@ -222,7 +224,7 @@ struct e1000_mbx_stats {
33885 };
33886
33887 struct e1000_mbx_info {
33888- struct e1000_mbx_operations ops;
33889+ e1000_mbx_operations_no_const ops;
33890 struct e1000_mbx_stats stats;
33891 u32 timeout;
33892 u32 usec_delay;
33893diff -urNp linux-2.6.32.46/drivers/net/iseries_veth.c linux-2.6.32.46/drivers/net/iseries_veth.c
33894--- linux-2.6.32.46/drivers/net/iseries_veth.c 2011-03-27 14:31:47.000000000 -0400
33895+++ linux-2.6.32.46/drivers/net/iseries_veth.c 2011-04-17 15:56:46.000000000 -0400
33896@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
33897 NULL
33898 };
33899
33900-static struct sysfs_ops veth_cnx_sysfs_ops = {
33901+static const struct sysfs_ops veth_cnx_sysfs_ops = {
33902 .show = veth_cnx_attribute_show
33903 };
33904
33905@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
33906 NULL
33907 };
33908
33909-static struct sysfs_ops veth_port_sysfs_ops = {
33910+static const struct sysfs_ops veth_port_sysfs_ops = {
33911 .show = veth_port_attribute_show
33912 };
33913
33914diff -urNp linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c
33915--- linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c 2011-03-27 14:31:47.000000000 -0400
33916+++ linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c 2011-05-16 21:46:57.000000000 -0400
33917@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev
33918 u32 rctl;
33919 int i;
33920
33921+ pax_track_stack();
33922+
33923 /* Check for Promiscuous and All Multicast modes */
33924
33925 rctl = IXGB_READ_REG(hw, RCTL);
33926diff -urNp linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c
33927--- linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c 2011-03-27 14:31:47.000000000 -0400
33928+++ linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c 2011-05-16 21:46:57.000000000 -0400
33929@@ -260,6 +260,9 @@ void __devinit
33930 ixgb_check_options(struct ixgb_adapter *adapter)
33931 {
33932 int bd = adapter->bd_number;
33933+
33934+ pax_track_stack();
33935+
33936 if (bd >= IXGB_MAX_NIC) {
33937 printk(KERN_NOTICE
33938 "Warning: no configuration for board #%i\n", bd);
33939diff -urNp linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h
33940--- linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h 2011-03-27 14:31:47.000000000 -0400
33941+++ linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h 2011-08-23 21:22:38.000000000 -0400
33942@@ -2327,6 +2327,7 @@ struct ixgbe_eeprom_operations {
33943 s32 (*validate_checksum)(struct ixgbe_hw *, u16 *);
33944 s32 (*update_checksum)(struct ixgbe_hw *);
33945 };
33946+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
33947
33948 struct ixgbe_mac_operations {
33949 s32 (*init_hw)(struct ixgbe_hw *);
33950@@ -2376,6 +2377,7 @@ struct ixgbe_mac_operations {
33951 /* Flow Control */
33952 s32 (*fc_enable)(struct ixgbe_hw *, s32);
33953 };
33954+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
33955
33956 struct ixgbe_phy_operations {
33957 s32 (*identify)(struct ixgbe_hw *);
33958@@ -2394,9 +2396,10 @@ struct ixgbe_phy_operations {
33959 s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
33960 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
33961 };
33962+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
33963
33964 struct ixgbe_eeprom_info {
33965- struct ixgbe_eeprom_operations ops;
33966+ ixgbe_eeprom_operations_no_const ops;
33967 enum ixgbe_eeprom_type type;
33968 u32 semaphore_delay;
33969 u16 word_size;
33970@@ -2404,7 +2407,7 @@ struct ixgbe_eeprom_info {
33971 };
33972
33973 struct ixgbe_mac_info {
33974- struct ixgbe_mac_operations ops;
33975+ ixgbe_mac_operations_no_const ops;
33976 enum ixgbe_mac_type type;
33977 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33978 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
33979@@ -2423,7 +2426,7 @@ struct ixgbe_mac_info {
33980 };
33981
33982 struct ixgbe_phy_info {
33983- struct ixgbe_phy_operations ops;
33984+ ixgbe_phy_operations_no_const ops;
33985 struct mdio_if_info mdio;
33986 enum ixgbe_phy_type type;
33987 u32 id;
33988diff -urNp linux-2.6.32.46/drivers/net/mlx4/main.c linux-2.6.32.46/drivers/net/mlx4/main.c
33989--- linux-2.6.32.46/drivers/net/mlx4/main.c 2011-03-27 14:31:47.000000000 -0400
33990+++ linux-2.6.32.46/drivers/net/mlx4/main.c 2011-05-18 20:09:37.000000000 -0400
33991@@ -38,6 +38,7 @@
33992 #include <linux/errno.h>
33993 #include <linux/pci.h>
33994 #include <linux/dma-mapping.h>
33995+#include <linux/sched.h>
33996
33997 #include <linux/mlx4/device.h>
33998 #include <linux/mlx4/doorbell.h>
33999@@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev
34000 u64 icm_size;
34001 int err;
34002
34003+ pax_track_stack();
34004+
34005 err = mlx4_QUERY_FW(dev);
34006 if (err) {
34007 if (err == -EACCES)
34008diff -urNp linux-2.6.32.46/drivers/net/niu.c linux-2.6.32.46/drivers/net/niu.c
34009--- linux-2.6.32.46/drivers/net/niu.c 2011-05-10 22:12:01.000000000 -0400
34010+++ linux-2.6.32.46/drivers/net/niu.c 2011-05-16 21:46:57.000000000 -0400
34011@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struc
34012 int i, num_irqs, err;
34013 u8 first_ldg;
34014
34015+ pax_track_stack();
34016+
34017 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
34018 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
34019 ldg_num_map[i] = first_ldg + i;
34020diff -urNp linux-2.6.32.46/drivers/net/pcnet32.c linux-2.6.32.46/drivers/net/pcnet32.c
34021--- linux-2.6.32.46/drivers/net/pcnet32.c 2011-03-27 14:31:47.000000000 -0400
34022+++ linux-2.6.32.46/drivers/net/pcnet32.c 2011-08-05 20:33:55.000000000 -0400
34023@@ -79,7 +79,7 @@ static int cards_found;
34024 /*
34025 * VLB I/O addresses
34026 */
34027-static unsigned int pcnet32_portlist[] __initdata =
34028+static unsigned int pcnet32_portlist[] __devinitdata =
34029 { 0x300, 0x320, 0x340, 0x360, 0 };
34030
34031 static int pcnet32_debug = 0;
34032@@ -267,7 +267,7 @@ struct pcnet32_private {
34033 struct sk_buff **rx_skbuff;
34034 dma_addr_t *tx_dma_addr;
34035 dma_addr_t *rx_dma_addr;
34036- struct pcnet32_access a;
34037+ struct pcnet32_access *a;
34038 spinlock_t lock; /* Guard lock */
34039 unsigned int cur_rx, cur_tx; /* The next free ring entry */
34040 unsigned int rx_ring_size; /* current rx ring size */
34041@@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct n
34042 u16 val;
34043
34044 netif_wake_queue(dev);
34045- val = lp->a.read_csr(ioaddr, CSR3);
34046+ val = lp->a->read_csr(ioaddr, CSR3);
34047 val &= 0x00ff;
34048- lp->a.write_csr(ioaddr, CSR3, val);
34049+ lp->a->write_csr(ioaddr, CSR3, val);
34050 napi_enable(&lp->napi);
34051 }
34052
34053@@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_d
34054 r = mii_link_ok(&lp->mii_if);
34055 } else if (lp->chip_version >= PCNET32_79C970A) {
34056 ulong ioaddr = dev->base_addr; /* card base I/O address */
34057- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34058+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34059 } else { /* can not detect link on really old chips */
34060 r = 1;
34061 }
34062@@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct
34063 pcnet32_netif_stop(dev);
34064
34065 spin_lock_irqsave(&lp->lock, flags);
34066- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
34067+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
34068
34069 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
34070
34071@@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct
34072 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
34073 {
34074 struct pcnet32_private *lp = netdev_priv(dev);
34075- struct pcnet32_access *a = &lp->a; /* access to registers */
34076+ struct pcnet32_access *a = lp->a; /* access to registers */
34077 ulong ioaddr = dev->base_addr; /* card base I/O address */
34078 struct sk_buff *skb; /* sk buff */
34079 int x, i; /* counters */
34080@@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct
34081 pcnet32_netif_stop(dev);
34082
34083 spin_lock_irqsave(&lp->lock, flags);
34084- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
34085+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
34086
34087 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
34088
34089 /* Reset the PCNET32 */
34090- lp->a.reset(ioaddr);
34091- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34092+ lp->a->reset(ioaddr);
34093+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34094
34095 /* switch pcnet32 to 32bit mode */
34096- lp->a.write_bcr(ioaddr, 20, 2);
34097+ lp->a->write_bcr(ioaddr, 20, 2);
34098
34099 /* purge & init rings but don't actually restart */
34100 pcnet32_restart(dev, 0x0000);
34101
34102- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
34103+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
34104
34105 /* Initialize Transmit buffers. */
34106 size = data_len + 15;
34107@@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct
34108
34109 /* set int loopback in CSR15 */
34110 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
34111- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
34112+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
34113
34114 teststatus = cpu_to_le16(0x8000);
34115- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
34116+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
34117
34118 /* Check status of descriptors */
34119 for (x = 0; x < numbuffs; x++) {
34120@@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct
34121 }
34122 }
34123
34124- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
34125+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
34126 wmb();
34127 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
34128 printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
34129@@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct
34130 pcnet32_restart(dev, CSR0_NORMAL);
34131 } else {
34132 pcnet32_purge_rx_ring(dev);
34133- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
34134+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
34135 }
34136 spin_unlock_irqrestore(&lp->lock, flags);
34137
34138@@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct
34139 static void pcnet32_led_blink_callback(struct net_device *dev)
34140 {
34141 struct pcnet32_private *lp = netdev_priv(dev);
34142- struct pcnet32_access *a = &lp->a;
34143+ struct pcnet32_access *a = lp->a;
34144 ulong ioaddr = dev->base_addr;
34145 unsigned long flags;
34146 int i;
34147@@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(s
34148 static int pcnet32_phys_id(struct net_device *dev, u32 data)
34149 {
34150 struct pcnet32_private *lp = netdev_priv(dev);
34151- struct pcnet32_access *a = &lp->a;
34152+ struct pcnet32_access *a = lp->a;
34153 ulong ioaddr = dev->base_addr;
34154 unsigned long flags;
34155 int i, regs[4];
34156@@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_de
34157 {
34158 int csr5;
34159 struct pcnet32_private *lp = netdev_priv(dev);
34160- struct pcnet32_access *a = &lp->a;
34161+ struct pcnet32_access *a = lp->a;
34162 ulong ioaddr = dev->base_addr;
34163 int ticks;
34164
34165@@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_stru
34166 spin_lock_irqsave(&lp->lock, flags);
34167 if (pcnet32_tx(dev)) {
34168 /* reset the chip to clear the error condition, then restart */
34169- lp->a.reset(ioaddr);
34170- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34171+ lp->a->reset(ioaddr);
34172+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34173 pcnet32_restart(dev, CSR0_START);
34174 netif_wake_queue(dev);
34175 }
34176@@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_stru
34177 __napi_complete(napi);
34178
34179 /* clear interrupt masks */
34180- val = lp->a.read_csr(ioaddr, CSR3);
34181+ val = lp->a->read_csr(ioaddr, CSR3);
34182 val &= 0x00ff;
34183- lp->a.write_csr(ioaddr, CSR3, val);
34184+ lp->a->write_csr(ioaddr, CSR3, val);
34185
34186 /* Set interrupt enable. */
34187- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
34188+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
34189
34190 spin_unlock_irqrestore(&lp->lock, flags);
34191 }
34192@@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_
34193 int i, csr0;
34194 u16 *buff = ptr;
34195 struct pcnet32_private *lp = netdev_priv(dev);
34196- struct pcnet32_access *a = &lp->a;
34197+ struct pcnet32_access *a = lp->a;
34198 ulong ioaddr = dev->base_addr;
34199 unsigned long flags;
34200
34201@@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_
34202 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
34203 if (lp->phymask & (1 << j)) {
34204 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
34205- lp->a.write_bcr(ioaddr, 33,
34206+ lp->a->write_bcr(ioaddr, 33,
34207 (j << 5) | i);
34208- *buff++ = lp->a.read_bcr(ioaddr, 34);
34209+ *buff++ = lp->a->read_bcr(ioaddr, 34);
34210 }
34211 }
34212 }
34213@@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int
34214 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
34215 lp->options |= PCNET32_PORT_FD;
34216
34217- lp->a = *a;
34218+ lp->a = a;
34219
34220 /* prior to register_netdev, dev->name is not yet correct */
34221 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
34222@@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int
34223 if (lp->mii) {
34224 /* lp->phycount and lp->phymask are set to 0 by memset above */
34225
34226- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
34227+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
34228 /* scan for PHYs */
34229 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
34230 unsigned short id1, id2;
34231@@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int
34232 "Found PHY %04x:%04x at address %d.\n",
34233 id1, id2, i);
34234 }
34235- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
34236+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
34237 if (lp->phycount > 1) {
34238 lp->options |= PCNET32_PORT_MII;
34239 }
34240@@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_devic
34241 }
34242
34243 /* Reset the PCNET32 */
34244- lp->a.reset(ioaddr);
34245+ lp->a->reset(ioaddr);
34246
34247 /* switch pcnet32 to 32bit mode */
34248- lp->a.write_bcr(ioaddr, 20, 2);
34249+ lp->a->write_bcr(ioaddr, 20, 2);
34250
34251 if (netif_msg_ifup(lp))
34252 printk(KERN_DEBUG
34253@@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_devic
34254 (u32) (lp->init_dma_addr));
34255
34256 /* set/reset autoselect bit */
34257- val = lp->a.read_bcr(ioaddr, 2) & ~2;
34258+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
34259 if (lp->options & PCNET32_PORT_ASEL)
34260 val |= 2;
34261- lp->a.write_bcr(ioaddr, 2, val);
34262+ lp->a->write_bcr(ioaddr, 2, val);
34263
34264 /* handle full duplex setting */
34265 if (lp->mii_if.full_duplex) {
34266- val = lp->a.read_bcr(ioaddr, 9) & ~3;
34267+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
34268 if (lp->options & PCNET32_PORT_FD) {
34269 val |= 1;
34270 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
34271@@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_devic
34272 if (lp->chip_version == 0x2627)
34273 val |= 3;
34274 }
34275- lp->a.write_bcr(ioaddr, 9, val);
34276+ lp->a->write_bcr(ioaddr, 9, val);
34277 }
34278
34279 /* set/reset GPSI bit in test register */
34280- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
34281+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
34282 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
34283 val |= 0x10;
34284- lp->a.write_csr(ioaddr, 124, val);
34285+ lp->a->write_csr(ioaddr, 124, val);
34286
34287 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
34288 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
34289@@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_devic
34290 * duplex, and/or enable auto negotiation, and clear DANAS
34291 */
34292 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
34293- lp->a.write_bcr(ioaddr, 32,
34294- lp->a.read_bcr(ioaddr, 32) | 0x0080);
34295+ lp->a->write_bcr(ioaddr, 32,
34296+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
34297 /* disable Auto Negotiation, set 10Mpbs, HD */
34298- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
34299+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
34300 if (lp->options & PCNET32_PORT_FD)
34301 val |= 0x10;
34302 if (lp->options & PCNET32_PORT_100)
34303 val |= 0x08;
34304- lp->a.write_bcr(ioaddr, 32, val);
34305+ lp->a->write_bcr(ioaddr, 32, val);
34306 } else {
34307 if (lp->options & PCNET32_PORT_ASEL) {
34308- lp->a.write_bcr(ioaddr, 32,
34309- lp->a.read_bcr(ioaddr,
34310+ lp->a->write_bcr(ioaddr, 32,
34311+ lp->a->read_bcr(ioaddr,
34312 32) | 0x0080);
34313 /* enable auto negotiate, setup, disable fd */
34314- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
34315+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
34316 val |= 0x20;
34317- lp->a.write_bcr(ioaddr, 32, val);
34318+ lp->a->write_bcr(ioaddr, 32, val);
34319 }
34320 }
34321 } else {
34322@@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_devic
34323 * There is really no good other way to handle multiple PHYs
34324 * other than turning off all automatics
34325 */
34326- val = lp->a.read_bcr(ioaddr, 2);
34327- lp->a.write_bcr(ioaddr, 2, val & ~2);
34328- val = lp->a.read_bcr(ioaddr, 32);
34329- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
34330+ val = lp->a->read_bcr(ioaddr, 2);
34331+ lp->a->write_bcr(ioaddr, 2, val & ~2);
34332+ val = lp->a->read_bcr(ioaddr, 32);
34333+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
34334
34335 if (!(lp->options & PCNET32_PORT_ASEL)) {
34336 /* setup ecmd */
34337@@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_devic
34338 ecmd.speed =
34339 lp->
34340 options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
34341- bcr9 = lp->a.read_bcr(ioaddr, 9);
34342+ bcr9 = lp->a->read_bcr(ioaddr, 9);
34343
34344 if (lp->options & PCNET32_PORT_FD) {
34345 ecmd.duplex = DUPLEX_FULL;
34346@@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_devic
34347 ecmd.duplex = DUPLEX_HALF;
34348 bcr9 |= ~(1 << 0);
34349 }
34350- lp->a.write_bcr(ioaddr, 9, bcr9);
34351+ lp->a->write_bcr(ioaddr, 9, bcr9);
34352 }
34353
34354 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
34355@@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_devic
34356
34357 #ifdef DO_DXSUFLO
34358 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
34359- val = lp->a.read_csr(ioaddr, CSR3);
34360+ val = lp->a->read_csr(ioaddr, CSR3);
34361 val |= 0x40;
34362- lp->a.write_csr(ioaddr, CSR3, val);
34363+ lp->a->write_csr(ioaddr, CSR3, val);
34364 }
34365 #endif
34366
34367@@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_devic
34368 napi_enable(&lp->napi);
34369
34370 /* Re-initialize the PCNET32, and start it when done. */
34371- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
34372- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
34373+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
34374+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
34375
34376- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34377- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
34378+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
34379+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
34380
34381 netif_start_queue(dev);
34382
34383@@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_devic
34384
34385 i = 0;
34386 while (i++ < 100)
34387- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
34388+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
34389 break;
34390 /*
34391 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
34392 * reports that doing so triggers a bug in the '974.
34393 */
34394- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
34395+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
34396
34397 if (netif_msg_ifup(lp))
34398 printk(KERN_DEBUG
34399 "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
34400 dev->name, i,
34401 (u32) (lp->init_dma_addr),
34402- lp->a.read_csr(ioaddr, CSR0));
34403+ lp->a->read_csr(ioaddr, CSR0));
34404
34405 spin_unlock_irqrestore(&lp->lock, flags);
34406
34407@@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_devic
34408 * Switch back to 16bit mode to avoid problems with dumb
34409 * DOS packet driver after a warm reboot
34410 */
34411- lp->a.write_bcr(ioaddr, 20, 4);
34412+ lp->a->write_bcr(ioaddr, 20, 4);
34413
34414 err_free_irq:
34415 spin_unlock_irqrestore(&lp->lock, flags);
34416@@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_d
34417
34418 /* wait for stop */
34419 for (i = 0; i < 100; i++)
34420- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
34421+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
34422 break;
34423
34424 if (i >= 100 && netif_msg_drv(lp))
34425@@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_d
34426 return;
34427
34428 /* ReInit Ring */
34429- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
34430+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
34431 i = 0;
34432 while (i++ < 1000)
34433- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
34434+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
34435 break;
34436
34437- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
34438+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
34439 }
34440
34441 static void pcnet32_tx_timeout(struct net_device *dev)
34442@@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct ne
34443 if (pcnet32_debug & NETIF_MSG_DRV)
34444 printk(KERN_ERR
34445 "%s: transmit timed out, status %4.4x, resetting.\n",
34446- dev->name, lp->a.read_csr(ioaddr, CSR0));
34447- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34448+ dev->name, lp->a->read_csr(ioaddr, CSR0));
34449+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34450 dev->stats.tx_errors++;
34451 if (netif_msg_tx_err(lp)) {
34452 int i;
34453@@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(st
34454 if (netif_msg_tx_queued(lp)) {
34455 printk(KERN_DEBUG
34456 "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
34457- dev->name, lp->a.read_csr(ioaddr, CSR0));
34458+ dev->name, lp->a->read_csr(ioaddr, CSR0));
34459 }
34460
34461 /* Default status -- will not enable Successful-TxDone
34462@@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(st
34463 dev->stats.tx_bytes += skb->len;
34464
34465 /* Trigger an immediate send poll. */
34466- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
34467+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
34468
34469 dev->trans_start = jiffies;
34470
34471@@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
34472
34473 spin_lock(&lp->lock);
34474
34475- csr0 = lp->a.read_csr(ioaddr, CSR0);
34476+ csr0 = lp->a->read_csr(ioaddr, CSR0);
34477 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
34478 if (csr0 == 0xffff) {
34479 break; /* PCMCIA remove happened */
34480 }
34481 /* Acknowledge all of the current interrupt sources ASAP. */
34482- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
34483+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
34484
34485 if (netif_msg_intr(lp))
34486 printk(KERN_DEBUG
34487 "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
34488- dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
34489+ dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
34490
34491 /* Log misc errors. */
34492 if (csr0 & 0x4000)
34493@@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
34494 if (napi_schedule_prep(&lp->napi)) {
34495 u16 val;
34496 /* set interrupt masks */
34497- val = lp->a.read_csr(ioaddr, CSR3);
34498+ val = lp->a->read_csr(ioaddr, CSR3);
34499 val |= 0x5f00;
34500- lp->a.write_csr(ioaddr, CSR3, val);
34501+ lp->a->write_csr(ioaddr, CSR3, val);
34502
34503 __napi_schedule(&lp->napi);
34504 break;
34505 }
34506- csr0 = lp->a.read_csr(ioaddr, CSR0);
34507+ csr0 = lp->a->read_csr(ioaddr, CSR0);
34508 }
34509
34510 if (netif_msg_intr(lp))
34511 printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
34512- dev->name, lp->a.read_csr(ioaddr, CSR0));
34513+ dev->name, lp->a->read_csr(ioaddr, CSR0));
34514
34515 spin_unlock(&lp->lock);
34516
34517@@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_devi
34518
34519 spin_lock_irqsave(&lp->lock, flags);
34520
34521- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
34522+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
34523
34524 if (netif_msg_ifdown(lp))
34525 printk(KERN_DEBUG
34526 "%s: Shutting down ethercard, status was %2.2x.\n",
34527- dev->name, lp->a.read_csr(ioaddr, CSR0));
34528+ dev->name, lp->a->read_csr(ioaddr, CSR0));
34529
34530 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
34531- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34532+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34533
34534 /*
34535 * Switch back to 16bit mode to avoid problems with dumb
34536 * DOS packet driver after a warm reboot
34537 */
34538- lp->a.write_bcr(ioaddr, 20, 4);
34539+ lp->a->write_bcr(ioaddr, 20, 4);
34540
34541 spin_unlock_irqrestore(&lp->lock, flags);
34542
34543@@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_
34544 unsigned long flags;
34545
34546 spin_lock_irqsave(&lp->lock, flags);
34547- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
34548+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
34549 spin_unlock_irqrestore(&lp->lock, flags);
34550
34551 return &dev->stats;
34552@@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struc
34553 if (dev->flags & IFF_ALLMULTI) {
34554 ib->filter[0] = cpu_to_le32(~0U);
34555 ib->filter[1] = cpu_to_le32(~0U);
34556- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
34557- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34558- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34559- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34560+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
34561+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
34562+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
34563+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
34564 return;
34565 }
34566 /* clear the multicast filter */
34567@@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struc
34568 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
34569 }
34570 for (i = 0; i < 4; i++)
34571- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
34572+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
34573 le16_to_cpu(mcast_table[i]));
34574 return;
34575 }
34576@@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(s
34577
34578 spin_lock_irqsave(&lp->lock, flags);
34579 suspended = pcnet32_suspend(dev, &flags, 0);
34580- csr15 = lp->a.read_csr(ioaddr, CSR15);
34581+ csr15 = lp->a->read_csr(ioaddr, CSR15);
34582 if (dev->flags & IFF_PROMISC) {
34583 /* Log any net taps. */
34584 if (netif_msg_hw(lp))
34585@@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(s
34586 lp->init_block->mode =
34587 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
34588 7);
34589- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
34590+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
34591 } else {
34592 lp->init_block->mode =
34593 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
34594- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34595+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
34596 pcnet32_load_multicast(dev);
34597 }
34598
34599 if (suspended) {
34600 int csr5;
34601 /* clear SUSPEND (SPND) - CSR5 bit 0 */
34602- csr5 = lp->a.read_csr(ioaddr, CSR5);
34603- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34604+ csr5 = lp->a->read_csr(ioaddr, CSR5);
34605+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
34606 } else {
34607- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
34608+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
34609 pcnet32_restart(dev, CSR0_NORMAL);
34610 netif_wake_queue(dev);
34611 }
34612@@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *
34613 if (!lp->mii)
34614 return 0;
34615
34616- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34617- val_out = lp->a.read_bcr(ioaddr, 34);
34618+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34619+ val_out = lp->a->read_bcr(ioaddr, 34);
34620
34621 return val_out;
34622 }
34623@@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device
34624 if (!lp->mii)
34625 return;
34626
34627- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34628- lp->a.write_bcr(ioaddr, 34, val);
34629+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
34630+ lp->a->write_bcr(ioaddr, 34, val);
34631 }
34632
34633 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34634@@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct n
34635 curr_link = mii_link_ok(&lp->mii_if);
34636 } else {
34637 ulong ioaddr = dev->base_addr; /* card base I/O address */
34638- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
34639+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
34640 }
34641 if (!curr_link) {
34642 if (prev_link || verbose) {
34643@@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct n
34644 (ecmd.duplex ==
34645 DUPLEX_FULL) ? "full" : "half");
34646 }
34647- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
34648+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
34649 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
34650 if (lp->mii_if.full_duplex)
34651 bcr9 |= (1 << 0);
34652 else
34653 bcr9 &= ~(1 << 0);
34654- lp->a.write_bcr(dev->base_addr, 9, bcr9);
34655+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
34656 }
34657 } else {
34658 if (netif_msg_link(lp))
34659diff -urNp linux-2.6.32.46/drivers/net/tg3.h linux-2.6.32.46/drivers/net/tg3.h
34660--- linux-2.6.32.46/drivers/net/tg3.h 2011-03-27 14:31:47.000000000 -0400
34661+++ linux-2.6.32.46/drivers/net/tg3.h 2011-04-17 15:56:46.000000000 -0400
34662@@ -95,6 +95,7 @@
34663 #define CHIPREV_ID_5750_A0 0x4000
34664 #define CHIPREV_ID_5750_A1 0x4001
34665 #define CHIPREV_ID_5750_A3 0x4003
34666+#define CHIPREV_ID_5750_C1 0x4201
34667 #define CHIPREV_ID_5750_C2 0x4202
34668 #define CHIPREV_ID_5752_A0_HW 0x5000
34669 #define CHIPREV_ID_5752_A0 0x6000
34670diff -urNp linux-2.6.32.46/drivers/net/tokenring/abyss.c linux-2.6.32.46/drivers/net/tokenring/abyss.c
34671--- linux-2.6.32.46/drivers/net/tokenring/abyss.c 2011-03-27 14:31:47.000000000 -0400
34672+++ linux-2.6.32.46/drivers/net/tokenring/abyss.c 2011-08-05 20:33:55.000000000 -0400
34673@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
34674
34675 static int __init abyss_init (void)
34676 {
34677- abyss_netdev_ops = tms380tr_netdev_ops;
34678+ pax_open_kernel();
34679+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34680
34681- abyss_netdev_ops.ndo_open = abyss_open;
34682- abyss_netdev_ops.ndo_stop = abyss_close;
34683+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
34684+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
34685+ pax_close_kernel();
34686
34687 return pci_register_driver(&abyss_driver);
34688 }
34689diff -urNp linux-2.6.32.46/drivers/net/tokenring/madgemc.c linux-2.6.32.46/drivers/net/tokenring/madgemc.c
34690--- linux-2.6.32.46/drivers/net/tokenring/madgemc.c 2011-03-27 14:31:47.000000000 -0400
34691+++ linux-2.6.32.46/drivers/net/tokenring/madgemc.c 2011-08-05 20:33:55.000000000 -0400
34692@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver
34693
34694 static int __init madgemc_init (void)
34695 {
34696- madgemc_netdev_ops = tms380tr_netdev_ops;
34697- madgemc_netdev_ops.ndo_open = madgemc_open;
34698- madgemc_netdev_ops.ndo_stop = madgemc_close;
34699+ pax_open_kernel();
34700+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34701+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
34702+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
34703+ pax_close_kernel();
34704
34705 return mca_register_driver (&madgemc_driver);
34706 }
34707diff -urNp linux-2.6.32.46/drivers/net/tokenring/proteon.c linux-2.6.32.46/drivers/net/tokenring/proteon.c
34708--- linux-2.6.32.46/drivers/net/tokenring/proteon.c 2011-03-27 14:31:47.000000000 -0400
34709+++ linux-2.6.32.46/drivers/net/tokenring/proteon.c 2011-08-05 20:33:55.000000000 -0400
34710@@ -353,9 +353,11 @@ static int __init proteon_init(void)
34711 struct platform_device *pdev;
34712 int i, num = 0, err = 0;
34713
34714- proteon_netdev_ops = tms380tr_netdev_ops;
34715- proteon_netdev_ops.ndo_open = proteon_open;
34716- proteon_netdev_ops.ndo_stop = tms380tr_close;
34717+ pax_open_kernel();
34718+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34719+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
34720+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
34721+ pax_close_kernel();
34722
34723 err = platform_driver_register(&proteon_driver);
34724 if (err)
34725diff -urNp linux-2.6.32.46/drivers/net/tokenring/skisa.c linux-2.6.32.46/drivers/net/tokenring/skisa.c
34726--- linux-2.6.32.46/drivers/net/tokenring/skisa.c 2011-03-27 14:31:47.000000000 -0400
34727+++ linux-2.6.32.46/drivers/net/tokenring/skisa.c 2011-08-05 20:33:55.000000000 -0400
34728@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
34729 struct platform_device *pdev;
34730 int i, num = 0, err = 0;
34731
34732- sk_isa_netdev_ops = tms380tr_netdev_ops;
34733- sk_isa_netdev_ops.ndo_open = sk_isa_open;
34734- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34735+ pax_open_kernel();
34736+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
34737+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
34738+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
34739+ pax_close_kernel();
34740
34741 err = platform_driver_register(&sk_isa_driver);
34742 if (err)
34743diff -urNp linux-2.6.32.46/drivers/net/tulip/de2104x.c linux-2.6.32.46/drivers/net/tulip/de2104x.c
34744--- linux-2.6.32.46/drivers/net/tulip/de2104x.c 2011-03-27 14:31:47.000000000 -0400
34745+++ linux-2.6.32.46/drivers/net/tulip/de2104x.c 2011-05-16 21:46:57.000000000 -0400
34746@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_i
34747 struct de_srom_info_leaf *il;
34748 void *bufp;
34749
34750+ pax_track_stack();
34751+
34752 /* download entire eeprom */
34753 for (i = 0; i < DE_EEPROM_WORDS; i++)
34754 ((__le16 *)ee_data)[i] =
34755diff -urNp linux-2.6.32.46/drivers/net/tulip/de4x5.c linux-2.6.32.46/drivers/net/tulip/de4x5.c
34756--- linux-2.6.32.46/drivers/net/tulip/de4x5.c 2011-03-27 14:31:47.000000000 -0400
34757+++ linux-2.6.32.46/drivers/net/tulip/de4x5.c 2011-04-17 15:56:46.000000000 -0400
34758@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
34759 for (i=0; i<ETH_ALEN; i++) {
34760 tmp.addr[i] = dev->dev_addr[i];
34761 }
34762- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34763+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34764 break;
34765
34766 case DE4X5_SET_HWADDR: /* Set the hardware address */
34767@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
34768 spin_lock_irqsave(&lp->lock, flags);
34769 memcpy(&statbuf, &lp->pktStats, ioc->len);
34770 spin_unlock_irqrestore(&lp->lock, flags);
34771- if (copy_to_user(ioc->data, &statbuf, ioc->len))
34772+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34773 return -EFAULT;
34774 break;
34775 }
34776diff -urNp linux-2.6.32.46/drivers/net/usb/hso.c linux-2.6.32.46/drivers/net/usb/hso.c
34777--- linux-2.6.32.46/drivers/net/usb/hso.c 2011-03-27 14:31:47.000000000 -0400
34778+++ linux-2.6.32.46/drivers/net/usb/hso.c 2011-04-17 15:56:46.000000000 -0400
34779@@ -71,7 +71,7 @@
34780 #include <asm/byteorder.h>
34781 #include <linux/serial_core.h>
34782 #include <linux/serial.h>
34783-
34784+#include <asm/local.h>
34785
34786 #define DRIVER_VERSION "1.2"
34787 #define MOD_AUTHOR "Option Wireless"
34788@@ -258,7 +258,7 @@ struct hso_serial {
34789
34790 /* from usb_serial_port */
34791 struct tty_struct *tty;
34792- int open_count;
34793+ local_t open_count;
34794 spinlock_t serial_lock;
34795
34796 int (*write_data) (struct hso_serial *serial);
34797@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
34798 struct urb *urb;
34799
34800 urb = serial->rx_urb[0];
34801- if (serial->open_count > 0) {
34802+ if (local_read(&serial->open_count) > 0) {
34803 count = put_rxbuf_data(urb, serial);
34804 if (count == -1)
34805 return;
34806@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
34807 DUMP1(urb->transfer_buffer, urb->actual_length);
34808
34809 /* Anyone listening? */
34810- if (serial->open_count == 0)
34811+ if (local_read(&serial->open_count) == 0)
34812 return;
34813
34814 if (status == 0) {
34815@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
34816 spin_unlock_irq(&serial->serial_lock);
34817
34818 /* check for port already opened, if not set the termios */
34819- serial->open_count++;
34820- if (serial->open_count == 1) {
34821+ if (local_inc_return(&serial->open_count) == 1) {
34822 tty->low_latency = 1;
34823 serial->rx_state = RX_IDLE;
34824 /* Force default termio settings */
34825@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
34826 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
34827 if (result) {
34828 hso_stop_serial_device(serial->parent);
34829- serial->open_count--;
34830+ local_dec(&serial->open_count);
34831 kref_put(&serial->parent->ref, hso_serial_ref_free);
34832 }
34833 } else {
34834@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
34835
34836 /* reset the rts and dtr */
34837 /* do the actual close */
34838- serial->open_count--;
34839+ local_dec(&serial->open_count);
34840
34841- if (serial->open_count <= 0) {
34842- serial->open_count = 0;
34843+ if (local_read(&serial->open_count) <= 0) {
34844+ local_set(&serial->open_count, 0);
34845 spin_lock_irq(&serial->serial_lock);
34846 if (serial->tty == tty) {
34847 serial->tty->driver_data = NULL;
34848@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
34849
34850 /* the actual setup */
34851 spin_lock_irqsave(&serial->serial_lock, flags);
34852- if (serial->open_count)
34853+ if (local_read(&serial->open_count))
34854 _hso_serial_set_termios(tty, old);
34855 else
34856 tty->termios = old;
34857@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
34858 /* Start all serial ports */
34859 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
34860 if (serial_table[i] && (serial_table[i]->interface == iface)) {
34861- if (dev2ser(serial_table[i])->open_count) {
34862+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
34863 result =
34864 hso_start_serial_device(serial_table[i], GFP_NOIO);
34865 hso_kick_transmit(dev2ser(serial_table[i]));
34866diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-config.h linux-2.6.32.46/drivers/net/vxge/vxge-config.h
34867--- linux-2.6.32.46/drivers/net/vxge/vxge-config.h 2011-03-27 14:31:47.000000000 -0400
34868+++ linux-2.6.32.46/drivers/net/vxge/vxge-config.h 2011-08-05 20:33:55.000000000 -0400
34869@@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
34870 void (*link_down)(struct __vxge_hw_device *devh);
34871 void (*crit_err)(struct __vxge_hw_device *devh,
34872 enum vxge_hw_event type, u64 ext_data);
34873-};
34874+} __no_const;
34875
34876 /*
34877 * struct __vxge_hw_blockpool_entry - Block private data structure
34878diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-main.c linux-2.6.32.46/drivers/net/vxge/vxge-main.c
34879--- linux-2.6.32.46/drivers/net/vxge/vxge-main.c 2011-03-27 14:31:47.000000000 -0400
34880+++ linux-2.6.32.46/drivers/net/vxge/vxge-main.c 2011-05-16 21:46:57.000000000 -0400
34881@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_T
34882 struct sk_buff *completed[NR_SKB_COMPLETED];
34883 int more;
34884
34885+ pax_track_stack();
34886+
34887 do {
34888 more = 0;
34889 skb_ptr = completed;
34890@@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_conf
34891 u8 mtable[256] = {0}; /* CPU to vpath mapping */
34892 int index;
34893
34894+ pax_track_stack();
34895+
34896 /*
34897 * Filling
34898 * - itable with bucket numbers
34899diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h
34900--- linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h 2011-03-27 14:31:47.000000000 -0400
34901+++ linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h 2011-08-05 20:33:55.000000000 -0400
34902@@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
34903 struct vxge_hw_mempool_dma *dma_object,
34904 u32 index,
34905 u32 is_last);
34906-};
34907+} __no_const;
34908
34909 void
34910 __vxge_hw_mempool_destroy(
34911diff -urNp linux-2.6.32.46/drivers/net/wan/cycx_x25.c linux-2.6.32.46/drivers/net/wan/cycx_x25.c
34912--- linux-2.6.32.46/drivers/net/wan/cycx_x25.c 2011-03-27 14:31:47.000000000 -0400
34913+++ linux-2.6.32.46/drivers/net/wan/cycx_x25.c 2011-05-16 21:46:57.000000000 -0400
34914@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned
34915 unsigned char hex[1024],
34916 * phex = hex;
34917
34918+ pax_track_stack();
34919+
34920 if (len >= (sizeof(hex) / 2))
34921 len = (sizeof(hex) / 2) - 1;
34922
34923diff -urNp linux-2.6.32.46/drivers/net/wan/hdlc_x25.c linux-2.6.32.46/drivers/net/wan/hdlc_x25.c
34924--- linux-2.6.32.46/drivers/net/wan/hdlc_x25.c 2011-03-27 14:31:47.000000000 -0400
34925+++ linux-2.6.32.46/drivers/net/wan/hdlc_x25.c 2011-08-05 20:33:55.000000000 -0400
34926@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
34927
34928 static int x25_open(struct net_device *dev)
34929 {
34930- struct lapb_register_struct cb;
34931+ static struct lapb_register_struct cb = {
34932+ .connect_confirmation = x25_connected,
34933+ .connect_indication = x25_connected,
34934+ .disconnect_confirmation = x25_disconnected,
34935+ .disconnect_indication = x25_disconnected,
34936+ .data_indication = x25_data_indication,
34937+ .data_transmit = x25_data_transmit
34938+ };
34939 int result;
34940
34941- cb.connect_confirmation = x25_connected;
34942- cb.connect_indication = x25_connected;
34943- cb.disconnect_confirmation = x25_disconnected;
34944- cb.disconnect_indication = x25_disconnected;
34945- cb.data_indication = x25_data_indication;
34946- cb.data_transmit = x25_data_transmit;
34947-
34948 result = lapb_register(dev, &cb);
34949 if (result != LAPB_OK)
34950 return result;
34951diff -urNp linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c
34952--- linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c 2011-03-27 14:31:47.000000000 -0400
34953+++ linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c 2011-05-16 21:46:57.000000000 -0400
34954@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
34955 int do_autopm = 1;
34956 DECLARE_COMPLETION_ONSTACK(notif_completion);
34957
34958+ pax_track_stack();
34959+
34960 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
34961 i2400m, ack, ack_size);
34962 BUG_ON(_ack == i2400m->bm_ack_buf);
34963diff -urNp linux-2.6.32.46/drivers/net/wireless/airo.c linux-2.6.32.46/drivers/net/wireless/airo.c
34964--- linux-2.6.32.46/drivers/net/wireless/airo.c 2011-03-27 14:31:47.000000000 -0400
34965+++ linux-2.6.32.46/drivers/net/wireless/airo.c 2011-05-16 21:46:57.000000000 -0400
34966@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
34967 BSSListElement * loop_net;
34968 BSSListElement * tmp_net;
34969
34970+ pax_track_stack();
34971+
34972 /* Blow away current list of scan results */
34973 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
34974 list_move_tail (&loop_net->list, &ai->network_free_list);
34975@@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *
34976 WepKeyRid wkr;
34977 int rc;
34978
34979+ pax_track_stack();
34980+
34981 memset( &mySsid, 0, sizeof( mySsid ) );
34982 kfree (ai->flash);
34983 ai->flash = NULL;
34984@@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct i
34985 __le32 *vals = stats.vals;
34986 int len;
34987
34988+ pax_track_stack();
34989+
34990 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
34991 return -ENOMEM;
34992 data = (struct proc_data *)file->private_data;
34993@@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct ino
34994 /* If doLoseSync is not 1, we won't do a Lose Sync */
34995 int doLoseSync = -1;
34996
34997+ pax_track_stack();
34998+
34999 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35000 return -ENOMEM;
35001 data = (struct proc_data *)file->private_data;
35002@@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_de
35003 int i;
35004 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35005
35006+ pax_track_stack();
35007+
35008 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35009 if (!qual)
35010 return -ENOMEM;
35011@@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(str
35012 CapabilityRid cap_rid;
35013 __le32 *vals = stats_rid.vals;
35014
35015+ pax_track_stack();
35016+
35017 /* Get stats out of the card */
35018 clear_bit(JOB_WSTATS, &local->jobs);
35019 if (local->power.event) {
35020diff -urNp linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c
35021--- linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c 2011-03-27 14:31:47.000000000 -0400
35022+++ linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c 2011-05-16 21:46:57.000000000 -0400
35023@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct f
35024 unsigned int v;
35025 u64 tsf;
35026
35027+ pax_track_stack();
35028+
35029 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35030 len += snprintf(buf+len, sizeof(buf)-len,
35031 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35032@@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct fi
35033 unsigned int len = 0;
35034 unsigned int i;
35035
35036+ pax_track_stack();
35037+
35038 len += snprintf(buf+len, sizeof(buf)-len,
35039 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35040
35041diff -urNp linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c
35042--- linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c 2011-03-27 14:31:47.000000000 -0400
35043+++ linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c 2011-05-16 21:46:57.000000000 -0400
35044@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struc
35045 char buf[512];
35046 unsigned int len = 0;
35047
35048+ pax_track_stack();
35049+
35050 len += snprintf(buf + len, sizeof(buf) - len,
35051 "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
35052 len += snprintf(buf + len, sizeof(buf) - len,
35053@@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct fi
35054 int i;
35055 u8 addr[ETH_ALEN];
35056
35057+ pax_track_stack();
35058+
35059 len += snprintf(buf + len, sizeof(buf) - len,
35060 "primary: %s (%s chan=%d ht=%d)\n",
35061 wiphy_name(sc->pri_wiphy->hw->wiphy),
35062diff -urNp linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c
35063--- linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c 2011-03-27 14:31:47.000000000 -0400
35064+++ linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c 2011-04-17 15:56:46.000000000 -0400
35065@@ -43,7 +43,7 @@ static struct dentry *rootdir;
35066 struct b43_debugfs_fops {
35067 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
35068 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
35069- struct file_operations fops;
35070+ const struct file_operations fops;
35071 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
35072 size_t file_struct_offset;
35073 };
35074diff -urNp linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c
35075--- linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c 2011-03-27 14:31:47.000000000 -0400
35076+++ linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c 2011-04-17 15:56:46.000000000 -0400
35077@@ -44,7 +44,7 @@ static struct dentry *rootdir;
35078 struct b43legacy_debugfs_fops {
35079 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
35080 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
35081- struct file_operations fops;
35082+ const struct file_operations fops;
35083 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
35084 size_t file_struct_offset;
35085 /* Take wl->irq_lock before calling read/write? */
35086diff -urNp linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c
35087--- linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c 2011-03-27 14:31:47.000000000 -0400
35088+++ linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-16 21:46:57.000000000 -0400
35089@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2
35090 int err;
35091 DECLARE_SSID_BUF(ssid);
35092
35093+ pax_track_stack();
35094+
35095 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
35096
35097 if (ssid_len)
35098@@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw210
35099 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
35100 int err;
35101
35102+ pax_track_stack();
35103+
35104 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
35105 idx, keylen, len);
35106
35107diff -urNp linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c
35108--- linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-03-27 14:31:47.000000000 -0400
35109+++ linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-16 21:46:57.000000000 -0400
35110@@ -1566,6 +1566,8 @@ static void libipw_process_probe_respons
35111 unsigned long flags;
35112 DECLARE_SSID_BUF(ssid);
35113
35114+ pax_track_stack();
35115+
35116 LIBIPW_DEBUG_SCAN("'%s' (%pM"
35117 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
35118 print_ssid(ssid, info_element->data, info_element->len),
35119diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c
35120--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-03-27 14:31:47.000000000 -0400
35121+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-04-17 15:56:46.000000000 -0400
35122@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib =
35123 },
35124 };
35125
35126-static struct iwl_ops iwl1000_ops = {
35127+static const struct iwl_ops iwl1000_ops = {
35128 .ucode = &iwl5000_ucode,
35129 .lib = &iwl1000_lib,
35130 .hcmd = &iwl5000_hcmd,
35131diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c
35132--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-03-27 14:31:47.000000000 -0400
35133+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-08-05 20:33:55.000000000 -0400
35134@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_
35135 */
35136 if (iwl3945_mod_params.disable_hw_scan) {
35137 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
35138- iwl3945_hw_ops.hw_scan = NULL;
35139+ pax_open_kernel();
35140+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
35141+ pax_close_kernel();
35142 }
35143
35144
35145diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c
35146--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-03-27 14:31:47.000000000 -0400
35147+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-04-17 15:56:46.000000000 -0400
35148@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
35149 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
35150 };
35151
35152-static struct iwl_ops iwl3945_ops = {
35153+static const struct iwl_ops iwl3945_ops = {
35154 .ucode = &iwl3945_ucode,
35155 .lib = &iwl3945_lib,
35156 .hcmd = &iwl3945_hcmd,
35157diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c
35158--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-03-27 14:31:47.000000000 -0400
35159+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-04-17 15:56:46.000000000 -0400
35160@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib =
35161 },
35162 };
35163
35164-static struct iwl_ops iwl4965_ops = {
35165+static const struct iwl_ops iwl4965_ops = {
35166 .ucode = &iwl4965_ucode,
35167 .lib = &iwl4965_lib,
35168 .hcmd = &iwl4965_hcmd,
35169diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c
35170--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:55:34.000000000 -0400
35171+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:56:37.000000000 -0400
35172@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib =
35173 },
35174 };
35175
35176-struct iwl_ops iwl5000_ops = {
35177+const struct iwl_ops iwl5000_ops = {
35178 .ucode = &iwl5000_ucode,
35179 .lib = &iwl5000_lib,
35180 .hcmd = &iwl5000_hcmd,
35181 .utils = &iwl5000_hcmd_utils,
35182 };
35183
35184-static struct iwl_ops iwl5150_ops = {
35185+static const struct iwl_ops iwl5150_ops = {
35186 .ucode = &iwl5000_ucode,
35187 .lib = &iwl5150_lib,
35188 .hcmd = &iwl5000_hcmd,
35189diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c
35190--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-03-27 14:31:47.000000000 -0400
35191+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-04-17 15:56:46.000000000 -0400
35192@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
35193 .calc_rssi = iwl5000_calc_rssi,
35194 };
35195
35196-static struct iwl_ops iwl6000_ops = {
35197+static const struct iwl_ops iwl6000_ops = {
35198 .ucode = &iwl5000_ucode,
35199 .lib = &iwl6000_lib,
35200 .hcmd = &iwl5000_hcmd,
35201diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c
35202--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-03-27 14:31:47.000000000 -0400
35203+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-08-05 20:33:55.000000000 -0400
35204@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev
35205 if (iwl_debug_level & IWL_DL_INFO)
35206 dev_printk(KERN_DEBUG, &(pdev->dev),
35207 "Disabling hw_scan\n");
35208- iwl_hw_ops.hw_scan = NULL;
35209+ pax_open_kernel();
35210+ *(void **)&iwl_hw_ops.hw_scan = NULL;
35211+ pax_close_kernel();
35212 }
35213
35214 hw = iwl_alloc_all(cfg, &iwl_hw_ops);
35215diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
35216--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-03-27 14:31:47.000000000 -0400
35217+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-16 21:46:57.000000000 -0400
35218@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, s
35219 u8 active_index = 0;
35220 s32 tpt = 0;
35221
35222+ pax_track_stack();
35223+
35224 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
35225
35226 if (!ieee80211_is_data(hdr->frame_control) ||
35227@@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_
35228 u8 valid_tx_ant = 0;
35229 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
35230
35231+ pax_track_stack();
35232+
35233 /* Override starting rate (index 0) if needed for debug purposes */
35234 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
35235
35236diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c
35237--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-03-27 14:31:47.000000000 -0400
35238+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-16 21:46:57.000000000 -0400
35239@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(str
35240 int pos = 0;
35241 const size_t bufsz = sizeof(buf);
35242
35243+ pax_track_stack();
35244+
35245 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
35246 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
35247 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
35248@@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
35249 const size_t bufsz = sizeof(buf);
35250 ssize_t ret;
35251
35252+ pax_track_stack();
35253+
35254 for (i = 0; i < AC_NUM; i++) {
35255 pos += scnprintf(buf + pos, bufsz - pos,
35256 "\tcw_min\tcw_max\taifsn\ttxop\n");
35257diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h
35258--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-03-27 14:31:47.000000000 -0400
35259+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-04-17 15:56:46.000000000 -0400
35260@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
35261 #endif
35262
35263 #else
35264-#define IWL_DEBUG(__priv, level, fmt, args...)
35265-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
35266+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
35267+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
35268 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
35269 void *p, u32 len)
35270 {}
35271diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h
35272--- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-03-27 14:31:47.000000000 -0400
35273+++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-04-17 15:56:46.000000000 -0400
35274@@ -68,7 +68,7 @@ struct iwl_tx_queue;
35275
35276 /* shared structures from iwl-5000.c */
35277 extern struct iwl_mod_params iwl50_mod_params;
35278-extern struct iwl_ops iwl5000_ops;
35279+extern const struct iwl_ops iwl5000_ops;
35280 extern struct iwl_ucode_ops iwl5000_ucode;
35281 extern struct iwl_lib_ops iwl5000_lib;
35282 extern struct iwl_hcmd_ops iwl5000_hcmd;
35283diff -urNp linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c
35284--- linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-03-27 14:31:47.000000000 -0400
35285+++ linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-16 21:46:57.000000000 -0400
35286@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
35287 int buf_len = 512;
35288 size_t len = 0;
35289
35290+ pax_track_stack();
35291+
35292 if (*ppos != 0)
35293 return 0;
35294 if (count < sizeof(buf))
35295diff -urNp linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c
35296--- linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c 2011-03-27 14:31:47.000000000 -0400
35297+++ linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c 2011-04-17 15:56:46.000000000 -0400
35298@@ -708,7 +708,7 @@ out_unlock:
35299 struct lbs_debugfs_files {
35300 const char *name;
35301 int perm;
35302- struct file_operations fops;
35303+ const struct file_operations fops;
35304 };
35305
35306 static const struct lbs_debugfs_files debugfs_files[] = {
35307diff -urNp linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c
35308--- linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c 2011-03-27 14:31:47.000000000 -0400
35309+++ linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c 2011-04-17 15:56:46.000000000 -0400
35310@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
35311
35312 devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
35313
35314- if (rts_threshold < 0 || rts_threshold > 2347)
35315+ if (rts_threshold > 2347)
35316 rts_threshold = 2347;
35317
35318 tmp = cpu_to_le32(rts_threshold);
35319diff -urNp linux-2.6.32.46/drivers/oprofile/buffer_sync.c linux-2.6.32.46/drivers/oprofile/buffer_sync.c
35320--- linux-2.6.32.46/drivers/oprofile/buffer_sync.c 2011-03-27 14:31:47.000000000 -0400
35321+++ linux-2.6.32.46/drivers/oprofile/buffer_sync.c 2011-04-17 15:56:46.000000000 -0400
35322@@ -341,7 +341,7 @@ static void add_data(struct op_entry *en
35323 if (cookie == NO_COOKIE)
35324 offset = pc;
35325 if (cookie == INVALID_COOKIE) {
35326- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35327+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35328 offset = pc;
35329 }
35330 if (cookie != last_cookie) {
35331@@ -385,14 +385,14 @@ add_sample(struct mm_struct *mm, struct
35332 /* add userspace sample */
35333
35334 if (!mm) {
35335- atomic_inc(&oprofile_stats.sample_lost_no_mm);
35336+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
35337 return 0;
35338 }
35339
35340 cookie = lookup_dcookie(mm, s->eip, &offset);
35341
35342 if (cookie == INVALID_COOKIE) {
35343- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35344+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35345 return 0;
35346 }
35347
35348@@ -561,7 +561,7 @@ void sync_buffer(int cpu)
35349 /* ignore backtraces if failed to add a sample */
35350 if (state == sb_bt_start) {
35351 state = sb_bt_ignore;
35352- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
35353+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
35354 }
35355 }
35356 release_mm(mm);
35357diff -urNp linux-2.6.32.46/drivers/oprofile/event_buffer.c linux-2.6.32.46/drivers/oprofile/event_buffer.c
35358--- linux-2.6.32.46/drivers/oprofile/event_buffer.c 2011-03-27 14:31:47.000000000 -0400
35359+++ linux-2.6.32.46/drivers/oprofile/event_buffer.c 2011-04-17 15:56:46.000000000 -0400
35360@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
35361 }
35362
35363 if (buffer_pos == buffer_size) {
35364- atomic_inc(&oprofile_stats.event_lost_overflow);
35365+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
35366 return;
35367 }
35368
35369diff -urNp linux-2.6.32.46/drivers/oprofile/oprof.c linux-2.6.32.46/drivers/oprofile/oprof.c
35370--- linux-2.6.32.46/drivers/oprofile/oprof.c 2011-03-27 14:31:47.000000000 -0400
35371+++ linux-2.6.32.46/drivers/oprofile/oprof.c 2011-04-17 15:56:46.000000000 -0400
35372@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
35373 if (oprofile_ops.switch_events())
35374 return;
35375
35376- atomic_inc(&oprofile_stats.multiplex_counter);
35377+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
35378 start_switch_worker();
35379 }
35380
35381diff -urNp linux-2.6.32.46/drivers/oprofile/oprofilefs.c linux-2.6.32.46/drivers/oprofile/oprofilefs.c
35382--- linux-2.6.32.46/drivers/oprofile/oprofilefs.c 2011-03-27 14:31:47.000000000 -0400
35383+++ linux-2.6.32.46/drivers/oprofile/oprofilefs.c 2011-04-17 15:56:46.000000000 -0400
35384@@ -187,7 +187,7 @@ static const struct file_operations atom
35385
35386
35387 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35388- char const *name, atomic_t *val)
35389+ char const *name, atomic_unchecked_t *val)
35390 {
35391 struct dentry *d = __oprofilefs_create_file(sb, root, name,
35392 &atomic_ro_fops, 0444);
35393diff -urNp linux-2.6.32.46/drivers/oprofile/oprofile_stats.c linux-2.6.32.46/drivers/oprofile/oprofile_stats.c
35394--- linux-2.6.32.46/drivers/oprofile/oprofile_stats.c 2011-03-27 14:31:47.000000000 -0400
35395+++ linux-2.6.32.46/drivers/oprofile/oprofile_stats.c 2011-04-17 15:56:46.000000000 -0400
35396@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
35397 cpu_buf->sample_invalid_eip = 0;
35398 }
35399
35400- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
35401- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35402- atomic_set(&oprofile_stats.event_lost_overflow, 0);
35403- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35404- atomic_set(&oprofile_stats.multiplex_counter, 0);
35405+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35406+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35407+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35408+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35409+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35410 }
35411
35412
35413diff -urNp linux-2.6.32.46/drivers/oprofile/oprofile_stats.h linux-2.6.32.46/drivers/oprofile/oprofile_stats.h
35414--- linux-2.6.32.46/drivers/oprofile/oprofile_stats.h 2011-03-27 14:31:47.000000000 -0400
35415+++ linux-2.6.32.46/drivers/oprofile/oprofile_stats.h 2011-04-17 15:56:46.000000000 -0400
35416@@ -13,11 +13,11 @@
35417 #include <asm/atomic.h>
35418
35419 struct oprofile_stat_struct {
35420- atomic_t sample_lost_no_mm;
35421- atomic_t sample_lost_no_mapping;
35422- atomic_t bt_lost_no_mapping;
35423- atomic_t event_lost_overflow;
35424- atomic_t multiplex_counter;
35425+ atomic_unchecked_t sample_lost_no_mm;
35426+ atomic_unchecked_t sample_lost_no_mapping;
35427+ atomic_unchecked_t bt_lost_no_mapping;
35428+ atomic_unchecked_t event_lost_overflow;
35429+ atomic_unchecked_t multiplex_counter;
35430 };
35431
35432 extern struct oprofile_stat_struct oprofile_stats;
35433diff -urNp linux-2.6.32.46/drivers/parisc/pdc_stable.c linux-2.6.32.46/drivers/parisc/pdc_stable.c
35434--- linux-2.6.32.46/drivers/parisc/pdc_stable.c 2011-03-27 14:31:47.000000000 -0400
35435+++ linux-2.6.32.46/drivers/parisc/pdc_stable.c 2011-04-17 15:56:46.000000000 -0400
35436@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
35437 return ret;
35438 }
35439
35440-static struct sysfs_ops pdcspath_attr_ops = {
35441+static const struct sysfs_ops pdcspath_attr_ops = {
35442 .show = pdcspath_attr_show,
35443 .store = pdcspath_attr_store,
35444 };
35445diff -urNp linux-2.6.32.46/drivers/parport/procfs.c linux-2.6.32.46/drivers/parport/procfs.c
35446--- linux-2.6.32.46/drivers/parport/procfs.c 2011-03-27 14:31:47.000000000 -0400
35447+++ linux-2.6.32.46/drivers/parport/procfs.c 2011-04-17 15:56:46.000000000 -0400
35448@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
35449
35450 *ppos += len;
35451
35452- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35453+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35454 }
35455
35456 #ifdef CONFIG_PARPORT_1284
35457@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
35458
35459 *ppos += len;
35460
35461- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35462+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35463 }
35464 #endif /* IEEE1284.3 support. */
35465
35466diff -urNp linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c
35467--- linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c 2011-03-27 14:31:47.000000000 -0400
35468+++ linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c 2011-04-17 15:56:46.000000000 -0400
35469@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
35470 }
35471
35472
35473-static struct acpi_dock_ops acpiphp_dock_ops = {
35474+static const struct acpi_dock_ops acpiphp_dock_ops = {
35475 .handler = handle_hotplug_event_func,
35476 };
35477
35478diff -urNp linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h
35479--- linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h 2011-03-27 14:31:47.000000000 -0400
35480+++ linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h 2011-08-05 20:33:55.000000000 -0400
35481@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35482 int (*hardware_test) (struct slot* slot, u32 value);
35483 u8 (*get_power) (struct slot* slot);
35484 int (*set_power) (struct slot* slot, int value);
35485-};
35486+} __no_const;
35487
35488 struct cpci_hp_controller {
35489 unsigned int irq;
35490diff -urNp linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c
35491--- linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c 2011-03-27 14:31:47.000000000 -0400
35492+++ linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c 2011-04-17 15:56:46.000000000 -0400
35493@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
35494
35495 void compaq_nvram_init (void __iomem *rom_start)
35496 {
35497+
35498+#ifndef CONFIG_PAX_KERNEXEC
35499 if (rom_start) {
35500 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35501 }
35502+#endif
35503+
35504 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35505
35506 /* initialize our int15 lock */
35507diff -urNp linux-2.6.32.46/drivers/pci/hotplug/fakephp.c linux-2.6.32.46/drivers/pci/hotplug/fakephp.c
35508--- linux-2.6.32.46/drivers/pci/hotplug/fakephp.c 2011-03-27 14:31:47.000000000 -0400
35509+++ linux-2.6.32.46/drivers/pci/hotplug/fakephp.c 2011-04-17 15:56:46.000000000 -0400
35510@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
35511 }
35512
35513 static struct kobj_type legacy_ktype = {
35514- .sysfs_ops = &(struct sysfs_ops){
35515+ .sysfs_ops = &(const struct sysfs_ops){
35516 .store = legacy_store, .show = legacy_show
35517 },
35518 .release = &legacy_release,
35519diff -urNp linux-2.6.32.46/drivers/pci/intel-iommu.c linux-2.6.32.46/drivers/pci/intel-iommu.c
35520--- linux-2.6.32.46/drivers/pci/intel-iommu.c 2011-05-10 22:12:01.000000000 -0400
35521+++ linux-2.6.32.46/drivers/pci/intel-iommu.c 2011-05-10 22:12:33.000000000 -0400
35522@@ -2643,7 +2643,7 @@ error:
35523 return 0;
35524 }
35525
35526-static dma_addr_t intel_map_page(struct device *dev, struct page *page,
35527+dma_addr_t intel_map_page(struct device *dev, struct page *page,
35528 unsigned long offset, size_t size,
35529 enum dma_data_direction dir,
35530 struct dma_attrs *attrs)
35531@@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain
35532 spin_unlock_irqrestore(&async_umap_flush_lock, flags);
35533 }
35534
35535-static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
35536+void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
35537 size_t size, enum dma_data_direction dir,
35538 struct dma_attrs *attrs)
35539 {
35540@@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct devi
35541 }
35542 }
35543
35544-static void *intel_alloc_coherent(struct device *hwdev, size_t size,
35545+void *intel_alloc_coherent(struct device *hwdev, size_t size,
35546 dma_addr_t *dma_handle, gfp_t flags)
35547 {
35548 void *vaddr;
35549@@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct
35550 return NULL;
35551 }
35552
35553-static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
35554+void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
35555 dma_addr_t dma_handle)
35556 {
35557 int order;
35558@@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct d
35559 free_pages((unsigned long)vaddr, order);
35560 }
35561
35562-static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
35563+void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
35564 int nelems, enum dma_data_direction dir,
35565 struct dma_attrs *attrs)
35566 {
35567@@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(str
35568 return nelems;
35569 }
35570
35571-static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
35572+int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
35573 enum dma_data_direction dir, struct dma_attrs *attrs)
35574 {
35575 int i;
35576@@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *h
35577 return nelems;
35578 }
35579
35580-static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
35581+int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
35582 {
35583 return !dma_addr;
35584 }
35585
35586-struct dma_map_ops intel_dma_ops = {
35587+const struct dma_map_ops intel_dma_ops = {
35588 .alloc_coherent = intel_alloc_coherent,
35589 .free_coherent = intel_free_coherent,
35590 .map_sg = intel_map_sg,
35591diff -urNp linux-2.6.32.46/drivers/pci/pcie/aspm.c linux-2.6.32.46/drivers/pci/pcie/aspm.c
35592--- linux-2.6.32.46/drivers/pci/pcie/aspm.c 2011-03-27 14:31:47.000000000 -0400
35593+++ linux-2.6.32.46/drivers/pci/pcie/aspm.c 2011-04-17 15:56:46.000000000 -0400
35594@@ -27,9 +27,9 @@
35595 #define MODULE_PARAM_PREFIX "pcie_aspm."
35596
35597 /* Note: those are not register definitions */
35598-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35599-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35600-#define ASPM_STATE_L1 (4) /* L1 state */
35601+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35602+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35603+#define ASPM_STATE_L1 (4U) /* L1 state */
35604 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35605 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35606
35607diff -urNp linux-2.6.32.46/drivers/pci/probe.c linux-2.6.32.46/drivers/pci/probe.c
35608--- linux-2.6.32.46/drivers/pci/probe.c 2011-03-27 14:31:47.000000000 -0400
35609+++ linux-2.6.32.46/drivers/pci/probe.c 2011-04-17 15:56:46.000000000 -0400
35610@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
35611 return ret;
35612 }
35613
35614-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
35615+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
35616 struct device_attribute *attr,
35617 char *buf)
35618 {
35619 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
35620 }
35621
35622-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
35623+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
35624 struct device_attribute *attr,
35625 char *buf)
35626 {
35627diff -urNp linux-2.6.32.46/drivers/pci/proc.c linux-2.6.32.46/drivers/pci/proc.c
35628--- linux-2.6.32.46/drivers/pci/proc.c 2011-03-27 14:31:47.000000000 -0400
35629+++ linux-2.6.32.46/drivers/pci/proc.c 2011-04-17 15:56:46.000000000 -0400
35630@@ -480,7 +480,16 @@ static const struct file_operations proc
35631 static int __init pci_proc_init(void)
35632 {
35633 struct pci_dev *dev = NULL;
35634+
35635+#ifdef CONFIG_GRKERNSEC_PROC_ADD
35636+#ifdef CONFIG_GRKERNSEC_PROC_USER
35637+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35638+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35639+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35640+#endif
35641+#else
35642 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35643+#endif
35644 proc_create("devices", 0, proc_bus_pci_dir,
35645 &proc_bus_pci_dev_operations);
35646 proc_initialized = 1;
35647diff -urNp linux-2.6.32.46/drivers/pci/slot.c linux-2.6.32.46/drivers/pci/slot.c
35648--- linux-2.6.32.46/drivers/pci/slot.c 2011-03-27 14:31:47.000000000 -0400
35649+++ linux-2.6.32.46/drivers/pci/slot.c 2011-04-17 15:56:46.000000000 -0400
35650@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
35651 return attribute->store ? attribute->store(slot, buf, len) : -EIO;
35652 }
35653
35654-static struct sysfs_ops pci_slot_sysfs_ops = {
35655+static const struct sysfs_ops pci_slot_sysfs_ops = {
35656 .show = pci_slot_attr_show,
35657 .store = pci_slot_attr_store,
35658 };
35659diff -urNp linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c
35660--- linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c 2011-03-27 14:31:47.000000000 -0400
35661+++ linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c 2011-04-17 15:56:46.000000000 -0400
35662@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode
35663 return -EFAULT;
35664 }
35665 }
35666- buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
35667+ buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
35668 if (!buf)
35669 return -ENOMEM;
35670
35671diff -urNp linux-2.6.32.46/drivers/platform/x86/acer-wmi.c linux-2.6.32.46/drivers/platform/x86/acer-wmi.c
35672--- linux-2.6.32.46/drivers/platform/x86/acer-wmi.c 2011-03-27 14:31:47.000000000 -0400
35673+++ linux-2.6.32.46/drivers/platform/x86/acer-wmi.c 2011-04-17 15:56:46.000000000 -0400
35674@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
35675 return 0;
35676 }
35677
35678-static struct backlight_ops acer_bl_ops = {
35679+static const struct backlight_ops acer_bl_ops = {
35680 .get_brightness = read_brightness,
35681 .update_status = update_bl_status,
35682 };
35683diff -urNp linux-2.6.32.46/drivers/platform/x86/asus_acpi.c linux-2.6.32.46/drivers/platform/x86/asus_acpi.c
35684--- linux-2.6.32.46/drivers/platform/x86/asus_acpi.c 2011-03-27 14:31:47.000000000 -0400
35685+++ linux-2.6.32.46/drivers/platform/x86/asus_acpi.c 2011-04-17 15:56:46.000000000 -0400
35686@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_
35687 return 0;
35688 }
35689
35690-static struct backlight_ops asus_backlight_data = {
35691+static const struct backlight_ops asus_backlight_data = {
35692 .get_brightness = read_brightness,
35693 .update_status = set_brightness_status,
35694 };
35695diff -urNp linux-2.6.32.46/drivers/platform/x86/asus-laptop.c linux-2.6.32.46/drivers/platform/x86/asus-laptop.c
35696--- linux-2.6.32.46/drivers/platform/x86/asus-laptop.c 2011-03-27 14:31:47.000000000 -0400
35697+++ linux-2.6.32.46/drivers/platform/x86/asus-laptop.c 2011-04-17 15:56:46.000000000 -0400
35698@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
35699 */
35700 static int read_brightness(struct backlight_device *bd);
35701 static int update_bl_status(struct backlight_device *bd);
35702-static struct backlight_ops asusbl_ops = {
35703+static const struct backlight_ops asusbl_ops = {
35704 .get_brightness = read_brightness,
35705 .update_status = update_bl_status,
35706 };
35707diff -urNp linux-2.6.32.46/drivers/platform/x86/compal-laptop.c linux-2.6.32.46/drivers/platform/x86/compal-laptop.c
35708--- linux-2.6.32.46/drivers/platform/x86/compal-laptop.c 2011-03-27 14:31:47.000000000 -0400
35709+++ linux-2.6.32.46/drivers/platform/x86/compal-laptop.c 2011-04-17 15:56:46.000000000 -0400
35710@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
35711 return set_lcd_level(b->props.brightness);
35712 }
35713
35714-static struct backlight_ops compalbl_ops = {
35715+static const struct backlight_ops compalbl_ops = {
35716 .get_brightness = bl_get_brightness,
35717 .update_status = bl_update_status,
35718 };
35719diff -urNp linux-2.6.32.46/drivers/platform/x86/dell-laptop.c linux-2.6.32.46/drivers/platform/x86/dell-laptop.c
35720--- linux-2.6.32.46/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:01.000000000 -0400
35721+++ linux-2.6.32.46/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:33.000000000 -0400
35722@@ -318,7 +318,7 @@ static int dell_get_intensity(struct bac
35723 return buffer.output[1];
35724 }
35725
35726-static struct backlight_ops dell_ops = {
35727+static const struct backlight_ops dell_ops = {
35728 .get_brightness = dell_get_intensity,
35729 .update_status = dell_send_intensity,
35730 };
35731diff -urNp linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c
35732--- linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c 2011-03-27 14:31:47.000000000 -0400
35733+++ linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c 2011-04-17 15:56:46.000000000 -0400
35734@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
35735 */
35736 static int read_brightness(struct backlight_device *bd);
35737 static int update_bl_status(struct backlight_device *bd);
35738-static struct backlight_ops eeepcbl_ops = {
35739+static const struct backlight_ops eeepcbl_ops = {
35740 .get_brightness = read_brightness,
35741 .update_status = update_bl_status,
35742 };
35743diff -urNp linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c
35744--- linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c 2011-03-27 14:31:47.000000000 -0400
35745+++ linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c 2011-04-17 15:56:46.000000000 -0400
35746@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
35747 return ret;
35748 }
35749
35750-static struct backlight_ops fujitsubl_ops = {
35751+static const struct backlight_ops fujitsubl_ops = {
35752 .get_brightness = bl_get_brightness,
35753 .update_status = bl_update_status,
35754 };
35755diff -urNp linux-2.6.32.46/drivers/platform/x86/msi-laptop.c linux-2.6.32.46/drivers/platform/x86/msi-laptop.c
35756--- linux-2.6.32.46/drivers/platform/x86/msi-laptop.c 2011-03-27 14:31:47.000000000 -0400
35757+++ linux-2.6.32.46/drivers/platform/x86/msi-laptop.c 2011-04-17 15:56:46.000000000 -0400
35758@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
35759 return set_lcd_level(b->props.brightness);
35760 }
35761
35762-static struct backlight_ops msibl_ops = {
35763+static const struct backlight_ops msibl_ops = {
35764 .get_brightness = bl_get_brightness,
35765 .update_status = bl_update_status,
35766 };
35767diff -urNp linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c
35768--- linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c 2011-03-27 14:31:47.000000000 -0400
35769+++ linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c 2011-04-17 15:56:46.000000000 -0400
35770@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
35771 return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
35772 }
35773
35774-static struct backlight_ops pcc_backlight_ops = {
35775+static const struct backlight_ops pcc_backlight_ops = {
35776 .get_brightness = bl_get,
35777 .update_status = bl_set_status,
35778 };
35779diff -urNp linux-2.6.32.46/drivers/platform/x86/sony-laptop.c linux-2.6.32.46/drivers/platform/x86/sony-laptop.c
35780--- linux-2.6.32.46/drivers/platform/x86/sony-laptop.c 2011-03-27 14:31:47.000000000 -0400
35781+++ linux-2.6.32.46/drivers/platform/x86/sony-laptop.c 2011-04-17 15:56:46.000000000 -0400
35782@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
35783 }
35784
35785 static struct backlight_device *sony_backlight_device;
35786-static struct backlight_ops sony_backlight_ops = {
35787+static const struct backlight_ops sony_backlight_ops = {
35788 .update_status = sony_backlight_update_status,
35789 .get_brightness = sony_backlight_get_brightness,
35790 };
35791diff -urNp linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c
35792--- linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c 2011-03-27 14:31:47.000000000 -0400
35793+++ linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c 2011-08-05 20:33:55.000000000 -0400
35794@@ -2137,7 +2137,7 @@ static int hotkey_mask_get(void)
35795 return 0;
35796 }
35797
35798-void static hotkey_mask_warn_incomplete_mask(void)
35799+static void hotkey_mask_warn_incomplete_mask(void)
35800 {
35801 /* log only what the user can fix... */
35802 const u32 wantedmask = hotkey_driver_mask &
35803@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
35804 BACKLIGHT_UPDATE_HOTKEY);
35805 }
35806
35807-static struct backlight_ops ibm_backlight_data = {
35808+static const struct backlight_ops ibm_backlight_data = {
35809 .get_brightness = brightness_get,
35810 .update_status = brightness_update_status,
35811 };
35812diff -urNp linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c
35813--- linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c 2011-03-27 14:31:47.000000000 -0400
35814+++ linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c 2011-04-17 15:56:46.000000000 -0400
35815@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
35816 return AE_OK;
35817 }
35818
35819-static struct backlight_ops toshiba_backlight_data = {
35820+static const struct backlight_ops toshiba_backlight_data = {
35821 .get_brightness = get_lcd,
35822 .update_status = set_lcd_status,
35823 };
35824diff -urNp linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c
35825--- linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c 2011-03-27 14:31:47.000000000 -0400
35826+++ linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c 2011-04-17 15:56:46.000000000 -0400
35827@@ -60,7 +60,7 @@ do { \
35828 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
35829 } while(0)
35830
35831-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
35832+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
35833 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
35834
35835 /*
35836@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
35837
35838 cpu = get_cpu();
35839 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
35840+
35841+ pax_open_kernel();
35842 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
35843+ pax_close_kernel();
35844
35845 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
35846 spin_lock_irqsave(&pnp_bios_lock, flags);
35847@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
35848 :"memory");
35849 spin_unlock_irqrestore(&pnp_bios_lock, flags);
35850
35851+ pax_open_kernel();
35852 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
35853+ pax_close_kernel();
35854+
35855 put_cpu();
35856
35857 /* If we get here and this is set then the PnP BIOS faulted on us. */
35858@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
35859 return status;
35860 }
35861
35862-void pnpbios_calls_init(union pnp_bios_install_struct *header)
35863+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
35864 {
35865 int i;
35866
35867@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
35868 pnp_bios_callpoint.offset = header->fields.pm16offset;
35869 pnp_bios_callpoint.segment = PNP_CS16;
35870
35871+ pax_open_kernel();
35872+
35873 for_each_possible_cpu(i) {
35874 struct desc_struct *gdt = get_cpu_gdt_table(i);
35875 if (!gdt)
35876@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
35877 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
35878 (unsigned long)__va(header->fields.pm16dseg));
35879 }
35880+
35881+ pax_close_kernel();
35882 }
35883diff -urNp linux-2.6.32.46/drivers/pnp/resource.c linux-2.6.32.46/drivers/pnp/resource.c
35884--- linux-2.6.32.46/drivers/pnp/resource.c 2011-03-27 14:31:47.000000000 -0400
35885+++ linux-2.6.32.46/drivers/pnp/resource.c 2011-04-17 15:56:46.000000000 -0400
35886@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
35887 return 1;
35888
35889 /* check if the resource is valid */
35890- if (*irq < 0 || *irq > 15)
35891+ if (*irq > 15)
35892 return 0;
35893
35894 /* check if the resource is reserved */
35895@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
35896 return 1;
35897
35898 /* check if the resource is valid */
35899- if (*dma < 0 || *dma == 4 || *dma > 7)
35900+ if (*dma == 4 || *dma > 7)
35901 return 0;
35902
35903 /* check if the resource is reserved */
35904diff -urNp linux-2.6.32.46/drivers/power/bq27x00_battery.c linux-2.6.32.46/drivers/power/bq27x00_battery.c
35905--- linux-2.6.32.46/drivers/power/bq27x00_battery.c 2011-03-27 14:31:47.000000000 -0400
35906+++ linux-2.6.32.46/drivers/power/bq27x00_battery.c 2011-08-05 20:33:55.000000000 -0400
35907@@ -44,7 +44,7 @@ struct bq27x00_device_info;
35908 struct bq27x00_access_methods {
35909 int (*read)(u8 reg, int *rt_value, int b_single,
35910 struct bq27x00_device_info *di);
35911-};
35912+} __no_const;
35913
35914 struct bq27x00_device_info {
35915 struct device *dev;
35916diff -urNp linux-2.6.32.46/drivers/rtc/rtc-dev.c linux-2.6.32.46/drivers/rtc/rtc-dev.c
35917--- linux-2.6.32.46/drivers/rtc/rtc-dev.c 2011-03-27 14:31:47.000000000 -0400
35918+++ linux-2.6.32.46/drivers/rtc/rtc-dev.c 2011-04-17 15:56:46.000000000 -0400
35919@@ -14,6 +14,7 @@
35920 #include <linux/module.h>
35921 #include <linux/rtc.h>
35922 #include <linux/sched.h>
35923+#include <linux/grsecurity.h>
35924 #include "rtc-core.h"
35925
35926 static dev_t rtc_devt;
35927@@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *f
35928 if (copy_from_user(&tm, uarg, sizeof(tm)))
35929 return -EFAULT;
35930
35931+ gr_log_timechange();
35932+
35933 return rtc_set_time(rtc, &tm);
35934
35935 case RTC_PIE_ON:
35936diff -urNp linux-2.6.32.46/drivers/s390/cio/qdio_perf.c linux-2.6.32.46/drivers/s390/cio/qdio_perf.c
35937--- linux-2.6.32.46/drivers/s390/cio/qdio_perf.c 2011-03-27 14:31:47.000000000 -0400
35938+++ linux-2.6.32.46/drivers/s390/cio/qdio_perf.c 2011-04-17 15:56:46.000000000 -0400
35939@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
35940 static int qdio_perf_proc_show(struct seq_file *m, void *v)
35941 {
35942 seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
35943- (long)atomic_long_read(&perf_stats.qdio_int));
35944+ (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
35945 seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
35946- (long)atomic_long_read(&perf_stats.pci_int));
35947+ (long)atomic_long_read_unchecked(&perf_stats.pci_int));
35948 seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
35949- (long)atomic_long_read(&perf_stats.thin_int));
35950+ (long)atomic_long_read_unchecked(&perf_stats.thin_int));
35951 seq_printf(m, "\n");
35952 seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
35953- (long)atomic_long_read(&perf_stats.tasklet_inbound));
35954+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
35955 seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
35956- (long)atomic_long_read(&perf_stats.tasklet_outbound));
35957+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
35958 seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
35959- (long)atomic_long_read(&perf_stats.tasklet_thinint),
35960- (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
35961+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
35962+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
35963 seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
35964- (long)atomic_long_read(&perf_stats.thinint_inbound),
35965- (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
35966+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
35967+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
35968 seq_printf(m, "\n");
35969 seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
35970- (long)atomic_long_read(&perf_stats.siga_in));
35971+ (long)atomic_long_read_unchecked(&perf_stats.siga_in));
35972 seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
35973- (long)atomic_long_read(&perf_stats.siga_out));
35974+ (long)atomic_long_read_unchecked(&perf_stats.siga_out));
35975 seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
35976- (long)atomic_long_read(&perf_stats.siga_sync));
35977+ (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
35978 seq_printf(m, "\n");
35979 seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
35980- (long)atomic_long_read(&perf_stats.inbound_handler));
35981+ (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
35982 seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
35983- (long)atomic_long_read(&perf_stats.outbound_handler));
35984+ (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
35985 seq_printf(m, "\n");
35986 seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
35987- (long)atomic_long_read(&perf_stats.fast_requeue));
35988+ (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
35989 seq_printf(m, "Number of outbound target full condition\t: %li\n",
35990- (long)atomic_long_read(&perf_stats.outbound_target_full));
35991+ (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
35992 seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
35993- (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
35994+ (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
35995 seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
35996- (long)atomic_long_read(&perf_stats.debug_stop_polling));
35997+ (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
35998 seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
35999- (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
36000+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
36001 seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
36002- (long)atomic_long_read(&perf_stats.debug_eqbs_all),
36003- (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
36004+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
36005+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
36006 seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
36007- (long)atomic_long_read(&perf_stats.debug_sqbs_all),
36008- (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
36009+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
36010+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
36011 seq_printf(m, "\n");
36012 return 0;
36013 }
36014diff -urNp linux-2.6.32.46/drivers/s390/cio/qdio_perf.h linux-2.6.32.46/drivers/s390/cio/qdio_perf.h
36015--- linux-2.6.32.46/drivers/s390/cio/qdio_perf.h 2011-03-27 14:31:47.000000000 -0400
36016+++ linux-2.6.32.46/drivers/s390/cio/qdio_perf.h 2011-04-17 15:56:46.000000000 -0400
36017@@ -13,46 +13,46 @@
36018
36019 struct qdio_perf_stats {
36020 /* interrupt handler calls */
36021- atomic_long_t qdio_int;
36022- atomic_long_t pci_int;
36023- atomic_long_t thin_int;
36024+ atomic_long_unchecked_t qdio_int;
36025+ atomic_long_unchecked_t pci_int;
36026+ atomic_long_unchecked_t thin_int;
36027
36028 /* tasklet runs */
36029- atomic_long_t tasklet_inbound;
36030- atomic_long_t tasklet_outbound;
36031- atomic_long_t tasklet_thinint;
36032- atomic_long_t tasklet_thinint_loop;
36033- atomic_long_t thinint_inbound;
36034- atomic_long_t thinint_inbound_loop;
36035- atomic_long_t thinint_inbound_loop2;
36036+ atomic_long_unchecked_t tasklet_inbound;
36037+ atomic_long_unchecked_t tasklet_outbound;
36038+ atomic_long_unchecked_t tasklet_thinint;
36039+ atomic_long_unchecked_t tasklet_thinint_loop;
36040+ atomic_long_unchecked_t thinint_inbound;
36041+ atomic_long_unchecked_t thinint_inbound_loop;
36042+ atomic_long_unchecked_t thinint_inbound_loop2;
36043
36044 /* signal adapter calls */
36045- atomic_long_t siga_out;
36046- atomic_long_t siga_in;
36047- atomic_long_t siga_sync;
36048+ atomic_long_unchecked_t siga_out;
36049+ atomic_long_unchecked_t siga_in;
36050+ atomic_long_unchecked_t siga_sync;
36051
36052 /* misc */
36053- atomic_long_t inbound_handler;
36054- atomic_long_t outbound_handler;
36055- atomic_long_t fast_requeue;
36056- atomic_long_t outbound_target_full;
36057+ atomic_long_unchecked_t inbound_handler;
36058+ atomic_long_unchecked_t outbound_handler;
36059+ atomic_long_unchecked_t fast_requeue;
36060+ atomic_long_unchecked_t outbound_target_full;
36061
36062 /* for debugging */
36063- atomic_long_t debug_tl_out_timer;
36064- atomic_long_t debug_stop_polling;
36065- atomic_long_t debug_eqbs_all;
36066- atomic_long_t debug_eqbs_incomplete;
36067- atomic_long_t debug_sqbs_all;
36068- atomic_long_t debug_sqbs_incomplete;
36069+ atomic_long_unchecked_t debug_tl_out_timer;
36070+ atomic_long_unchecked_t debug_stop_polling;
36071+ atomic_long_unchecked_t debug_eqbs_all;
36072+ atomic_long_unchecked_t debug_eqbs_incomplete;
36073+ atomic_long_unchecked_t debug_sqbs_all;
36074+ atomic_long_unchecked_t debug_sqbs_incomplete;
36075 };
36076
36077 extern struct qdio_perf_stats perf_stats;
36078 extern int qdio_performance_stats;
36079
36080-static inline void qdio_perf_stat_inc(atomic_long_t *count)
36081+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
36082 {
36083 if (qdio_performance_stats)
36084- atomic_long_inc(count);
36085+ atomic_long_inc_unchecked(count);
36086 }
36087
36088 int qdio_setup_perf_stats(void);
36089diff -urNp linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h
36090--- linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h 2011-03-27 14:31:47.000000000 -0400
36091+++ linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h 2011-08-05 20:33:55.000000000 -0400
36092@@ -471,7 +471,7 @@ struct adapter_ops
36093 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
36094 /* Administrative operations */
36095 int (*adapter_comm)(struct aac_dev * dev, int comm);
36096-};
36097+} __no_const;
36098
36099 /*
36100 * Define which interrupt handler needs to be installed
36101diff -urNp linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c
36102--- linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c 2011-03-27 14:31:47.000000000 -0400
36103+++ linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c 2011-05-16 21:46:57.000000000 -0400
36104@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
36105 u32 actual_fibsize64, actual_fibsize = 0;
36106 int i;
36107
36108+ pax_track_stack();
36109
36110 if (dev->in_reset) {
36111 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
36112diff -urNp linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c
36113--- linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c 2011-03-27 14:31:47.000000000 -0400
36114+++ linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c 2011-04-17 15:56:46.000000000 -0400
36115@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(stru
36116 flash_error_table[i].reason);
36117 }
36118
36119-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
36120+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
36121 asd_show_update_bios, asd_store_update_bios);
36122
36123 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
36124diff -urNp linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h
36125--- linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h 2011-03-27 14:31:47.000000000 -0400
36126+++ linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h 2011-08-05 20:33:55.000000000 -0400
36127@@ -61,7 +61,7 @@ struct bfa_hwif_s {
36128 void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
36129 void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
36130 u32 *nvecs, u32 *maxvec);
36131-};
36132+} __no_const;
36133 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
36134
36135 struct bfa_iocfc_s {
36136diff -urNp linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h
36137--- linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h 2011-03-27 14:31:47.000000000 -0400
36138+++ linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h 2011-08-05 20:33:55.000000000 -0400
36139@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
36140 bfa_ioc_disable_cbfn_t disable_cbfn;
36141 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
36142 bfa_ioc_reset_cbfn_t reset_cbfn;
36143-};
36144+} __no_const;
36145
36146 /**
36147 * Heartbeat failure notification queue element.
36148diff -urNp linux-2.6.32.46/drivers/scsi/BusLogic.c linux-2.6.32.46/drivers/scsi/BusLogic.c
36149--- linux-2.6.32.46/drivers/scsi/BusLogic.c 2011-03-27 14:31:47.000000000 -0400
36150+++ linux-2.6.32.46/drivers/scsi/BusLogic.c 2011-05-16 21:46:57.000000000 -0400
36151@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFla
36152 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
36153 *PrototypeHostAdapter)
36154 {
36155+ pax_track_stack();
36156+
36157 /*
36158 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
36159 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
36160diff -urNp linux-2.6.32.46/drivers/scsi/dpt_i2o.c linux-2.6.32.46/drivers/scsi/dpt_i2o.c
36161--- linux-2.6.32.46/drivers/scsi/dpt_i2o.c 2011-03-27 14:31:47.000000000 -0400
36162+++ linux-2.6.32.46/drivers/scsi/dpt_i2o.c 2011-05-16 21:46:57.000000000 -0400
36163@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* p
36164 dma_addr_t addr;
36165 ulong flags = 0;
36166
36167+ pax_track_stack();
36168+
36169 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
36170 // get user msg size in u32s
36171 if(get_user(size, &user_msg[0])){
36172@@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
36173 s32 rcode;
36174 dma_addr_t addr;
36175
36176+ pax_track_stack();
36177+
36178 memset(msg, 0 , sizeof(msg));
36179 len = scsi_bufflen(cmd);
36180 direction = 0x00000000;
36181diff -urNp linux-2.6.32.46/drivers/scsi/eata.c linux-2.6.32.46/drivers/scsi/eata.c
36182--- linux-2.6.32.46/drivers/scsi/eata.c 2011-03-27 14:31:47.000000000 -0400
36183+++ linux-2.6.32.46/drivers/scsi/eata.c 2011-05-16 21:46:57.000000000 -0400
36184@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
36185 struct hostdata *ha;
36186 char name[16];
36187
36188+ pax_track_stack();
36189+
36190 sprintf(name, "%s%d", driver_name, j);
36191
36192 if (!request_region(port_base, REGION_SIZE, driver_name)) {
36193diff -urNp linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c
36194--- linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c 2011-03-27 14:31:47.000000000 -0400
36195+++ linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c 2011-05-16 21:46:57.000000000 -0400
36196@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fc
36197 size_t rlen;
36198 size_t dlen;
36199
36200+ pax_track_stack();
36201+
36202 fiph = (struct fip_header *)skb->data;
36203 sub = fiph->fip_subcode;
36204 if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
36205diff -urNp linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c
36206--- linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c 2011-03-27 14:31:47.000000000 -0400
36207+++ linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c 2011-08-05 20:33:55.000000000 -0400
36208@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct p
36209 /* Start local port initiatialization */
36210
36211 lp->link_up = 0;
36212- lp->tt = fnic_transport_template;
36213+ memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
36214
36215 lp->max_retry_count = fnic->config.flogi_retries;
36216 lp->max_rport_retry_count = fnic->config.plogi_retries;
36217diff -urNp linux-2.6.32.46/drivers/scsi/gdth.c linux-2.6.32.46/drivers/scsi/gdth.c
36218--- linux-2.6.32.46/drivers/scsi/gdth.c 2011-03-27 14:31:47.000000000 -0400
36219+++ linux-2.6.32.46/drivers/scsi/gdth.c 2011-05-16 21:46:57.000000000 -0400
36220@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
36221 ulong flags;
36222 gdth_ha_str *ha;
36223
36224+ pax_track_stack();
36225+
36226 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
36227 return -EFAULT;
36228 ha = gdth_find_ha(ldrv.ionode);
36229@@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg
36230 gdth_ha_str *ha;
36231 int rval;
36232
36233+ pax_track_stack();
36234+
36235 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
36236 res.number >= MAX_HDRIVES)
36237 return -EFAULT;
36238@@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg,
36239 gdth_ha_str *ha;
36240 int rval;
36241
36242+ pax_track_stack();
36243+
36244 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
36245 return -EFAULT;
36246 ha = gdth_find_ha(gen.ionode);
36247@@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
36248 int i;
36249 gdth_cmd_str gdtcmd;
36250 char cmnd[MAX_COMMAND_SIZE];
36251+
36252+ pax_track_stack();
36253+
36254 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
36255
36256 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
36257diff -urNp linux-2.6.32.46/drivers/scsi/gdth_proc.c linux-2.6.32.46/drivers/scsi/gdth_proc.c
36258--- linux-2.6.32.46/drivers/scsi/gdth_proc.c 2011-03-27 14:31:47.000000000 -0400
36259+++ linux-2.6.32.46/drivers/scsi/gdth_proc.c 2011-05-16 21:46:57.000000000 -0400
36260@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi
36261 ulong64 paddr;
36262
36263 char cmnd[MAX_COMMAND_SIZE];
36264+
36265+ pax_track_stack();
36266+
36267 memset(cmnd, 0xff, 12);
36268 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
36269
36270@@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,ch
36271 gdth_hget_str *phg;
36272 char cmnd[MAX_COMMAND_SIZE];
36273
36274+ pax_track_stack();
36275+
36276 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
36277 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
36278 if (!gdtcmd || !estr)
36279diff -urNp linux-2.6.32.46/drivers/scsi/hosts.c linux-2.6.32.46/drivers/scsi/hosts.c
36280--- linux-2.6.32.46/drivers/scsi/hosts.c 2011-03-27 14:31:47.000000000 -0400
36281+++ linux-2.6.32.46/drivers/scsi/hosts.c 2011-05-04 17:56:28.000000000 -0400
36282@@ -40,7 +40,7 @@
36283 #include "scsi_logging.h"
36284
36285
36286-static atomic_t scsi_host_next_hn; /* host_no for next new host */
36287+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
36288
36289
36290 static void scsi_host_cls_release(struct device *dev)
36291@@ -344,7 +344,7 @@ struct Scsi_Host *scsi_host_alloc(struct
36292 * subtract one because we increment first then return, but we need to
36293 * know what the next host number was before increment
36294 */
36295- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
36296+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
36297 shost->dma_channel = 0xff;
36298
36299 /* These three are default values which can be overridden */
36300diff -urNp linux-2.6.32.46/drivers/scsi/ipr.c linux-2.6.32.46/drivers/scsi/ipr.c
36301--- linux-2.6.32.46/drivers/scsi/ipr.c 2011-03-27 14:31:47.000000000 -0400
36302+++ linux-2.6.32.46/drivers/scsi/ipr.c 2011-04-17 15:56:46.000000000 -0400
36303@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
36304 return true;
36305 }
36306
36307-static struct ata_port_operations ipr_sata_ops = {
36308+static const struct ata_port_operations ipr_sata_ops = {
36309 .phy_reset = ipr_ata_phy_reset,
36310 .hardreset = ipr_sata_reset,
36311 .post_internal_cmd = ipr_ata_post_internal,
36312diff -urNp linux-2.6.32.46/drivers/scsi/ips.h linux-2.6.32.46/drivers/scsi/ips.h
36313--- linux-2.6.32.46/drivers/scsi/ips.h 2011-03-27 14:31:47.000000000 -0400
36314+++ linux-2.6.32.46/drivers/scsi/ips.h 2011-08-05 20:33:55.000000000 -0400
36315@@ -1027,7 +1027,7 @@ typedef struct {
36316 int (*intr)(struct ips_ha *);
36317 void (*enableint)(struct ips_ha *);
36318 uint32_t (*statupd)(struct ips_ha *);
36319-} ips_hw_func_t;
36320+} __no_const ips_hw_func_t;
36321
36322 typedef struct ips_ha {
36323 uint8_t ha_id[IPS_MAX_CHANNELS+1];
36324diff -urNp linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c
36325--- linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c 2011-03-27 14:31:47.000000000 -0400
36326+++ linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c 2011-08-23 21:22:32.000000000 -0400
36327@@ -86,12 +86,12 @@ struct fc_exch_mgr {
36328 * all together if not used XXX
36329 */
36330 struct {
36331- atomic_t no_free_exch;
36332- atomic_t no_free_exch_xid;
36333- atomic_t xid_not_found;
36334- atomic_t xid_busy;
36335- atomic_t seq_not_found;
36336- atomic_t non_bls_resp;
36337+ atomic_unchecked_t no_free_exch;
36338+ atomic_unchecked_t no_free_exch_xid;
36339+ atomic_unchecked_t xid_not_found;
36340+ atomic_unchecked_t xid_busy;
36341+ atomic_unchecked_t seq_not_found;
36342+ atomic_unchecked_t non_bls_resp;
36343 } stats;
36344 };
36345 #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
36346@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
36347 /* allocate memory for exchange */
36348 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
36349 if (!ep) {
36350- atomic_inc(&mp->stats.no_free_exch);
36351+ atomic_inc_unchecked(&mp->stats.no_free_exch);
36352 goto out;
36353 }
36354 memset(ep, 0, sizeof(*ep));
36355@@ -557,7 +557,7 @@ out:
36356 return ep;
36357 err:
36358 spin_unlock_bh(&pool->lock);
36359- atomic_inc(&mp->stats.no_free_exch_xid);
36360+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
36361 mempool_free(ep, mp->ep_pool);
36362 return NULL;
36363 }
36364@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
36365 xid = ntohs(fh->fh_ox_id); /* we originated exch */
36366 ep = fc_exch_find(mp, xid);
36367 if (!ep) {
36368- atomic_inc(&mp->stats.xid_not_found);
36369+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36370 reject = FC_RJT_OX_ID;
36371 goto out;
36372 }
36373@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
36374 ep = fc_exch_find(mp, xid);
36375 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
36376 if (ep) {
36377- atomic_inc(&mp->stats.xid_busy);
36378+ atomic_inc_unchecked(&mp->stats.xid_busy);
36379 reject = FC_RJT_RX_ID;
36380 goto rel;
36381 }
36382@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
36383 }
36384 xid = ep->xid; /* get our XID */
36385 } else if (!ep) {
36386- atomic_inc(&mp->stats.xid_not_found);
36387+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36388 reject = FC_RJT_RX_ID; /* XID not found */
36389 goto out;
36390 }
36391@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
36392 } else {
36393 sp = &ep->seq;
36394 if (sp->id != fh->fh_seq_id) {
36395- atomic_inc(&mp->stats.seq_not_found);
36396+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36397 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
36398 goto rel;
36399 }
36400@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
36401
36402 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36403 if (!ep) {
36404- atomic_inc(&mp->stats.xid_not_found);
36405+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36406 goto out;
36407 }
36408 if (ep->esb_stat & ESB_ST_COMPLETE) {
36409- atomic_inc(&mp->stats.xid_not_found);
36410+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36411 goto out;
36412 }
36413 if (ep->rxid == FC_XID_UNKNOWN)
36414 ep->rxid = ntohs(fh->fh_rx_id);
36415 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36416- atomic_inc(&mp->stats.xid_not_found);
36417+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36418 goto rel;
36419 }
36420 if (ep->did != ntoh24(fh->fh_s_id) &&
36421 ep->did != FC_FID_FLOGI) {
36422- atomic_inc(&mp->stats.xid_not_found);
36423+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36424 goto rel;
36425 }
36426 sof = fr_sof(fp);
36427@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
36428 } else {
36429 sp = &ep->seq;
36430 if (sp->id != fh->fh_seq_id) {
36431- atomic_inc(&mp->stats.seq_not_found);
36432+ atomic_inc_unchecked(&mp->stats.seq_not_found);
36433 goto rel;
36434 }
36435 }
36436@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
36437 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36438
36439 if (!sp)
36440- atomic_inc(&mp->stats.xid_not_found);
36441+ atomic_inc_unchecked(&mp->stats.xid_not_found);
36442 else
36443- atomic_inc(&mp->stats.non_bls_resp);
36444+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
36445
36446 fc_frame_free(fp);
36447 }
36448diff -urNp linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c
36449--- linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c 2011-03-27 14:31:47.000000000 -0400
36450+++ linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c 2011-04-23 12:56:11.000000000 -0400
36451@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
36452 }
36453 }
36454
36455-static struct ata_port_operations sas_sata_ops = {
36456+static const struct ata_port_operations sas_sata_ops = {
36457 .phy_reset = sas_ata_phy_reset,
36458 .post_internal_cmd = sas_ata_post_internal,
36459 .qc_defer = ata_std_qc_defer,
36460diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c
36461--- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c 2011-03-27 14:31:47.000000000 -0400
36462+++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-16 21:46:57.000000000 -0400
36463@@ -124,7 +124,7 @@ struct lpfc_debug {
36464 int len;
36465 };
36466
36467-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36468+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36469 static unsigned long lpfc_debugfs_start_time = 0L;
36470
36471 /**
36472@@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
36473 lpfc_debugfs_enable = 0;
36474
36475 len = 0;
36476- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36477+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36478 (lpfc_debugfs_max_disc_trc - 1);
36479 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36480 dtp = vport->disc_trc + i;
36481@@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
36482 lpfc_debugfs_enable = 0;
36483
36484 len = 0;
36485- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36486+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36487 (lpfc_debugfs_max_slow_ring_trc - 1);
36488 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36489 dtp = phba->slow_ring_trc + i;
36490@@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
36491 uint32_t *ptr;
36492 char buffer[1024];
36493
36494+ pax_track_stack();
36495+
36496 off = 0;
36497 spin_lock_irq(&phba->hbalock);
36498
36499@@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
36500 !vport || !vport->disc_trc)
36501 return;
36502
36503- index = atomic_inc_return(&vport->disc_trc_cnt) &
36504+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36505 (lpfc_debugfs_max_disc_trc - 1);
36506 dtp = vport->disc_trc + index;
36507 dtp->fmt = fmt;
36508 dtp->data1 = data1;
36509 dtp->data2 = data2;
36510 dtp->data3 = data3;
36511- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36512+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36513 dtp->jif = jiffies;
36514 #endif
36515 return;
36516@@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
36517 !phba || !phba->slow_ring_trc)
36518 return;
36519
36520- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36521+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36522 (lpfc_debugfs_max_slow_ring_trc - 1);
36523 dtp = phba->slow_ring_trc + index;
36524 dtp->fmt = fmt;
36525 dtp->data1 = data1;
36526 dtp->data2 = data2;
36527 dtp->data3 = data3;
36528- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36529+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36530 dtp->jif = jiffies;
36531 #endif
36532 return;
36533@@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
36534 "slow_ring buffer\n");
36535 goto debug_failed;
36536 }
36537- atomic_set(&phba->slow_ring_trc_cnt, 0);
36538+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36539 memset(phba->slow_ring_trc, 0,
36540 (sizeof(struct lpfc_debugfs_trc) *
36541 lpfc_debugfs_max_slow_ring_trc));
36542@@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
36543 "buffer\n");
36544 goto debug_failed;
36545 }
36546- atomic_set(&vport->disc_trc_cnt, 0);
36547+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36548
36549 snprintf(name, sizeof(name), "discovery_trace");
36550 vport->debug_disc_trc =
36551diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h
36552--- linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h 2011-03-27 14:31:47.000000000 -0400
36553+++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h 2011-05-04 17:56:28.000000000 -0400
36554@@ -400,7 +400,7 @@ struct lpfc_vport {
36555 struct dentry *debug_nodelist;
36556 struct dentry *vport_debugfs_root;
36557 struct lpfc_debugfs_trc *disc_trc;
36558- atomic_t disc_trc_cnt;
36559+ atomic_unchecked_t disc_trc_cnt;
36560 #endif
36561 uint8_t stat_data_enabled;
36562 uint8_t stat_data_blocked;
36563@@ -725,8 +725,8 @@ struct lpfc_hba {
36564 struct timer_list fabric_block_timer;
36565 unsigned long bit_flags;
36566 #define FABRIC_COMANDS_BLOCKED 0
36567- atomic_t num_rsrc_err;
36568- atomic_t num_cmd_success;
36569+ atomic_unchecked_t num_rsrc_err;
36570+ atomic_unchecked_t num_cmd_success;
36571 unsigned long last_rsrc_error_time;
36572 unsigned long last_ramp_down_time;
36573 unsigned long last_ramp_up_time;
36574@@ -740,7 +740,7 @@ struct lpfc_hba {
36575 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
36576 struct dentry *debug_slow_ring_trc;
36577 struct lpfc_debugfs_trc *slow_ring_trc;
36578- atomic_t slow_ring_trc_cnt;
36579+ atomic_unchecked_t slow_ring_trc_cnt;
36580 #endif
36581
36582 /* Used for deferred freeing of ELS data buffers */
36583diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c
36584--- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c 2011-03-27 14:31:47.000000000 -0400
36585+++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c 2011-08-05 20:33:55.000000000 -0400
36586@@ -8021,8 +8021,10 @@ lpfc_init(void)
36587 printk(LPFC_COPYRIGHT "\n");
36588
36589 if (lpfc_enable_npiv) {
36590- lpfc_transport_functions.vport_create = lpfc_vport_create;
36591- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36592+ pax_open_kernel();
36593+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36594+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36595+ pax_close_kernel();
36596 }
36597 lpfc_transport_template =
36598 fc_attach_transport(&lpfc_transport_functions);
36599diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c
36600--- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c 2011-03-27 14:31:47.000000000 -0400
36601+++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-04 17:56:28.000000000 -0400
36602@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
36603 uint32_t evt_posted;
36604
36605 spin_lock_irqsave(&phba->hbalock, flags);
36606- atomic_inc(&phba->num_rsrc_err);
36607+ atomic_inc_unchecked(&phba->num_rsrc_err);
36608 phba->last_rsrc_error_time = jiffies;
36609
36610 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36611@@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
36612 unsigned long flags;
36613 struct lpfc_hba *phba = vport->phba;
36614 uint32_t evt_posted;
36615- atomic_inc(&phba->num_cmd_success);
36616+ atomic_inc_unchecked(&phba->num_cmd_success);
36617
36618 if (vport->cfg_lun_queue_depth <= queue_depth)
36619 return;
36620@@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
36621 int i;
36622 struct lpfc_rport_data *rdata;
36623
36624- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36625- num_cmd_success = atomic_read(&phba->num_cmd_success);
36626+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36627+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36628
36629 vports = lpfc_create_vport_work_array(phba);
36630 if (vports != NULL)
36631@@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
36632 }
36633 }
36634 lpfc_destroy_vport_work_array(phba, vports);
36635- atomic_set(&phba->num_rsrc_err, 0);
36636- atomic_set(&phba->num_cmd_success, 0);
36637+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36638+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36639 }
36640
36641 /**
36642@@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
36643 }
36644 }
36645 lpfc_destroy_vport_work_array(phba, vports);
36646- atomic_set(&phba->num_rsrc_err, 0);
36647- atomic_set(&phba->num_cmd_success, 0);
36648+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
36649+ atomic_set_unchecked(&phba->num_cmd_success, 0);
36650 }
36651
36652 /**
36653diff -urNp linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c
36654--- linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c 2011-03-27 14:31:47.000000000 -0400
36655+++ linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-16 21:46:57.000000000 -0400
36656@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
36657 int rval;
36658 int i;
36659
36660+ pax_track_stack();
36661+
36662 // Allocate memory for the base list of scb for management module.
36663 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
36664
36665diff -urNp linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c
36666--- linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c 2011-03-27 14:31:47.000000000 -0400
36667+++ linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c 2011-05-16 21:46:57.000000000 -0400
36668@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct
36669 int nelem = ARRAY_SIZE(get_attrs), a = 0;
36670 int ret;
36671
36672+ pax_track_stack();
36673+
36674 or = osd_start_request(od, GFP_KERNEL);
36675 if (!or)
36676 return -ENOMEM;
36677diff -urNp linux-2.6.32.46/drivers/scsi/pmcraid.c linux-2.6.32.46/drivers/scsi/pmcraid.c
36678--- linux-2.6.32.46/drivers/scsi/pmcraid.c 2011-08-09 18:35:29.000000000 -0400
36679+++ linux-2.6.32.46/drivers/scsi/pmcraid.c 2011-08-09 18:33:59.000000000 -0400
36680@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct sc
36681 res->scsi_dev = scsi_dev;
36682 scsi_dev->hostdata = res;
36683 res->change_detected = 0;
36684- atomic_set(&res->read_failures, 0);
36685- atomic_set(&res->write_failures, 0);
36686+ atomic_set_unchecked(&res->read_failures, 0);
36687+ atomic_set_unchecked(&res->write_failures, 0);
36688 rc = 0;
36689 }
36690 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36691@@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct
36692
36693 /* If this was a SCSI read/write command keep count of errors */
36694 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36695- atomic_inc(&res->read_failures);
36696+ atomic_inc_unchecked(&res->read_failures);
36697 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36698- atomic_inc(&res->write_failures);
36699+ atomic_inc_unchecked(&res->write_failures);
36700
36701 if (!RES_IS_GSCSI(res->cfg_entry) &&
36702 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36703@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(stru
36704
36705 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36706 /* add resources only after host is added into system */
36707- if (!atomic_read(&pinstance->expose_resources))
36708+ if (!atomic_read_unchecked(&pinstance->expose_resources))
36709 return;
36710
36711 spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
36712@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instan
36713 init_waitqueue_head(&pinstance->reset_wait_q);
36714
36715 atomic_set(&pinstance->outstanding_cmds, 0);
36716- atomic_set(&pinstance->expose_resources, 0);
36717+ atomic_set_unchecked(&pinstance->expose_resources, 0);
36718
36719 INIT_LIST_HEAD(&pinstance->free_res_q);
36720 INIT_LIST_HEAD(&pinstance->used_res_q);
36721@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
36722 /* Schedule worker thread to handle CCN and take care of adding and
36723 * removing devices to OS
36724 */
36725- atomic_set(&pinstance->expose_resources, 1);
36726+ atomic_set_unchecked(&pinstance->expose_resources, 1);
36727 schedule_work(&pinstance->worker_q);
36728 return rc;
36729
36730diff -urNp linux-2.6.32.46/drivers/scsi/pmcraid.h linux-2.6.32.46/drivers/scsi/pmcraid.h
36731--- linux-2.6.32.46/drivers/scsi/pmcraid.h 2011-03-27 14:31:47.000000000 -0400
36732+++ linux-2.6.32.46/drivers/scsi/pmcraid.h 2011-05-04 17:56:28.000000000 -0400
36733@@ -690,7 +690,7 @@ struct pmcraid_instance {
36734 atomic_t outstanding_cmds;
36735
36736 /* should add/delete resources to mid-layer now ?*/
36737- atomic_t expose_resources;
36738+ atomic_unchecked_t expose_resources;
36739
36740 /* Tasklet to handle deferred processing */
36741 struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
36742@@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
36743 struct list_head queue; /* link to "to be exposed" resources */
36744 struct pmcraid_config_table_entry cfg_entry;
36745 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36746- atomic_t read_failures; /* count of failed READ commands */
36747- atomic_t write_failures; /* count of failed WRITE commands */
36748+ atomic_unchecked_t read_failures; /* count of failed READ commands */
36749+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36750
36751 /* To indicate add/delete/modify during CCN */
36752 u8 change_detected;
36753diff -urNp linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h
36754--- linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h 2011-03-27 14:31:47.000000000 -0400
36755+++ linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h 2011-08-05 20:33:55.000000000 -0400
36756@@ -2089,7 +2089,7 @@ struct isp_operations {
36757
36758 int (*get_flash_version) (struct scsi_qla_host *, void *);
36759 int (*start_scsi) (srb_t *);
36760-};
36761+} __no_const;
36762
36763 /* MSI-X Support *************************************************************/
36764
36765diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h
36766--- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h 2011-03-27 14:31:47.000000000 -0400
36767+++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h 2011-05-04 17:56:28.000000000 -0400
36768@@ -240,7 +240,7 @@ struct ddb_entry {
36769 atomic_t retry_relogin_timer; /* Min Time between relogins
36770 * (4000 only) */
36771 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
36772- atomic_t relogin_retry_count; /* Num of times relogin has been
36773+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
36774 * retried */
36775
36776 uint16_t port;
36777diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c
36778--- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c 2011-03-27 14:31:47.000000000 -0400
36779+++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c 2011-05-04 17:56:28.000000000 -0400
36780@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_
36781 atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
36782 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
36783 atomic_set(&ddb_entry->relogin_timer, 0);
36784- atomic_set(&ddb_entry->relogin_retry_count, 0);
36785+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36786 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36787 list_add_tail(&ddb_entry->list, &ha->ddb_list);
36788 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
36789@@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct s
36790 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
36791 atomic_set(&ddb_entry->port_down_timer,
36792 ha->port_down_retry_count);
36793- atomic_set(&ddb_entry->relogin_retry_count, 0);
36794+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
36795 atomic_set(&ddb_entry->relogin_timer, 0);
36796 clear_bit(DF_RELOGIN, &ddb_entry->flags);
36797 clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
36798diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c
36799--- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c 2011-03-27 14:31:47.000000000 -0400
36800+++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c 2011-05-04 17:56:28.000000000 -0400
36801@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_ql
36802 ddb_entry->fw_ddb_device_state ==
36803 DDB_DS_SESSION_FAILED) {
36804 /* Reset retry relogin timer */
36805- atomic_inc(&ddb_entry->relogin_retry_count);
36806+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
36807 DEBUG2(printk("scsi%ld: index[%d] relogin"
36808 " timed out-retrying"
36809 " relogin (%d)\n",
36810 ha->host_no,
36811 ddb_entry->fw_ddb_index,
36812- atomic_read(&ddb_entry->
36813+ atomic_read_unchecked(&ddb_entry->
36814 relogin_retry_count))
36815 );
36816 start_dpc++;
36817diff -urNp linux-2.6.32.46/drivers/scsi/scsi.c linux-2.6.32.46/drivers/scsi/scsi.c
36818--- linux-2.6.32.46/drivers/scsi/scsi.c 2011-03-27 14:31:47.000000000 -0400
36819+++ linux-2.6.32.46/drivers/scsi/scsi.c 2011-05-04 17:56:28.000000000 -0400
36820@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
36821 unsigned long timeout;
36822 int rtn = 0;
36823
36824- atomic_inc(&cmd->device->iorequest_cnt);
36825+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36826
36827 /* check if the device is still usable */
36828 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
36829diff -urNp linux-2.6.32.46/drivers/scsi/scsi_debug.c linux-2.6.32.46/drivers/scsi/scsi_debug.c
36830--- linux-2.6.32.46/drivers/scsi/scsi_debug.c 2011-03-27 14:31:47.000000000 -0400
36831+++ linux-2.6.32.46/drivers/scsi/scsi_debug.c 2011-05-16 21:46:57.000000000 -0400
36832@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_
36833 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
36834 unsigned char *cmd = (unsigned char *)scp->cmnd;
36835
36836+ pax_track_stack();
36837+
36838 if ((errsts = check_readiness(scp, 1, devip)))
36839 return errsts;
36840 memset(arr, 0, sizeof(arr));
36841@@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cm
36842 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
36843 unsigned char *cmd = (unsigned char *)scp->cmnd;
36844
36845+ pax_track_stack();
36846+
36847 if ((errsts = check_readiness(scp, 1, devip)))
36848 return errsts;
36849 memset(arr, 0, sizeof(arr));
36850diff -urNp linux-2.6.32.46/drivers/scsi/scsi_lib.c linux-2.6.32.46/drivers/scsi/scsi_lib.c
36851--- linux-2.6.32.46/drivers/scsi/scsi_lib.c 2011-05-10 22:12:01.000000000 -0400
36852+++ linux-2.6.32.46/drivers/scsi/scsi_lib.c 2011-05-10 22:12:33.000000000 -0400
36853@@ -1384,7 +1384,7 @@ static void scsi_kill_request(struct req
36854
36855 scsi_init_cmd_errh(cmd);
36856 cmd->result = DID_NO_CONNECT << 16;
36857- atomic_inc(&cmd->device->iorequest_cnt);
36858+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
36859
36860 /*
36861 * SCSI request completion path will do scsi_device_unbusy(),
36862@@ -1415,9 +1415,9 @@ static void scsi_softirq_done(struct req
36863 */
36864 cmd->serial_number = 0;
36865
36866- atomic_inc(&cmd->device->iodone_cnt);
36867+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
36868 if (cmd->result)
36869- atomic_inc(&cmd->device->ioerr_cnt);
36870+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
36871
36872 disposition = scsi_decide_disposition(cmd);
36873 if (disposition != SUCCESS &&
36874diff -urNp linux-2.6.32.46/drivers/scsi/scsi_sysfs.c linux-2.6.32.46/drivers/scsi/scsi_sysfs.c
36875--- linux-2.6.32.46/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:34.000000000 -0400
36876+++ linux-2.6.32.46/drivers/scsi/scsi_sysfs.c 2011-06-25 12:56:37.000000000 -0400
36877@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev,
36878 char *buf) \
36879 { \
36880 struct scsi_device *sdev = to_scsi_device(dev); \
36881- unsigned long long count = atomic_read(&sdev->field); \
36882+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
36883 return snprintf(buf, 20, "0x%llx\n", count); \
36884 } \
36885 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
36886diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c
36887--- linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400
36888+++ linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400
36889@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
36890 * Netlink Infrastructure
36891 */
36892
36893-static atomic_t fc_event_seq;
36894+static atomic_unchecked_t fc_event_seq;
36895
36896 /**
36897 * fc_get_event_number - Obtain the next sequential FC event number
36898@@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
36899 u32
36900 fc_get_event_number(void)
36901 {
36902- return atomic_add_return(1, &fc_event_seq);
36903+ return atomic_add_return_unchecked(1, &fc_event_seq);
36904 }
36905 EXPORT_SYMBOL(fc_get_event_number);
36906
36907@@ -641,7 +641,7 @@ static __init int fc_transport_init(void
36908 {
36909 int error;
36910
36911- atomic_set(&fc_event_seq, 0);
36912+ atomic_set_unchecked(&fc_event_seq, 0);
36913
36914 error = transport_class_register(&fc_host_class);
36915 if (error)
36916diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c
36917--- linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c 2011-03-27 14:31:47.000000000 -0400
36918+++ linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c 2011-05-04 17:56:28.000000000 -0400
36919@@ -81,7 +81,7 @@ struct iscsi_internal {
36920 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
36921 };
36922
36923-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
36924+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
36925 static struct workqueue_struct *iscsi_eh_timer_workq;
36926
36927 /*
36928@@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_s
36929 int err;
36930
36931 ihost = shost->shost_data;
36932- session->sid = atomic_add_return(1, &iscsi_session_nr);
36933+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
36934
36935 if (id == ISCSI_MAX_TARGET) {
36936 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
36937@@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(v
36938 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
36939 ISCSI_TRANSPORT_VERSION);
36940
36941- atomic_set(&iscsi_session_nr, 0);
36942+ atomic_set_unchecked(&iscsi_session_nr, 0);
36943
36944 err = class_register(&iscsi_transport_class);
36945 if (err)
36946diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c
36947--- linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c 2011-03-27 14:31:47.000000000 -0400
36948+++ linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c 2011-05-04 17:56:28.000000000 -0400
36949@@ -33,7 +33,7 @@
36950 #include "scsi_transport_srp_internal.h"
36951
36952 struct srp_host_attrs {
36953- atomic_t next_port_id;
36954+ atomic_unchecked_t next_port_id;
36955 };
36956 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
36957
36958@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
36959 struct Scsi_Host *shost = dev_to_shost(dev);
36960 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
36961
36962- atomic_set(&srp_host->next_port_id, 0);
36963+ atomic_set_unchecked(&srp_host->next_port_id, 0);
36964 return 0;
36965 }
36966
36967@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
36968 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
36969 rport->roles = ids->roles;
36970
36971- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
36972+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
36973 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
36974
36975 transport_setup_device(&rport->dev);
36976diff -urNp linux-2.6.32.46/drivers/scsi/sg.c linux-2.6.32.46/drivers/scsi/sg.c
36977--- linux-2.6.32.46/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400
36978+++ linux-2.6.32.46/drivers/scsi/sg.c 2011-04-17 15:56:46.000000000 -0400
36979@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
36980 const struct file_operations * fops;
36981 };
36982
36983-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
36984+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
36985 {"allow_dio", &adio_fops},
36986 {"debug", &debug_fops},
36987 {"def_reserved_size", &dressz_fops},
36988@@ -2307,7 +2307,7 @@ sg_proc_init(void)
36989 {
36990 int k, mask;
36991 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
36992- struct sg_proc_leaf * leaf;
36993+ const struct sg_proc_leaf * leaf;
36994
36995 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
36996 if (!sg_proc_sgp)
36997diff -urNp linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c
36998--- linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-03-27 14:31:47.000000000 -0400
36999+++ linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-16 21:46:57.000000000 -0400
37000@@ -1754,6 +1754,8 @@ static int __devinit sym2_probe(struct p
37001 int do_iounmap = 0;
37002 int do_disable_device = 1;
37003
37004+ pax_track_stack();
37005+
37006 memset(&sym_dev, 0, sizeof(sym_dev));
37007 memset(&nvram, 0, sizeof(nvram));
37008 sym_dev.pdev = pdev;
37009diff -urNp linux-2.6.32.46/drivers/serial/kgdboc.c linux-2.6.32.46/drivers/serial/kgdboc.c
37010--- linux-2.6.32.46/drivers/serial/kgdboc.c 2011-03-27 14:31:47.000000000 -0400
37011+++ linux-2.6.32.46/drivers/serial/kgdboc.c 2011-04-17 15:56:46.000000000 -0400
37012@@ -18,7 +18,7 @@
37013
37014 #define MAX_CONFIG_LEN 40
37015
37016-static struct kgdb_io kgdboc_io_ops;
37017+static const struct kgdb_io kgdboc_io_ops;
37018
37019 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
37020 static int configured = -1;
37021@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
37022 module_put(THIS_MODULE);
37023 }
37024
37025-static struct kgdb_io kgdboc_io_ops = {
37026+static const struct kgdb_io kgdboc_io_ops = {
37027 .name = "kgdboc",
37028 .read_char = kgdboc_get_char,
37029 .write_char = kgdboc_put_char,
37030diff -urNp linux-2.6.32.46/drivers/spi/spi.c linux-2.6.32.46/drivers/spi/spi.c
37031--- linux-2.6.32.46/drivers/spi/spi.c 2011-03-27 14:31:47.000000000 -0400
37032+++ linux-2.6.32.46/drivers/spi/spi.c 2011-05-04 17:56:28.000000000 -0400
37033@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, str
37034 EXPORT_SYMBOL_GPL(spi_sync);
37035
37036 /* portable code must never pass more than 32 bytes */
37037-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
37038+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
37039
37040 static u8 *buf;
37041
37042diff -urNp linux-2.6.32.46/drivers/staging/android/binder.c linux-2.6.32.46/drivers/staging/android/binder.c
37043--- linux-2.6.32.46/drivers/staging/android/binder.c 2011-03-27 14:31:47.000000000 -0400
37044+++ linux-2.6.32.46/drivers/staging/android/binder.c 2011-04-17 15:56:46.000000000 -0400
37045@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
37046 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
37047 }
37048
37049-static struct vm_operations_struct binder_vm_ops = {
37050+static const struct vm_operations_struct binder_vm_ops = {
37051 .open = binder_vma_open,
37052 .close = binder_vma_close,
37053 };
37054diff -urNp linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c
37055--- linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c 2011-03-27 14:31:47.000000000 -0400
37056+++ linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c 2011-04-17 15:56:46.000000000 -0400
37057@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
37058 return VM_FAULT_NOPAGE;
37059 }
37060
37061-static struct vm_operations_struct b3dfg_vm_ops = {
37062+static const struct vm_operations_struct b3dfg_vm_ops = {
37063 .fault = b3dfg_vma_fault,
37064 };
37065
37066@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
37067 return r;
37068 }
37069
37070-static struct file_operations b3dfg_fops = {
37071+static const struct file_operations b3dfg_fops = {
37072 .owner = THIS_MODULE,
37073 .open = b3dfg_open,
37074 .release = b3dfg_release,
37075diff -urNp linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c
37076--- linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:35:29.000000000 -0400
37077+++ linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:34:00.000000000 -0400
37078@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct
37079 mutex_unlock(&dev->mutex);
37080 }
37081
37082-static struct vm_operations_struct comedi_vm_ops = {
37083+static const struct vm_operations_struct comedi_vm_ops = {
37084 .close = comedi_unmap,
37085 };
37086
37087diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c
37088--- linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c 2011-03-27 14:31:47.000000000 -0400
37089+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c 2011-04-17 15:56:46.000000000 -0400
37090@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
37091 static dev_t adsp_devno;
37092 static struct class *adsp_class;
37093
37094-static struct file_operations adsp_fops = {
37095+static const struct file_operations adsp_fops = {
37096 .owner = THIS_MODULE,
37097 .open = adsp_open,
37098 .unlocked_ioctl = adsp_ioctl,
37099diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c
37100--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c 2011-03-27 14:31:47.000000000 -0400
37101+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c 2011-04-17 15:56:46.000000000 -0400
37102@@ -1022,7 +1022,7 @@ done:
37103 return rc;
37104 }
37105
37106-static struct file_operations audio_aac_fops = {
37107+static const struct file_operations audio_aac_fops = {
37108 .owner = THIS_MODULE,
37109 .open = audio_open,
37110 .release = audio_release,
37111diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c
37112--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-03-27 14:31:47.000000000 -0400
37113+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-04-17 15:56:46.000000000 -0400
37114@@ -833,7 +833,7 @@ done:
37115 return rc;
37116 }
37117
37118-static struct file_operations audio_amrnb_fops = {
37119+static const struct file_operations audio_amrnb_fops = {
37120 .owner = THIS_MODULE,
37121 .open = audamrnb_open,
37122 .release = audamrnb_release,
37123diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c
37124--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c 2011-03-27 14:31:47.000000000 -0400
37125+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c 2011-04-17 15:56:46.000000000 -0400
37126@@ -805,7 +805,7 @@ dma_fail:
37127 return rc;
37128 }
37129
37130-static struct file_operations audio_evrc_fops = {
37131+static const struct file_operations audio_evrc_fops = {
37132 .owner = THIS_MODULE,
37133 .open = audevrc_open,
37134 .release = audevrc_release,
37135diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c
37136--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c 2011-03-27 14:31:47.000000000 -0400
37137+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c 2011-04-17 15:56:46.000000000 -0400
37138@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
37139 return 0;
37140 }
37141
37142-static struct file_operations audio_fops = {
37143+static const struct file_operations audio_fops = {
37144 .owner = THIS_MODULE,
37145 .open = audio_in_open,
37146 .release = audio_in_release,
37147@@ -922,7 +922,7 @@ static struct file_operations audio_fops
37148 .unlocked_ioctl = audio_in_ioctl,
37149 };
37150
37151-static struct file_operations audpre_fops = {
37152+static const struct file_operations audpre_fops = {
37153 .owner = THIS_MODULE,
37154 .open = audpre_open,
37155 .unlocked_ioctl = audpre_ioctl,
37156diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c
37157--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c 2011-03-27 14:31:47.000000000 -0400
37158+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c 2011-04-17 15:56:46.000000000 -0400
37159@@ -941,7 +941,7 @@ done:
37160 return rc;
37161 }
37162
37163-static struct file_operations audio_mp3_fops = {
37164+static const struct file_operations audio_mp3_fops = {
37165 .owner = THIS_MODULE,
37166 .open = audio_open,
37167 .release = audio_release,
37168diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c
37169--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c 2011-03-27 14:31:47.000000000 -0400
37170+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c 2011-04-17 15:56:46.000000000 -0400
37171@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
37172 return 0;
37173 }
37174
37175-static struct file_operations audio_fops = {
37176+static const struct file_operations audio_fops = {
37177 .owner = THIS_MODULE,
37178 .open = audio_open,
37179 .release = audio_release,
37180@@ -819,7 +819,7 @@ static struct file_operations audio_fops
37181 .unlocked_ioctl = audio_ioctl,
37182 };
37183
37184-static struct file_operations audpp_fops = {
37185+static const struct file_operations audpp_fops = {
37186 .owner = THIS_MODULE,
37187 .open = audpp_open,
37188 .unlocked_ioctl = audpp_ioctl,
37189diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c
37190--- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-03-27 14:31:47.000000000 -0400
37191+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-04-17 15:56:46.000000000 -0400
37192@@ -816,7 +816,7 @@ err:
37193 return rc;
37194 }
37195
37196-static struct file_operations audio_qcelp_fops = {
37197+static const struct file_operations audio_qcelp_fops = {
37198 .owner = THIS_MODULE,
37199 .open = audqcelp_open,
37200 .release = audqcelp_release,
37201diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c
37202--- linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c 2011-03-27 14:31:47.000000000 -0400
37203+++ linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c 2011-04-17 15:56:46.000000000 -0400
37204@@ -242,7 +242,7 @@ err:
37205 return rc;
37206 }
37207
37208-static struct file_operations snd_fops = {
37209+static const struct file_operations snd_fops = {
37210 .owner = THIS_MODULE,
37211 .open = snd_open,
37212 .release = snd_release,
37213diff -urNp linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c
37214--- linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c 2011-03-27 14:31:47.000000000 -0400
37215+++ linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c 2011-04-17 15:56:46.000000000 -0400
37216@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
37217 return 0;
37218 }
37219
37220-static struct file_operations qmi_fops = {
37221+static const struct file_operations qmi_fops = {
37222 .owner = THIS_MODULE,
37223 .read = qmi_read,
37224 .write = qmi_write,
37225diff -urNp linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c
37226--- linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-03-27 14:31:47.000000000 -0400
37227+++ linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-04-17 15:56:46.000000000 -0400
37228@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
37229 return rc;
37230 }
37231
37232-static struct file_operations rpcrouter_server_fops = {
37233+static const struct file_operations rpcrouter_server_fops = {
37234 .owner = THIS_MODULE,
37235 .open = rpcrouter_open,
37236 .release = rpcrouter_release,
37237@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
37238 .unlocked_ioctl = rpcrouter_ioctl,
37239 };
37240
37241-static struct file_operations rpcrouter_router_fops = {
37242+static const struct file_operations rpcrouter_router_fops = {
37243 .owner = THIS_MODULE,
37244 .open = rpcrouter_open,
37245 .release = rpcrouter_release,
37246diff -urNp linux-2.6.32.46/drivers/staging/dst/dcore.c linux-2.6.32.46/drivers/staging/dst/dcore.c
37247--- linux-2.6.32.46/drivers/staging/dst/dcore.c 2011-03-27 14:31:47.000000000 -0400
37248+++ linux-2.6.32.46/drivers/staging/dst/dcore.c 2011-04-17 15:56:46.000000000 -0400
37249@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
37250 return 0;
37251 }
37252
37253-static struct block_device_operations dst_blk_ops = {
37254+static const struct block_device_operations dst_blk_ops = {
37255 .open = dst_bdev_open,
37256 .release = dst_bdev_release,
37257 .owner = THIS_MODULE,
37258@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
37259 n->size = ctl->size;
37260
37261 atomic_set(&n->refcnt, 1);
37262- atomic_long_set(&n->gen, 0);
37263+ atomic_long_set_unchecked(&n->gen, 0);
37264 snprintf(n->name, sizeof(n->name), "%s", ctl->name);
37265
37266 err = dst_node_sysfs_init(n);
37267diff -urNp linux-2.6.32.46/drivers/staging/dst/trans.c linux-2.6.32.46/drivers/staging/dst/trans.c
37268--- linux-2.6.32.46/drivers/staging/dst/trans.c 2011-03-27 14:31:47.000000000 -0400
37269+++ linux-2.6.32.46/drivers/staging/dst/trans.c 2011-04-17 15:56:46.000000000 -0400
37270@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n,
37271 t->error = 0;
37272 t->retries = 0;
37273 atomic_set(&t->refcnt, 1);
37274- t->gen = atomic_long_inc_return(&n->gen);
37275+ t->gen = atomic_long_inc_return_unchecked(&n->gen);
37276
37277 t->enc = bio_data_dir(bio);
37278 dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
37279diff -urNp linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c
37280--- linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c 2011-03-27 14:31:47.000000000 -0400
37281+++ linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c 2011-05-04 17:56:28.000000000 -0400
37282@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(stru
37283 struct net_device_stats *stats = &etdev->net_stats;
37284
37285 if (pMpTcb->Flags & fMP_DEST_BROAD)
37286- atomic_inc(&etdev->Stats.brdcstxmt);
37287+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
37288 else if (pMpTcb->Flags & fMP_DEST_MULTI)
37289- atomic_inc(&etdev->Stats.multixmt);
37290+ atomic_inc_unchecked(&etdev->Stats.multixmt);
37291 else
37292- atomic_inc(&etdev->Stats.unixmt);
37293+ atomic_inc_unchecked(&etdev->Stats.unixmt);
37294
37295 if (pMpTcb->Packet) {
37296 stats->tx_bytes += pMpTcb->Packet->len;
37297diff -urNp linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h
37298--- linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h 2011-03-27 14:31:47.000000000 -0400
37299+++ linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h 2011-05-04 17:56:28.000000000 -0400
37300@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
37301 * operations
37302 */
37303 u32 unircv; /* # multicast packets received */
37304- atomic_t unixmt; /* # multicast packets for Tx */
37305+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
37306 u32 multircv; /* # multicast packets received */
37307- atomic_t multixmt; /* # multicast packets for Tx */
37308+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
37309 u32 brdcstrcv; /* # broadcast packets received */
37310- atomic_t brdcstxmt; /* # broadcast packets for Tx */
37311+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
37312 u32 norcvbuf; /* # Rx packets discarded */
37313 u32 noxmtbuf; /* # Tx packets discarded */
37314
37315diff -urNp linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c
37316--- linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c 2011-03-27 14:31:47.000000000 -0400
37317+++ linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c 2011-04-17 15:56:46.000000000 -0400
37318@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
37319 return 0;
37320 }
37321
37322-static struct vm_operations_struct go7007_vm_ops = {
37323+static const struct vm_operations_struct go7007_vm_ops = {
37324 .open = go7007_vm_open,
37325 .close = go7007_vm_close,
37326 .fault = go7007_vm_fault,
37327diff -urNp linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c
37328--- linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c 2011-03-27 14:31:47.000000000 -0400
37329+++ linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c 2011-04-17 15:56:46.000000000 -0400
37330@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
37331 /* The one and only one */
37332 static struct blkvsc_driver_context g_blkvsc_drv;
37333
37334-static struct block_device_operations block_ops = {
37335+static const struct block_device_operations block_ops = {
37336 .owner = THIS_MODULE,
37337 .open = blkvsc_open,
37338 .release = blkvsc_release,
37339diff -urNp linux-2.6.32.46/drivers/staging/hv/Channel.c linux-2.6.32.46/drivers/staging/hv/Channel.c
37340--- linux-2.6.32.46/drivers/staging/hv/Channel.c 2011-04-17 17:00:52.000000000 -0400
37341+++ linux-2.6.32.46/drivers/staging/hv/Channel.c 2011-05-04 17:56:28.000000000 -0400
37342@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vm
37343
37344 DPRINT_ENTER(VMBUS);
37345
37346- nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
37347- atomic_inc(&gVmbusConnection.NextGpadlHandle);
37348+ nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
37349+ atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
37350
37351 VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
37352 ASSERT(msgInfo != NULL);
37353diff -urNp linux-2.6.32.46/drivers/staging/hv/Hv.c linux-2.6.32.46/drivers/staging/hv/Hv.c
37354--- linux-2.6.32.46/drivers/staging/hv/Hv.c 2011-03-27 14:31:47.000000000 -0400
37355+++ linux-2.6.32.46/drivers/staging/hv/Hv.c 2011-04-17 15:56:46.000000000 -0400
37356@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, vo
37357 u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
37358 u32 outputAddressHi = outputAddress >> 32;
37359 u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
37360- volatile void *hypercallPage = gHvContext.HypercallPage;
37361+ volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
37362
37363 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
37364 Control, Input, Output);
37365diff -urNp linux-2.6.32.46/drivers/staging/hv/VmbusApi.h linux-2.6.32.46/drivers/staging/hv/VmbusApi.h
37366--- linux-2.6.32.46/drivers/staging/hv/VmbusApi.h 2011-03-27 14:31:47.000000000 -0400
37367+++ linux-2.6.32.46/drivers/staging/hv/VmbusApi.h 2011-08-29 22:32:57.000000000 -0400
37368@@ -109,7 +109,7 @@ struct vmbus_channel_interface {
37369 u32 *GpadlHandle);
37370 int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
37371 void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
37372-};
37373+} __no_const;
37374
37375 /* Base driver object */
37376 struct hv_driver {
37377diff -urNp linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c
37378--- linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c 2011-03-27 14:31:47.000000000 -0400
37379+++ linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c 2011-05-04 17:56:28.000000000 -0400
37380@@ -532,7 +532,7 @@ static int vmbus_child_device_register(s
37381 to_device_context(root_device_obj);
37382 struct device_context *child_device_ctx =
37383 to_device_context(child_device_obj);
37384- static atomic_t device_num = ATOMIC_INIT(0);
37385+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
37386
37387 DPRINT_ENTER(VMBUS_DRV);
37388
37389@@ -541,7 +541,7 @@ static int vmbus_child_device_register(s
37390
37391 /* Set the device name. Otherwise, device_register() will fail. */
37392 dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
37393- atomic_inc_return(&device_num));
37394+ atomic_inc_return_unchecked(&device_num));
37395
37396 /* The new device belongs to this bus */
37397 child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
37398diff -urNp linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h
37399--- linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h 2011-04-17 17:00:52.000000000 -0400
37400+++ linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h 2011-05-04 17:56:28.000000000 -0400
37401@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
37402 struct VMBUS_CONNECTION {
37403 enum VMBUS_CONNECT_STATE ConnectState;
37404
37405- atomic_t NextGpadlHandle;
37406+ atomic_unchecked_t NextGpadlHandle;
37407
37408 /*
37409 * Represents channel interrupts. Each bit position represents a
37410diff -urNp linux-2.6.32.46/drivers/staging/iio/ring_generic.h linux-2.6.32.46/drivers/staging/iio/ring_generic.h
37411--- linux-2.6.32.46/drivers/staging/iio/ring_generic.h 2011-03-27 14:31:47.000000000 -0400
37412+++ linux-2.6.32.46/drivers/staging/iio/ring_generic.h 2011-08-23 20:24:26.000000000 -0400
37413@@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
37414
37415 int (*is_enabled)(struct iio_ring_buffer *ring);
37416 int (*enable)(struct iio_ring_buffer *ring);
37417-};
37418+} __no_const;
37419
37420 /**
37421 * struct iio_ring_buffer - general ring buffer structure
37422diff -urNp linux-2.6.32.46/drivers/staging/octeon/ethernet.c linux-2.6.32.46/drivers/staging/octeon/ethernet.c
37423--- linux-2.6.32.46/drivers/staging/octeon/ethernet.c 2011-03-27 14:31:47.000000000 -0400
37424+++ linux-2.6.32.46/drivers/staging/octeon/ethernet.c 2011-05-04 17:56:28.000000000 -0400
37425@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_
37426 * since the RX tasklet also increments it.
37427 */
37428 #ifdef CONFIG_64BIT
37429- atomic64_add(rx_status.dropped_packets,
37430- (atomic64_t *)&priv->stats.rx_dropped);
37431+ atomic64_add_unchecked(rx_status.dropped_packets,
37432+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37433 #else
37434- atomic_add(rx_status.dropped_packets,
37435- (atomic_t *)&priv->stats.rx_dropped);
37436+ atomic_add_unchecked(rx_status.dropped_packets,
37437+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
37438 #endif
37439 }
37440
37441diff -urNp linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c
37442--- linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c 2011-03-27 14:31:47.000000000 -0400
37443+++ linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c 2011-05-04 17:56:28.000000000 -0400
37444@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long un
37445 /* Increment RX stats for virtual ports */
37446 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37447 #ifdef CONFIG_64BIT
37448- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37449- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37450+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37451+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37452 #else
37453- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37454- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37455+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37456+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37457 #endif
37458 }
37459 netif_receive_skb(skb);
37460@@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long un
37461 dev->name);
37462 */
37463 #ifdef CONFIG_64BIT
37464- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37465+ atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
37466 #else
37467- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37468+ atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
37469 #endif
37470 dev_kfree_skb_irq(skb);
37471 }
37472diff -urNp linux-2.6.32.46/drivers/staging/panel/panel.c linux-2.6.32.46/drivers/staging/panel/panel.c
37473--- linux-2.6.32.46/drivers/staging/panel/panel.c 2011-03-27 14:31:47.000000000 -0400
37474+++ linux-2.6.32.46/drivers/staging/panel/panel.c 2011-04-17 15:56:46.000000000 -0400
37475@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
37476 return 0;
37477 }
37478
37479-static struct file_operations lcd_fops = {
37480+static const struct file_operations lcd_fops = {
37481 .write = lcd_write,
37482 .open = lcd_open,
37483 .release = lcd_release,
37484@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
37485 return 0;
37486 }
37487
37488-static struct file_operations keypad_fops = {
37489+static const struct file_operations keypad_fops = {
37490 .read = keypad_read, /* read */
37491 .open = keypad_open, /* open */
37492 .release = keypad_release, /* close */
37493diff -urNp linux-2.6.32.46/drivers/staging/phison/phison.c linux-2.6.32.46/drivers/staging/phison/phison.c
37494--- linux-2.6.32.46/drivers/staging/phison/phison.c 2011-03-27 14:31:47.000000000 -0400
37495+++ linux-2.6.32.46/drivers/staging/phison/phison.c 2011-04-17 15:56:46.000000000 -0400
37496@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
37497 ATA_BMDMA_SHT(DRV_NAME),
37498 };
37499
37500-static struct ata_port_operations phison_ops = {
37501+static const struct ata_port_operations phison_ops = {
37502 .inherits = &ata_bmdma_port_ops,
37503 .prereset = phison_pre_reset,
37504 };
37505diff -urNp linux-2.6.32.46/drivers/staging/poch/poch.c linux-2.6.32.46/drivers/staging/poch/poch.c
37506--- linux-2.6.32.46/drivers/staging/poch/poch.c 2011-03-27 14:31:47.000000000 -0400
37507+++ linux-2.6.32.46/drivers/staging/poch/poch.c 2011-04-17 15:56:46.000000000 -0400
37508@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
37509 return 0;
37510 }
37511
37512-static struct file_operations poch_fops = {
37513+static const struct file_operations poch_fops = {
37514 .owner = THIS_MODULE,
37515 .open = poch_open,
37516 .release = poch_release,
37517diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/inode.c linux-2.6.32.46/drivers/staging/pohmelfs/inode.c
37518--- linux-2.6.32.46/drivers/staging/pohmelfs/inode.c 2011-03-27 14:31:47.000000000 -0400
37519+++ linux-2.6.32.46/drivers/staging/pohmelfs/inode.c 2011-05-04 17:56:20.000000000 -0400
37520@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
37521 mutex_init(&psb->mcache_lock);
37522 psb->mcache_root = RB_ROOT;
37523 psb->mcache_timeout = msecs_to_jiffies(5000);
37524- atomic_long_set(&psb->mcache_gen, 0);
37525+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
37526
37527 psb->trans_max_pages = 100;
37528
37529@@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct su
37530 INIT_LIST_HEAD(&psb->crypto_ready_list);
37531 INIT_LIST_HEAD(&psb->crypto_active_list);
37532
37533- atomic_set(&psb->trans_gen, 1);
37534+ atomic_set_unchecked(&psb->trans_gen, 1);
37535 atomic_long_set(&psb->total_inodes, 0);
37536
37537 mutex_init(&psb->state_lock);
37538diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c
37539--- linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c 2011-03-27 14:31:47.000000000 -0400
37540+++ linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c 2011-04-17 15:56:46.000000000 -0400
37541@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
37542 m->data = data;
37543 m->start = start;
37544 m->size = size;
37545- m->gen = atomic_long_inc_return(&psb->mcache_gen);
37546+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
37547
37548 mutex_lock(&psb->mcache_lock);
37549 err = pohmelfs_mcache_insert(psb, m);
37550diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h
37551--- linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h 2011-03-27 14:31:47.000000000 -0400
37552+++ linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h 2011-05-04 17:56:20.000000000 -0400
37553@@ -570,14 +570,14 @@ struct pohmelfs_config;
37554 struct pohmelfs_sb {
37555 struct rb_root mcache_root;
37556 struct mutex mcache_lock;
37557- atomic_long_t mcache_gen;
37558+ atomic_long_unchecked_t mcache_gen;
37559 unsigned long mcache_timeout;
37560
37561 unsigned int idx;
37562
37563 unsigned int trans_retries;
37564
37565- atomic_t trans_gen;
37566+ atomic_unchecked_t trans_gen;
37567
37568 unsigned int crypto_attached_size;
37569 unsigned int crypto_align_size;
37570diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/trans.c linux-2.6.32.46/drivers/staging/pohmelfs/trans.c
37571--- linux-2.6.32.46/drivers/staging/pohmelfs/trans.c 2011-03-27 14:31:47.000000000 -0400
37572+++ linux-2.6.32.46/drivers/staging/pohmelfs/trans.c 2011-05-04 17:56:28.000000000 -0400
37573@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
37574 int err;
37575 struct netfs_cmd *cmd = t->iovec.iov_base;
37576
37577- t->gen = atomic_inc_return(&psb->trans_gen);
37578+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
37579
37580 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
37581 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
37582diff -urNp linux-2.6.32.46/drivers/staging/sep/sep_driver.c linux-2.6.32.46/drivers/staging/sep/sep_driver.c
37583--- linux-2.6.32.46/drivers/staging/sep/sep_driver.c 2011-03-27 14:31:47.000000000 -0400
37584+++ linux-2.6.32.46/drivers/staging/sep/sep_driver.c 2011-04-17 15:56:46.000000000 -0400
37585@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver
37586 static dev_t sep_devno;
37587
37588 /* the files operations structure of the driver */
37589-static struct file_operations sep_file_operations = {
37590+static const struct file_operations sep_file_operations = {
37591 .owner = THIS_MODULE,
37592 .ioctl = sep_ioctl,
37593 .poll = sep_poll,
37594diff -urNp linux-2.6.32.46/drivers/staging/usbip/usbip_common.h linux-2.6.32.46/drivers/staging/usbip/usbip_common.h
37595--- linux-2.6.32.46/drivers/staging/usbip/usbip_common.h 2011-04-17 17:00:52.000000000 -0400
37596+++ linux-2.6.32.46/drivers/staging/usbip/usbip_common.h 2011-08-23 20:24:26.000000000 -0400
37597@@ -374,7 +374,7 @@ struct usbip_device {
37598 void (*shutdown)(struct usbip_device *);
37599 void (*reset)(struct usbip_device *);
37600 void (*unusable)(struct usbip_device *);
37601- } eh_ops;
37602+ } __no_const eh_ops;
37603 };
37604
37605
37606diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci.h linux-2.6.32.46/drivers/staging/usbip/vhci.h
37607--- linux-2.6.32.46/drivers/staging/usbip/vhci.h 2011-03-27 14:31:47.000000000 -0400
37608+++ linux-2.6.32.46/drivers/staging/usbip/vhci.h 2011-05-04 17:56:28.000000000 -0400
37609@@ -92,7 +92,7 @@ struct vhci_hcd {
37610 unsigned resuming:1;
37611 unsigned long re_timeout;
37612
37613- atomic_t seqnum;
37614+ atomic_unchecked_t seqnum;
37615
37616 /*
37617 * NOTE:
37618diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c
37619--- linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:01.000000000 -0400
37620+++ linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:33.000000000 -0400
37621@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
37622 return;
37623 }
37624
37625- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37626+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37627 if (priv->seqnum == 0xffff)
37628 usbip_uinfo("seqnum max\n");
37629
37630@@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_h
37631 return -ENOMEM;
37632 }
37633
37634- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37635+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37636 if (unlink->seqnum == 0xffff)
37637 usbip_uinfo("seqnum max\n");
37638
37639@@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hc
37640 vdev->rhport = rhport;
37641 }
37642
37643- atomic_set(&vhci->seqnum, 0);
37644+ atomic_set_unchecked(&vhci->seqnum, 0);
37645 spin_lock_init(&vhci->lock);
37646
37647
37648diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c
37649--- linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c 2011-04-17 17:00:52.000000000 -0400
37650+++ linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c 2011-05-04 17:56:28.000000000 -0400
37651@@ -78,7 +78,7 @@ static void vhci_recv_ret_submit(struct
37652 usbip_uerr("cannot find a urb of seqnum %u\n",
37653 pdu->base.seqnum);
37654 usbip_uinfo("max seqnum %d\n",
37655- atomic_read(&the_controller->seqnum));
37656+ atomic_read_unchecked(&the_controller->seqnum));
37657 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37658 return;
37659 }
37660diff -urNp linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c
37661--- linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c 2011-03-27 14:31:47.000000000 -0400
37662+++ linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c 2011-04-17 15:56:46.000000000 -0400
37663@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
37664 static int __init vme_user_probe(struct device *, int, int);
37665 static int __exit vme_user_remove(struct device *, int, int);
37666
37667-static struct file_operations vme_user_fops = {
37668+static const struct file_operations vme_user_fops = {
37669 .open = vme_user_open,
37670 .release = vme_user_release,
37671 .read = vme_user_read,
37672diff -urNp linux-2.6.32.46/drivers/staging/vt6655/hostap.c linux-2.6.32.46/drivers/staging/vt6655/hostap.c
37673--- linux-2.6.32.46/drivers/staging/vt6655/hostap.c 2011-03-27 14:31:47.000000000 -0400
37674+++ linux-2.6.32.46/drivers/staging/vt6655/hostap.c 2011-09-14 09:51:07.000000000 -0400
37675@@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevic
37676 PSDevice apdev_priv;
37677 struct net_device *dev = pDevice->dev;
37678 int ret;
37679- const struct net_device_ops apdev_netdev_ops = {
37680+ net_device_ops_no_const apdev_netdev_ops = {
37681 .ndo_start_xmit = pDevice->tx_80211,
37682 };
37683
37684diff -urNp linux-2.6.32.46/drivers/staging/vt6656/hostap.c linux-2.6.32.46/drivers/staging/vt6656/hostap.c
37685--- linux-2.6.32.46/drivers/staging/vt6656/hostap.c 2011-03-27 14:31:47.000000000 -0400
37686+++ linux-2.6.32.46/drivers/staging/vt6656/hostap.c 2011-09-14 09:49:53.000000000 -0400
37687@@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevic
37688 PSDevice apdev_priv;
37689 struct net_device *dev = pDevice->dev;
37690 int ret;
37691- const struct net_device_ops apdev_netdev_ops = {
37692+ net_device_ops_no_const apdev_netdev_ops = {
37693 .ndo_start_xmit = pDevice->tx_80211,
37694 };
37695
37696diff -urNp linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c
37697--- linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c 2011-03-27 14:31:47.000000000 -0400
37698+++ linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c 2011-08-23 20:24:26.000000000 -0400
37699@@ -205,7 +205,7 @@ static void unlocked_usbctlx_complete(hf
37700
37701 struct usbctlx_completor {
37702 int (*complete) (struct usbctlx_completor *);
37703-};
37704+} __no_const;
37705 typedef struct usbctlx_completor usbctlx_completor_t;
37706
37707 static int
37708diff -urNp linux-2.6.32.46/drivers/telephony/ixj.c linux-2.6.32.46/drivers/telephony/ixj.c
37709--- linux-2.6.32.46/drivers/telephony/ixj.c 2011-03-27 14:31:47.000000000 -0400
37710+++ linux-2.6.32.46/drivers/telephony/ixj.c 2011-05-16 21:46:57.000000000 -0400
37711@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
37712 bool mContinue;
37713 char *pIn, *pOut;
37714
37715+ pax_track_stack();
37716+
37717 if (!SCI_Prepare(j))
37718 return 0;
37719
37720diff -urNp linux-2.6.32.46/drivers/uio/uio.c linux-2.6.32.46/drivers/uio/uio.c
37721--- linux-2.6.32.46/drivers/uio/uio.c 2011-03-27 14:31:47.000000000 -0400
37722+++ linux-2.6.32.46/drivers/uio/uio.c 2011-05-04 17:56:20.000000000 -0400
37723@@ -23,6 +23,7 @@
37724 #include <linux/string.h>
37725 #include <linux/kobject.h>
37726 #include <linux/uio_driver.h>
37727+#include <asm/local.h>
37728
37729 #define UIO_MAX_DEVICES 255
37730
37731@@ -30,10 +31,10 @@ struct uio_device {
37732 struct module *owner;
37733 struct device *dev;
37734 int minor;
37735- atomic_t event;
37736+ atomic_unchecked_t event;
37737 struct fasync_struct *async_queue;
37738 wait_queue_head_t wait;
37739- int vma_count;
37740+ local_t vma_count;
37741 struct uio_info *info;
37742 struct kobject *map_dir;
37743 struct kobject *portio_dir;
37744@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobj
37745 return entry->show(mem, buf);
37746 }
37747
37748-static struct sysfs_ops map_sysfs_ops = {
37749+static const struct sysfs_ops map_sysfs_ops = {
37750 .show = map_type_show,
37751 };
37752
37753@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct k
37754 return entry->show(port, buf);
37755 }
37756
37757-static struct sysfs_ops portio_sysfs_ops = {
37758+static const struct sysfs_ops portio_sysfs_ops = {
37759 .show = portio_type_show,
37760 };
37761
37762@@ -255,7 +256,7 @@ static ssize_t show_event(struct device
37763 struct uio_device *idev = dev_get_drvdata(dev);
37764 if (idev)
37765 return sprintf(buf, "%u\n",
37766- (unsigned int)atomic_read(&idev->event));
37767+ (unsigned int)atomic_read_unchecked(&idev->event));
37768 else
37769 return -ENODEV;
37770 }
37771@@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *i
37772 {
37773 struct uio_device *idev = info->uio_dev;
37774
37775- atomic_inc(&idev->event);
37776+ atomic_inc_unchecked(&idev->event);
37777 wake_up_interruptible(&idev->wait);
37778 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
37779 }
37780@@ -477,7 +478,7 @@ static int uio_open(struct inode *inode,
37781 }
37782
37783 listener->dev = idev;
37784- listener->event_count = atomic_read(&idev->event);
37785+ listener->event_count = atomic_read_unchecked(&idev->event);
37786 filep->private_data = listener;
37787
37788 if (idev->info->open) {
37789@@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file
37790 return -EIO;
37791
37792 poll_wait(filep, &idev->wait, wait);
37793- if (listener->event_count != atomic_read(&idev->event))
37794+ if (listener->event_count != atomic_read_unchecked(&idev->event))
37795 return POLLIN | POLLRDNORM;
37796 return 0;
37797 }
37798@@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *fil
37799 do {
37800 set_current_state(TASK_INTERRUPTIBLE);
37801
37802- event_count = atomic_read(&idev->event);
37803+ event_count = atomic_read_unchecked(&idev->event);
37804 if (event_count != listener->event_count) {
37805 if (copy_to_user(buf, &event_count, count))
37806 retval = -EFAULT;
37807@@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_
37808 static void uio_vma_open(struct vm_area_struct *vma)
37809 {
37810 struct uio_device *idev = vma->vm_private_data;
37811- idev->vma_count++;
37812+ local_inc(&idev->vma_count);
37813 }
37814
37815 static void uio_vma_close(struct vm_area_struct *vma)
37816 {
37817 struct uio_device *idev = vma->vm_private_data;
37818- idev->vma_count--;
37819+ local_dec(&idev->vma_count);
37820 }
37821
37822 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
37823@@ -840,7 +841,7 @@ int __uio_register_device(struct module
37824 idev->owner = owner;
37825 idev->info = info;
37826 init_waitqueue_head(&idev->wait);
37827- atomic_set(&idev->event, 0);
37828+ atomic_set_unchecked(&idev->event, 0);
37829
37830 ret = uio_get_minor(idev);
37831 if (ret)
37832diff -urNp linux-2.6.32.46/drivers/usb/atm/usbatm.c linux-2.6.32.46/drivers/usb/atm/usbatm.c
37833--- linux-2.6.32.46/drivers/usb/atm/usbatm.c 2011-03-27 14:31:47.000000000 -0400
37834+++ linux-2.6.32.46/drivers/usb/atm/usbatm.c 2011-04-17 15:56:46.000000000 -0400
37835@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
37836 if (printk_ratelimit())
37837 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
37838 __func__, vpi, vci);
37839- atomic_inc(&vcc->stats->rx_err);
37840+ atomic_inc_unchecked(&vcc->stats->rx_err);
37841 return;
37842 }
37843
37844@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
37845 if (length > ATM_MAX_AAL5_PDU) {
37846 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
37847 __func__, length, vcc);
37848- atomic_inc(&vcc->stats->rx_err);
37849+ atomic_inc_unchecked(&vcc->stats->rx_err);
37850 goto out;
37851 }
37852
37853@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
37854 if (sarb->len < pdu_length) {
37855 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
37856 __func__, pdu_length, sarb->len, vcc);
37857- atomic_inc(&vcc->stats->rx_err);
37858+ atomic_inc_unchecked(&vcc->stats->rx_err);
37859 goto out;
37860 }
37861
37862 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
37863 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
37864 __func__, vcc);
37865- atomic_inc(&vcc->stats->rx_err);
37866+ atomic_inc_unchecked(&vcc->stats->rx_err);
37867 goto out;
37868 }
37869
37870@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
37871 if (printk_ratelimit())
37872 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
37873 __func__, length);
37874- atomic_inc(&vcc->stats->rx_drop);
37875+ atomic_inc_unchecked(&vcc->stats->rx_drop);
37876 goto out;
37877 }
37878
37879@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
37880
37881 vcc->push(vcc, skb);
37882
37883- atomic_inc(&vcc->stats->rx);
37884+ atomic_inc_unchecked(&vcc->stats->rx);
37885 out:
37886 skb_trim(sarb, 0);
37887 }
37888@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
37889 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
37890
37891 usbatm_pop(vcc, skb);
37892- atomic_inc(&vcc->stats->tx);
37893+ atomic_inc_unchecked(&vcc->stats->tx);
37894
37895 skb = skb_dequeue(&instance->sndqueue);
37896 }
37897@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
37898 if (!left--)
37899 return sprintf(page,
37900 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
37901- atomic_read(&atm_dev->stats.aal5.tx),
37902- atomic_read(&atm_dev->stats.aal5.tx_err),
37903- atomic_read(&atm_dev->stats.aal5.rx),
37904- atomic_read(&atm_dev->stats.aal5.rx_err),
37905- atomic_read(&atm_dev->stats.aal5.rx_drop));
37906+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
37907+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
37908+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
37909+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
37910+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
37911
37912 if (!left--) {
37913 if (instance->disconnected)
37914diff -urNp linux-2.6.32.46/drivers/usb/class/cdc-wdm.c linux-2.6.32.46/drivers/usb/class/cdc-wdm.c
37915--- linux-2.6.32.46/drivers/usb/class/cdc-wdm.c 2011-03-27 14:31:47.000000000 -0400
37916+++ linux-2.6.32.46/drivers/usb/class/cdc-wdm.c 2011-04-17 15:56:46.000000000 -0400
37917@@ -314,7 +314,7 @@ static ssize_t wdm_write
37918 if (r < 0)
37919 goto outnp;
37920
37921- if (!file->f_flags && O_NONBLOCK)
37922+ if (!(file->f_flags & O_NONBLOCK))
37923 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
37924 &desc->flags));
37925 else
37926diff -urNp linux-2.6.32.46/drivers/usb/core/hcd.c linux-2.6.32.46/drivers/usb/core/hcd.c
37927--- linux-2.6.32.46/drivers/usb/core/hcd.c 2011-03-27 14:31:47.000000000 -0400
37928+++ linux-2.6.32.46/drivers/usb/core/hcd.c 2011-04-17 15:56:46.000000000 -0400
37929@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
37930
37931 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
37932
37933-struct usb_mon_operations *mon_ops;
37934+const struct usb_mon_operations *mon_ops;
37935
37936 /*
37937 * The registration is unlocked.
37938@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
37939 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
37940 */
37941
37942-int usb_mon_register (struct usb_mon_operations *ops)
37943+int usb_mon_register (const struct usb_mon_operations *ops)
37944 {
37945
37946 if (mon_ops)
37947diff -urNp linux-2.6.32.46/drivers/usb/core/hcd.h linux-2.6.32.46/drivers/usb/core/hcd.h
37948--- linux-2.6.32.46/drivers/usb/core/hcd.h 2011-03-27 14:31:47.000000000 -0400
37949+++ linux-2.6.32.46/drivers/usb/core/hcd.h 2011-04-17 15:56:46.000000000 -0400
37950@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
37951 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
37952
37953 struct usb_mon_operations {
37954- void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
37955- void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
37956- void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
37957+ void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
37958+ void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
37959+ void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
37960 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
37961 };
37962
37963-extern struct usb_mon_operations *mon_ops;
37964+extern const struct usb_mon_operations *mon_ops;
37965
37966 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
37967 {
37968@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
37969 (*mon_ops->urb_complete)(bus, urb, status);
37970 }
37971
37972-int usb_mon_register(struct usb_mon_operations *ops);
37973+int usb_mon_register(const struct usb_mon_operations *ops);
37974 void usb_mon_deregister(void);
37975
37976 #else
37977diff -urNp linux-2.6.32.46/drivers/usb/core/message.c linux-2.6.32.46/drivers/usb/core/message.c
37978--- linux-2.6.32.46/drivers/usb/core/message.c 2011-03-27 14:31:47.000000000 -0400
37979+++ linux-2.6.32.46/drivers/usb/core/message.c 2011-04-17 15:56:46.000000000 -0400
37980@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
37981 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
37982 if (buf) {
37983 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
37984- if (len > 0) {
37985- smallbuf = kmalloc(++len, GFP_NOIO);
37986+ if (len++ > 0) {
37987+ smallbuf = kmalloc(len, GFP_NOIO);
37988 if (!smallbuf)
37989 return buf;
37990 memcpy(smallbuf, buf, len);
37991diff -urNp linux-2.6.32.46/drivers/usb/misc/appledisplay.c linux-2.6.32.46/drivers/usb/misc/appledisplay.c
37992--- linux-2.6.32.46/drivers/usb/misc/appledisplay.c 2011-03-27 14:31:47.000000000 -0400
37993+++ linux-2.6.32.46/drivers/usb/misc/appledisplay.c 2011-04-17 15:56:46.000000000 -0400
37994@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
37995 return pdata->msgdata[1];
37996 }
37997
37998-static struct backlight_ops appledisplay_bl_data = {
37999+static const struct backlight_ops appledisplay_bl_data = {
38000 .get_brightness = appledisplay_bl_get_brightness,
38001 .update_status = appledisplay_bl_update_status,
38002 };
38003diff -urNp linux-2.6.32.46/drivers/usb/mon/mon_main.c linux-2.6.32.46/drivers/usb/mon/mon_main.c
38004--- linux-2.6.32.46/drivers/usb/mon/mon_main.c 2011-03-27 14:31:47.000000000 -0400
38005+++ linux-2.6.32.46/drivers/usb/mon/mon_main.c 2011-04-17 15:56:46.000000000 -0400
38006@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
38007 /*
38008 * Ops
38009 */
38010-static struct usb_mon_operations mon_ops_0 = {
38011+static const struct usb_mon_operations mon_ops_0 = {
38012 .urb_submit = mon_submit,
38013 .urb_submit_error = mon_submit_error,
38014 .urb_complete = mon_complete,
38015diff -urNp linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h
38016--- linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h 2011-03-27 14:31:47.000000000 -0400
38017+++ linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h 2011-05-04 17:56:28.000000000 -0400
38018@@ -192,7 +192,7 @@ struct wahc {
38019 struct list_head xfer_delayed_list;
38020 spinlock_t xfer_list_lock;
38021 struct work_struct xfer_work;
38022- atomic_t xfer_id_count;
38023+ atomic_unchecked_t xfer_id_count;
38024 };
38025
38026
38027@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
38028 INIT_LIST_HEAD(&wa->xfer_delayed_list);
38029 spin_lock_init(&wa->xfer_list_lock);
38030 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
38031- atomic_set(&wa->xfer_id_count, 1);
38032+ atomic_set_unchecked(&wa->xfer_id_count, 1);
38033 }
38034
38035 /**
38036diff -urNp linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c
38037--- linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c 2011-03-27 14:31:47.000000000 -0400
38038+++ linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c 2011-05-04 17:56:28.000000000 -0400
38039@@ -293,7 +293,7 @@ out:
38040 */
38041 static void wa_xfer_id_init(struct wa_xfer *xfer)
38042 {
38043- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
38044+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
38045 }
38046
38047 /*
38048diff -urNp linux-2.6.32.46/drivers/uwb/wlp/messages.c linux-2.6.32.46/drivers/uwb/wlp/messages.c
38049--- linux-2.6.32.46/drivers/uwb/wlp/messages.c 2011-03-27 14:31:47.000000000 -0400
38050+++ linux-2.6.32.46/drivers/uwb/wlp/messages.c 2011-04-17 15:56:46.000000000 -0400
38051@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
38052 size_t len = skb->len;
38053 size_t used;
38054 ssize_t result;
38055- struct wlp_nonce enonce, rnonce;
38056+ struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
38057 enum wlp_assc_error assc_err;
38058 char enonce_buf[WLP_WSS_NONCE_STRSIZE];
38059 char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
38060diff -urNp linux-2.6.32.46/drivers/uwb/wlp/sysfs.c linux-2.6.32.46/drivers/uwb/wlp/sysfs.c
38061--- linux-2.6.32.46/drivers/uwb/wlp/sysfs.c 2011-03-27 14:31:47.000000000 -0400
38062+++ linux-2.6.32.46/drivers/uwb/wlp/sysfs.c 2011-04-17 15:56:46.000000000 -0400
38063@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
38064 return ret;
38065 }
38066
38067-static
38068-struct sysfs_ops wss_sysfs_ops = {
38069+static const struct sysfs_ops wss_sysfs_ops = {
38070 .show = wlp_wss_attr_show,
38071 .store = wlp_wss_attr_store,
38072 };
38073diff -urNp linux-2.6.32.46/drivers/video/atmel_lcdfb.c linux-2.6.32.46/drivers/video/atmel_lcdfb.c
38074--- linux-2.6.32.46/drivers/video/atmel_lcdfb.c 2011-03-27 14:31:47.000000000 -0400
38075+++ linux-2.6.32.46/drivers/video/atmel_lcdfb.c 2011-04-17 15:56:46.000000000 -0400
38076@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
38077 return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
38078 }
38079
38080-static struct backlight_ops atmel_lcdc_bl_ops = {
38081+static const struct backlight_ops atmel_lcdc_bl_ops = {
38082 .update_status = atmel_bl_update_status,
38083 .get_brightness = atmel_bl_get_brightness,
38084 };
38085diff -urNp linux-2.6.32.46/drivers/video/aty/aty128fb.c linux-2.6.32.46/drivers/video/aty/aty128fb.c
38086--- linux-2.6.32.46/drivers/video/aty/aty128fb.c 2011-03-27 14:31:47.000000000 -0400
38087+++ linux-2.6.32.46/drivers/video/aty/aty128fb.c 2011-04-17 15:56:46.000000000 -0400
38088@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
38089 return bd->props.brightness;
38090 }
38091
38092-static struct backlight_ops aty128_bl_data = {
38093+static const struct backlight_ops aty128_bl_data = {
38094 .get_brightness = aty128_bl_get_brightness,
38095 .update_status = aty128_bl_update_status,
38096 };
38097diff -urNp linux-2.6.32.46/drivers/video/aty/atyfb_base.c linux-2.6.32.46/drivers/video/aty/atyfb_base.c
38098--- linux-2.6.32.46/drivers/video/aty/atyfb_base.c 2011-03-27 14:31:47.000000000 -0400
38099+++ linux-2.6.32.46/drivers/video/aty/atyfb_base.c 2011-04-17 15:56:46.000000000 -0400
38100@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
38101 return bd->props.brightness;
38102 }
38103
38104-static struct backlight_ops aty_bl_data = {
38105+static const struct backlight_ops aty_bl_data = {
38106 .get_brightness = aty_bl_get_brightness,
38107 .update_status = aty_bl_update_status,
38108 };
38109diff -urNp linux-2.6.32.46/drivers/video/aty/radeon_backlight.c linux-2.6.32.46/drivers/video/aty/radeon_backlight.c
38110--- linux-2.6.32.46/drivers/video/aty/radeon_backlight.c 2011-03-27 14:31:47.000000000 -0400
38111+++ linux-2.6.32.46/drivers/video/aty/radeon_backlight.c 2011-04-17 15:56:46.000000000 -0400
38112@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
38113 return bd->props.brightness;
38114 }
38115
38116-static struct backlight_ops radeon_bl_data = {
38117+static const struct backlight_ops radeon_bl_data = {
38118 .get_brightness = radeon_bl_get_brightness,
38119 .update_status = radeon_bl_update_status,
38120 };
38121diff -urNp linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c
38122--- linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c 2011-03-27 14:31:47.000000000 -0400
38123+++ linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c 2011-04-17 15:56:46.000000000 -0400
38124@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
38125 return error ? data->current_brightness : reg_val;
38126 }
38127
38128-static struct backlight_ops adp5520_bl_ops = {
38129+static const struct backlight_ops adp5520_bl_ops = {
38130 .update_status = adp5520_bl_update_status,
38131 .get_brightness = adp5520_bl_get_brightness,
38132 };
38133diff -urNp linux-2.6.32.46/drivers/video/backlight/adx_bl.c linux-2.6.32.46/drivers/video/backlight/adx_bl.c
38134--- linux-2.6.32.46/drivers/video/backlight/adx_bl.c 2011-03-27 14:31:47.000000000 -0400
38135+++ linux-2.6.32.46/drivers/video/backlight/adx_bl.c 2011-04-17 15:56:46.000000000 -0400
38136@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
38137 return 1;
38138 }
38139
38140-static struct backlight_ops adx_backlight_ops = {
38141+static const struct backlight_ops adx_backlight_ops = {
38142 .options = 0,
38143 .update_status = adx_backlight_update_status,
38144 .get_brightness = adx_backlight_get_brightness,
38145diff -urNp linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c
38146--- linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c 2011-03-27 14:31:47.000000000 -0400
38147+++ linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c 2011-04-17 15:56:46.000000000 -0400
38148@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct
38149 return pwm_channel_enable(&pwmbl->pwmc);
38150 }
38151
38152-static struct backlight_ops atmel_pwm_bl_ops = {
38153+static const struct backlight_ops atmel_pwm_bl_ops = {
38154 .get_brightness = atmel_pwm_bl_get_intensity,
38155 .update_status = atmel_pwm_bl_set_intensity,
38156 };
38157diff -urNp linux-2.6.32.46/drivers/video/backlight/backlight.c linux-2.6.32.46/drivers/video/backlight/backlight.c
38158--- linux-2.6.32.46/drivers/video/backlight/backlight.c 2011-03-27 14:31:47.000000000 -0400
38159+++ linux-2.6.32.46/drivers/video/backlight/backlight.c 2011-04-17 15:56:46.000000000 -0400
38160@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
38161 * ERR_PTR() or a pointer to the newly allocated device.
38162 */
38163 struct backlight_device *backlight_device_register(const char *name,
38164- struct device *parent, void *devdata, struct backlight_ops *ops)
38165+ struct device *parent, void *devdata, const struct backlight_ops *ops)
38166 {
38167 struct backlight_device *new_bd;
38168 int rc;
38169diff -urNp linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c
38170--- linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c 2011-03-27 14:31:47.000000000 -0400
38171+++ linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c 2011-04-17 15:56:46.000000000 -0400
38172@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
38173 }
38174 EXPORT_SYMBOL(corgi_lcd_limit_intensity);
38175
38176-static struct backlight_ops corgi_bl_ops = {
38177+static const struct backlight_ops corgi_bl_ops = {
38178 .get_brightness = corgi_bl_get_intensity,
38179 .update_status = corgi_bl_update_status,
38180 };
38181diff -urNp linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c
38182--- linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c 2011-03-27 14:31:47.000000000 -0400
38183+++ linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c 2011-04-17 15:56:46.000000000 -0400
38184@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
38185 return intensity;
38186 }
38187
38188-static struct backlight_ops cr_backlight_ops = {
38189+static const struct backlight_ops cr_backlight_ops = {
38190 .get_brightness = cr_backlight_get_intensity,
38191 .update_status = cr_backlight_set_intensity,
38192 };
38193diff -urNp linux-2.6.32.46/drivers/video/backlight/da903x_bl.c linux-2.6.32.46/drivers/video/backlight/da903x_bl.c
38194--- linux-2.6.32.46/drivers/video/backlight/da903x_bl.c 2011-03-27 14:31:47.000000000 -0400
38195+++ linux-2.6.32.46/drivers/video/backlight/da903x_bl.c 2011-04-17 15:56:46.000000000 -0400
38196@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
38197 return data->current_brightness;
38198 }
38199
38200-static struct backlight_ops da903x_backlight_ops = {
38201+static const struct backlight_ops da903x_backlight_ops = {
38202 .update_status = da903x_backlight_update_status,
38203 .get_brightness = da903x_backlight_get_brightness,
38204 };
38205diff -urNp linux-2.6.32.46/drivers/video/backlight/generic_bl.c linux-2.6.32.46/drivers/video/backlight/generic_bl.c
38206--- linux-2.6.32.46/drivers/video/backlight/generic_bl.c 2011-03-27 14:31:47.000000000 -0400
38207+++ linux-2.6.32.46/drivers/video/backlight/generic_bl.c 2011-04-17 15:56:46.000000000 -0400
38208@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
38209 }
38210 EXPORT_SYMBOL(corgibl_limit_intensity);
38211
38212-static struct backlight_ops genericbl_ops = {
38213+static const struct backlight_ops genericbl_ops = {
38214 .options = BL_CORE_SUSPENDRESUME,
38215 .get_brightness = genericbl_get_intensity,
38216 .update_status = genericbl_send_intensity,
38217diff -urNp linux-2.6.32.46/drivers/video/backlight/hp680_bl.c linux-2.6.32.46/drivers/video/backlight/hp680_bl.c
38218--- linux-2.6.32.46/drivers/video/backlight/hp680_bl.c 2011-03-27 14:31:47.000000000 -0400
38219+++ linux-2.6.32.46/drivers/video/backlight/hp680_bl.c 2011-04-17 15:56:46.000000000 -0400
38220@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct
38221 return current_intensity;
38222 }
38223
38224-static struct backlight_ops hp680bl_ops = {
38225+static const struct backlight_ops hp680bl_ops = {
38226 .get_brightness = hp680bl_get_intensity,
38227 .update_status = hp680bl_set_intensity,
38228 };
38229diff -urNp linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c
38230--- linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c 2011-03-27 14:31:47.000000000 -0400
38231+++ linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c 2011-04-17 15:56:46.000000000 -0400
38232@@ -93,7 +93,7 @@ out:
38233 return ret;
38234 }
38235
38236-static struct backlight_ops jornada_bl_ops = {
38237+static const struct backlight_ops jornada_bl_ops = {
38238 .get_brightness = jornada_bl_get_brightness,
38239 .update_status = jornada_bl_update_status,
38240 .options = BL_CORE_SUSPENDRESUME,
38241diff -urNp linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c
38242--- linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c 2011-03-27 14:31:47.000000000 -0400
38243+++ linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c 2011-04-17 15:56:46.000000000 -0400
38244@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
38245 return kb3886bl_intensity;
38246 }
38247
38248-static struct backlight_ops kb3886bl_ops = {
38249+static const struct backlight_ops kb3886bl_ops = {
38250 .get_brightness = kb3886bl_get_intensity,
38251 .update_status = kb3886bl_send_intensity,
38252 };
38253diff -urNp linux-2.6.32.46/drivers/video/backlight/locomolcd.c linux-2.6.32.46/drivers/video/backlight/locomolcd.c
38254--- linux-2.6.32.46/drivers/video/backlight/locomolcd.c 2011-03-27 14:31:47.000000000 -0400
38255+++ linux-2.6.32.46/drivers/video/backlight/locomolcd.c 2011-04-17 15:56:46.000000000 -0400
38256@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
38257 return current_intensity;
38258 }
38259
38260-static struct backlight_ops locomobl_data = {
38261+static const struct backlight_ops locomobl_data = {
38262 .get_brightness = locomolcd_get_intensity,
38263 .update_status = locomolcd_set_intensity,
38264 };
38265diff -urNp linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c
38266--- linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:01.000000000 -0400
38267+++ linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:33.000000000 -0400
38268@@ -33,7 +33,7 @@ struct dmi_match_data {
38269 unsigned long iostart;
38270 unsigned long iolen;
38271 /* Backlight operations structure. */
38272- struct backlight_ops backlight_ops;
38273+ const struct backlight_ops backlight_ops;
38274 };
38275
38276 /* Module parameters. */
38277diff -urNp linux-2.6.32.46/drivers/video/backlight/omap1_bl.c linux-2.6.32.46/drivers/video/backlight/omap1_bl.c
38278--- linux-2.6.32.46/drivers/video/backlight/omap1_bl.c 2011-03-27 14:31:47.000000000 -0400
38279+++ linux-2.6.32.46/drivers/video/backlight/omap1_bl.c 2011-04-17 15:56:46.000000000 -0400
38280@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
38281 return bl->current_intensity;
38282 }
38283
38284-static struct backlight_ops omapbl_ops = {
38285+static const struct backlight_ops omapbl_ops = {
38286 .get_brightness = omapbl_get_intensity,
38287 .update_status = omapbl_update_status,
38288 };
38289diff -urNp linux-2.6.32.46/drivers/video/backlight/progear_bl.c linux-2.6.32.46/drivers/video/backlight/progear_bl.c
38290--- linux-2.6.32.46/drivers/video/backlight/progear_bl.c 2011-03-27 14:31:47.000000000 -0400
38291+++ linux-2.6.32.46/drivers/video/backlight/progear_bl.c 2011-04-17 15:56:46.000000000 -0400
38292@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
38293 return intensity - HW_LEVEL_MIN;
38294 }
38295
38296-static struct backlight_ops progearbl_ops = {
38297+static const struct backlight_ops progearbl_ops = {
38298 .get_brightness = progearbl_get_intensity,
38299 .update_status = progearbl_set_intensity,
38300 };
38301diff -urNp linux-2.6.32.46/drivers/video/backlight/pwm_bl.c linux-2.6.32.46/drivers/video/backlight/pwm_bl.c
38302--- linux-2.6.32.46/drivers/video/backlight/pwm_bl.c 2011-03-27 14:31:47.000000000 -0400
38303+++ linux-2.6.32.46/drivers/video/backlight/pwm_bl.c 2011-04-17 15:56:46.000000000 -0400
38304@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
38305 return bl->props.brightness;
38306 }
38307
38308-static struct backlight_ops pwm_backlight_ops = {
38309+static const struct backlight_ops pwm_backlight_ops = {
38310 .update_status = pwm_backlight_update_status,
38311 .get_brightness = pwm_backlight_get_brightness,
38312 };
38313diff -urNp linux-2.6.32.46/drivers/video/backlight/tosa_bl.c linux-2.6.32.46/drivers/video/backlight/tosa_bl.c
38314--- linux-2.6.32.46/drivers/video/backlight/tosa_bl.c 2011-03-27 14:31:47.000000000 -0400
38315+++ linux-2.6.32.46/drivers/video/backlight/tosa_bl.c 2011-04-17 15:56:46.000000000 -0400
38316@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
38317 return props->brightness;
38318 }
38319
38320-static struct backlight_ops bl_ops = {
38321+static const struct backlight_ops bl_ops = {
38322 .get_brightness = tosa_bl_get_brightness,
38323 .update_status = tosa_bl_update_status,
38324 };
38325diff -urNp linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c
38326--- linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c 2011-03-27 14:31:47.000000000 -0400
38327+++ linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c 2011-04-17 15:56:46.000000000 -0400
38328@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
38329 return data->current_brightness;
38330 }
38331
38332-static struct backlight_ops wm831x_backlight_ops = {
38333+static const struct backlight_ops wm831x_backlight_ops = {
38334 .options = BL_CORE_SUSPENDRESUME,
38335 .update_status = wm831x_backlight_update_status,
38336 .get_brightness = wm831x_backlight_get_brightness,
38337diff -urNp linux-2.6.32.46/drivers/video/bf54x-lq043fb.c linux-2.6.32.46/drivers/video/bf54x-lq043fb.c
38338--- linux-2.6.32.46/drivers/video/bf54x-lq043fb.c 2011-03-27 14:31:47.000000000 -0400
38339+++ linux-2.6.32.46/drivers/video/bf54x-lq043fb.c 2011-04-17 15:56:46.000000000 -0400
38340@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
38341 return 0;
38342 }
38343
38344-static struct backlight_ops bfin_lq043fb_bl_ops = {
38345+static const struct backlight_ops bfin_lq043fb_bl_ops = {
38346 .get_brightness = bl_get_brightness,
38347 };
38348
38349diff -urNp linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c
38350--- linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c 2011-03-27 14:31:47.000000000 -0400
38351+++ linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c 2011-04-17 15:56:46.000000000 -0400
38352@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
38353 return 0;
38354 }
38355
38356-static struct backlight_ops bfin_lq043fb_bl_ops = {
38357+static const struct backlight_ops bfin_lq043fb_bl_ops = {
38358 .get_brightness = bl_get_brightness,
38359 };
38360
38361diff -urNp linux-2.6.32.46/drivers/video/fbcmap.c linux-2.6.32.46/drivers/video/fbcmap.c
38362--- linux-2.6.32.46/drivers/video/fbcmap.c 2011-03-27 14:31:47.000000000 -0400
38363+++ linux-2.6.32.46/drivers/video/fbcmap.c 2011-04-17 15:56:46.000000000 -0400
38364@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
38365 rc = -ENODEV;
38366 goto out;
38367 }
38368- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
38369- !info->fbops->fb_setcmap)) {
38370+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
38371 rc = -EINVAL;
38372 goto out1;
38373 }
38374diff -urNp linux-2.6.32.46/drivers/video/fbmem.c linux-2.6.32.46/drivers/video/fbmem.c
38375--- linux-2.6.32.46/drivers/video/fbmem.c 2011-03-27 14:31:47.000000000 -0400
38376+++ linux-2.6.32.46/drivers/video/fbmem.c 2011-05-16 21:46:57.000000000 -0400
38377@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
38378 image->dx += image->width + 8;
38379 }
38380 } else if (rotate == FB_ROTATE_UD) {
38381- for (x = 0; x < num && image->dx >= 0; x++) {
38382+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
38383 info->fbops->fb_imageblit(info, image);
38384 image->dx -= image->width + 8;
38385 }
38386@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
38387 image->dy += image->height + 8;
38388 }
38389 } else if (rotate == FB_ROTATE_CCW) {
38390- for (x = 0; x < num && image->dy >= 0; x++) {
38391+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
38392 info->fbops->fb_imageblit(info, image);
38393 image->dy -= image->height + 8;
38394 }
38395@@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct
38396 int flags = info->flags;
38397 int ret = 0;
38398
38399+ pax_track_stack();
38400+
38401 if (var->activate & FB_ACTIVATE_INV_MODE) {
38402 struct fb_videomode mode1, mode2;
38403
38404@@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *
38405 void __user *argp = (void __user *)arg;
38406 long ret = 0;
38407
38408+ pax_track_stack();
38409+
38410 switch (cmd) {
38411 case FBIOGET_VSCREENINFO:
38412 if (!lock_fb_info(info))
38413@@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *
38414 return -EFAULT;
38415 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
38416 return -EINVAL;
38417- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
38418+ if (con2fb.framebuffer >= FB_MAX)
38419 return -EINVAL;
38420 if (!registered_fb[con2fb.framebuffer])
38421 request_module("fb%d", con2fb.framebuffer);
38422diff -urNp linux-2.6.32.46/drivers/video/i810/i810_accel.c linux-2.6.32.46/drivers/video/i810/i810_accel.c
38423--- linux-2.6.32.46/drivers/video/i810/i810_accel.c 2011-03-27 14:31:47.000000000 -0400
38424+++ linux-2.6.32.46/drivers/video/i810/i810_accel.c 2011-04-17 15:56:46.000000000 -0400
38425@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
38426 }
38427 }
38428 printk("ringbuffer lockup!!!\n");
38429+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
38430 i810_report_error(mmio);
38431 par->dev_flags |= LOCKUP;
38432 info->pixmap.scan_align = 1;
38433diff -urNp linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm
38434--- linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm 2011-03-27 14:31:47.000000000 -0400
38435+++ linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm 2011-08-29 23:49:24.000000000 -0400
38436@@ -1,1604 +1,1123 @@
38437 P3
38438-# Standard 224-color Linux logo
38439 80 80
38440 255
38441- 0 0 0 0 0 0 0 0 0 0 0 0
38442- 0 0 0 0 0 0 0 0 0 0 0 0
38443- 0 0 0 0 0 0 0 0 0 0 0 0
38444- 0 0 0 0 0 0 0 0 0 0 0 0
38445- 0 0 0 0 0 0 0 0 0 0 0 0
38446- 0 0 0 0 0 0 0 0 0 0 0 0
38447- 0 0 0 0 0 0 0 0 0 0 0 0
38448- 0 0 0 0 0 0 0 0 0 0 0 0
38449- 0 0 0 0 0 0 0 0 0 0 0 0
38450- 6 6 6 6 6 6 10 10 10 10 10 10
38451- 10 10 10 6 6 6 6 6 6 6 6 6
38452- 0 0 0 0 0 0 0 0 0 0 0 0
38453- 0 0 0 0 0 0 0 0 0 0 0 0
38454- 0 0 0 0 0 0 0 0 0 0 0 0
38455- 0 0 0 0 0 0 0 0 0 0 0 0
38456- 0 0 0 0 0 0 0 0 0 0 0 0
38457- 0 0 0 0 0 0 0 0 0 0 0 0
38458- 0 0 0 0 0 0 0 0 0 0 0 0
38459- 0 0 0 0 0 0 0 0 0 0 0 0
38460- 0 0 0 0 0 0 0 0 0 0 0 0
38461- 0 0 0 0 0 0 0 0 0 0 0 0
38462- 0 0 0 0 0 0 0 0 0 0 0 0
38463- 0 0 0 0 0 0 0 0 0 0 0 0
38464- 0 0 0 0 0 0 0 0 0 0 0 0
38465- 0 0 0 0 0 0 0 0 0 0 0 0
38466- 0 0 0 0 0 0 0 0 0 0 0 0
38467- 0 0 0 0 0 0 0 0 0 0 0 0
38468- 0 0 0 0 0 0 0 0 0 0 0 0
38469- 0 0 0 6 6 6 10 10 10 14 14 14
38470- 22 22 22 26 26 26 30 30 30 34 34 34
38471- 30 30 30 30 30 30 26 26 26 18 18 18
38472- 14 14 14 10 10 10 6 6 6 0 0 0
38473- 0 0 0 0 0 0 0 0 0 0 0 0
38474- 0 0 0 0 0 0 0 0 0 0 0 0
38475- 0 0 0 0 0 0 0 0 0 0 0 0
38476- 0 0 0 0 0 0 0 0 0 0 0 0
38477- 0 0 0 0 0 0 0 0 0 0 0 0
38478- 0 0 0 0 0 0 0 0 0 0 0 0
38479- 0 0 0 0 0 0 0 0 0 0 0 0
38480- 0 0 0 0 0 0 0 0 0 0 0 0
38481- 0 0 0 0 0 0 0 0 0 0 0 0
38482- 0 0 0 0 0 1 0 0 1 0 0 0
38483- 0 0 0 0 0 0 0 0 0 0 0 0
38484- 0 0 0 0 0 0 0 0 0 0 0 0
38485- 0 0 0 0 0 0 0 0 0 0 0 0
38486- 0 0 0 0 0 0 0 0 0 0 0 0
38487- 0 0 0 0 0 0 0 0 0 0 0 0
38488- 0 0 0 0 0 0 0 0 0 0 0 0
38489- 6 6 6 14 14 14 26 26 26 42 42 42
38490- 54 54 54 66 66 66 78 78 78 78 78 78
38491- 78 78 78 74 74 74 66 66 66 54 54 54
38492- 42 42 42 26 26 26 18 18 18 10 10 10
38493- 6 6 6 0 0 0 0 0 0 0 0 0
38494- 0 0 0 0 0 0 0 0 0 0 0 0
38495- 0 0 0 0 0 0 0 0 0 0 0 0
38496- 0 0 0 0 0 0 0 0 0 0 0 0
38497- 0 0 0 0 0 0 0 0 0 0 0 0
38498- 0 0 0 0 0 0 0 0 0 0 0 0
38499- 0 0 0 0 0 0 0 0 0 0 0 0
38500- 0 0 0 0 0 0 0 0 0 0 0 0
38501- 0 0 0 0 0 0 0 0 0 0 0 0
38502- 0 0 1 0 0 0 0 0 0 0 0 0
38503- 0 0 0 0 0 0 0 0 0 0 0 0
38504- 0 0 0 0 0 0 0 0 0 0 0 0
38505- 0 0 0 0 0 0 0 0 0 0 0 0
38506- 0 0 0 0 0 0 0 0 0 0 0 0
38507- 0 0 0 0 0 0 0 0 0 0 0 0
38508- 0 0 0 0 0 0 0 0 0 10 10 10
38509- 22 22 22 42 42 42 66 66 66 86 86 86
38510- 66 66 66 38 38 38 38 38 38 22 22 22
38511- 26 26 26 34 34 34 54 54 54 66 66 66
38512- 86 86 86 70 70 70 46 46 46 26 26 26
38513- 14 14 14 6 6 6 0 0 0 0 0 0
38514- 0 0 0 0 0 0 0 0 0 0 0 0
38515- 0 0 0 0 0 0 0 0 0 0 0 0
38516- 0 0 0 0 0 0 0 0 0 0 0 0
38517- 0 0 0 0 0 0 0 0 0 0 0 0
38518- 0 0 0 0 0 0 0 0 0 0 0 0
38519- 0 0 0 0 0 0 0 0 0 0 0 0
38520- 0 0 0 0 0 0 0 0 0 0 0 0
38521- 0 0 0 0 0 0 0 0 0 0 0 0
38522- 0 0 1 0 0 1 0 0 1 0 0 0
38523- 0 0 0 0 0 0 0 0 0 0 0 0
38524- 0 0 0 0 0 0 0 0 0 0 0 0
38525- 0 0 0 0 0 0 0 0 0 0 0 0
38526- 0 0 0 0 0 0 0 0 0 0 0 0
38527- 0 0 0 0 0 0 0 0 0 0 0 0
38528- 0 0 0 0 0 0 10 10 10 26 26 26
38529- 50 50 50 82 82 82 58 58 58 6 6 6
38530- 2 2 6 2 2 6 2 2 6 2 2 6
38531- 2 2 6 2 2 6 2 2 6 2 2 6
38532- 6 6 6 54 54 54 86 86 86 66 66 66
38533- 38 38 38 18 18 18 6 6 6 0 0 0
38534- 0 0 0 0 0 0 0 0 0 0 0 0
38535- 0 0 0 0 0 0 0 0 0 0 0 0
38536- 0 0 0 0 0 0 0 0 0 0 0 0
38537- 0 0 0 0 0 0 0 0 0 0 0 0
38538- 0 0 0 0 0 0 0 0 0 0 0 0
38539- 0 0 0 0 0 0 0 0 0 0 0 0
38540- 0 0 0 0 0 0 0 0 0 0 0 0
38541- 0 0 0 0 0 0 0 0 0 0 0 0
38542- 0 0 0 0 0 0 0 0 0 0 0 0
38543- 0 0 0 0 0 0 0 0 0 0 0 0
38544- 0 0 0 0 0 0 0 0 0 0 0 0
38545- 0 0 0 0 0 0 0 0 0 0 0 0
38546- 0 0 0 0 0 0 0 0 0 0 0 0
38547- 0 0 0 0 0 0 0 0 0 0 0 0
38548- 0 0 0 6 6 6 22 22 22 50 50 50
38549- 78 78 78 34 34 34 2 2 6 2 2 6
38550- 2 2 6 2 2 6 2 2 6 2 2 6
38551- 2 2 6 2 2 6 2 2 6 2 2 6
38552- 2 2 6 2 2 6 6 6 6 70 70 70
38553- 78 78 78 46 46 46 22 22 22 6 6 6
38554- 0 0 0 0 0 0 0 0 0 0 0 0
38555- 0 0 0 0 0 0 0 0 0 0 0 0
38556- 0 0 0 0 0 0 0 0 0 0 0 0
38557- 0 0 0 0 0 0 0 0 0 0 0 0
38558- 0 0 0 0 0 0 0 0 0 0 0 0
38559- 0 0 0 0 0 0 0 0 0 0 0 0
38560- 0 0 0 0 0 0 0 0 0 0 0 0
38561- 0 0 0 0 0 0 0 0 0 0 0 0
38562- 0 0 1 0 0 1 0 0 1 0 0 0
38563- 0 0 0 0 0 0 0 0 0 0 0 0
38564- 0 0 0 0 0 0 0 0 0 0 0 0
38565- 0 0 0 0 0 0 0 0 0 0 0 0
38566- 0 0 0 0 0 0 0 0 0 0 0 0
38567- 0 0 0 0 0 0 0 0 0 0 0 0
38568- 6 6 6 18 18 18 42 42 42 82 82 82
38569- 26 26 26 2 2 6 2 2 6 2 2 6
38570- 2 2 6 2 2 6 2 2 6 2 2 6
38571- 2 2 6 2 2 6 2 2 6 14 14 14
38572- 46 46 46 34 34 34 6 6 6 2 2 6
38573- 42 42 42 78 78 78 42 42 42 18 18 18
38574- 6 6 6 0 0 0 0 0 0 0 0 0
38575- 0 0 0 0 0 0 0 0 0 0 0 0
38576- 0 0 0 0 0 0 0 0 0 0 0 0
38577- 0 0 0 0 0 0 0 0 0 0 0 0
38578- 0 0 0 0 0 0 0 0 0 0 0 0
38579- 0 0 0 0 0 0 0 0 0 0 0 0
38580- 0 0 0 0 0 0 0 0 0 0 0 0
38581- 0 0 0 0 0 0 0 0 0 0 0 0
38582- 0 0 1 0 0 0 0 0 1 0 0 0
38583- 0 0 0 0 0 0 0 0 0 0 0 0
38584- 0 0 0 0 0 0 0 0 0 0 0 0
38585- 0 0 0 0 0 0 0 0 0 0 0 0
38586- 0 0 0 0 0 0 0 0 0 0 0 0
38587- 0 0 0 0 0 0 0 0 0 0 0 0
38588- 10 10 10 30 30 30 66 66 66 58 58 58
38589- 2 2 6 2 2 6 2 2 6 2 2 6
38590- 2 2 6 2 2 6 2 2 6 2 2 6
38591- 2 2 6 2 2 6 2 2 6 26 26 26
38592- 86 86 86 101 101 101 46 46 46 10 10 10
38593- 2 2 6 58 58 58 70 70 70 34 34 34
38594- 10 10 10 0 0 0 0 0 0 0 0 0
38595- 0 0 0 0 0 0 0 0 0 0 0 0
38596- 0 0 0 0 0 0 0 0 0 0 0 0
38597- 0 0 0 0 0 0 0 0 0 0 0 0
38598- 0 0 0 0 0 0 0 0 0 0 0 0
38599- 0 0 0 0 0 0 0 0 0 0 0 0
38600- 0 0 0 0 0 0 0 0 0 0 0 0
38601- 0 0 0 0 0 0 0 0 0 0 0 0
38602- 0 0 1 0 0 1 0 0 1 0 0 0
38603- 0 0 0 0 0 0 0 0 0 0 0 0
38604- 0 0 0 0 0 0 0 0 0 0 0 0
38605- 0 0 0 0 0 0 0 0 0 0 0 0
38606- 0 0 0 0 0 0 0 0 0 0 0 0
38607- 0 0 0 0 0 0 0 0 0 0 0 0
38608- 14 14 14 42 42 42 86 86 86 10 10 10
38609- 2 2 6 2 2 6 2 2 6 2 2 6
38610- 2 2 6 2 2 6 2 2 6 2 2 6
38611- 2 2 6 2 2 6 2 2 6 30 30 30
38612- 94 94 94 94 94 94 58 58 58 26 26 26
38613- 2 2 6 6 6 6 78 78 78 54 54 54
38614- 22 22 22 6 6 6 0 0 0 0 0 0
38615- 0 0 0 0 0 0 0 0 0 0 0 0
38616- 0 0 0 0 0 0 0 0 0 0 0 0
38617- 0 0 0 0 0 0 0 0 0 0 0 0
38618- 0 0 0 0 0 0 0 0 0 0 0 0
38619- 0 0 0 0 0 0 0 0 0 0 0 0
38620- 0 0 0 0 0 0 0 0 0 0 0 0
38621- 0 0 0 0 0 0 0 0 0 0 0 0
38622- 0 0 0 0 0 0 0 0 0 0 0 0
38623- 0 0 0 0 0 0 0 0 0 0 0 0
38624- 0 0 0 0 0 0 0 0 0 0 0 0
38625- 0 0 0 0 0 0 0 0 0 0 0 0
38626- 0 0 0 0 0 0 0 0 0 0 0 0
38627- 0 0 0 0 0 0 0 0 0 6 6 6
38628- 22 22 22 62 62 62 62 62 62 2 2 6
38629- 2 2 6 2 2 6 2 2 6 2 2 6
38630- 2 2 6 2 2 6 2 2 6 2 2 6
38631- 2 2 6 2 2 6 2 2 6 26 26 26
38632- 54 54 54 38 38 38 18 18 18 10 10 10
38633- 2 2 6 2 2 6 34 34 34 82 82 82
38634- 38 38 38 14 14 14 0 0 0 0 0 0
38635- 0 0 0 0 0 0 0 0 0 0 0 0
38636- 0 0 0 0 0 0 0 0 0 0 0 0
38637- 0 0 0 0 0 0 0 0 0 0 0 0
38638- 0 0 0 0 0 0 0 0 0 0 0 0
38639- 0 0 0 0 0 0 0 0 0 0 0 0
38640- 0 0 0 0 0 0 0 0 0 0 0 0
38641- 0 0 0 0 0 0 0 0 0 0 0 0
38642- 0 0 0 0 0 1 0 0 1 0 0 0
38643- 0 0 0 0 0 0 0 0 0 0 0 0
38644- 0 0 0 0 0 0 0 0 0 0 0 0
38645- 0 0 0 0 0 0 0 0 0 0 0 0
38646- 0 0 0 0 0 0 0 0 0 0 0 0
38647- 0 0 0 0 0 0 0 0 0 6 6 6
38648- 30 30 30 78 78 78 30 30 30 2 2 6
38649- 2 2 6 2 2 6 2 2 6 2 2 6
38650- 2 2 6 2 2 6 2 2 6 2 2 6
38651- 2 2 6 2 2 6 2 2 6 10 10 10
38652- 10 10 10 2 2 6 2 2 6 2 2 6
38653- 2 2 6 2 2 6 2 2 6 78 78 78
38654- 50 50 50 18 18 18 6 6 6 0 0 0
38655- 0 0 0 0 0 0 0 0 0 0 0 0
38656- 0 0 0 0 0 0 0 0 0 0 0 0
38657- 0 0 0 0 0 0 0 0 0 0 0 0
38658- 0 0 0 0 0 0 0 0 0 0 0 0
38659- 0 0 0 0 0 0 0 0 0 0 0 0
38660- 0 0 0 0 0 0 0 0 0 0 0 0
38661- 0 0 0 0 0 0 0 0 0 0 0 0
38662- 0 0 1 0 0 0 0 0 0 0 0 0
38663- 0 0 0 0 0 0 0 0 0 0 0 0
38664- 0 0 0 0 0 0 0 0 0 0 0 0
38665- 0 0 0 0 0 0 0 0 0 0 0 0
38666- 0 0 0 0 0 0 0 0 0 0 0 0
38667- 0 0 0 0 0 0 0 0 0 10 10 10
38668- 38 38 38 86 86 86 14 14 14 2 2 6
38669- 2 2 6 2 2 6 2 2 6 2 2 6
38670- 2 2 6 2 2 6 2 2 6 2 2 6
38671- 2 2 6 2 2 6 2 2 6 2 2 6
38672- 2 2 6 2 2 6 2 2 6 2 2 6
38673- 2 2 6 2 2 6 2 2 6 54 54 54
38674- 66 66 66 26 26 26 6 6 6 0 0 0
38675- 0 0 0 0 0 0 0 0 0 0 0 0
38676- 0 0 0 0 0 0 0 0 0 0 0 0
38677- 0 0 0 0 0 0 0 0 0 0 0 0
38678- 0 0 0 0 0 0 0 0 0 0 0 0
38679- 0 0 0 0 0 0 0 0 0 0 0 0
38680- 0 0 0 0 0 0 0 0 0 0 0 0
38681- 0 0 0 0 0 0 0 0 0 0 0 0
38682- 0 0 0 0 0 1 0 0 1 0 0 0
38683- 0 0 0 0 0 0 0 0 0 0 0 0
38684- 0 0 0 0 0 0 0 0 0 0 0 0
38685- 0 0 0 0 0 0 0 0 0 0 0 0
38686- 0 0 0 0 0 0 0 0 0 0 0 0
38687- 0 0 0 0 0 0 0 0 0 14 14 14
38688- 42 42 42 82 82 82 2 2 6 2 2 6
38689- 2 2 6 6 6 6 10 10 10 2 2 6
38690- 2 2 6 2 2 6 2 2 6 2 2 6
38691- 2 2 6 2 2 6 2 2 6 6 6 6
38692- 14 14 14 10 10 10 2 2 6 2 2 6
38693- 2 2 6 2 2 6 2 2 6 18 18 18
38694- 82 82 82 34 34 34 10 10 10 0 0 0
38695- 0 0 0 0 0 0 0 0 0 0 0 0
38696- 0 0 0 0 0 0 0 0 0 0 0 0
38697- 0 0 0 0 0 0 0 0 0 0 0 0
38698- 0 0 0 0 0 0 0 0 0 0 0 0
38699- 0 0 0 0 0 0 0 0 0 0 0 0
38700- 0 0 0 0 0 0 0 0 0 0 0 0
38701- 0 0 0 0 0 0 0 0 0 0 0 0
38702- 0 0 1 0 0 0 0 0 0 0 0 0
38703- 0 0 0 0 0 0 0 0 0 0 0 0
38704- 0 0 0 0 0 0 0 0 0 0 0 0
38705- 0 0 0 0 0 0 0 0 0 0 0 0
38706- 0 0 0 0 0 0 0 0 0 0 0 0
38707- 0 0 0 0 0 0 0 0 0 14 14 14
38708- 46 46 46 86 86 86 2 2 6 2 2 6
38709- 6 6 6 6 6 6 22 22 22 34 34 34
38710- 6 6 6 2 2 6 2 2 6 2 2 6
38711- 2 2 6 2 2 6 18 18 18 34 34 34
38712- 10 10 10 50 50 50 22 22 22 2 2 6
38713- 2 2 6 2 2 6 2 2 6 10 10 10
38714- 86 86 86 42 42 42 14 14 14 0 0 0
38715- 0 0 0 0 0 0 0 0 0 0 0 0
38716- 0 0 0 0 0 0 0 0 0 0 0 0
38717- 0 0 0 0 0 0 0 0 0 0 0 0
38718- 0 0 0 0 0 0 0 0 0 0 0 0
38719- 0 0 0 0 0 0 0 0 0 0 0 0
38720- 0 0 0 0 0 0 0 0 0 0 0 0
38721- 0 0 0 0 0 0 0 0 0 0 0 0
38722- 0 0 1 0 0 1 0 0 1 0 0 0
38723- 0 0 0 0 0 0 0 0 0 0 0 0
38724- 0 0 0 0 0 0 0 0 0 0 0 0
38725- 0 0 0 0 0 0 0 0 0 0 0 0
38726- 0 0 0 0 0 0 0 0 0 0 0 0
38727- 0 0 0 0 0 0 0 0 0 14 14 14
38728- 46 46 46 86 86 86 2 2 6 2 2 6
38729- 38 38 38 116 116 116 94 94 94 22 22 22
38730- 22 22 22 2 2 6 2 2 6 2 2 6
38731- 14 14 14 86 86 86 138 138 138 162 162 162
38732-154 154 154 38 38 38 26 26 26 6 6 6
38733- 2 2 6 2 2 6 2 2 6 2 2 6
38734- 86 86 86 46 46 46 14 14 14 0 0 0
38735- 0 0 0 0 0 0 0 0 0 0 0 0
38736- 0 0 0 0 0 0 0 0 0 0 0 0
38737- 0 0 0 0 0 0 0 0 0 0 0 0
38738- 0 0 0 0 0 0 0 0 0 0 0 0
38739- 0 0 0 0 0 0 0 0 0 0 0 0
38740- 0 0 0 0 0 0 0 0 0 0 0 0
38741- 0 0 0 0 0 0 0 0 0 0 0 0
38742- 0 0 0 0 0 0 0 0 0 0 0 0
38743- 0 0 0 0 0 0 0 0 0 0 0 0
38744- 0 0 0 0 0 0 0 0 0 0 0 0
38745- 0 0 0 0 0 0 0 0 0 0 0 0
38746- 0 0 0 0 0 0 0 0 0 0 0 0
38747- 0 0 0 0 0 0 0 0 0 14 14 14
38748- 46 46 46 86 86 86 2 2 6 14 14 14
38749-134 134 134 198 198 198 195 195 195 116 116 116
38750- 10 10 10 2 2 6 2 2 6 6 6 6
38751-101 98 89 187 187 187 210 210 210 218 218 218
38752-214 214 214 134 134 134 14 14 14 6 6 6
38753- 2 2 6 2 2 6 2 2 6 2 2 6
38754- 86 86 86 50 50 50 18 18 18 6 6 6
38755- 0 0 0 0 0 0 0 0 0 0 0 0
38756- 0 0 0 0 0 0 0 0 0 0 0 0
38757- 0 0 0 0 0 0 0 0 0 0 0 0
38758- 0 0 0 0 0 0 0 0 0 0 0 0
38759- 0 0 0 0 0 0 0 0 0 0 0 0
38760- 0 0 0 0 0 0 0 0 0 0 0 0
38761- 0 0 0 0 0 0 0 0 1 0 0 0
38762- 0 0 1 0 0 1 0 0 1 0 0 0
38763- 0 0 0 0 0 0 0 0 0 0 0 0
38764- 0 0 0 0 0 0 0 0 0 0 0 0
38765- 0 0 0 0 0 0 0 0 0 0 0 0
38766- 0 0 0 0 0 0 0 0 0 0 0 0
38767- 0 0 0 0 0 0 0 0 0 14 14 14
38768- 46 46 46 86 86 86 2 2 6 54 54 54
38769-218 218 218 195 195 195 226 226 226 246 246 246
38770- 58 58 58 2 2 6 2 2 6 30 30 30
38771-210 210 210 253 253 253 174 174 174 123 123 123
38772-221 221 221 234 234 234 74 74 74 2 2 6
38773- 2 2 6 2 2 6 2 2 6 2 2 6
38774- 70 70 70 58 58 58 22 22 22 6 6 6
38775- 0 0 0 0 0 0 0 0 0 0 0 0
38776- 0 0 0 0 0 0 0 0 0 0 0 0
38777- 0 0 0 0 0 0 0 0 0 0 0 0
38778- 0 0 0 0 0 0 0 0 0 0 0 0
38779- 0 0 0 0 0 0 0 0 0 0 0 0
38780- 0 0 0 0 0 0 0 0 0 0 0 0
38781- 0 0 0 0 0 0 0 0 0 0 0 0
38782- 0 0 0 0 0 0 0 0 0 0 0 0
38783- 0 0 0 0 0 0 0 0 0 0 0 0
38784- 0 0 0 0 0 0 0 0 0 0 0 0
38785- 0 0 0 0 0 0 0 0 0 0 0 0
38786- 0 0 0 0 0 0 0 0 0 0 0 0
38787- 0 0 0 0 0 0 0 0 0 14 14 14
38788- 46 46 46 82 82 82 2 2 6 106 106 106
38789-170 170 170 26 26 26 86 86 86 226 226 226
38790-123 123 123 10 10 10 14 14 14 46 46 46
38791-231 231 231 190 190 190 6 6 6 70 70 70
38792- 90 90 90 238 238 238 158 158 158 2 2 6
38793- 2 2 6 2 2 6 2 2 6 2 2 6
38794- 70 70 70 58 58 58 22 22 22 6 6 6
38795- 0 0 0 0 0 0 0 0 0 0 0 0
38796- 0 0 0 0 0 0 0 0 0 0 0 0
38797- 0 0 0 0 0 0 0 0 0 0 0 0
38798- 0 0 0 0 0 0 0 0 0 0 0 0
38799- 0 0 0 0 0 0 0 0 0 0 0 0
38800- 0 0 0 0 0 0 0 0 0 0 0 0
38801- 0 0 0 0 0 0 0 0 1 0 0 0
38802- 0 0 1 0 0 1 0 0 1 0 0 0
38803- 0 0 0 0 0 0 0 0 0 0 0 0
38804- 0 0 0 0 0 0 0 0 0 0 0 0
38805- 0 0 0 0 0 0 0 0 0 0 0 0
38806- 0 0 0 0 0 0 0 0 0 0 0 0
38807- 0 0 0 0 0 0 0 0 0 14 14 14
38808- 42 42 42 86 86 86 6 6 6 116 116 116
38809-106 106 106 6 6 6 70 70 70 149 149 149
38810-128 128 128 18 18 18 38 38 38 54 54 54
38811-221 221 221 106 106 106 2 2 6 14 14 14
38812- 46 46 46 190 190 190 198 198 198 2 2 6
38813- 2 2 6 2 2 6 2 2 6 2 2 6
38814- 74 74 74 62 62 62 22 22 22 6 6 6
38815- 0 0 0 0 0 0 0 0 0 0 0 0
38816- 0 0 0 0 0 0 0 0 0 0 0 0
38817- 0 0 0 0 0 0 0 0 0 0 0 0
38818- 0 0 0 0 0 0 0 0 0 0 0 0
38819- 0 0 0 0 0 0 0 0 0 0 0 0
38820- 0 0 0 0 0 0 0 0 0 0 0 0
38821- 0 0 0 0 0 0 0 0 1 0 0 0
38822- 0 0 1 0 0 0 0 0 1 0 0 0
38823- 0 0 0 0 0 0 0 0 0 0 0 0
38824- 0 0 0 0 0 0 0 0 0 0 0 0
38825- 0 0 0 0 0 0 0 0 0 0 0 0
38826- 0 0 0 0 0 0 0 0 0 0 0 0
38827- 0 0 0 0 0 0 0 0 0 14 14 14
38828- 42 42 42 94 94 94 14 14 14 101 101 101
38829-128 128 128 2 2 6 18 18 18 116 116 116
38830-118 98 46 121 92 8 121 92 8 98 78 10
38831-162 162 162 106 106 106 2 2 6 2 2 6
38832- 2 2 6 195 195 195 195 195 195 6 6 6
38833- 2 2 6 2 2 6 2 2 6 2 2 6
38834- 74 74 74 62 62 62 22 22 22 6 6 6
38835- 0 0 0 0 0 0 0 0 0 0 0 0
38836- 0 0 0 0 0 0 0 0 0 0 0 0
38837- 0 0 0 0 0 0 0 0 0 0 0 0
38838- 0 0 0 0 0 0 0 0 0 0 0 0
38839- 0 0 0 0 0 0 0 0 0 0 0 0
38840- 0 0 0 0 0 0 0 0 0 0 0 0
38841- 0 0 0 0 0 0 0 0 1 0 0 1
38842- 0 0 1 0 0 0 0 0 1 0 0 0
38843- 0 0 0 0 0 0 0 0 0 0 0 0
38844- 0 0 0 0 0 0 0 0 0 0 0 0
38845- 0 0 0 0 0 0 0 0 0 0 0 0
38846- 0 0 0 0 0 0 0 0 0 0 0 0
38847- 0 0 0 0 0 0 0 0 0 10 10 10
38848- 38 38 38 90 90 90 14 14 14 58 58 58
38849-210 210 210 26 26 26 54 38 6 154 114 10
38850-226 170 11 236 186 11 225 175 15 184 144 12
38851-215 174 15 175 146 61 37 26 9 2 2 6
38852- 70 70 70 246 246 246 138 138 138 2 2 6
38853- 2 2 6 2 2 6 2 2 6 2 2 6
38854- 70 70 70 66 66 66 26 26 26 6 6 6
38855- 0 0 0 0 0 0 0 0 0 0 0 0
38856- 0 0 0 0 0 0 0 0 0 0 0 0
38857- 0 0 0 0 0 0 0 0 0 0 0 0
38858- 0 0 0 0 0 0 0 0 0 0 0 0
38859- 0 0 0 0 0 0 0 0 0 0 0 0
38860- 0 0 0 0 0 0 0 0 0 0 0 0
38861- 0 0 0 0 0 0 0 0 0 0 0 0
38862- 0 0 0 0 0 0 0 0 0 0 0 0
38863- 0 0 0 0 0 0 0 0 0 0 0 0
38864- 0 0 0 0 0 0 0 0 0 0 0 0
38865- 0 0 0 0 0 0 0 0 0 0 0 0
38866- 0 0 0 0 0 0 0 0 0 0 0 0
38867- 0 0 0 0 0 0 0 0 0 10 10 10
38868- 38 38 38 86 86 86 14 14 14 10 10 10
38869-195 195 195 188 164 115 192 133 9 225 175 15
38870-239 182 13 234 190 10 232 195 16 232 200 30
38871-245 207 45 241 208 19 232 195 16 184 144 12
38872-218 194 134 211 206 186 42 42 42 2 2 6
38873- 2 2 6 2 2 6 2 2 6 2 2 6
38874- 50 50 50 74 74 74 30 30 30 6 6 6
38875- 0 0 0 0 0 0 0 0 0 0 0 0
38876- 0 0 0 0 0 0 0 0 0 0 0 0
38877- 0 0 0 0 0 0 0 0 0 0 0 0
38878- 0 0 0 0 0 0 0 0 0 0 0 0
38879- 0 0 0 0 0 0 0 0 0 0 0 0
38880- 0 0 0 0 0 0 0 0 0 0 0 0
38881- 0 0 0 0 0 0 0 0 0 0 0 0
38882- 0 0 0 0 0 0 0 0 0 0 0 0
38883- 0 0 0 0 0 0 0 0 0 0 0 0
38884- 0 0 0 0 0 0 0 0 0 0 0 0
38885- 0 0 0 0 0 0 0 0 0 0 0 0
38886- 0 0 0 0 0 0 0 0 0 0 0 0
38887- 0 0 0 0 0 0 0 0 0 10 10 10
38888- 34 34 34 86 86 86 14 14 14 2 2 6
38889-121 87 25 192 133 9 219 162 10 239 182 13
38890-236 186 11 232 195 16 241 208 19 244 214 54
38891-246 218 60 246 218 38 246 215 20 241 208 19
38892-241 208 19 226 184 13 121 87 25 2 2 6
38893- 2 2 6 2 2 6 2 2 6 2 2 6
38894- 50 50 50 82 82 82 34 34 34 10 10 10
38895- 0 0 0 0 0 0 0 0 0 0 0 0
38896- 0 0 0 0 0 0 0 0 0 0 0 0
38897- 0 0 0 0 0 0 0 0 0 0 0 0
38898- 0 0 0 0 0 0 0 0 0 0 0 0
38899- 0 0 0 0 0 0 0 0 0 0 0 0
38900- 0 0 0 0 0 0 0 0 0 0 0 0
38901- 0 0 0 0 0 0 0 0 0 0 0 0
38902- 0 0 0 0 0 0 0 0 0 0 0 0
38903- 0 0 0 0 0 0 0 0 0 0 0 0
38904- 0 0 0 0 0 0 0 0 0 0 0 0
38905- 0 0 0 0 0 0 0 0 0 0 0 0
38906- 0 0 0 0 0 0 0 0 0 0 0 0
38907- 0 0 0 0 0 0 0 0 0 10 10 10
38908- 34 34 34 82 82 82 30 30 30 61 42 6
38909-180 123 7 206 145 10 230 174 11 239 182 13
38910-234 190 10 238 202 15 241 208 19 246 218 74
38911-246 218 38 246 215 20 246 215 20 246 215 20
38912-226 184 13 215 174 15 184 144 12 6 6 6
38913- 2 2 6 2 2 6 2 2 6 2 2 6
38914- 26 26 26 94 94 94 42 42 42 14 14 14
38915- 0 0 0 0 0 0 0 0 0 0 0 0
38916- 0 0 0 0 0 0 0 0 0 0 0 0
38917- 0 0 0 0 0 0 0 0 0 0 0 0
38918- 0 0 0 0 0 0 0 0 0 0 0 0
38919- 0 0 0 0 0 0 0 0 0 0 0 0
38920- 0 0 0 0 0 0 0 0 0 0 0 0
38921- 0 0 0 0 0 0 0 0 0 0 0 0
38922- 0 0 0 0 0 0 0 0 0 0 0 0
38923- 0 0 0 0 0 0 0 0 0 0 0 0
38924- 0 0 0 0 0 0 0 0 0 0 0 0
38925- 0 0 0 0 0 0 0 0 0 0 0 0
38926- 0 0 0 0 0 0 0 0 0 0 0 0
38927- 0 0 0 0 0 0 0 0 0 10 10 10
38928- 30 30 30 78 78 78 50 50 50 104 69 6
38929-192 133 9 216 158 10 236 178 12 236 186 11
38930-232 195 16 241 208 19 244 214 54 245 215 43
38931-246 215 20 246 215 20 241 208 19 198 155 10
38932-200 144 11 216 158 10 156 118 10 2 2 6
38933- 2 2 6 2 2 6 2 2 6 2 2 6
38934- 6 6 6 90 90 90 54 54 54 18 18 18
38935- 6 6 6 0 0 0 0 0 0 0 0 0
38936- 0 0 0 0 0 0 0 0 0 0 0 0
38937- 0 0 0 0 0 0 0 0 0 0 0 0
38938- 0 0 0 0 0 0 0 0 0 0 0 0
38939- 0 0 0 0 0 0 0 0 0 0 0 0
38940- 0 0 0 0 0 0 0 0 0 0 0 0
38941- 0 0 0 0 0 0 0 0 0 0 0 0
38942- 0 0 0 0 0 0 0 0 0 0 0 0
38943- 0 0 0 0 0 0 0 0 0 0 0 0
38944- 0 0 0 0 0 0 0 0 0 0 0 0
38945- 0 0 0 0 0 0 0 0 0 0 0 0
38946- 0 0 0 0 0 0 0 0 0 0 0 0
38947- 0 0 0 0 0 0 0 0 0 10 10 10
38948- 30 30 30 78 78 78 46 46 46 22 22 22
38949-137 92 6 210 162 10 239 182 13 238 190 10
38950-238 202 15 241 208 19 246 215 20 246 215 20
38951-241 208 19 203 166 17 185 133 11 210 150 10
38952-216 158 10 210 150 10 102 78 10 2 2 6
38953- 6 6 6 54 54 54 14 14 14 2 2 6
38954- 2 2 6 62 62 62 74 74 74 30 30 30
38955- 10 10 10 0 0 0 0 0 0 0 0 0
38956- 0 0 0 0 0 0 0 0 0 0 0 0
38957- 0 0 0 0 0 0 0 0 0 0 0 0
38958- 0 0 0 0 0 0 0 0 0 0 0 0
38959- 0 0 0 0 0 0 0 0 0 0 0 0
38960- 0 0 0 0 0 0 0 0 0 0 0 0
38961- 0 0 0 0 0 0 0 0 0 0 0 0
38962- 0 0 0 0 0 0 0 0 0 0 0 0
38963- 0 0 0 0 0 0 0 0 0 0 0 0
38964- 0 0 0 0 0 0 0 0 0 0 0 0
38965- 0 0 0 0 0 0 0 0 0 0 0 0
38966- 0 0 0 0 0 0 0 0 0 0 0 0
38967- 0 0 0 0 0 0 0 0 0 10 10 10
38968- 34 34 34 78 78 78 50 50 50 6 6 6
38969- 94 70 30 139 102 15 190 146 13 226 184 13
38970-232 200 30 232 195 16 215 174 15 190 146 13
38971-168 122 10 192 133 9 210 150 10 213 154 11
38972-202 150 34 182 157 106 101 98 89 2 2 6
38973- 2 2 6 78 78 78 116 116 116 58 58 58
38974- 2 2 6 22 22 22 90 90 90 46 46 46
38975- 18 18 18 6 6 6 0 0 0 0 0 0
38976- 0 0 0 0 0 0 0 0 0 0 0 0
38977- 0 0 0 0 0 0 0 0 0 0 0 0
38978- 0 0 0 0 0 0 0 0 0 0 0 0
38979- 0 0 0 0 0 0 0 0 0 0 0 0
38980- 0 0 0 0 0 0 0 0 0 0 0 0
38981- 0 0 0 0 0 0 0 0 0 0 0 0
38982- 0 0 0 0 0 0 0 0 0 0 0 0
38983- 0 0 0 0 0 0 0 0 0 0 0 0
38984- 0 0 0 0 0 0 0 0 0 0 0 0
38985- 0 0 0 0 0 0 0 0 0 0 0 0
38986- 0 0 0 0 0 0 0 0 0 0 0 0
38987- 0 0 0 0 0 0 0 0 0 10 10 10
38988- 38 38 38 86 86 86 50 50 50 6 6 6
38989-128 128 128 174 154 114 156 107 11 168 122 10
38990-198 155 10 184 144 12 197 138 11 200 144 11
38991-206 145 10 206 145 10 197 138 11 188 164 115
38992-195 195 195 198 198 198 174 174 174 14 14 14
38993- 2 2 6 22 22 22 116 116 116 116 116 116
38994- 22 22 22 2 2 6 74 74 74 70 70 70
38995- 30 30 30 10 10 10 0 0 0 0 0 0
38996- 0 0 0 0 0 0 0 0 0 0 0 0
38997- 0 0 0 0 0 0 0 0 0 0 0 0
38998- 0 0 0 0 0 0 0 0 0 0 0 0
38999- 0 0 0 0 0 0 0 0 0 0 0 0
39000- 0 0 0 0 0 0 0 0 0 0 0 0
39001- 0 0 0 0 0 0 0 0 0 0 0 0
39002- 0 0 0 0 0 0 0 0 0 0 0 0
39003- 0 0 0 0 0 0 0 0 0 0 0 0
39004- 0 0 0 0 0 0 0 0 0 0 0 0
39005- 0 0 0 0 0 0 0 0 0 0 0 0
39006- 0 0 0 0 0 0 0 0 0 0 0 0
39007- 0 0 0 0 0 0 6 6 6 18 18 18
39008- 50 50 50 101 101 101 26 26 26 10 10 10
39009-138 138 138 190 190 190 174 154 114 156 107 11
39010-197 138 11 200 144 11 197 138 11 192 133 9
39011-180 123 7 190 142 34 190 178 144 187 187 187
39012-202 202 202 221 221 221 214 214 214 66 66 66
39013- 2 2 6 2 2 6 50 50 50 62 62 62
39014- 6 6 6 2 2 6 10 10 10 90 90 90
39015- 50 50 50 18 18 18 6 6 6 0 0 0
39016- 0 0 0 0 0 0 0 0 0 0 0 0
39017- 0 0 0 0 0 0 0 0 0 0 0 0
39018- 0 0 0 0 0 0 0 0 0 0 0 0
39019- 0 0 0 0 0 0 0 0 0 0 0 0
39020- 0 0 0 0 0 0 0 0 0 0 0 0
39021- 0 0 0 0 0 0 0 0 0 0 0 0
39022- 0 0 0 0 0 0 0 0 0 0 0 0
39023- 0 0 0 0 0 0 0 0 0 0 0 0
39024- 0 0 0 0 0 0 0 0 0 0 0 0
39025- 0 0 0 0 0 0 0 0 0 0 0 0
39026- 0 0 0 0 0 0 0 0 0 0 0 0
39027- 0 0 0 0 0 0 10 10 10 34 34 34
39028- 74 74 74 74 74 74 2 2 6 6 6 6
39029-144 144 144 198 198 198 190 190 190 178 166 146
39030-154 121 60 156 107 11 156 107 11 168 124 44
39031-174 154 114 187 187 187 190 190 190 210 210 210
39032-246 246 246 253 253 253 253 253 253 182 182 182
39033- 6 6 6 2 2 6 2 2 6 2 2 6
39034- 2 2 6 2 2 6 2 2 6 62 62 62
39035- 74 74 74 34 34 34 14 14 14 0 0 0
39036- 0 0 0 0 0 0 0 0 0 0 0 0
39037- 0 0 0 0 0 0 0 0 0 0 0 0
39038- 0 0 0 0 0 0 0 0 0 0 0 0
39039- 0 0 0 0 0 0 0 0 0 0 0 0
39040- 0 0 0 0 0 0 0 0 0 0 0 0
39041- 0 0 0 0 0 0 0 0 0 0 0 0
39042- 0 0 0 0 0 0 0 0 0 0 0 0
39043- 0 0 0 0 0 0 0 0 0 0 0 0
39044- 0 0 0 0 0 0 0 0 0 0 0 0
39045- 0 0 0 0 0 0 0 0 0 0 0 0
39046- 0 0 0 0 0 0 0 0 0 0 0 0
39047- 0 0 0 10 10 10 22 22 22 54 54 54
39048- 94 94 94 18 18 18 2 2 6 46 46 46
39049-234 234 234 221 221 221 190 190 190 190 190 190
39050-190 190 190 187 187 187 187 187 187 190 190 190
39051-190 190 190 195 195 195 214 214 214 242 242 242
39052-253 253 253 253 253 253 253 253 253 253 253 253
39053- 82 82 82 2 2 6 2 2 6 2 2 6
39054- 2 2 6 2 2 6 2 2 6 14 14 14
39055- 86 86 86 54 54 54 22 22 22 6 6 6
39056- 0 0 0 0 0 0 0 0 0 0 0 0
39057- 0 0 0 0 0 0 0 0 0 0 0 0
39058- 0 0 0 0 0 0 0 0 0 0 0 0
39059- 0 0 0 0 0 0 0 0 0 0 0 0
39060- 0 0 0 0 0 0 0 0 0 0 0 0
39061- 0 0 0 0 0 0 0 0 0 0 0 0
39062- 0 0 0 0 0 0 0 0 0 0 0 0
39063- 0 0 0 0 0 0 0 0 0 0 0 0
39064- 0 0 0 0 0 0 0 0 0 0 0 0
39065- 0 0 0 0 0 0 0 0 0 0 0 0
39066- 0 0 0 0 0 0 0 0 0 0 0 0
39067- 6 6 6 18 18 18 46 46 46 90 90 90
39068- 46 46 46 18 18 18 6 6 6 182 182 182
39069-253 253 253 246 246 246 206 206 206 190 190 190
39070-190 190 190 190 190 190 190 190 190 190 190 190
39071-206 206 206 231 231 231 250 250 250 253 253 253
39072-253 253 253 253 253 253 253 253 253 253 253 253
39073-202 202 202 14 14 14 2 2 6 2 2 6
39074- 2 2 6 2 2 6 2 2 6 2 2 6
39075- 42 42 42 86 86 86 42 42 42 18 18 18
39076- 6 6 6 0 0 0 0 0 0 0 0 0
39077- 0 0 0 0 0 0 0 0 0 0 0 0
39078- 0 0 0 0 0 0 0 0 0 0 0 0
39079- 0 0 0 0 0 0 0 0 0 0 0 0
39080- 0 0 0 0 0 0 0 0 0 0 0 0
39081- 0 0 0 0 0 0 0 0 0 0 0 0
39082- 0 0 0 0 0 0 0 0 0 0 0 0
39083- 0 0 0 0 0 0 0 0 0 0 0 0
39084- 0 0 0 0 0 0 0 0 0 0 0 0
39085- 0 0 0 0 0 0 0 0 0 0 0 0
39086- 0 0 0 0 0 0 0 0 0 6 6 6
39087- 14 14 14 38 38 38 74 74 74 66 66 66
39088- 2 2 6 6 6 6 90 90 90 250 250 250
39089-253 253 253 253 253 253 238 238 238 198 198 198
39090-190 190 190 190 190 190 195 195 195 221 221 221
39091-246 246 246 253 253 253 253 253 253 253 253 253
39092-253 253 253 253 253 253 253 253 253 253 253 253
39093-253 253 253 82 82 82 2 2 6 2 2 6
39094- 2 2 6 2 2 6 2 2 6 2 2 6
39095- 2 2 6 78 78 78 70 70 70 34 34 34
39096- 14 14 14 6 6 6 0 0 0 0 0 0
39097- 0 0 0 0 0 0 0 0 0 0 0 0
39098- 0 0 0 0 0 0 0 0 0 0 0 0
39099- 0 0 0 0 0 0 0 0 0 0 0 0
39100- 0 0 0 0 0 0 0 0 0 0 0 0
39101- 0 0 0 0 0 0 0 0 0 0 0 0
39102- 0 0 0 0 0 0 0 0 0 0 0 0
39103- 0 0 0 0 0 0 0 0 0 0 0 0
39104- 0 0 0 0 0 0 0 0 0 0 0 0
39105- 0 0 0 0 0 0 0 0 0 0 0 0
39106- 0 0 0 0 0 0 0 0 0 14 14 14
39107- 34 34 34 66 66 66 78 78 78 6 6 6
39108- 2 2 6 18 18 18 218 218 218 253 253 253
39109-253 253 253 253 253 253 253 253 253 246 246 246
39110-226 226 226 231 231 231 246 246 246 253 253 253
39111-253 253 253 253 253 253 253 253 253 253 253 253
39112-253 253 253 253 253 253 253 253 253 253 253 253
39113-253 253 253 178 178 178 2 2 6 2 2 6
39114- 2 2 6 2 2 6 2 2 6 2 2 6
39115- 2 2 6 18 18 18 90 90 90 62 62 62
39116- 30 30 30 10 10 10 0 0 0 0 0 0
39117- 0 0 0 0 0 0 0 0 0 0 0 0
39118- 0 0 0 0 0 0 0 0 0 0 0 0
39119- 0 0 0 0 0 0 0 0 0 0 0 0
39120- 0 0 0 0 0 0 0 0 0 0 0 0
39121- 0 0 0 0 0 0 0 0 0 0 0 0
39122- 0 0 0 0 0 0 0 0 0 0 0 0
39123- 0 0 0 0 0 0 0 0 0 0 0 0
39124- 0 0 0 0 0 0 0 0 0 0 0 0
39125- 0 0 0 0 0 0 0 0 0 0 0 0
39126- 0 0 0 0 0 0 10 10 10 26 26 26
39127- 58 58 58 90 90 90 18 18 18 2 2 6
39128- 2 2 6 110 110 110 253 253 253 253 253 253
39129-253 253 253 253 253 253 253 253 253 253 253 253
39130-250 250 250 253 253 253 253 253 253 253 253 253
39131-253 253 253 253 253 253 253 253 253 253 253 253
39132-253 253 253 253 253 253 253 253 253 253 253 253
39133-253 253 253 231 231 231 18 18 18 2 2 6
39134- 2 2 6 2 2 6 2 2 6 2 2 6
39135- 2 2 6 2 2 6 18 18 18 94 94 94
39136- 54 54 54 26 26 26 10 10 10 0 0 0
39137- 0 0 0 0 0 0 0 0 0 0 0 0
39138- 0 0 0 0 0 0 0 0 0 0 0 0
39139- 0 0 0 0 0 0 0 0 0 0 0 0
39140- 0 0 0 0 0 0 0 0 0 0 0 0
39141- 0 0 0 0 0 0 0 0 0 0 0 0
39142- 0 0 0 0 0 0 0 0 0 0 0 0
39143- 0 0 0 0 0 0 0 0 0 0 0 0
39144- 0 0 0 0 0 0 0 0 0 0 0 0
39145- 0 0 0 0 0 0 0 0 0 0 0 0
39146- 0 0 0 6 6 6 22 22 22 50 50 50
39147- 90 90 90 26 26 26 2 2 6 2 2 6
39148- 14 14 14 195 195 195 250 250 250 253 253 253
39149-253 253 253 253 253 253 253 253 253 253 253 253
39150-253 253 253 253 253 253 253 253 253 253 253 253
39151-253 253 253 253 253 253 253 253 253 253 253 253
39152-253 253 253 253 253 253 253 253 253 253 253 253
39153-250 250 250 242 242 242 54 54 54 2 2 6
39154- 2 2 6 2 2 6 2 2 6 2 2 6
39155- 2 2 6 2 2 6 2 2 6 38 38 38
39156- 86 86 86 50 50 50 22 22 22 6 6 6
39157- 0 0 0 0 0 0 0 0 0 0 0 0
39158- 0 0 0 0 0 0 0 0 0 0 0 0
39159- 0 0 0 0 0 0 0 0 0 0 0 0
39160- 0 0 0 0 0 0 0 0 0 0 0 0
39161- 0 0 0 0 0 0 0 0 0 0 0 0
39162- 0 0 0 0 0 0 0 0 0 0 0 0
39163- 0 0 0 0 0 0 0 0 0 0 0 0
39164- 0 0 0 0 0 0 0 0 0 0 0 0
39165- 0 0 0 0 0 0 0 0 0 0 0 0
39166- 6 6 6 14 14 14 38 38 38 82 82 82
39167- 34 34 34 2 2 6 2 2 6 2 2 6
39168- 42 42 42 195 195 195 246 246 246 253 253 253
39169-253 253 253 253 253 253 253 253 253 250 250 250
39170-242 242 242 242 242 242 250 250 250 253 253 253
39171-253 253 253 253 253 253 253 253 253 253 253 253
39172-253 253 253 250 250 250 246 246 246 238 238 238
39173-226 226 226 231 231 231 101 101 101 6 6 6
39174- 2 2 6 2 2 6 2 2 6 2 2 6
39175- 2 2 6 2 2 6 2 2 6 2 2 6
39176- 38 38 38 82 82 82 42 42 42 14 14 14
39177- 6 6 6 0 0 0 0 0 0 0 0 0
39178- 0 0 0 0 0 0 0 0 0 0 0 0
39179- 0 0 0 0 0 0 0 0 0 0 0 0
39180- 0 0 0 0 0 0 0 0 0 0 0 0
39181- 0 0 0 0 0 0 0 0 0 0 0 0
39182- 0 0 0 0 0 0 0 0 0 0 0 0
39183- 0 0 0 0 0 0 0 0 0 0 0 0
39184- 0 0 0 0 0 0 0 0 0 0 0 0
39185- 0 0 0 0 0 0 0 0 0 0 0 0
39186- 10 10 10 26 26 26 62 62 62 66 66 66
39187- 2 2 6 2 2 6 2 2 6 6 6 6
39188- 70 70 70 170 170 170 206 206 206 234 234 234
39189-246 246 246 250 250 250 250 250 250 238 238 238
39190-226 226 226 231 231 231 238 238 238 250 250 250
39191-250 250 250 250 250 250 246 246 246 231 231 231
39192-214 214 214 206 206 206 202 202 202 202 202 202
39193-198 198 198 202 202 202 182 182 182 18 18 18
39194- 2 2 6 2 2 6 2 2 6 2 2 6
39195- 2 2 6 2 2 6 2 2 6 2 2 6
39196- 2 2 6 62 62 62 66 66 66 30 30 30
39197- 10 10 10 0 0 0 0 0 0 0 0 0
39198- 0 0 0 0 0 0 0 0 0 0 0 0
39199- 0 0 0 0 0 0 0 0 0 0 0 0
39200- 0 0 0 0 0 0 0 0 0 0 0 0
39201- 0 0 0 0 0 0 0 0 0 0 0 0
39202- 0 0 0 0 0 0 0 0 0 0 0 0
39203- 0 0 0 0 0 0 0 0 0 0 0 0
39204- 0 0 0 0 0 0 0 0 0 0 0 0
39205- 0 0 0 0 0 0 0 0 0 0 0 0
39206- 14 14 14 42 42 42 82 82 82 18 18 18
39207- 2 2 6 2 2 6 2 2 6 10 10 10
39208- 94 94 94 182 182 182 218 218 218 242 242 242
39209-250 250 250 253 253 253 253 253 253 250 250 250
39210-234 234 234 253 253 253 253 253 253 253 253 253
39211-253 253 253 253 253 253 253 253 253 246 246 246
39212-238 238 238 226 226 226 210 210 210 202 202 202
39213-195 195 195 195 195 195 210 210 210 158 158 158
39214- 6 6 6 14 14 14 50 50 50 14 14 14
39215- 2 2 6 2 2 6 2 2 6 2 2 6
39216- 2 2 6 6 6 6 86 86 86 46 46 46
39217- 18 18 18 6 6 6 0 0 0 0 0 0
39218- 0 0 0 0 0 0 0 0 0 0 0 0
39219- 0 0 0 0 0 0 0 0 0 0 0 0
39220- 0 0 0 0 0 0 0 0 0 0 0 0
39221- 0 0 0 0 0 0 0 0 0 0 0 0
39222- 0 0 0 0 0 0 0 0 0 0 0 0
39223- 0 0 0 0 0 0 0 0 0 0 0 0
39224- 0 0 0 0 0 0 0 0 0 0 0 0
39225- 0 0 0 0 0 0 0 0 0 6 6 6
39226- 22 22 22 54 54 54 70 70 70 2 2 6
39227- 2 2 6 10 10 10 2 2 6 22 22 22
39228-166 166 166 231 231 231 250 250 250 253 253 253
39229-253 253 253 253 253 253 253 253 253 250 250 250
39230-242 242 242 253 253 253 253 253 253 253 253 253
39231-253 253 253 253 253 253 253 253 253 253 253 253
39232-253 253 253 253 253 253 253 253 253 246 246 246
39233-231 231 231 206 206 206 198 198 198 226 226 226
39234- 94 94 94 2 2 6 6 6 6 38 38 38
39235- 30 30 30 2 2 6 2 2 6 2 2 6
39236- 2 2 6 2 2 6 62 62 62 66 66 66
39237- 26 26 26 10 10 10 0 0 0 0 0 0
39238- 0 0 0 0 0 0 0 0 0 0 0 0
39239- 0 0 0 0 0 0 0 0 0 0 0 0
39240- 0 0 0 0 0 0 0 0 0 0 0 0
39241- 0 0 0 0 0 0 0 0 0 0 0 0
39242- 0 0 0 0 0 0 0 0 0 0 0 0
39243- 0 0 0 0 0 0 0 0 0 0 0 0
39244- 0 0 0 0 0 0 0 0 0 0 0 0
39245- 0 0 0 0 0 0 0 0 0 10 10 10
39246- 30 30 30 74 74 74 50 50 50 2 2 6
39247- 26 26 26 26 26 26 2 2 6 106 106 106
39248-238 238 238 253 253 253 253 253 253 253 253 253
39249-253 253 253 253 253 253 253 253 253 253 253 253
39250-253 253 253 253 253 253 253 253 253 253 253 253
39251-253 253 253 253 253 253 253 253 253 253 253 253
39252-253 253 253 253 253 253 253 253 253 253 253 253
39253-253 253 253 246 246 246 218 218 218 202 202 202
39254-210 210 210 14 14 14 2 2 6 2 2 6
39255- 30 30 30 22 22 22 2 2 6 2 2 6
39256- 2 2 6 2 2 6 18 18 18 86 86 86
39257- 42 42 42 14 14 14 0 0 0 0 0 0
39258- 0 0 0 0 0 0 0 0 0 0 0 0
39259- 0 0 0 0 0 0 0 0 0 0 0 0
39260- 0 0 0 0 0 0 0 0 0 0 0 0
39261- 0 0 0 0 0 0 0 0 0 0 0 0
39262- 0 0 0 0 0 0 0 0 0 0 0 0
39263- 0 0 0 0 0 0 0 0 0 0 0 0
39264- 0 0 0 0 0 0 0 0 0 0 0 0
39265- 0 0 0 0 0 0 0 0 0 14 14 14
39266- 42 42 42 90 90 90 22 22 22 2 2 6
39267- 42 42 42 2 2 6 18 18 18 218 218 218
39268-253 253 253 253 253 253 253 253 253 253 253 253
39269-253 253 253 253 253 253 253 253 253 253 253 253
39270-253 253 253 253 253 253 253 253 253 253 253 253
39271-253 253 253 253 253 253 253 253 253 253 253 253
39272-253 253 253 253 253 253 253 253 253 253 253 253
39273-253 253 253 253 253 253 250 250 250 221 221 221
39274-218 218 218 101 101 101 2 2 6 14 14 14
39275- 18 18 18 38 38 38 10 10 10 2 2 6
39276- 2 2 6 2 2 6 2 2 6 78 78 78
39277- 58 58 58 22 22 22 6 6 6 0 0 0
39278- 0 0 0 0 0 0 0 0 0 0 0 0
39279- 0 0 0 0 0 0 0 0 0 0 0 0
39280- 0 0 0 0 0 0 0 0 0 0 0 0
39281- 0 0 0 0 0 0 0 0 0 0 0 0
39282- 0 0 0 0 0 0 0 0 0 0 0 0
39283- 0 0 0 0 0 0 0 0 0 0 0 0
39284- 0 0 0 0 0 0 0 0 0 0 0 0
39285- 0 0 0 0 0 0 6 6 6 18 18 18
39286- 54 54 54 82 82 82 2 2 6 26 26 26
39287- 22 22 22 2 2 6 123 123 123 253 253 253
39288-253 253 253 253 253 253 253 253 253 253 253 253
39289-253 253 253 253 253 253 253 253 253 253 253 253
39290-253 253 253 253 253 253 253 253 253 253 253 253
39291-253 253 253 253 253 253 253 253 253 253 253 253
39292-253 253 253 253 253 253 253 253 253 253 253 253
39293-253 253 253 253 253 253 253 253 253 250 250 250
39294-238 238 238 198 198 198 6 6 6 38 38 38
39295- 58 58 58 26 26 26 38 38 38 2 2 6
39296- 2 2 6 2 2 6 2 2 6 46 46 46
39297- 78 78 78 30 30 30 10 10 10 0 0 0
39298- 0 0 0 0 0 0 0 0 0 0 0 0
39299- 0 0 0 0 0 0 0 0 0 0 0 0
39300- 0 0 0 0 0 0 0 0 0 0 0 0
39301- 0 0 0 0 0 0 0 0 0 0 0 0
39302- 0 0 0 0 0 0 0 0 0 0 0 0
39303- 0 0 0 0 0 0 0 0 0 0 0 0
39304- 0 0 0 0 0 0 0 0 0 0 0 0
39305- 0 0 0 0 0 0 10 10 10 30 30 30
39306- 74 74 74 58 58 58 2 2 6 42 42 42
39307- 2 2 6 22 22 22 231 231 231 253 253 253
39308-253 253 253 253 253 253 253 253 253 253 253 253
39309-253 253 253 253 253 253 253 253 253 250 250 250
39310-253 253 253 253 253 253 253 253 253 253 253 253
39311-253 253 253 253 253 253 253 253 253 253 253 253
39312-253 253 253 253 253 253 253 253 253 253 253 253
39313-253 253 253 253 253 253 253 253 253 253 253 253
39314-253 253 253 246 246 246 46 46 46 38 38 38
39315- 42 42 42 14 14 14 38 38 38 14 14 14
39316- 2 2 6 2 2 6 2 2 6 6 6 6
39317- 86 86 86 46 46 46 14 14 14 0 0 0
39318- 0 0 0 0 0 0 0 0 0 0 0 0
39319- 0 0 0 0 0 0 0 0 0 0 0 0
39320- 0 0 0 0 0 0 0 0 0 0 0 0
39321- 0 0 0 0 0 0 0 0 0 0 0 0
39322- 0 0 0 0 0 0 0 0 0 0 0 0
39323- 0 0 0 0 0 0 0 0 0 0 0 0
39324- 0 0 0 0 0 0 0 0 0 0 0 0
39325- 0 0 0 6 6 6 14 14 14 42 42 42
39326- 90 90 90 18 18 18 18 18 18 26 26 26
39327- 2 2 6 116 116 116 253 253 253 253 253 253
39328-253 253 253 253 253 253 253 253 253 253 253 253
39329-253 253 253 253 253 253 250 250 250 238 238 238
39330-253 253 253 253 253 253 253 253 253 253 253 253
39331-253 253 253 253 253 253 253 253 253 253 253 253
39332-253 253 253 253 253 253 253 253 253 253 253 253
39333-253 253 253 253 253 253 253 253 253 253 253 253
39334-253 253 253 253 253 253 94 94 94 6 6 6
39335- 2 2 6 2 2 6 10 10 10 34 34 34
39336- 2 2 6 2 2 6 2 2 6 2 2 6
39337- 74 74 74 58 58 58 22 22 22 6 6 6
39338- 0 0 0 0 0 0 0 0 0 0 0 0
39339- 0 0 0 0 0 0 0 0 0 0 0 0
39340- 0 0 0 0 0 0 0 0 0 0 0 0
39341- 0 0 0 0 0 0 0 0 0 0 0 0
39342- 0 0 0 0 0 0 0 0 0 0 0 0
39343- 0 0 0 0 0 0 0 0 0 0 0 0
39344- 0 0 0 0 0 0 0 0 0 0 0 0
39345- 0 0 0 10 10 10 26 26 26 66 66 66
39346- 82 82 82 2 2 6 38 38 38 6 6 6
39347- 14 14 14 210 210 210 253 253 253 253 253 253
39348-253 253 253 253 253 253 253 253 253 253 253 253
39349-253 253 253 253 253 253 246 246 246 242 242 242
39350-253 253 253 253 253 253 253 253 253 253 253 253
39351-253 253 253 253 253 253 253 253 253 253 253 253
39352-253 253 253 253 253 253 253 253 253 253 253 253
39353-253 253 253 253 253 253 253 253 253 253 253 253
39354-253 253 253 253 253 253 144 144 144 2 2 6
39355- 2 2 6 2 2 6 2 2 6 46 46 46
39356- 2 2 6 2 2 6 2 2 6 2 2 6
39357- 42 42 42 74 74 74 30 30 30 10 10 10
39358- 0 0 0 0 0 0 0 0 0 0 0 0
39359- 0 0 0 0 0 0 0 0 0 0 0 0
39360- 0 0 0 0 0 0 0 0 0 0 0 0
39361- 0 0 0 0 0 0 0 0 0 0 0 0
39362- 0 0 0 0 0 0 0 0 0 0 0 0
39363- 0 0 0 0 0 0 0 0 0 0 0 0
39364- 0 0 0 0 0 0 0 0 0 0 0 0
39365- 6 6 6 14 14 14 42 42 42 90 90 90
39366- 26 26 26 6 6 6 42 42 42 2 2 6
39367- 74 74 74 250 250 250 253 253 253 253 253 253
39368-253 253 253 253 253 253 253 253 253 253 253 253
39369-253 253 253 253 253 253 242 242 242 242 242 242
39370-253 253 253 253 253 253 253 253 253 253 253 253
39371-253 253 253 253 253 253 253 253 253 253 253 253
39372-253 253 253 253 253 253 253 253 253 253 253 253
39373-253 253 253 253 253 253 253 253 253 253 253 253
39374-253 253 253 253 253 253 182 182 182 2 2 6
39375- 2 2 6 2 2 6 2 2 6 46 46 46
39376- 2 2 6 2 2 6 2 2 6 2 2 6
39377- 10 10 10 86 86 86 38 38 38 10 10 10
39378- 0 0 0 0 0 0 0 0 0 0 0 0
39379- 0 0 0 0 0 0 0 0 0 0 0 0
39380- 0 0 0 0 0 0 0 0 0 0 0 0
39381- 0 0 0 0 0 0 0 0 0 0 0 0
39382- 0 0 0 0 0 0 0 0 0 0 0 0
39383- 0 0 0 0 0 0 0 0 0 0 0 0
39384- 0 0 0 0 0 0 0 0 0 0 0 0
39385- 10 10 10 26 26 26 66 66 66 82 82 82
39386- 2 2 6 22 22 22 18 18 18 2 2 6
39387-149 149 149 253 253 253 253 253 253 253 253 253
39388-253 253 253 253 253 253 253 253 253 253 253 253
39389-253 253 253 253 253 253 234 234 234 242 242 242
39390-253 253 253 253 253 253 253 253 253 253 253 253
39391-253 253 253 253 253 253 253 253 253 253 253 253
39392-253 253 253 253 253 253 253 253 253 253 253 253
39393-253 253 253 253 253 253 253 253 253 253 253 253
39394-253 253 253 253 253 253 206 206 206 2 2 6
39395- 2 2 6 2 2 6 2 2 6 38 38 38
39396- 2 2 6 2 2 6 2 2 6 2 2 6
39397- 6 6 6 86 86 86 46 46 46 14 14 14
39398- 0 0 0 0 0 0 0 0 0 0 0 0
39399- 0 0 0 0 0 0 0 0 0 0 0 0
39400- 0 0 0 0 0 0 0 0 0 0 0 0
39401- 0 0 0 0 0 0 0 0 0 0 0 0
39402- 0 0 0 0 0 0 0 0 0 0 0 0
39403- 0 0 0 0 0 0 0 0 0 0 0 0
39404- 0 0 0 0 0 0 0 0 0 6 6 6
39405- 18 18 18 46 46 46 86 86 86 18 18 18
39406- 2 2 6 34 34 34 10 10 10 6 6 6
39407-210 210 210 253 253 253 253 253 253 253 253 253
39408-253 253 253 253 253 253 253 253 253 253 253 253
39409-253 253 253 253 253 253 234 234 234 242 242 242
39410-253 253 253 253 253 253 253 253 253 253 253 253
39411-253 253 253 253 253 253 253 253 253 253 253 253
39412-253 253 253 253 253 253 253 253 253 253 253 253
39413-253 253 253 253 253 253 253 253 253 253 253 253
39414-253 253 253 253 253 253 221 221 221 6 6 6
39415- 2 2 6 2 2 6 6 6 6 30 30 30
39416- 2 2 6 2 2 6 2 2 6 2 2 6
39417- 2 2 6 82 82 82 54 54 54 18 18 18
39418- 6 6 6 0 0 0 0 0 0 0 0 0
39419- 0 0 0 0 0 0 0 0 0 0 0 0
39420- 0 0 0 0 0 0 0 0 0 0 0 0
39421- 0 0 0 0 0 0 0 0 0 0 0 0
39422- 0 0 0 0 0 0 0 0 0 0 0 0
39423- 0 0 0 0 0 0 0 0 0 0 0 0
39424- 0 0 0 0 0 0 0 0 0 10 10 10
39425- 26 26 26 66 66 66 62 62 62 2 2 6
39426- 2 2 6 38 38 38 10 10 10 26 26 26
39427-238 238 238 253 253 253 253 253 253 253 253 253
39428-253 253 253 253 253 253 253 253 253 253 253 253
39429-253 253 253 253 253 253 231 231 231 238 238 238
39430-253 253 253 253 253 253 253 253 253 253 253 253
39431-253 253 253 253 253 253 253 253 253 253 253 253
39432-253 253 253 253 253 253 253 253 253 253 253 253
39433-253 253 253 253 253 253 253 253 253 253 253 253
39434-253 253 253 253 253 253 231 231 231 6 6 6
39435- 2 2 6 2 2 6 10 10 10 30 30 30
39436- 2 2 6 2 2 6 2 2 6 2 2 6
39437- 2 2 6 66 66 66 58 58 58 22 22 22
39438- 6 6 6 0 0 0 0 0 0 0 0 0
39439- 0 0 0 0 0 0 0 0 0 0 0 0
39440- 0 0 0 0 0 0 0 0 0 0 0 0
39441- 0 0 0 0 0 0 0 0 0 0 0 0
39442- 0 0 0 0 0 0 0 0 0 0 0 0
39443- 0 0 0 0 0 0 0 0 0 0 0 0
39444- 0 0 0 0 0 0 0 0 0 10 10 10
39445- 38 38 38 78 78 78 6 6 6 2 2 6
39446- 2 2 6 46 46 46 14 14 14 42 42 42
39447-246 246 246 253 253 253 253 253 253 253 253 253
39448-253 253 253 253 253 253 253 253 253 253 253 253
39449-253 253 253 253 253 253 231 231 231 242 242 242
39450-253 253 253 253 253 253 253 253 253 253 253 253
39451-253 253 253 253 253 253 253 253 253 253 253 253
39452-253 253 253 253 253 253 253 253 253 253 253 253
39453-253 253 253 253 253 253 253 253 253 253 253 253
39454-253 253 253 253 253 253 234 234 234 10 10 10
39455- 2 2 6 2 2 6 22 22 22 14 14 14
39456- 2 2 6 2 2 6 2 2 6 2 2 6
39457- 2 2 6 66 66 66 62 62 62 22 22 22
39458- 6 6 6 0 0 0 0 0 0 0 0 0
39459- 0 0 0 0 0 0 0 0 0 0 0 0
39460- 0 0 0 0 0 0 0 0 0 0 0 0
39461- 0 0 0 0 0 0 0 0 0 0 0 0
39462- 0 0 0 0 0 0 0 0 0 0 0 0
39463- 0 0 0 0 0 0 0 0 0 0 0 0
39464- 0 0 0 0 0 0 6 6 6 18 18 18
39465- 50 50 50 74 74 74 2 2 6 2 2 6
39466- 14 14 14 70 70 70 34 34 34 62 62 62
39467-250 250 250 253 253 253 253 253 253 253 253 253
39468-253 253 253 253 253 253 253 253 253 253 253 253
39469-253 253 253 253 253 253 231 231 231 246 246 246
39470-253 253 253 253 253 253 253 253 253 253 253 253
39471-253 253 253 253 253 253 253 253 253 253 253 253
39472-253 253 253 253 253 253 253 253 253 253 253 253
39473-253 253 253 253 253 253 253 253 253 253 253 253
39474-253 253 253 253 253 253 234 234 234 14 14 14
39475- 2 2 6 2 2 6 30 30 30 2 2 6
39476- 2 2 6 2 2 6 2 2 6 2 2 6
39477- 2 2 6 66 66 66 62 62 62 22 22 22
39478- 6 6 6 0 0 0 0 0 0 0 0 0
39479- 0 0 0 0 0 0 0 0 0 0 0 0
39480- 0 0 0 0 0 0 0 0 0 0 0 0
39481- 0 0 0 0 0 0 0 0 0 0 0 0
39482- 0 0 0 0 0 0 0 0 0 0 0 0
39483- 0 0 0 0 0 0 0 0 0 0 0 0
39484- 0 0 0 0 0 0 6 6 6 18 18 18
39485- 54 54 54 62 62 62 2 2 6 2 2 6
39486- 2 2 6 30 30 30 46 46 46 70 70 70
39487-250 250 250 253 253 253 253 253 253 253 253 253
39488-253 253 253 253 253 253 253 253 253 253 253 253
39489-253 253 253 253 253 253 231 231 231 246 246 246
39490-253 253 253 253 253 253 253 253 253 253 253 253
39491-253 253 253 253 253 253 253 253 253 253 253 253
39492-253 253 253 253 253 253 253 253 253 253 253 253
39493-253 253 253 253 253 253 253 253 253 253 253 253
39494-253 253 253 253 253 253 226 226 226 10 10 10
39495- 2 2 6 6 6 6 30 30 30 2 2 6
39496- 2 2 6 2 2 6 2 2 6 2 2 6
39497- 2 2 6 66 66 66 58 58 58 22 22 22
39498- 6 6 6 0 0 0 0 0 0 0 0 0
39499- 0 0 0 0 0 0 0 0 0 0 0 0
39500- 0 0 0 0 0 0 0 0 0 0 0 0
39501- 0 0 0 0 0 0 0 0 0 0 0 0
39502- 0 0 0 0 0 0 0 0 0 0 0 0
39503- 0 0 0 0 0 0 0 0 0 0 0 0
39504- 0 0 0 0 0 0 6 6 6 22 22 22
39505- 58 58 58 62 62 62 2 2 6 2 2 6
39506- 2 2 6 2 2 6 30 30 30 78 78 78
39507-250 250 250 253 253 253 253 253 253 253 253 253
39508-253 253 253 253 253 253 253 253 253 253 253 253
39509-253 253 253 253 253 253 231 231 231 246 246 246
39510-253 253 253 253 253 253 253 253 253 253 253 253
39511-253 253 253 253 253 253 253 253 253 253 253 253
39512-253 253 253 253 253 253 253 253 253 253 253 253
39513-253 253 253 253 253 253 253 253 253 253 253 253
39514-253 253 253 253 253 253 206 206 206 2 2 6
39515- 22 22 22 34 34 34 18 14 6 22 22 22
39516- 26 26 26 18 18 18 6 6 6 2 2 6
39517- 2 2 6 82 82 82 54 54 54 18 18 18
39518- 6 6 6 0 0 0 0 0 0 0 0 0
39519- 0 0 0 0 0 0 0 0 0 0 0 0
39520- 0 0 0 0 0 0 0 0 0 0 0 0
39521- 0 0 0 0 0 0 0 0 0 0 0 0
39522- 0 0 0 0 0 0 0 0 0 0 0 0
39523- 0 0 0 0 0 0 0 0 0 0 0 0
39524- 0 0 0 0 0 0 6 6 6 26 26 26
39525- 62 62 62 106 106 106 74 54 14 185 133 11
39526-210 162 10 121 92 8 6 6 6 62 62 62
39527-238 238 238 253 253 253 253 253 253 253 253 253
39528-253 253 253 253 253 253 253 253 253 253 253 253
39529-253 253 253 253 253 253 231 231 231 246 246 246
39530-253 253 253 253 253 253 253 253 253 253 253 253
39531-253 253 253 253 253 253 253 253 253 253 253 253
39532-253 253 253 253 253 253 253 253 253 253 253 253
39533-253 253 253 253 253 253 253 253 253 253 253 253
39534-253 253 253 253 253 253 158 158 158 18 18 18
39535- 14 14 14 2 2 6 2 2 6 2 2 6
39536- 6 6 6 18 18 18 66 66 66 38 38 38
39537- 6 6 6 94 94 94 50 50 50 18 18 18
39538- 6 6 6 0 0 0 0 0 0 0 0 0
39539- 0 0 0 0 0 0 0 0 0 0 0 0
39540- 0 0 0 0 0 0 0 0 0 0 0 0
39541- 0 0 0 0 0 0 0 0 0 0 0 0
39542- 0 0 0 0 0 0 0 0 0 0 0 0
39543- 0 0 0 0 0 0 0 0 0 6 6 6
39544- 10 10 10 10 10 10 18 18 18 38 38 38
39545- 78 78 78 142 134 106 216 158 10 242 186 14
39546-246 190 14 246 190 14 156 118 10 10 10 10
39547- 90 90 90 238 238 238 253 253 253 253 253 253
39548-253 253 253 253 253 253 253 253 253 253 253 253
39549-253 253 253 253 253 253 231 231 231 250 250 250
39550-253 253 253 253 253 253 253 253 253 253 253 253
39551-253 253 253 253 253 253 253 253 253 253 253 253
39552-253 253 253 253 253 253 253 253 253 253 253 253
39553-253 253 253 253 253 253 253 253 253 246 230 190
39554-238 204 91 238 204 91 181 142 44 37 26 9
39555- 2 2 6 2 2 6 2 2 6 2 2 6
39556- 2 2 6 2 2 6 38 38 38 46 46 46
39557- 26 26 26 106 106 106 54 54 54 18 18 18
39558- 6 6 6 0 0 0 0 0 0 0 0 0
39559- 0 0 0 0 0 0 0 0 0 0 0 0
39560- 0 0 0 0 0 0 0 0 0 0 0 0
39561- 0 0 0 0 0 0 0 0 0 0 0 0
39562- 0 0 0 0 0 0 0 0 0 0 0 0
39563- 0 0 0 6 6 6 14 14 14 22 22 22
39564- 30 30 30 38 38 38 50 50 50 70 70 70
39565-106 106 106 190 142 34 226 170 11 242 186 14
39566-246 190 14 246 190 14 246 190 14 154 114 10
39567- 6 6 6 74 74 74 226 226 226 253 253 253
39568-253 253 253 253 253 253 253 253 253 253 253 253
39569-253 253 253 253 253 253 231 231 231 250 250 250
39570-253 253 253 253 253 253 253 253 253 253 253 253
39571-253 253 253 253 253 253 253 253 253 253 253 253
39572-253 253 253 253 253 253 253 253 253 253 253 253
39573-253 253 253 253 253 253 253 253 253 228 184 62
39574-241 196 14 241 208 19 232 195 16 38 30 10
39575- 2 2 6 2 2 6 2 2 6 2 2 6
39576- 2 2 6 6 6 6 30 30 30 26 26 26
39577-203 166 17 154 142 90 66 66 66 26 26 26
39578- 6 6 6 0 0 0 0 0 0 0 0 0
39579- 0 0 0 0 0 0 0 0 0 0 0 0
39580- 0 0 0 0 0 0 0 0 0 0 0 0
39581- 0 0 0 0 0 0 0 0 0 0 0 0
39582- 0 0 0 0 0 0 0 0 0 0 0 0
39583- 6 6 6 18 18 18 38 38 38 58 58 58
39584- 78 78 78 86 86 86 101 101 101 123 123 123
39585-175 146 61 210 150 10 234 174 13 246 186 14
39586-246 190 14 246 190 14 246 190 14 238 190 10
39587-102 78 10 2 2 6 46 46 46 198 198 198
39588-253 253 253 253 253 253 253 253 253 253 253 253
39589-253 253 253 253 253 253 234 234 234 242 242 242
39590-253 253 253 253 253 253 253 253 253 253 253 253
39591-253 253 253 253 253 253 253 253 253 253 253 253
39592-253 253 253 253 253 253 253 253 253 253 253 253
39593-253 253 253 253 253 253 253 253 253 224 178 62
39594-242 186 14 241 196 14 210 166 10 22 18 6
39595- 2 2 6 2 2 6 2 2 6 2 2 6
39596- 2 2 6 2 2 6 6 6 6 121 92 8
39597-238 202 15 232 195 16 82 82 82 34 34 34
39598- 10 10 10 0 0 0 0 0 0 0 0 0
39599- 0 0 0 0 0 0 0 0 0 0 0 0
39600- 0 0 0 0 0 0 0 0 0 0 0 0
39601- 0 0 0 0 0 0 0 0 0 0 0 0
39602- 0 0 0 0 0 0 0 0 0 0 0 0
39603- 14 14 14 38 38 38 70 70 70 154 122 46
39604-190 142 34 200 144 11 197 138 11 197 138 11
39605-213 154 11 226 170 11 242 186 14 246 190 14
39606-246 190 14 246 190 14 246 190 14 246 190 14
39607-225 175 15 46 32 6 2 2 6 22 22 22
39608-158 158 158 250 250 250 253 253 253 253 253 253
39609-253 253 253 253 253 253 253 253 253 253 253 253
39610-253 253 253 253 253 253 253 253 253 253 253 253
39611-253 253 253 253 253 253 253 253 253 253 253 253
39612-253 253 253 253 253 253 253 253 253 253 253 253
39613-253 253 253 250 250 250 242 242 242 224 178 62
39614-239 182 13 236 186 11 213 154 11 46 32 6
39615- 2 2 6 2 2 6 2 2 6 2 2 6
39616- 2 2 6 2 2 6 61 42 6 225 175 15
39617-238 190 10 236 186 11 112 100 78 42 42 42
39618- 14 14 14 0 0 0 0 0 0 0 0 0
39619- 0 0 0 0 0 0 0 0 0 0 0 0
39620- 0 0 0 0 0 0 0 0 0 0 0 0
39621- 0 0 0 0 0 0 0 0 0 0 0 0
39622- 0 0 0 0 0 0 0 0 0 6 6 6
39623- 22 22 22 54 54 54 154 122 46 213 154 11
39624-226 170 11 230 174 11 226 170 11 226 170 11
39625-236 178 12 242 186 14 246 190 14 246 190 14
39626-246 190 14 246 190 14 246 190 14 246 190 14
39627-241 196 14 184 144 12 10 10 10 2 2 6
39628- 6 6 6 116 116 116 242 242 242 253 253 253
39629-253 253 253 253 253 253 253 253 253 253 253 253
39630-253 253 253 253 253 253 253 253 253 253 253 253
39631-253 253 253 253 253 253 253 253 253 253 253 253
39632-253 253 253 253 253 253 253 253 253 253 253 253
39633-253 253 253 231 231 231 198 198 198 214 170 54
39634-236 178 12 236 178 12 210 150 10 137 92 6
39635- 18 14 6 2 2 6 2 2 6 2 2 6
39636- 6 6 6 70 47 6 200 144 11 236 178 12
39637-239 182 13 239 182 13 124 112 88 58 58 58
39638- 22 22 22 6 6 6 0 0 0 0 0 0
39639- 0 0 0 0 0 0 0 0 0 0 0 0
39640- 0 0 0 0 0 0 0 0 0 0 0 0
39641- 0 0 0 0 0 0 0 0 0 0 0 0
39642- 0 0 0 0 0 0 0 0 0 10 10 10
39643- 30 30 30 70 70 70 180 133 36 226 170 11
39644-239 182 13 242 186 14 242 186 14 246 186 14
39645-246 190 14 246 190 14 246 190 14 246 190 14
39646-246 190 14 246 190 14 246 190 14 246 190 14
39647-246 190 14 232 195 16 98 70 6 2 2 6
39648- 2 2 6 2 2 6 66 66 66 221 221 221
39649-253 253 253 253 253 253 253 253 253 253 253 253
39650-253 253 253 253 253 253 253 253 253 253 253 253
39651-253 253 253 253 253 253 253 253 253 253 253 253
39652-253 253 253 253 253 253 253 253 253 253 253 253
39653-253 253 253 206 206 206 198 198 198 214 166 58
39654-230 174 11 230 174 11 216 158 10 192 133 9
39655-163 110 8 116 81 8 102 78 10 116 81 8
39656-167 114 7 197 138 11 226 170 11 239 182 13
39657-242 186 14 242 186 14 162 146 94 78 78 78
39658- 34 34 34 14 14 14 6 6 6 0 0 0
39659- 0 0 0 0 0 0 0 0 0 0 0 0
39660- 0 0 0 0 0 0 0 0 0 0 0 0
39661- 0 0 0 0 0 0 0 0 0 0 0 0
39662- 0 0 0 0 0 0 0 0 0 6 6 6
39663- 30 30 30 78 78 78 190 142 34 226 170 11
39664-239 182 13 246 190 14 246 190 14 246 190 14
39665-246 190 14 246 190 14 246 190 14 246 190 14
39666-246 190 14 246 190 14 246 190 14 246 190 14
39667-246 190 14 241 196 14 203 166 17 22 18 6
39668- 2 2 6 2 2 6 2 2 6 38 38 38
39669-218 218 218 253 253 253 253 253 253 253 253 253
39670-253 253 253 253 253 253 253 253 253 253 253 253
39671-253 253 253 253 253 253 253 253 253 253 253 253
39672-253 253 253 253 253 253 253 253 253 253 253 253
39673-250 250 250 206 206 206 198 198 198 202 162 69
39674-226 170 11 236 178 12 224 166 10 210 150 10
39675-200 144 11 197 138 11 192 133 9 197 138 11
39676-210 150 10 226 170 11 242 186 14 246 190 14
39677-246 190 14 246 186 14 225 175 15 124 112 88
39678- 62 62 62 30 30 30 14 14 14 6 6 6
39679- 0 0 0 0 0 0 0 0 0 0 0 0
39680- 0 0 0 0 0 0 0 0 0 0 0 0
39681- 0 0 0 0 0 0 0 0 0 0 0 0
39682- 0 0 0 0 0 0 0 0 0 10 10 10
39683- 30 30 30 78 78 78 174 135 50 224 166 10
39684-239 182 13 246 190 14 246 190 14 246 190 14
39685-246 190 14 246 190 14 246 190 14 246 190 14
39686-246 190 14 246 190 14 246 190 14 246 190 14
39687-246 190 14 246 190 14 241 196 14 139 102 15
39688- 2 2 6 2 2 6 2 2 6 2 2 6
39689- 78 78 78 250 250 250 253 253 253 253 253 253
39690-253 253 253 253 253 253 253 253 253 253 253 253
39691-253 253 253 253 253 253 253 253 253 253 253 253
39692-253 253 253 253 253 253 253 253 253 253 253 253
39693-250 250 250 214 214 214 198 198 198 190 150 46
39694-219 162 10 236 178 12 234 174 13 224 166 10
39695-216 158 10 213 154 11 213 154 11 216 158 10
39696-226 170 11 239 182 13 246 190 14 246 190 14
39697-246 190 14 246 190 14 242 186 14 206 162 42
39698-101 101 101 58 58 58 30 30 30 14 14 14
39699- 6 6 6 0 0 0 0 0 0 0 0 0
39700- 0 0 0 0 0 0 0 0 0 0 0 0
39701- 0 0 0 0 0 0 0 0 0 0 0 0
39702- 0 0 0 0 0 0 0 0 0 10 10 10
39703- 30 30 30 74 74 74 174 135 50 216 158 10
39704-236 178 12 246 190 14 246 190 14 246 190 14
39705-246 190 14 246 190 14 246 190 14 246 190 14
39706-246 190 14 246 190 14 246 190 14 246 190 14
39707-246 190 14 246 190 14 241 196 14 226 184 13
39708- 61 42 6 2 2 6 2 2 6 2 2 6
39709- 22 22 22 238 238 238 253 253 253 253 253 253
39710-253 253 253 253 253 253 253 253 253 253 253 253
39711-253 253 253 253 253 253 253 253 253 253 253 253
39712-253 253 253 253 253 253 253 253 253 253 253 253
39713-253 253 253 226 226 226 187 187 187 180 133 36
39714-216 158 10 236 178 12 239 182 13 236 178 12
39715-230 174 11 226 170 11 226 170 11 230 174 11
39716-236 178 12 242 186 14 246 190 14 246 190 14
39717-246 190 14 246 190 14 246 186 14 239 182 13
39718-206 162 42 106 106 106 66 66 66 34 34 34
39719- 14 14 14 6 6 6 0 0 0 0 0 0
39720- 0 0 0 0 0 0 0 0 0 0 0 0
39721- 0 0 0 0 0 0 0 0 0 0 0 0
39722- 0 0 0 0 0 0 0 0 0 6 6 6
39723- 26 26 26 70 70 70 163 133 67 213 154 11
39724-236 178 12 246 190 14 246 190 14 246 190 14
39725-246 190 14 246 190 14 246 190 14 246 190 14
39726-246 190 14 246 190 14 246 190 14 246 190 14
39727-246 190 14 246 190 14 246 190 14 241 196 14
39728-190 146 13 18 14 6 2 2 6 2 2 6
39729- 46 46 46 246 246 246 253 253 253 253 253 253
39730-253 253 253 253 253 253 253 253 253 253 253 253
39731-253 253 253 253 253 253 253 253 253 253 253 253
39732-253 253 253 253 253 253 253 253 253 253 253 253
39733-253 253 253 221 221 221 86 86 86 156 107 11
39734-216 158 10 236 178 12 242 186 14 246 186 14
39735-242 186 14 239 182 13 239 182 13 242 186 14
39736-242 186 14 246 186 14 246 190 14 246 190 14
39737-246 190 14 246 190 14 246 190 14 246 190 14
39738-242 186 14 225 175 15 142 122 72 66 66 66
39739- 30 30 30 10 10 10 0 0 0 0 0 0
39740- 0 0 0 0 0 0 0 0 0 0 0 0
39741- 0 0 0 0 0 0 0 0 0 0 0 0
39742- 0 0 0 0 0 0 0 0 0 6 6 6
39743- 26 26 26 70 70 70 163 133 67 210 150 10
39744-236 178 12 246 190 14 246 190 14 246 190 14
39745-246 190 14 246 190 14 246 190 14 246 190 14
39746-246 190 14 246 190 14 246 190 14 246 190 14
39747-246 190 14 246 190 14 246 190 14 246 190 14
39748-232 195 16 121 92 8 34 34 34 106 106 106
39749-221 221 221 253 253 253 253 253 253 253 253 253
39750-253 253 253 253 253 253 253 253 253 253 253 253
39751-253 253 253 253 253 253 253 253 253 253 253 253
39752-253 253 253 253 253 253 253 253 253 253 253 253
39753-242 242 242 82 82 82 18 14 6 163 110 8
39754-216 158 10 236 178 12 242 186 14 246 190 14
39755-246 190 14 246 190 14 246 190 14 246 190 14
39756-246 190 14 246 190 14 246 190 14 246 190 14
39757-246 190 14 246 190 14 246 190 14 246 190 14
39758-246 190 14 246 190 14 242 186 14 163 133 67
39759- 46 46 46 18 18 18 6 6 6 0 0 0
39760- 0 0 0 0 0 0 0 0 0 0 0 0
39761- 0 0 0 0 0 0 0 0 0 0 0 0
39762- 0 0 0 0 0 0 0 0 0 10 10 10
39763- 30 30 30 78 78 78 163 133 67 210 150 10
39764-236 178 12 246 186 14 246 190 14 246 190 14
39765-246 190 14 246 190 14 246 190 14 246 190 14
39766-246 190 14 246 190 14 246 190 14 246 190 14
39767-246 190 14 246 190 14 246 190 14 246 190 14
39768-241 196 14 215 174 15 190 178 144 253 253 253
39769-253 253 253 253 253 253 253 253 253 253 253 253
39770-253 253 253 253 253 253 253 253 253 253 253 253
39771-253 253 253 253 253 253 253 253 253 253 253 253
39772-253 253 253 253 253 253 253 253 253 218 218 218
39773- 58 58 58 2 2 6 22 18 6 167 114 7
39774-216 158 10 236 178 12 246 186 14 246 190 14
39775-246 190 14 246 190 14 246 190 14 246 190 14
39776-246 190 14 246 190 14 246 190 14 246 190 14
39777-246 190 14 246 190 14 246 190 14 246 190 14
39778-246 190 14 246 186 14 242 186 14 190 150 46
39779- 54 54 54 22 22 22 6 6 6 0 0 0
39780- 0 0 0 0 0 0 0 0 0 0 0 0
39781- 0 0 0 0 0 0 0 0 0 0 0 0
39782- 0 0 0 0 0 0 0 0 0 14 14 14
39783- 38 38 38 86 86 86 180 133 36 213 154 11
39784-236 178 12 246 186 14 246 190 14 246 190 14
39785-246 190 14 246 190 14 246 190 14 246 190 14
39786-246 190 14 246 190 14 246 190 14 246 190 14
39787-246 190 14 246 190 14 246 190 14 246 190 14
39788-246 190 14 232 195 16 190 146 13 214 214 214
39789-253 253 253 253 253 253 253 253 253 253 253 253
39790-253 253 253 253 253 253 253 253 253 253 253 253
39791-253 253 253 253 253 253 253 253 253 253 253 253
39792-253 253 253 250 250 250 170 170 170 26 26 26
39793- 2 2 6 2 2 6 37 26 9 163 110 8
39794-219 162 10 239 182 13 246 186 14 246 190 14
39795-246 190 14 246 190 14 246 190 14 246 190 14
39796-246 190 14 246 190 14 246 190 14 246 190 14
39797-246 190 14 246 190 14 246 190 14 246 190 14
39798-246 186 14 236 178 12 224 166 10 142 122 72
39799- 46 46 46 18 18 18 6 6 6 0 0 0
39800- 0 0 0 0 0 0 0 0 0 0 0 0
39801- 0 0 0 0 0 0 0 0 0 0 0 0
39802- 0 0 0 0 0 0 6 6 6 18 18 18
39803- 50 50 50 109 106 95 192 133 9 224 166 10
39804-242 186 14 246 190 14 246 190 14 246 190 14
39805-246 190 14 246 190 14 246 190 14 246 190 14
39806-246 190 14 246 190 14 246 190 14 246 190 14
39807-246 190 14 246 190 14 246 190 14 246 190 14
39808-242 186 14 226 184 13 210 162 10 142 110 46
39809-226 226 226 253 253 253 253 253 253 253 253 253
39810-253 253 253 253 253 253 253 253 253 253 253 253
39811-253 253 253 253 253 253 253 253 253 253 253 253
39812-198 198 198 66 66 66 2 2 6 2 2 6
39813- 2 2 6 2 2 6 50 34 6 156 107 11
39814-219 162 10 239 182 13 246 186 14 246 190 14
39815-246 190 14 246 190 14 246 190 14 246 190 14
39816-246 190 14 246 190 14 246 190 14 246 190 14
39817-246 190 14 246 190 14 246 190 14 242 186 14
39818-234 174 13 213 154 11 154 122 46 66 66 66
39819- 30 30 30 10 10 10 0 0 0 0 0 0
39820- 0 0 0 0 0 0 0 0 0 0 0 0
39821- 0 0 0 0 0 0 0 0 0 0 0 0
39822- 0 0 0 0 0 0 6 6 6 22 22 22
39823- 58 58 58 154 121 60 206 145 10 234 174 13
39824-242 186 14 246 186 14 246 190 14 246 190 14
39825-246 190 14 246 190 14 246 190 14 246 190 14
39826-246 190 14 246 190 14 246 190 14 246 190 14
39827-246 190 14 246 190 14 246 190 14 246 190 14
39828-246 186 14 236 178 12 210 162 10 163 110 8
39829- 61 42 6 138 138 138 218 218 218 250 250 250
39830-253 253 253 253 253 253 253 253 253 250 250 250
39831-242 242 242 210 210 210 144 144 144 66 66 66
39832- 6 6 6 2 2 6 2 2 6 2 2 6
39833- 2 2 6 2 2 6 61 42 6 163 110 8
39834-216 158 10 236 178 12 246 190 14 246 190 14
39835-246 190 14 246 190 14 246 190 14 246 190 14
39836-246 190 14 246 190 14 246 190 14 246 190 14
39837-246 190 14 239 182 13 230 174 11 216 158 10
39838-190 142 34 124 112 88 70 70 70 38 38 38
39839- 18 18 18 6 6 6 0 0 0 0 0 0
39840- 0 0 0 0 0 0 0 0 0 0 0 0
39841- 0 0 0 0 0 0 0 0 0 0 0 0
39842- 0 0 0 0 0 0 6 6 6 22 22 22
39843- 62 62 62 168 124 44 206 145 10 224 166 10
39844-236 178 12 239 182 13 242 186 14 242 186 14
39845-246 186 14 246 190 14 246 190 14 246 190 14
39846-246 190 14 246 190 14 246 190 14 246 190 14
39847-246 190 14 246 190 14 246 190 14 246 190 14
39848-246 190 14 236 178 12 216 158 10 175 118 6
39849- 80 54 7 2 2 6 6 6 6 30 30 30
39850- 54 54 54 62 62 62 50 50 50 38 38 38
39851- 14 14 14 2 2 6 2 2 6 2 2 6
39852- 2 2 6 2 2 6 2 2 6 2 2 6
39853- 2 2 6 6 6 6 80 54 7 167 114 7
39854-213 154 11 236 178 12 246 190 14 246 190 14
39855-246 190 14 246 190 14 246 190 14 246 190 14
39856-246 190 14 242 186 14 239 182 13 239 182 13
39857-230 174 11 210 150 10 174 135 50 124 112 88
39858- 82 82 82 54 54 54 34 34 34 18 18 18
39859- 6 6 6 0 0 0 0 0 0 0 0 0
39860- 0 0 0 0 0 0 0 0 0 0 0 0
39861- 0 0 0 0 0 0 0 0 0 0 0 0
39862- 0 0 0 0 0 0 6 6 6 18 18 18
39863- 50 50 50 158 118 36 192 133 9 200 144 11
39864-216 158 10 219 162 10 224 166 10 226 170 11
39865-230 174 11 236 178 12 239 182 13 239 182 13
39866-242 186 14 246 186 14 246 190 14 246 190 14
39867-246 190 14 246 190 14 246 190 14 246 190 14
39868-246 186 14 230 174 11 210 150 10 163 110 8
39869-104 69 6 10 10 10 2 2 6 2 2 6
39870- 2 2 6 2 2 6 2 2 6 2 2 6
39871- 2 2 6 2 2 6 2 2 6 2 2 6
39872- 2 2 6 2 2 6 2 2 6 2 2 6
39873- 2 2 6 6 6 6 91 60 6 167 114 7
39874-206 145 10 230 174 11 242 186 14 246 190 14
39875-246 190 14 246 190 14 246 186 14 242 186 14
39876-239 182 13 230 174 11 224 166 10 213 154 11
39877-180 133 36 124 112 88 86 86 86 58 58 58
39878- 38 38 38 22 22 22 10 10 10 6 6 6
39879- 0 0 0 0 0 0 0 0 0 0 0 0
39880- 0 0 0 0 0 0 0 0 0 0 0 0
39881- 0 0 0 0 0 0 0 0 0 0 0 0
39882- 0 0 0 0 0 0 0 0 0 14 14 14
39883- 34 34 34 70 70 70 138 110 50 158 118 36
39884-167 114 7 180 123 7 192 133 9 197 138 11
39885-200 144 11 206 145 10 213 154 11 219 162 10
39886-224 166 10 230 174 11 239 182 13 242 186 14
39887-246 186 14 246 186 14 246 186 14 246 186 14
39888-239 182 13 216 158 10 185 133 11 152 99 6
39889-104 69 6 18 14 6 2 2 6 2 2 6
39890- 2 2 6 2 2 6 2 2 6 2 2 6
39891- 2 2 6 2 2 6 2 2 6 2 2 6
39892- 2 2 6 2 2 6 2 2 6 2 2 6
39893- 2 2 6 6 6 6 80 54 7 152 99 6
39894-192 133 9 219 162 10 236 178 12 239 182 13
39895-246 186 14 242 186 14 239 182 13 236 178 12
39896-224 166 10 206 145 10 192 133 9 154 121 60
39897- 94 94 94 62 62 62 42 42 42 22 22 22
39898- 14 14 14 6 6 6 0 0 0 0 0 0
39899- 0 0 0 0 0 0 0 0 0 0 0 0
39900- 0 0 0 0 0 0 0 0 0 0 0 0
39901- 0 0 0 0 0 0 0 0 0 0 0 0
39902- 0 0 0 0 0 0 0 0 0 6 6 6
39903- 18 18 18 34 34 34 58 58 58 78 78 78
39904-101 98 89 124 112 88 142 110 46 156 107 11
39905-163 110 8 167 114 7 175 118 6 180 123 7
39906-185 133 11 197 138 11 210 150 10 219 162 10
39907-226 170 11 236 178 12 236 178 12 234 174 13
39908-219 162 10 197 138 11 163 110 8 130 83 6
39909- 91 60 6 10 10 10 2 2 6 2 2 6
39910- 18 18 18 38 38 38 38 38 38 38 38 38
39911- 38 38 38 38 38 38 38 38 38 38 38 38
39912- 38 38 38 38 38 38 26 26 26 2 2 6
39913- 2 2 6 6 6 6 70 47 6 137 92 6
39914-175 118 6 200 144 11 219 162 10 230 174 11
39915-234 174 13 230 174 11 219 162 10 210 150 10
39916-192 133 9 163 110 8 124 112 88 82 82 82
39917- 50 50 50 30 30 30 14 14 14 6 6 6
39918- 0 0 0 0 0 0 0 0 0 0 0 0
39919- 0 0 0 0 0 0 0 0 0 0 0 0
39920- 0 0 0 0 0 0 0 0 0 0 0 0
39921- 0 0 0 0 0 0 0 0 0 0 0 0
39922- 0 0 0 0 0 0 0 0 0 0 0 0
39923- 6 6 6 14 14 14 22 22 22 34 34 34
39924- 42 42 42 58 58 58 74 74 74 86 86 86
39925-101 98 89 122 102 70 130 98 46 121 87 25
39926-137 92 6 152 99 6 163 110 8 180 123 7
39927-185 133 11 197 138 11 206 145 10 200 144 11
39928-180 123 7 156 107 11 130 83 6 104 69 6
39929- 50 34 6 54 54 54 110 110 110 101 98 89
39930- 86 86 86 82 82 82 78 78 78 78 78 78
39931- 78 78 78 78 78 78 78 78 78 78 78 78
39932- 78 78 78 82 82 82 86 86 86 94 94 94
39933-106 106 106 101 101 101 86 66 34 124 80 6
39934-156 107 11 180 123 7 192 133 9 200 144 11
39935-206 145 10 200 144 11 192 133 9 175 118 6
39936-139 102 15 109 106 95 70 70 70 42 42 42
39937- 22 22 22 10 10 10 0 0 0 0 0 0
39938- 0 0 0 0 0 0 0 0 0 0 0 0
39939- 0 0 0 0 0 0 0 0 0 0 0 0
39940- 0 0 0 0 0 0 0 0 0 0 0 0
39941- 0 0 0 0 0 0 0 0 0 0 0 0
39942- 0 0 0 0 0 0 0 0 0 0 0 0
39943- 0 0 0 0 0 0 6 6 6 10 10 10
39944- 14 14 14 22 22 22 30 30 30 38 38 38
39945- 50 50 50 62 62 62 74 74 74 90 90 90
39946-101 98 89 112 100 78 121 87 25 124 80 6
39947-137 92 6 152 99 6 152 99 6 152 99 6
39948-138 86 6 124 80 6 98 70 6 86 66 30
39949-101 98 89 82 82 82 58 58 58 46 46 46
39950- 38 38 38 34 34 34 34 34 34 34 34 34
39951- 34 34 34 34 34 34 34 34 34 34 34 34
39952- 34 34 34 34 34 34 38 38 38 42 42 42
39953- 54 54 54 82 82 82 94 86 76 91 60 6
39954-134 86 6 156 107 11 167 114 7 175 118 6
39955-175 118 6 167 114 7 152 99 6 121 87 25
39956-101 98 89 62 62 62 34 34 34 18 18 18
39957- 6 6 6 0 0 0 0 0 0 0 0 0
39958- 0 0 0 0 0 0 0 0 0 0 0 0
39959- 0 0 0 0 0 0 0 0 0 0 0 0
39960- 0 0 0 0 0 0 0 0 0 0 0 0
39961- 0 0 0 0 0 0 0 0 0 0 0 0
39962- 0 0 0 0 0 0 0 0 0 0 0 0
39963- 0 0 0 0 0 0 0 0 0 0 0 0
39964- 0 0 0 6 6 6 6 6 6 10 10 10
39965- 18 18 18 22 22 22 30 30 30 42 42 42
39966- 50 50 50 66 66 66 86 86 86 101 98 89
39967-106 86 58 98 70 6 104 69 6 104 69 6
39968-104 69 6 91 60 6 82 62 34 90 90 90
39969- 62 62 62 38 38 38 22 22 22 14 14 14
39970- 10 10 10 10 10 10 10 10 10 10 10 10
39971- 10 10 10 10 10 10 6 6 6 10 10 10
39972- 10 10 10 10 10 10 10 10 10 14 14 14
39973- 22 22 22 42 42 42 70 70 70 89 81 66
39974- 80 54 7 104 69 6 124 80 6 137 92 6
39975-134 86 6 116 81 8 100 82 52 86 86 86
39976- 58 58 58 30 30 30 14 14 14 6 6 6
39977- 0 0 0 0 0 0 0 0 0 0 0 0
39978- 0 0 0 0 0 0 0 0 0 0 0 0
39979- 0 0 0 0 0 0 0 0 0 0 0 0
39980- 0 0 0 0 0 0 0 0 0 0 0 0
39981- 0 0 0 0 0 0 0 0 0 0 0 0
39982- 0 0 0 0 0 0 0 0 0 0 0 0
39983- 0 0 0 0 0 0 0 0 0 0 0 0
39984- 0 0 0 0 0 0 0 0 0 0 0 0
39985- 0 0 0 6 6 6 10 10 10 14 14 14
39986- 18 18 18 26 26 26 38 38 38 54 54 54
39987- 70 70 70 86 86 86 94 86 76 89 81 66
39988- 89 81 66 86 86 86 74 74 74 50 50 50
39989- 30 30 30 14 14 14 6 6 6 0 0 0
39990- 0 0 0 0 0 0 0 0 0 0 0 0
39991- 0 0 0 0 0 0 0 0 0 0 0 0
39992- 0 0 0 0 0 0 0 0 0 0 0 0
39993- 6 6 6 18 18 18 34 34 34 58 58 58
39994- 82 82 82 89 81 66 89 81 66 89 81 66
39995- 94 86 66 94 86 76 74 74 74 50 50 50
39996- 26 26 26 14 14 14 6 6 6 0 0 0
39997- 0 0 0 0 0 0 0 0 0 0 0 0
39998- 0 0 0 0 0 0 0 0 0 0 0 0
39999- 0 0 0 0 0 0 0 0 0 0 0 0
40000- 0 0 0 0 0 0 0 0 0 0 0 0
40001- 0 0 0 0 0 0 0 0 0 0 0 0
40002- 0 0 0 0 0 0 0 0 0 0 0 0
40003- 0 0 0 0 0 0 0 0 0 0 0 0
40004- 0 0 0 0 0 0 0 0 0 0 0 0
40005- 0 0 0 0 0 0 0 0 0 0 0 0
40006- 6 6 6 6 6 6 14 14 14 18 18 18
40007- 30 30 30 38 38 38 46 46 46 54 54 54
40008- 50 50 50 42 42 42 30 30 30 18 18 18
40009- 10 10 10 0 0 0 0 0 0 0 0 0
40010- 0 0 0 0 0 0 0 0 0 0 0 0
40011- 0 0 0 0 0 0 0 0 0 0 0 0
40012- 0 0 0 0 0 0 0 0 0 0 0 0
40013- 0 0 0 6 6 6 14 14 14 26 26 26
40014- 38 38 38 50 50 50 58 58 58 58 58 58
40015- 54 54 54 42 42 42 30 30 30 18 18 18
40016- 10 10 10 0 0 0 0 0 0 0 0 0
40017- 0 0 0 0 0 0 0 0 0 0 0 0
40018- 0 0 0 0 0 0 0 0 0 0 0 0
40019- 0 0 0 0 0 0 0 0 0 0 0 0
40020- 0 0 0 0 0 0 0 0 0 0 0 0
40021- 0 0 0 0 0 0 0 0 0 0 0 0
40022- 0 0 0 0 0 0 0 0 0 0 0 0
40023- 0 0 0 0 0 0 0 0 0 0 0 0
40024- 0 0 0 0 0 0 0 0 0 0 0 0
40025- 0 0 0 0 0 0 0 0 0 0 0 0
40026- 0 0 0 0 0 0 0 0 0 6 6 6
40027- 6 6 6 10 10 10 14 14 14 18 18 18
40028- 18 18 18 14 14 14 10 10 10 6 6 6
40029- 0 0 0 0 0 0 0 0 0 0 0 0
40030- 0 0 0 0 0 0 0 0 0 0 0 0
40031- 0 0 0 0 0 0 0 0 0 0 0 0
40032- 0 0 0 0 0 0 0 0 0 0 0 0
40033- 0 0 0 0 0 0 0 0 0 6 6 6
40034- 14 14 14 18 18 18 22 22 22 22 22 22
40035- 18 18 18 14 14 14 10 10 10 6 6 6
40036- 0 0 0 0 0 0 0 0 0 0 0 0
40037- 0 0 0 0 0 0 0 0 0 0 0 0
40038- 0 0 0 0 0 0 0 0 0 0 0 0
40039- 0 0 0 0 0 0 0 0 0 0 0 0
40040- 0 0 0 0 0 0 0 0 0 0 0 0
40041+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40042+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40043+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40044+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40045+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40046+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40047+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40048+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40049+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40050+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40051+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40052+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40053+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40054+4 4 4 4 4 4
40055+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40056+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40057+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40058+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40059+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40060+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40061+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40062+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40063+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40064+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40065+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40066+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40067+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40068+4 4 4 4 4 4
40069+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40070+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40071+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40072+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40073+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40074+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40075+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40076+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40077+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40078+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40079+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40080+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40081+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40082+4 4 4 4 4 4
40083+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40084+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40085+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40086+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40087+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40088+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40089+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40090+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40091+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40092+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40093+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40094+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40095+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40096+4 4 4 4 4 4
40097+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40098+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40099+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40100+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40101+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40102+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40103+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40104+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40105+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40106+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40107+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40108+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40109+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40110+4 4 4 4 4 4
40111+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40112+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40113+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40114+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40115+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40116+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40117+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40118+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40119+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40120+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40121+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40122+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40123+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40124+4 4 4 4 4 4
40125+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40126+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40127+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40128+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40129+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40130+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40131+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40132+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40133+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40134+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40135+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40136+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40137+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40138+4 4 4 4 4 4
40139+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40140+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40141+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40142+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40143+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40144+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40145+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40146+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40147+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40148+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40149+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40150+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40151+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40152+4 4 4 4 4 4
40153+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40154+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40155+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40156+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40157+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40158+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40159+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40160+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40161+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40162+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40163+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40164+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40165+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40166+4 4 4 4 4 4
40167+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40168+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40169+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40170+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40171+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40172+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40173+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40174+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40175+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40176+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40177+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40178+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40179+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40180+4 4 4 4 4 4
40181+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40182+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40183+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40184+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40185+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40186+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40187+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40188+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40189+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40190+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40191+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40192+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40193+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40194+4 4 4 4 4 4
40195+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40196+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40197+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40198+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
40199+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
40200+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
40201+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
40202+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
40203+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
40204+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
40205+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
40206+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
40207+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
40208+4 4 4 4 4 4
40209+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40210+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40211+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
40212+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
40213+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
40214+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
40215+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
40216+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
40217+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
40218+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
40219+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
40220+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
40221+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
40222+4 4 4 4 4 4
40223+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40224+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40225+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
40226+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
40227+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
40228+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
40229+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
40230+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
40231+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
40232+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
40233+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
40234+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
40235+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
40236+4 4 4 4 4 4
40237+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40238+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40239+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
40240+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
40241+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
40242+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
40243+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
40244+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
40245+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
40246+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
40247+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
40248+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
40249+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40250+4 4 4 4 4 4
40251+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40252+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40253+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
40254+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
40255+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
40256+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
40257+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
40258+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
40259+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
40260+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
40261+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
40262+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
40263+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
40264+4 4 4 4 4 4
40265+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40266+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
40267+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
40268+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
40269+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
40270+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
40271+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
40272+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
40273+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
40274+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
40275+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
40276+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
40277+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
40278+4 4 4 4 4 4
40279+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40280+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
40281+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
40282+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
40283+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40284+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
40285+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
40286+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
40287+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
40288+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
40289+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
40290+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
40291+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
40292+0 0 0 4 4 4
40293+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40294+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
40295+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
40296+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
40297+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
40298+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
40299+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
40300+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
40301+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
40302+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
40303+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
40304+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
40305+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
40306+2 0 0 0 0 0
40307+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
40308+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
40309+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
40310+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
40311+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
40312+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
40313+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
40314+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
40315+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
40316+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
40317+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
40318+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
40319+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
40320+37 38 37 0 0 0
40321+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40322+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
40323+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
40324+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
40325+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
40326+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
40327+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
40328+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
40329+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
40330+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
40331+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
40332+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
40333+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
40334+85 115 134 4 0 0
40335+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
40336+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
40337+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
40338+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
40339+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
40340+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
40341+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
40342+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
40343+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
40344+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
40345+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
40346+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
40347+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
40348+60 73 81 4 0 0
40349+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
40350+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
40351+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
40352+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
40353+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
40354+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
40355+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
40356+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
40357+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
40358+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
40359+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
40360+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
40361+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
40362+16 19 21 4 0 0
40363+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
40364+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
40365+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
40366+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
40367+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
40368+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
40369+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
40370+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
40371+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
40372+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
40373+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
40374+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
40375+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
40376+4 0 0 4 3 3
40377+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
40378+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
40379+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
40380+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
40381+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
40382+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
40383+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
40384+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
40385+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
40386+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
40387+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
40388+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
40389+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
40390+3 2 2 4 4 4
40391+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
40392+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
40393+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
40394+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
40395+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
40396+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
40397+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
40398+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
40399+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
40400+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
40401+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
40402+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
40403+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
40404+4 4 4 4 4 4
40405+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
40406+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
40407+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
40408+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
40409+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
40410+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
40411+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
40412+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
40413+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
40414+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
40415+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
40416+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
40417+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
40418+4 4 4 4 4 4
40419+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
40420+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
40421+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
40422+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
40423+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
40424+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40425+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
40426+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
40427+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
40428+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
40429+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
40430+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
40431+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
40432+5 5 5 5 5 5
40433+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
40434+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
40435+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
40436+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
40437+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
40438+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40439+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
40440+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
40441+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
40442+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
40443+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
40444+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
40445+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
40446+5 5 5 4 4 4
40447+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
40448+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
40449+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
40450+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
40451+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40452+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
40453+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
40454+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
40455+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
40456+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
40457+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
40458+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40459+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40460+4 4 4 4 4 4
40461+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
40462+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
40463+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
40464+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
40465+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
40466+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40467+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40468+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
40469+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
40470+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
40471+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
40472+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
40473+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40474+4 4 4 4 4 4
40475+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
40476+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
40477+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
40478+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
40479+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40480+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
40481+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
40482+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
40483+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
40484+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
40485+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
40486+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40487+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40488+4 4 4 4 4 4
40489+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
40490+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
40491+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
40492+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
40493+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40494+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40495+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
40496+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
40497+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
40498+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
40499+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
40500+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40501+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40502+4 4 4 4 4 4
40503+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
40504+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
40505+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
40506+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
40507+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40508+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
40509+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
40510+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
40511+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
40512+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
40513+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40514+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40515+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40516+4 4 4 4 4 4
40517+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
40518+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
40519+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
40520+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
40521+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
40522+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
40523+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
40524+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
40525+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
40526+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
40527+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
40528+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40529+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40530+4 4 4 4 4 4
40531+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
40532+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
40533+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
40534+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
40535+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
40536+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
40537+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
40538+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
40539+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
40540+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
40541+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
40542+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40543+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40544+4 4 4 4 4 4
40545+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
40546+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
40547+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
40548+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40549+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
40550+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
40551+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
40552+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
40553+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
40554+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
40555+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40556+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40557+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40558+4 4 4 4 4 4
40559+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
40560+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
40561+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
40562+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40563+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40564+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
40565+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
40566+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
40567+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
40568+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
40569+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40570+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40571+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40572+4 4 4 4 4 4
40573+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
40574+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
40575+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40576+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
40577+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40578+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
40579+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
40580+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
40581+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
40582+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
40583+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40584+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40585+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40586+4 4 4 4 4 4
40587+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
40588+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
40589+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40590+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
40591+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40592+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
40593+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
40594+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
40595+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40596+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40597+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40598+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40599+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40600+4 4 4 4 4 4
40601+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40602+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
40603+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
40604+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
40605+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
40606+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
40607+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
40608+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
40609+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40610+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40611+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40612+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40613+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40614+4 4 4 4 4 4
40615+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
40616+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
40617+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
40618+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
40619+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40620+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
40621+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
40622+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
40623+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40624+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40625+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40626+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40627+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40628+4 4 4 4 4 4
40629+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
40630+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
40631+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40632+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
40633+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
40634+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
40635+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
40636+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
40637+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40638+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40639+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40640+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40641+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40642+4 4 4 4 4 4
40643+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
40644+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
40645+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40646+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
40647+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
40648+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
40649+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
40650+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
40651+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
40652+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40653+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40654+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40655+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40656+4 4 4 4 4 4
40657+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40658+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
40659+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
40660+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
40661+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
40662+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
40663+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
40664+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
40665+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40666+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40667+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40668+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40669+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40670+4 4 4 4 4 4
40671+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
40672+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
40673+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40674+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
40675+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
40676+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
40677+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
40678+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
40679+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
40680+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40681+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40682+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40683+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40684+4 4 4 4 4 4
40685+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
40686+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
40687+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
40688+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
40689+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
40690+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
40691+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
40692+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
40693+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40694+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40695+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40696+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40697+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40698+4 4 4 4 4 4
40699+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40700+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
40701+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
40702+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
40703+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
40704+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
40705+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
40706+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
40707+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40708+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40709+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40710+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40711+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40712+4 4 4 4 4 4
40713+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40714+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
40715+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
40716+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
40717+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
40718+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
40719+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40720+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
40721+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
40722+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40723+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40724+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40725+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40726+4 4 4 4 4 4
40727+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40728+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
40729+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
40730+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40731+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
40732+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
40733+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
40734+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
40735+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
40736+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40737+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40738+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40739+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40740+4 4 4 4 4 4
40741+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
40742+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
40743+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
40744+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
40745+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
40746+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
40747+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
40748+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
40749+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
40750+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40751+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40752+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40753+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40754+4 4 4 4 4 4
40755+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40756+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
40757+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
40758+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
40759+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
40760+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
40761+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
40762+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
40763+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
40764+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40765+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40766+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40767+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40768+4 4 4 4 4 4
40769+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
40770+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
40771+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
40772+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
40773+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
40774+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
40775+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
40776+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
40777+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
40778+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40779+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40780+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40781+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40782+4 4 4 4 4 4
40783+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
40784+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
40785+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
40786+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
40787+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
40788+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
40789+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
40790+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
40791+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
40792+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
40793+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40794+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40795+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40796+4 4 4 4 4 4
40797+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
40798+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
40799+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
40800+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
40801+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
40802+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
40803+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
40804+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
40805+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
40806+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
40807+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
40808+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40809+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40810+4 4 4 4 4 4
40811+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
40812+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
40813+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
40814+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
40815+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
40816+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
40817+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
40818+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
40819+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
40820+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
40821+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40822+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40823+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40824+4 4 4 4 4 4
40825+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
40826+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
40827+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
40828+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
40829+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
40830+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
40831+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40832+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
40833+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
40834+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
40835+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40836+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40837+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40838+4 4 4 4 4 4
40839+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
40840+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
40841+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
40842+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
40843+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
40844+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
40845+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
40846+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
40847+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
40848+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
40849+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40850+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40851+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40852+4 4 4 4 4 4
40853+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
40854+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
40855+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
40856+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
40857+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
40858+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
40859+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
40860+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
40861+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
40862+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
40863+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40864+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40865+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40866+4 4 4 4 4 4
40867+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
40868+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
40869+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
40870+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
40871+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
40872+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
40873+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
40874+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
40875+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
40876+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
40877+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40878+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40879+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40880+4 4 4 4 4 4
40881+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
40882+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
40883+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
40884+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
40885+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
40886+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
40887+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
40888+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
40889+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
40890+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
40891+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40892+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40893+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40894+4 4 4 4 4 4
40895+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
40896+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
40897+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
40898+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
40899+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
40900+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
40901+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
40902+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
40903+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
40904+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40905+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40906+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40907+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40908+4 4 4 4 4 4
40909+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
40910+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
40911+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
40912+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
40913+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
40914+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
40915+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
40916+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
40917+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
40918+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40919+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40920+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40921+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40922+4 4 4 4 4 4
40923+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
40924+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
40925+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
40926+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
40927+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
40928+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
40929+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
40930+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
40931+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
40932+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40933+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40934+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40935+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40936+4 4 4 4 4 4
40937+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
40938+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
40939+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
40940+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
40941+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
40942+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
40943+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
40944+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
40945+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40946+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40947+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40948+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40949+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40950+4 4 4 4 4 4
40951+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
40952+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
40953+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
40954+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
40955+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
40956+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
40957+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
40958+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
40959+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40960+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40961+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40962+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40963+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40964+4 4 4 4 4 4
40965+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
40966+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
40967+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
40968+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
40969+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
40970+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
40971+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
40972+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
40973+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40974+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40975+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40976+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40977+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40978+4 4 4 4 4 4
40979+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
40980+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
40981+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
40982+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
40983+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
40984+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
40985+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
40986+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
40987+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40988+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40989+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40990+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40991+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40992+4 4 4 4 4 4
40993+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40994+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
40995+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
40996+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
40997+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
40998+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
40999+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41000+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41001+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41002+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41003+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41004+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41005+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41006+4 4 4 4 4 4
41007+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41008+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41009+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41010+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41011+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41012+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41013+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41014+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41015+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41016+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41017+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41018+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41019+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41020+4 4 4 4 4 4
41021+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41022+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41023+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41024+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41025+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41026+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41027+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41028+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41029+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41030+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41031+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41032+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41033+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41034+4 4 4 4 4 4
41035+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41036+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41037+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41038+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41039+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41040+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41041+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41042+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41043+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41044+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41045+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41046+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41047+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41048+4 4 4 4 4 4
41049+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41050+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41051+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41052+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41053+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41054+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41055+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41056+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41057+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41058+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41059+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41060+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41061+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41062+4 4 4 4 4 4
41063+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41064+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41065+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41066+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41067+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41068+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41069+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41070+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41071+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41072+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41073+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41074+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41075+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41076+4 4 4 4 4 4
41077+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41078+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41079+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41080+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41081+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41082+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41083+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41084+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41085+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41086+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41087+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41088+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41089+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41090+4 4 4 4 4 4
41091+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41092+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41093+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41094+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41095+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41096+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41097+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41098+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41099+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41100+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41101+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41102+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41103+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41104+4 4 4 4 4 4
41105+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41106+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41107+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41108+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41109+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41110+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41111+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41112+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41113+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41114+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41115+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41116+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41117+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41118+4 4 4 4 4 4
41119+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41120+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41121+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41122+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41123+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41124+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41125+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41126+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41127+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41128+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41129+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41130+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41131+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41132+4 4 4 4 4 4
41133+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41134+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41135+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41136+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41137+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41138+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41139+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41140+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41141+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41142+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41143+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41144+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41145+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41146+4 4 4 4 4 4
41147+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41148+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41149+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41150+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41151+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41152+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41153+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41154+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41155+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41156+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41157+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41158+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41159+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41160+4 4 4 4 4 4
41161diff -urNp linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c
41162--- linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c 2011-03-27 14:31:47.000000000 -0400
41163+++ linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c 2011-04-17 15:56:46.000000000 -0400
41164@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
41165 return bd->props.brightness;
41166 }
41167
41168-static struct backlight_ops nvidia_bl_ops = {
41169+static const struct backlight_ops nvidia_bl_ops = {
41170 .get_brightness = nvidia_bl_get_brightness,
41171 .update_status = nvidia_bl_update_status,
41172 };
41173diff -urNp linux-2.6.32.46/drivers/video/riva/fbdev.c linux-2.6.32.46/drivers/video/riva/fbdev.c
41174--- linux-2.6.32.46/drivers/video/riva/fbdev.c 2011-03-27 14:31:47.000000000 -0400
41175+++ linux-2.6.32.46/drivers/video/riva/fbdev.c 2011-04-17 15:56:46.000000000 -0400
41176@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
41177 return bd->props.brightness;
41178 }
41179
41180-static struct backlight_ops riva_bl_ops = {
41181+static const struct backlight_ops riva_bl_ops = {
41182 .get_brightness = riva_bl_get_brightness,
41183 .update_status = riva_bl_update_status,
41184 };
41185diff -urNp linux-2.6.32.46/drivers/video/uvesafb.c linux-2.6.32.46/drivers/video/uvesafb.c
41186--- linux-2.6.32.46/drivers/video/uvesafb.c 2011-03-27 14:31:47.000000000 -0400
41187+++ linux-2.6.32.46/drivers/video/uvesafb.c 2011-04-17 15:56:46.000000000 -0400
41188@@ -18,6 +18,7 @@
41189 #include <linux/fb.h>
41190 #include <linux/io.h>
41191 #include <linux/mutex.h>
41192+#include <linux/moduleloader.h>
41193 #include <video/edid.h>
41194 #include <video/uvesafb.h>
41195 #ifdef CONFIG_X86
41196@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
41197 NULL,
41198 };
41199
41200- return call_usermodehelper(v86d_path, argv, envp, 1);
41201+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
41202 }
41203
41204 /*
41205@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
41206 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
41207 par->pmi_setpal = par->ypan = 0;
41208 } else {
41209+
41210+#ifdef CONFIG_PAX_KERNEXEC
41211+#ifdef CONFIG_MODULES
41212+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
41213+#endif
41214+ if (!par->pmi_code) {
41215+ par->pmi_setpal = par->ypan = 0;
41216+ return 0;
41217+ }
41218+#endif
41219+
41220 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
41221 + task->t.regs.edi);
41222+
41223+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41224+ pax_open_kernel();
41225+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
41226+ pax_close_kernel();
41227+
41228+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
41229+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
41230+#else
41231 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
41232 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
41233+#endif
41234+
41235 printk(KERN_INFO "uvesafb: protected mode interface info at "
41236 "%04x:%04x\n",
41237 (u16)task->t.regs.es, (u16)task->t.regs.edi);
41238@@ -1799,6 +1822,11 @@ out:
41239 if (par->vbe_modes)
41240 kfree(par->vbe_modes);
41241
41242+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41243+ if (par->pmi_code)
41244+ module_free_exec(NULL, par->pmi_code);
41245+#endif
41246+
41247 framebuffer_release(info);
41248 return err;
41249 }
41250@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
41251 kfree(par->vbe_state_orig);
41252 if (par->vbe_state_saved)
41253 kfree(par->vbe_state_saved);
41254+
41255+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41256+ if (par->pmi_code)
41257+ module_free_exec(NULL, par->pmi_code);
41258+#endif
41259+
41260 }
41261
41262 framebuffer_release(info);
41263diff -urNp linux-2.6.32.46/drivers/video/vesafb.c linux-2.6.32.46/drivers/video/vesafb.c
41264--- linux-2.6.32.46/drivers/video/vesafb.c 2011-03-27 14:31:47.000000000 -0400
41265+++ linux-2.6.32.46/drivers/video/vesafb.c 2011-08-05 20:33:55.000000000 -0400
41266@@ -9,6 +9,7 @@
41267 */
41268
41269 #include <linux/module.h>
41270+#include <linux/moduleloader.h>
41271 #include <linux/kernel.h>
41272 #include <linux/errno.h>
41273 #include <linux/string.h>
41274@@ -53,8 +54,8 @@ static int vram_remap __initdata; /*
41275 static int vram_total __initdata; /* Set total amount of memory */
41276 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
41277 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
41278-static void (*pmi_start)(void) __read_mostly;
41279-static void (*pmi_pal) (void) __read_mostly;
41280+static void (*pmi_start)(void) __read_only;
41281+static void (*pmi_pal) (void) __read_only;
41282 static int depth __read_mostly;
41283 static int vga_compat __read_mostly;
41284 /* --------------------------------------------------------------------- */
41285@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
41286 unsigned int size_vmode;
41287 unsigned int size_remap;
41288 unsigned int size_total;
41289+ void *pmi_code = NULL;
41290
41291 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
41292 return -ENODEV;
41293@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
41294 size_remap = size_total;
41295 vesafb_fix.smem_len = size_remap;
41296
41297-#ifndef __i386__
41298- screen_info.vesapm_seg = 0;
41299-#endif
41300-
41301 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
41302 printk(KERN_WARNING
41303 "vesafb: cannot reserve video memory at 0x%lx\n",
41304@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
41305 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
41306 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
41307
41308+#ifdef __i386__
41309+
41310+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41311+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
41312+ if (!pmi_code)
41313+#elif !defined(CONFIG_PAX_KERNEXEC)
41314+ if (0)
41315+#endif
41316+
41317+#endif
41318+ screen_info.vesapm_seg = 0;
41319+
41320 if (screen_info.vesapm_seg) {
41321- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
41322- screen_info.vesapm_seg,screen_info.vesapm_off);
41323+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
41324+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
41325 }
41326
41327 if (screen_info.vesapm_seg < 0xc000)
41328@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
41329
41330 if (ypan || pmi_setpal) {
41331 unsigned short *pmi_base;
41332+
41333 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
41334- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
41335- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
41336+
41337+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41338+ pax_open_kernel();
41339+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
41340+#else
41341+ pmi_code = pmi_base;
41342+#endif
41343+
41344+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
41345+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
41346+
41347+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41348+ pmi_start = ktva_ktla(pmi_start);
41349+ pmi_pal = ktva_ktla(pmi_pal);
41350+ pax_close_kernel();
41351+#endif
41352+
41353 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
41354 if (pmi_base[3]) {
41355 printk(KERN_INFO "vesafb: pmi: ports = ");
41356@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
41357 info->node, info->fix.id);
41358 return 0;
41359 err:
41360+
41361+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
41362+ module_free_exec(NULL, pmi_code);
41363+#endif
41364+
41365 if (info->screen_base)
41366 iounmap(info->screen_base);
41367 framebuffer_release(info);
41368diff -urNp linux-2.6.32.46/drivers/xen/sys-hypervisor.c linux-2.6.32.46/drivers/xen/sys-hypervisor.c
41369--- linux-2.6.32.46/drivers/xen/sys-hypervisor.c 2011-03-27 14:31:47.000000000 -0400
41370+++ linux-2.6.32.46/drivers/xen/sys-hypervisor.c 2011-04-17 15:56:46.000000000 -0400
41371@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
41372 return 0;
41373 }
41374
41375-static struct sysfs_ops hyp_sysfs_ops = {
41376+static const struct sysfs_ops hyp_sysfs_ops = {
41377 .show = hyp_sysfs_show,
41378 .store = hyp_sysfs_store,
41379 };
41380diff -urNp linux-2.6.32.46/fs/9p/vfs_inode.c linux-2.6.32.46/fs/9p/vfs_inode.c
41381--- linux-2.6.32.46/fs/9p/vfs_inode.c 2011-03-27 14:31:47.000000000 -0400
41382+++ linux-2.6.32.46/fs/9p/vfs_inode.c 2011-04-17 15:56:46.000000000 -0400
41383@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
41384 static void
41385 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
41386 {
41387- char *s = nd_get_link(nd);
41388+ const char *s = nd_get_link(nd);
41389
41390 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
41391 IS_ERR(s) ? "<error>" : s);
41392diff -urNp linux-2.6.32.46/fs/aio.c linux-2.6.32.46/fs/aio.c
41393--- linux-2.6.32.46/fs/aio.c 2011-03-27 14:31:47.000000000 -0400
41394+++ linux-2.6.32.46/fs/aio.c 2011-06-04 20:40:21.000000000 -0400
41395@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx
41396 size += sizeof(struct io_event) * nr_events;
41397 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
41398
41399- if (nr_pages < 0)
41400+ if (nr_pages <= 0)
41401 return -EINVAL;
41402
41403 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
41404@@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ct
41405 struct aio_timeout to;
41406 int retry = 0;
41407
41408+ pax_track_stack();
41409+
41410 /* needed to zero any padding within an entry (there shouldn't be
41411 * any, but C is fun!
41412 */
41413@@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *i
41414 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
41415 {
41416 ssize_t ret;
41417+ struct iovec iovstack;
41418
41419 ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
41420 kiocb->ki_nbytes, 1,
41421- &kiocb->ki_inline_vec, &kiocb->ki_iovec);
41422+ &iovstack, &kiocb->ki_iovec);
41423 if (ret < 0)
41424 goto out;
41425
41426+ if (kiocb->ki_iovec == &iovstack) {
41427+ kiocb->ki_inline_vec = iovstack;
41428+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
41429+ }
41430 kiocb->ki_nr_segs = kiocb->ki_nbytes;
41431 kiocb->ki_cur_seg = 0;
41432 /* ki_nbytes/left now reflect bytes instead of segs */
41433diff -urNp linux-2.6.32.46/fs/attr.c linux-2.6.32.46/fs/attr.c
41434--- linux-2.6.32.46/fs/attr.c 2011-03-27 14:31:47.000000000 -0400
41435+++ linux-2.6.32.46/fs/attr.c 2011-04-17 15:56:46.000000000 -0400
41436@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
41437 unsigned long limit;
41438
41439 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
41440+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
41441 if (limit != RLIM_INFINITY && offset > limit)
41442 goto out_sig;
41443 if (offset > inode->i_sb->s_maxbytes)
41444diff -urNp linux-2.6.32.46/fs/autofs/root.c linux-2.6.32.46/fs/autofs/root.c
41445--- linux-2.6.32.46/fs/autofs/root.c 2011-03-27 14:31:47.000000000 -0400
41446+++ linux-2.6.32.46/fs/autofs/root.c 2011-04-17 15:56:46.000000000 -0400
41447@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
41448 set_bit(n,sbi->symlink_bitmap);
41449 sl = &sbi->symlink[n];
41450 sl->len = strlen(symname);
41451- sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
41452+ slsize = sl->len+1;
41453+ sl->data = kmalloc(slsize, GFP_KERNEL);
41454 if (!sl->data) {
41455 clear_bit(n,sbi->symlink_bitmap);
41456 unlock_kernel();
41457diff -urNp linux-2.6.32.46/fs/autofs4/symlink.c linux-2.6.32.46/fs/autofs4/symlink.c
41458--- linux-2.6.32.46/fs/autofs4/symlink.c 2011-03-27 14:31:47.000000000 -0400
41459+++ linux-2.6.32.46/fs/autofs4/symlink.c 2011-04-17 15:56:46.000000000 -0400
41460@@ -15,7 +15,7 @@
41461 static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
41462 {
41463 struct autofs_info *ino = autofs4_dentry_ino(dentry);
41464- nd_set_link(nd, (char *)ino->u.symlink);
41465+ nd_set_link(nd, ino->u.symlink);
41466 return NULL;
41467 }
41468
41469diff -urNp linux-2.6.32.46/fs/befs/linuxvfs.c linux-2.6.32.46/fs/befs/linuxvfs.c
41470--- linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:24:44.000000000 -0400
41471+++ linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:25:07.000000000 -0400
41472@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
41473 {
41474 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
41475 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
41476- char *link = nd_get_link(nd);
41477+ const char *link = nd_get_link(nd);
41478 if (!IS_ERR(link))
41479 kfree(link);
41480 }
41481diff -urNp linux-2.6.32.46/fs/binfmt_aout.c linux-2.6.32.46/fs/binfmt_aout.c
41482--- linux-2.6.32.46/fs/binfmt_aout.c 2011-03-27 14:31:47.000000000 -0400
41483+++ linux-2.6.32.46/fs/binfmt_aout.c 2011-04-17 15:56:46.000000000 -0400
41484@@ -16,6 +16,7 @@
41485 #include <linux/string.h>
41486 #include <linux/fs.h>
41487 #include <linux/file.h>
41488+#include <linux/security.h>
41489 #include <linux/stat.h>
41490 #include <linux/fcntl.h>
41491 #include <linux/ptrace.h>
41492@@ -102,6 +103,8 @@ static int aout_core_dump(long signr, st
41493 #endif
41494 # define START_STACK(u) (u.start_stack)
41495
41496+ memset(&dump, 0, sizeof(dump));
41497+
41498 fs = get_fs();
41499 set_fs(KERNEL_DS);
41500 has_dumped = 1;
41501@@ -113,10 +116,12 @@ static int aout_core_dump(long signr, st
41502
41503 /* If the size of the dump file exceeds the rlimit, then see what would happen
41504 if we wrote the stack, but not the data area. */
41505+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
41506 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
41507 dump.u_dsize = 0;
41508
41509 /* Make sure we have enough room to write the stack and data areas. */
41510+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
41511 if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
41512 dump.u_ssize = 0;
41513
41514@@ -146,9 +151,7 @@ static int aout_core_dump(long signr, st
41515 dump_size = dump.u_ssize << PAGE_SHIFT;
41516 DUMP_WRITE(dump_start,dump_size);
41517 }
41518-/* Finally dump the task struct. Not be used by gdb, but could be useful */
41519- set_fs(KERNEL_DS);
41520- DUMP_WRITE(current,sizeof(*current));
41521+/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
41522 end_coredump:
41523 set_fs(fs);
41524 return has_dumped;
41525@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
41526 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
41527 if (rlim >= RLIM_INFINITY)
41528 rlim = ~0;
41529+
41530+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
41531 if (ex.a_data + ex.a_bss > rlim)
41532 return -ENOMEM;
41533
41534@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
41535 install_exec_creds(bprm);
41536 current->flags &= ~PF_FORKNOEXEC;
41537
41538+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
41539+ current->mm->pax_flags = 0UL;
41540+#endif
41541+
41542+#ifdef CONFIG_PAX_PAGEEXEC
41543+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
41544+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
41545+
41546+#ifdef CONFIG_PAX_EMUTRAMP
41547+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
41548+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
41549+#endif
41550+
41551+#ifdef CONFIG_PAX_MPROTECT
41552+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
41553+ current->mm->pax_flags |= MF_PAX_MPROTECT;
41554+#endif
41555+
41556+ }
41557+#endif
41558+
41559 if (N_MAGIC(ex) == OMAGIC) {
41560 unsigned long text_addr, map_size;
41561 loff_t pos;
41562@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
41563
41564 down_write(&current->mm->mmap_sem);
41565 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
41566- PROT_READ | PROT_WRITE | PROT_EXEC,
41567+ PROT_READ | PROT_WRITE,
41568 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
41569 fd_offset + ex.a_text);
41570 up_write(&current->mm->mmap_sem);
41571diff -urNp linux-2.6.32.46/fs/binfmt_elf.c linux-2.6.32.46/fs/binfmt_elf.c
41572--- linux-2.6.32.46/fs/binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
41573+++ linux-2.6.32.46/fs/binfmt_elf.c 2011-05-16 21:46:57.000000000 -0400
41574@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
41575 #define elf_core_dump NULL
41576 #endif
41577
41578+#ifdef CONFIG_PAX_MPROTECT
41579+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
41580+#endif
41581+
41582 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
41583 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
41584 #else
41585@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format =
41586 .load_binary = load_elf_binary,
41587 .load_shlib = load_elf_library,
41588 .core_dump = elf_core_dump,
41589+
41590+#ifdef CONFIG_PAX_MPROTECT
41591+ .handle_mprotect= elf_handle_mprotect,
41592+#endif
41593+
41594 .min_coredump = ELF_EXEC_PAGESIZE,
41595 .hasvdso = 1
41596 };
41597@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
41598
41599 static int set_brk(unsigned long start, unsigned long end)
41600 {
41601+ unsigned long e = end;
41602+
41603 start = ELF_PAGEALIGN(start);
41604 end = ELF_PAGEALIGN(end);
41605 if (end > start) {
41606@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
41607 if (BAD_ADDR(addr))
41608 return addr;
41609 }
41610- current->mm->start_brk = current->mm->brk = end;
41611+ current->mm->start_brk = current->mm->brk = e;
41612 return 0;
41613 }
41614
41615@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
41616 elf_addr_t __user *u_rand_bytes;
41617 const char *k_platform = ELF_PLATFORM;
41618 const char *k_base_platform = ELF_BASE_PLATFORM;
41619- unsigned char k_rand_bytes[16];
41620+ u32 k_rand_bytes[4];
41621 int items;
41622 elf_addr_t *elf_info;
41623 int ei_index = 0;
41624 const struct cred *cred = current_cred();
41625 struct vm_area_struct *vma;
41626+ unsigned long saved_auxv[AT_VECTOR_SIZE];
41627+
41628+ pax_track_stack();
41629
41630 /*
41631 * In some cases (e.g. Hyper-Threading), we want to avoid L1
41632@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
41633 * Generate 16 random bytes for userspace PRNG seeding.
41634 */
41635 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
41636- u_rand_bytes = (elf_addr_t __user *)
41637- STACK_ALLOC(p, sizeof(k_rand_bytes));
41638+ srandom32(k_rand_bytes[0] ^ random32());
41639+ srandom32(k_rand_bytes[1] ^ random32());
41640+ srandom32(k_rand_bytes[2] ^ random32());
41641+ srandom32(k_rand_bytes[3] ^ random32());
41642+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
41643+ u_rand_bytes = (elf_addr_t __user *) p;
41644 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
41645 return -EFAULT;
41646
41647@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
41648 return -EFAULT;
41649 current->mm->env_end = p;
41650
41651+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
41652+
41653 /* Put the elf_info on the stack in the right place. */
41654 sp = (elf_addr_t __user *)envp + 1;
41655- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
41656+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
41657 return -EFAULT;
41658 return 0;
41659 }
41660@@ -385,10 +405,10 @@ static unsigned long load_elf_interp(str
41661 {
41662 struct elf_phdr *elf_phdata;
41663 struct elf_phdr *eppnt;
41664- unsigned long load_addr = 0;
41665+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
41666 int load_addr_set = 0;
41667 unsigned long last_bss = 0, elf_bss = 0;
41668- unsigned long error = ~0UL;
41669+ unsigned long error = -EINVAL;
41670 unsigned long total_size;
41671 int retval, i, size;
41672
41673@@ -434,6 +454,11 @@ static unsigned long load_elf_interp(str
41674 goto out_close;
41675 }
41676
41677+#ifdef CONFIG_PAX_SEGMEXEC
41678+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
41679+ pax_task_size = SEGMEXEC_TASK_SIZE;
41680+#endif
41681+
41682 eppnt = elf_phdata;
41683 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
41684 if (eppnt->p_type == PT_LOAD) {
41685@@ -477,8 +502,8 @@ static unsigned long load_elf_interp(str
41686 k = load_addr + eppnt->p_vaddr;
41687 if (BAD_ADDR(k) ||
41688 eppnt->p_filesz > eppnt->p_memsz ||
41689- eppnt->p_memsz > TASK_SIZE ||
41690- TASK_SIZE - eppnt->p_memsz < k) {
41691+ eppnt->p_memsz > pax_task_size ||
41692+ pax_task_size - eppnt->p_memsz < k) {
41693 error = -ENOMEM;
41694 goto out_close;
41695 }
41696@@ -532,6 +557,194 @@ out:
41697 return error;
41698 }
41699
41700+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
41701+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
41702+{
41703+ unsigned long pax_flags = 0UL;
41704+
41705+#ifdef CONFIG_PAX_PAGEEXEC
41706+ if (elf_phdata->p_flags & PF_PAGEEXEC)
41707+ pax_flags |= MF_PAX_PAGEEXEC;
41708+#endif
41709+
41710+#ifdef CONFIG_PAX_SEGMEXEC
41711+ if (elf_phdata->p_flags & PF_SEGMEXEC)
41712+ pax_flags |= MF_PAX_SEGMEXEC;
41713+#endif
41714+
41715+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
41716+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41717+ if (nx_enabled)
41718+ pax_flags &= ~MF_PAX_SEGMEXEC;
41719+ else
41720+ pax_flags &= ~MF_PAX_PAGEEXEC;
41721+ }
41722+#endif
41723+
41724+#ifdef CONFIG_PAX_EMUTRAMP
41725+ if (elf_phdata->p_flags & PF_EMUTRAMP)
41726+ pax_flags |= MF_PAX_EMUTRAMP;
41727+#endif
41728+
41729+#ifdef CONFIG_PAX_MPROTECT
41730+ if (elf_phdata->p_flags & PF_MPROTECT)
41731+ pax_flags |= MF_PAX_MPROTECT;
41732+#endif
41733+
41734+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
41735+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
41736+ pax_flags |= MF_PAX_RANDMMAP;
41737+#endif
41738+
41739+ return pax_flags;
41740+}
41741+#endif
41742+
41743+#ifdef CONFIG_PAX_PT_PAX_FLAGS
41744+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
41745+{
41746+ unsigned long pax_flags = 0UL;
41747+
41748+#ifdef CONFIG_PAX_PAGEEXEC
41749+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
41750+ pax_flags |= MF_PAX_PAGEEXEC;
41751+#endif
41752+
41753+#ifdef CONFIG_PAX_SEGMEXEC
41754+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
41755+ pax_flags |= MF_PAX_SEGMEXEC;
41756+#endif
41757+
41758+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
41759+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41760+ if (nx_enabled)
41761+ pax_flags &= ~MF_PAX_SEGMEXEC;
41762+ else
41763+ pax_flags &= ~MF_PAX_PAGEEXEC;
41764+ }
41765+#endif
41766+
41767+#ifdef CONFIG_PAX_EMUTRAMP
41768+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
41769+ pax_flags |= MF_PAX_EMUTRAMP;
41770+#endif
41771+
41772+#ifdef CONFIG_PAX_MPROTECT
41773+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
41774+ pax_flags |= MF_PAX_MPROTECT;
41775+#endif
41776+
41777+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
41778+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
41779+ pax_flags |= MF_PAX_RANDMMAP;
41780+#endif
41781+
41782+ return pax_flags;
41783+}
41784+#endif
41785+
41786+#ifdef CONFIG_PAX_EI_PAX
41787+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
41788+{
41789+ unsigned long pax_flags = 0UL;
41790+
41791+#ifdef CONFIG_PAX_PAGEEXEC
41792+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
41793+ pax_flags |= MF_PAX_PAGEEXEC;
41794+#endif
41795+
41796+#ifdef CONFIG_PAX_SEGMEXEC
41797+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
41798+ pax_flags |= MF_PAX_SEGMEXEC;
41799+#endif
41800+
41801+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
41802+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41803+ if (nx_enabled)
41804+ pax_flags &= ~MF_PAX_SEGMEXEC;
41805+ else
41806+ pax_flags &= ~MF_PAX_PAGEEXEC;
41807+ }
41808+#endif
41809+
41810+#ifdef CONFIG_PAX_EMUTRAMP
41811+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
41812+ pax_flags |= MF_PAX_EMUTRAMP;
41813+#endif
41814+
41815+#ifdef CONFIG_PAX_MPROTECT
41816+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
41817+ pax_flags |= MF_PAX_MPROTECT;
41818+#endif
41819+
41820+#ifdef CONFIG_PAX_ASLR
41821+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
41822+ pax_flags |= MF_PAX_RANDMMAP;
41823+#endif
41824+
41825+ return pax_flags;
41826+}
41827+#endif
41828+
41829+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
41830+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
41831+{
41832+ unsigned long pax_flags = 0UL;
41833+
41834+#ifdef CONFIG_PAX_PT_PAX_FLAGS
41835+ unsigned long i;
41836+ int found_flags = 0;
41837+#endif
41838+
41839+#ifdef CONFIG_PAX_EI_PAX
41840+ pax_flags = pax_parse_ei_pax(elf_ex);
41841+#endif
41842+
41843+#ifdef CONFIG_PAX_PT_PAX_FLAGS
41844+ for (i = 0UL; i < elf_ex->e_phnum; i++)
41845+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
41846+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
41847+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
41848+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
41849+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
41850+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
41851+ return -EINVAL;
41852+
41853+#ifdef CONFIG_PAX_SOFTMODE
41854+ if (pax_softmode)
41855+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
41856+ else
41857+#endif
41858+
41859+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
41860+ found_flags = 1;
41861+ break;
41862+ }
41863+#endif
41864+
41865+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
41866+ if (found_flags == 0) {
41867+ struct elf_phdr phdr;
41868+ memset(&phdr, 0, sizeof(phdr));
41869+ phdr.p_flags = PF_NOEMUTRAMP;
41870+#ifdef CONFIG_PAX_SOFTMODE
41871+ if (pax_softmode)
41872+ pax_flags = pax_parse_softmode(&phdr);
41873+ else
41874+#endif
41875+ pax_flags = pax_parse_hardmode(&phdr);
41876+ }
41877+#endif
41878+
41879+
41880+ if (0 > pax_check_flags(&pax_flags))
41881+ return -EINVAL;
41882+
41883+ current->mm->pax_flags = pax_flags;
41884+ return 0;
41885+}
41886+#endif
41887+
41888 /*
41889 * These are the functions used to load ELF style executables and shared
41890 * libraries. There is no binary dependent code anywhere else.
41891@@ -548,6 +761,11 @@ static unsigned long randomize_stack_top
41892 {
41893 unsigned int random_variable = 0;
41894
41895+#ifdef CONFIG_PAX_RANDUSTACK
41896+ if (randomize_va_space)
41897+ return stack_top - current->mm->delta_stack;
41898+#endif
41899+
41900 if ((current->flags & PF_RANDOMIZE) &&
41901 !(current->personality & ADDR_NO_RANDOMIZE)) {
41902 random_variable = get_random_int() & STACK_RND_MASK;
41903@@ -566,7 +784,7 @@ static int load_elf_binary(struct linux_
41904 unsigned long load_addr = 0, load_bias = 0;
41905 int load_addr_set = 0;
41906 char * elf_interpreter = NULL;
41907- unsigned long error;
41908+ unsigned long error = 0;
41909 struct elf_phdr *elf_ppnt, *elf_phdata;
41910 unsigned long elf_bss, elf_brk;
41911 int retval, i;
41912@@ -576,11 +794,11 @@ static int load_elf_binary(struct linux_
41913 unsigned long start_code, end_code, start_data, end_data;
41914 unsigned long reloc_func_desc = 0;
41915 int executable_stack = EXSTACK_DEFAULT;
41916- unsigned long def_flags = 0;
41917 struct {
41918 struct elfhdr elf_ex;
41919 struct elfhdr interp_elf_ex;
41920 } *loc;
41921+ unsigned long pax_task_size = TASK_SIZE;
41922
41923 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
41924 if (!loc) {
41925@@ -718,11 +936,80 @@ static int load_elf_binary(struct linux_
41926
41927 /* OK, This is the point of no return */
41928 current->flags &= ~PF_FORKNOEXEC;
41929- current->mm->def_flags = def_flags;
41930+
41931+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
41932+ current->mm->pax_flags = 0UL;
41933+#endif
41934+
41935+#ifdef CONFIG_PAX_DLRESOLVE
41936+ current->mm->call_dl_resolve = 0UL;
41937+#endif
41938+
41939+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
41940+ current->mm->call_syscall = 0UL;
41941+#endif
41942+
41943+#ifdef CONFIG_PAX_ASLR
41944+ current->mm->delta_mmap = 0UL;
41945+ current->mm->delta_stack = 0UL;
41946+#endif
41947+
41948+ current->mm->def_flags = 0;
41949+
41950+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
41951+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
41952+ send_sig(SIGKILL, current, 0);
41953+ goto out_free_dentry;
41954+ }
41955+#endif
41956+
41957+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
41958+ pax_set_initial_flags(bprm);
41959+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
41960+ if (pax_set_initial_flags_func)
41961+ (pax_set_initial_flags_func)(bprm);
41962+#endif
41963+
41964+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
41965+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
41966+ current->mm->context.user_cs_limit = PAGE_SIZE;
41967+ current->mm->def_flags |= VM_PAGEEXEC;
41968+ }
41969+#endif
41970+
41971+#ifdef CONFIG_PAX_SEGMEXEC
41972+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
41973+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
41974+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
41975+ pax_task_size = SEGMEXEC_TASK_SIZE;
41976+ }
41977+#endif
41978+
41979+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
41980+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41981+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
41982+ put_cpu();
41983+ }
41984+#endif
41985
41986 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
41987 may depend on the personality. */
41988 SET_PERSONALITY(loc->elf_ex);
41989+
41990+#ifdef CONFIG_PAX_ASLR
41991+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
41992+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
41993+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
41994+ }
41995+#endif
41996+
41997+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
41998+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41999+ executable_stack = EXSTACK_DISABLE_X;
42000+ current->personality &= ~READ_IMPLIES_EXEC;
42001+ } else
42002+#endif
42003+
42004 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
42005 current->personality |= READ_IMPLIES_EXEC;
42006
42007@@ -804,6 +1091,20 @@ static int load_elf_binary(struct linux_
42008 #else
42009 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
42010 #endif
42011+
42012+#ifdef CONFIG_PAX_RANDMMAP
42013+ /* PaX: randomize base address at the default exe base if requested */
42014+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
42015+#ifdef CONFIG_SPARC64
42016+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
42017+#else
42018+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
42019+#endif
42020+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
42021+ elf_flags |= MAP_FIXED;
42022+ }
42023+#endif
42024+
42025 }
42026
42027 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
42028@@ -836,9 +1137,9 @@ static int load_elf_binary(struct linux_
42029 * allowed task size. Note that p_filesz must always be
42030 * <= p_memsz so it is only necessary to check p_memsz.
42031 */
42032- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42033- elf_ppnt->p_memsz > TASK_SIZE ||
42034- TASK_SIZE - elf_ppnt->p_memsz < k) {
42035+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
42036+ elf_ppnt->p_memsz > pax_task_size ||
42037+ pax_task_size - elf_ppnt->p_memsz < k) {
42038 /* set_brk can never work. Avoid overflows. */
42039 send_sig(SIGKILL, current, 0);
42040 retval = -EINVAL;
42041@@ -866,6 +1167,11 @@ static int load_elf_binary(struct linux_
42042 start_data += load_bias;
42043 end_data += load_bias;
42044
42045+#ifdef CONFIG_PAX_RANDMMAP
42046+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
42047+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
42048+#endif
42049+
42050 /* Calling set_brk effectively mmaps the pages that we need
42051 * for the bss and break sections. We must do this before
42052 * mapping in the interpreter, to make sure it doesn't wind
42053@@ -877,9 +1183,11 @@ static int load_elf_binary(struct linux_
42054 goto out_free_dentry;
42055 }
42056 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
42057- send_sig(SIGSEGV, current, 0);
42058- retval = -EFAULT; /* Nobody gets to see this, but.. */
42059- goto out_free_dentry;
42060+ /*
42061+ * This bss-zeroing can fail if the ELF
42062+ * file specifies odd protections. So
42063+ * we don't check the return value
42064+ */
42065 }
42066
42067 if (elf_interpreter) {
42068@@ -1112,8 +1420,10 @@ static int dump_seek(struct file *file,
42069 unsigned long n = off;
42070 if (n > PAGE_SIZE)
42071 n = PAGE_SIZE;
42072- if (!dump_write(file, buf, n))
42073+ if (!dump_write(file, buf, n)) {
42074+ free_page((unsigned long)buf);
42075 return 0;
42076+ }
42077 off -= n;
42078 }
42079 free_page((unsigned long)buf);
42080@@ -1125,7 +1435,7 @@ static int dump_seek(struct file *file,
42081 * Decide what to dump of a segment, part, all or none.
42082 */
42083 static unsigned long vma_dump_size(struct vm_area_struct *vma,
42084- unsigned long mm_flags)
42085+ unsigned long mm_flags, long signr)
42086 {
42087 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
42088
42089@@ -1159,7 +1469,7 @@ static unsigned long vma_dump_size(struc
42090 if (vma->vm_file == NULL)
42091 return 0;
42092
42093- if (FILTER(MAPPED_PRIVATE))
42094+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
42095 goto whole;
42096
42097 /*
42098@@ -1255,8 +1565,11 @@ static int writenote(struct memelfnote *
42099 #undef DUMP_WRITE
42100
42101 #define DUMP_WRITE(addr, nr) \
42102+ do { \
42103+ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
42104 if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
42105- goto end_coredump;
42106+ goto end_coredump; \
42107+ } while (0);
42108
42109 static void fill_elf_header(struct elfhdr *elf, int segs,
42110 u16 machine, u32 flags, u8 osabi)
42111@@ -1385,9 +1698,9 @@ static void fill_auxv_note(struct memelf
42112 {
42113 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
42114 int i = 0;
42115- do
42116+ do {
42117 i += 2;
42118- while (auxv[i - 2] != AT_NULL);
42119+ } while (auxv[i - 2] != AT_NULL);
42120 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
42121 }
42122
42123@@ -1973,7 +2286,7 @@ static int elf_core_dump(long signr, str
42124 phdr.p_offset = offset;
42125 phdr.p_vaddr = vma->vm_start;
42126 phdr.p_paddr = 0;
42127- phdr.p_filesz = vma_dump_size(vma, mm_flags);
42128+ phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
42129 phdr.p_memsz = vma->vm_end - vma->vm_start;
42130 offset += phdr.p_filesz;
42131 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
42132@@ -2006,7 +2319,7 @@ static int elf_core_dump(long signr, str
42133 unsigned long addr;
42134 unsigned long end;
42135
42136- end = vma->vm_start + vma_dump_size(vma, mm_flags);
42137+ end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
42138
42139 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
42140 struct page *page;
42141@@ -2015,6 +2328,7 @@ static int elf_core_dump(long signr, str
42142 page = get_dump_page(addr);
42143 if (page) {
42144 void *kaddr = kmap(page);
42145+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
42146 stop = ((size += PAGE_SIZE) > limit) ||
42147 !dump_write(file, kaddr, PAGE_SIZE);
42148 kunmap(page);
42149@@ -2042,6 +2356,97 @@ out:
42150
42151 #endif /* USE_ELF_CORE_DUMP */
42152
42153+#ifdef CONFIG_PAX_MPROTECT
42154+/* PaX: non-PIC ELF libraries need relocations on their executable segments
42155+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
42156+ * we'll remove VM_MAYWRITE for good on RELRO segments.
42157+ *
42158+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
42159+ * basis because we want to allow the common case and not the special ones.
42160+ */
42161+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
42162+{
42163+ struct elfhdr elf_h;
42164+ struct elf_phdr elf_p;
42165+ unsigned long i;
42166+ unsigned long oldflags;
42167+ bool is_textrel_rw, is_textrel_rx, is_relro;
42168+
42169+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
42170+ return;
42171+
42172+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
42173+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
42174+
42175+#ifdef CONFIG_PAX_ELFRELOCS
42176+ /* possible TEXTREL */
42177+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
42178+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
42179+#else
42180+ is_textrel_rw = false;
42181+ is_textrel_rx = false;
42182+#endif
42183+
42184+ /* possible RELRO */
42185+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
42186+
42187+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
42188+ return;
42189+
42190+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
42191+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
42192+
42193+#ifdef CONFIG_PAX_ETEXECRELOCS
42194+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42195+#else
42196+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
42197+#endif
42198+
42199+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
42200+ !elf_check_arch(&elf_h) ||
42201+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
42202+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
42203+ return;
42204+
42205+ for (i = 0UL; i < elf_h.e_phnum; i++) {
42206+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
42207+ return;
42208+ switch (elf_p.p_type) {
42209+ case PT_DYNAMIC:
42210+ if (!is_textrel_rw && !is_textrel_rx)
42211+ continue;
42212+ i = 0UL;
42213+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
42214+ elf_dyn dyn;
42215+
42216+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
42217+ return;
42218+ if (dyn.d_tag == DT_NULL)
42219+ return;
42220+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
42221+ gr_log_textrel(vma);
42222+ if (is_textrel_rw)
42223+ vma->vm_flags |= VM_MAYWRITE;
42224+ else
42225+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
42226+ vma->vm_flags &= ~VM_MAYWRITE;
42227+ return;
42228+ }
42229+ i++;
42230+ }
42231+ return;
42232+
42233+ case PT_GNU_RELRO:
42234+ if (!is_relro)
42235+ continue;
42236+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
42237+ vma->vm_flags &= ~VM_MAYWRITE;
42238+ return;
42239+ }
42240+ }
42241+}
42242+#endif
42243+
42244 static int __init init_elf_binfmt(void)
42245 {
42246 return register_binfmt(&elf_format);
42247diff -urNp linux-2.6.32.46/fs/binfmt_flat.c linux-2.6.32.46/fs/binfmt_flat.c
42248--- linux-2.6.32.46/fs/binfmt_flat.c 2011-03-27 14:31:47.000000000 -0400
42249+++ linux-2.6.32.46/fs/binfmt_flat.c 2011-04-17 15:56:46.000000000 -0400
42250@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
42251 realdatastart = (unsigned long) -ENOMEM;
42252 printk("Unable to allocate RAM for process data, errno %d\n",
42253 (int)-realdatastart);
42254+ down_write(&current->mm->mmap_sem);
42255 do_munmap(current->mm, textpos, text_len);
42256+ up_write(&current->mm->mmap_sem);
42257 ret = realdatastart;
42258 goto err;
42259 }
42260@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
42261 }
42262 if (IS_ERR_VALUE(result)) {
42263 printk("Unable to read data+bss, errno %d\n", (int)-result);
42264+ down_write(&current->mm->mmap_sem);
42265 do_munmap(current->mm, textpos, text_len);
42266 do_munmap(current->mm, realdatastart, data_len + extra);
42267+ up_write(&current->mm->mmap_sem);
42268 ret = result;
42269 goto err;
42270 }
42271@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
42272 }
42273 if (IS_ERR_VALUE(result)) {
42274 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
42275+ down_write(&current->mm->mmap_sem);
42276 do_munmap(current->mm, textpos, text_len + data_len + extra +
42277 MAX_SHARED_LIBS * sizeof(unsigned long));
42278+ up_write(&current->mm->mmap_sem);
42279 ret = result;
42280 goto err;
42281 }
42282diff -urNp linux-2.6.32.46/fs/bio.c linux-2.6.32.46/fs/bio.c
42283--- linux-2.6.32.46/fs/bio.c 2011-03-27 14:31:47.000000000 -0400
42284+++ linux-2.6.32.46/fs/bio.c 2011-04-17 15:56:46.000000000 -0400
42285@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
42286
42287 i = 0;
42288 while (i < bio_slab_nr) {
42289- struct bio_slab *bslab = &bio_slabs[i];
42290+ bslab = &bio_slabs[i];
42291
42292 if (!bslab->slab && entry == -1)
42293 entry = i;
42294@@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct b
42295 const int read = bio_data_dir(bio) == READ;
42296 struct bio_map_data *bmd = bio->bi_private;
42297 int i;
42298- char *p = bmd->sgvecs[0].iov_base;
42299+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
42300
42301 __bio_for_each_segment(bvec, bio, i, 0) {
42302 char *addr = page_address(bvec->bv_page);
42303diff -urNp linux-2.6.32.46/fs/block_dev.c linux-2.6.32.46/fs/block_dev.c
42304--- linux-2.6.32.46/fs/block_dev.c 2011-08-09 18:35:29.000000000 -0400
42305+++ linux-2.6.32.46/fs/block_dev.c 2011-08-09 18:34:00.000000000 -0400
42306@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev,
42307 else if (bdev->bd_contains == bdev)
42308 res = 0; /* is a whole device which isn't held */
42309
42310- else if (bdev->bd_contains->bd_holder == bd_claim)
42311+ else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
42312 res = 0; /* is a partition of a device that is being partitioned */
42313 else if (bdev->bd_contains->bd_holder != NULL)
42314 res = -EBUSY; /* is a partition of a held device */
42315diff -urNp linux-2.6.32.46/fs/btrfs/ctree.c linux-2.6.32.46/fs/btrfs/ctree.c
42316--- linux-2.6.32.46/fs/btrfs/ctree.c 2011-03-27 14:31:47.000000000 -0400
42317+++ linux-2.6.32.46/fs/btrfs/ctree.c 2011-04-17 15:56:46.000000000 -0400
42318@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
42319 free_extent_buffer(buf);
42320 add_root_to_dirty_list(root);
42321 } else {
42322- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
42323- parent_start = parent->start;
42324- else
42325+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
42326+ if (parent)
42327+ parent_start = parent->start;
42328+ else
42329+ parent_start = 0;
42330+ } else
42331 parent_start = 0;
42332
42333 WARN_ON(trans->transid != btrfs_header_generation(parent));
42334@@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_tran
42335
42336 ret = 0;
42337 if (slot == 0) {
42338- struct btrfs_disk_key disk_key;
42339 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
42340 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
42341 }
42342diff -urNp linux-2.6.32.46/fs/btrfs/disk-io.c linux-2.6.32.46/fs/btrfs/disk-io.c
42343--- linux-2.6.32.46/fs/btrfs/disk-io.c 2011-04-17 17:00:52.000000000 -0400
42344+++ linux-2.6.32.46/fs/btrfs/disk-io.c 2011-04-17 17:03:11.000000000 -0400
42345@@ -39,7 +39,7 @@
42346 #include "tree-log.h"
42347 #include "free-space-cache.h"
42348
42349-static struct extent_io_ops btree_extent_io_ops;
42350+static const struct extent_io_ops btree_extent_io_ops;
42351 static void end_workqueue_fn(struct btrfs_work *work);
42352 static void free_fs_root(struct btrfs_root *root);
42353
42354@@ -2607,7 +2607,7 @@ out:
42355 return 0;
42356 }
42357
42358-static struct extent_io_ops btree_extent_io_ops = {
42359+static const struct extent_io_ops btree_extent_io_ops = {
42360 .write_cache_pages_lock_hook = btree_lock_page_hook,
42361 .readpage_end_io_hook = btree_readpage_end_io_hook,
42362 .submit_bio_hook = btree_submit_bio_hook,
42363diff -urNp linux-2.6.32.46/fs/btrfs/extent_io.h linux-2.6.32.46/fs/btrfs/extent_io.h
42364--- linux-2.6.32.46/fs/btrfs/extent_io.h 2011-03-27 14:31:47.000000000 -0400
42365+++ linux-2.6.32.46/fs/btrfs/extent_io.h 2011-04-17 15:56:46.000000000 -0400
42366@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(s
42367 struct bio *bio, int mirror_num,
42368 unsigned long bio_flags);
42369 struct extent_io_ops {
42370- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
42371+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
42372 u64 start, u64 end, int *page_started,
42373 unsigned long *nr_written);
42374- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
42375- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
42376+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
42377+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
42378 extent_submit_bio_hook_t *submit_bio_hook;
42379- int (*merge_bio_hook)(struct page *page, unsigned long offset,
42380+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
42381 size_t size, struct bio *bio,
42382 unsigned long bio_flags);
42383- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
42384- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
42385+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
42386+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
42387 u64 start, u64 end,
42388 struct extent_state *state);
42389- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
42390+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
42391 u64 start, u64 end,
42392 struct extent_state *state);
42393- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
42394+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
42395 struct extent_state *state);
42396- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
42397+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
42398 struct extent_state *state, int uptodate);
42399- int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
42400+ int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
42401 unsigned long old, unsigned long bits);
42402- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
42403+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
42404 unsigned long bits);
42405- int (*merge_extent_hook)(struct inode *inode,
42406+ int (* const merge_extent_hook)(struct inode *inode,
42407 struct extent_state *new,
42408 struct extent_state *other);
42409- int (*split_extent_hook)(struct inode *inode,
42410+ int (* const split_extent_hook)(struct inode *inode,
42411 struct extent_state *orig, u64 split);
42412- int (*write_cache_pages_lock_hook)(struct page *page);
42413+ int (* const write_cache_pages_lock_hook)(struct page *page);
42414 };
42415
42416 struct extent_io_tree {
42417@@ -88,7 +88,7 @@ struct extent_io_tree {
42418 u64 dirty_bytes;
42419 spinlock_t lock;
42420 spinlock_t buffer_lock;
42421- struct extent_io_ops *ops;
42422+ const struct extent_io_ops *ops;
42423 };
42424
42425 struct extent_state {
42426diff -urNp linux-2.6.32.46/fs/btrfs/extent-tree.c linux-2.6.32.46/fs/btrfs/extent-tree.c
42427--- linux-2.6.32.46/fs/btrfs/extent-tree.c 2011-03-27 14:31:47.000000000 -0400
42428+++ linux-2.6.32.46/fs/btrfs/extent-tree.c 2011-06-12 06:39:08.000000000 -0400
42429@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(
42430 u64 group_start = group->key.objectid;
42431 new_extents = kmalloc(sizeof(*new_extents),
42432 GFP_NOFS);
42433+ if (!new_extents) {
42434+ ret = -ENOMEM;
42435+ goto out;
42436+ }
42437 nr_extents = 1;
42438 ret = get_new_locations(reloc_inode,
42439 extent_key,
42440diff -urNp linux-2.6.32.46/fs/btrfs/free-space-cache.c linux-2.6.32.46/fs/btrfs/free-space-cache.c
42441--- linux-2.6.32.46/fs/btrfs/free-space-cache.c 2011-03-27 14:31:47.000000000 -0400
42442+++ linux-2.6.32.46/fs/btrfs/free-space-cache.c 2011-04-17 15:56:46.000000000 -0400
42443@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
42444
42445 while(1) {
42446 if (entry->bytes < bytes || entry->offset < min_start) {
42447- struct rb_node *node;
42448-
42449 node = rb_next(&entry->offset_index);
42450 if (!node)
42451 break;
42452@@ -1226,7 +1224,7 @@ again:
42453 */
42454 while (entry->bitmap || found_bitmap ||
42455 (!entry->bitmap && entry->bytes < min_bytes)) {
42456- struct rb_node *node = rb_next(&entry->offset_index);
42457+ node = rb_next(&entry->offset_index);
42458
42459 if (entry->bitmap && entry->bytes > bytes + empty_size) {
42460 ret = btrfs_bitmap_cluster(block_group, entry, cluster,
42461diff -urNp linux-2.6.32.46/fs/btrfs/inode.c linux-2.6.32.46/fs/btrfs/inode.c
42462--- linux-2.6.32.46/fs/btrfs/inode.c 2011-03-27 14:31:47.000000000 -0400
42463+++ linux-2.6.32.46/fs/btrfs/inode.c 2011-06-12 06:39:58.000000000 -0400
42464@@ -63,7 +63,7 @@ static const struct inode_operations btr
42465 static const struct address_space_operations btrfs_aops;
42466 static const struct address_space_operations btrfs_symlink_aops;
42467 static const struct file_operations btrfs_dir_file_operations;
42468-static struct extent_io_ops btrfs_extent_io_ops;
42469+static const struct extent_io_ops btrfs_extent_io_ops;
42470
42471 static struct kmem_cache *btrfs_inode_cachep;
42472 struct kmem_cache *btrfs_trans_handle_cachep;
42473@@ -925,6 +925,7 @@ static int cow_file_range_async(struct i
42474 1, 0, NULL, GFP_NOFS);
42475 while (start < end) {
42476 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
42477+ BUG_ON(!async_cow);
42478 async_cow->inode = inode;
42479 async_cow->root = root;
42480 async_cow->locked_page = locked_page;
42481@@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(st
42482 inline_size = btrfs_file_extent_inline_item_len(leaf,
42483 btrfs_item_nr(leaf, path->slots[0]));
42484 tmp = kmalloc(inline_size, GFP_NOFS);
42485+ if (!tmp)
42486+ return -ENOMEM;
42487 ptr = btrfs_file_extent_inline_start(item);
42488
42489 read_extent_buffer(leaf, tmp, ptr, inline_size);
42490@@ -5410,7 +5413,7 @@ fail:
42491 return -ENOMEM;
42492 }
42493
42494-static int btrfs_getattr(struct vfsmount *mnt,
42495+int btrfs_getattr(struct vfsmount *mnt,
42496 struct dentry *dentry, struct kstat *stat)
42497 {
42498 struct inode *inode = dentry->d_inode;
42499@@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount
42500 return 0;
42501 }
42502
42503+EXPORT_SYMBOL(btrfs_getattr);
42504+
42505+dev_t get_btrfs_dev_from_inode(struct inode *inode)
42506+{
42507+ return BTRFS_I(inode)->root->anon_super.s_dev;
42508+}
42509+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
42510+
42511 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
42512 struct inode *new_dir, struct dentry *new_dentry)
42513 {
42514@@ -5972,7 +5983,7 @@ static const struct file_operations btrf
42515 .fsync = btrfs_sync_file,
42516 };
42517
42518-static struct extent_io_ops btrfs_extent_io_ops = {
42519+static const struct extent_io_ops btrfs_extent_io_ops = {
42520 .fill_delalloc = run_delalloc_range,
42521 .submit_bio_hook = btrfs_submit_bio_hook,
42522 .merge_bio_hook = btrfs_merge_bio_hook,
42523diff -urNp linux-2.6.32.46/fs/btrfs/relocation.c linux-2.6.32.46/fs/btrfs/relocation.c
42524--- linux-2.6.32.46/fs/btrfs/relocation.c 2011-03-27 14:31:47.000000000 -0400
42525+++ linux-2.6.32.46/fs/btrfs/relocation.c 2011-04-17 15:56:46.000000000 -0400
42526@@ -884,7 +884,7 @@ static int __update_reloc_root(struct bt
42527 }
42528 spin_unlock(&rc->reloc_root_tree.lock);
42529
42530- BUG_ON((struct btrfs_root *)node->data != root);
42531+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
42532
42533 if (!del) {
42534 spin_lock(&rc->reloc_root_tree.lock);
42535diff -urNp linux-2.6.32.46/fs/btrfs/sysfs.c linux-2.6.32.46/fs/btrfs/sysfs.c
42536--- linux-2.6.32.46/fs/btrfs/sysfs.c 2011-03-27 14:31:47.000000000 -0400
42537+++ linux-2.6.32.46/fs/btrfs/sysfs.c 2011-04-17 15:56:46.000000000 -0400
42538@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
42539 complete(&root->kobj_unregister);
42540 }
42541
42542-static struct sysfs_ops btrfs_super_attr_ops = {
42543+static const struct sysfs_ops btrfs_super_attr_ops = {
42544 .show = btrfs_super_attr_show,
42545 .store = btrfs_super_attr_store,
42546 };
42547
42548-static struct sysfs_ops btrfs_root_attr_ops = {
42549+static const struct sysfs_ops btrfs_root_attr_ops = {
42550 .show = btrfs_root_attr_show,
42551 .store = btrfs_root_attr_store,
42552 };
42553diff -urNp linux-2.6.32.46/fs/buffer.c linux-2.6.32.46/fs/buffer.c
42554--- linux-2.6.32.46/fs/buffer.c 2011-03-27 14:31:47.000000000 -0400
42555+++ linux-2.6.32.46/fs/buffer.c 2011-04-17 15:56:46.000000000 -0400
42556@@ -25,6 +25,7 @@
42557 #include <linux/percpu.h>
42558 #include <linux/slab.h>
42559 #include <linux/capability.h>
42560+#include <linux/security.h>
42561 #include <linux/blkdev.h>
42562 #include <linux/file.h>
42563 #include <linux/quotaops.h>
42564diff -urNp linux-2.6.32.46/fs/cachefiles/bind.c linux-2.6.32.46/fs/cachefiles/bind.c
42565--- linux-2.6.32.46/fs/cachefiles/bind.c 2011-03-27 14:31:47.000000000 -0400
42566+++ linux-2.6.32.46/fs/cachefiles/bind.c 2011-04-17 15:56:46.000000000 -0400
42567@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
42568 args);
42569
42570 /* start by checking things over */
42571- ASSERT(cache->fstop_percent >= 0 &&
42572- cache->fstop_percent < cache->fcull_percent &&
42573+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
42574 cache->fcull_percent < cache->frun_percent &&
42575 cache->frun_percent < 100);
42576
42577- ASSERT(cache->bstop_percent >= 0 &&
42578- cache->bstop_percent < cache->bcull_percent &&
42579+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
42580 cache->bcull_percent < cache->brun_percent &&
42581 cache->brun_percent < 100);
42582
42583diff -urNp linux-2.6.32.46/fs/cachefiles/daemon.c linux-2.6.32.46/fs/cachefiles/daemon.c
42584--- linux-2.6.32.46/fs/cachefiles/daemon.c 2011-03-27 14:31:47.000000000 -0400
42585+++ linux-2.6.32.46/fs/cachefiles/daemon.c 2011-04-17 15:56:46.000000000 -0400
42586@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
42587 if (test_bit(CACHEFILES_DEAD, &cache->flags))
42588 return -EIO;
42589
42590- if (datalen < 0 || datalen > PAGE_SIZE - 1)
42591+ if (datalen > PAGE_SIZE - 1)
42592 return -EOPNOTSUPP;
42593
42594 /* drag the command string into the kernel so we can parse it */
42595@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
42596 if (args[0] != '%' || args[1] != '\0')
42597 return -EINVAL;
42598
42599- if (fstop < 0 || fstop >= cache->fcull_percent)
42600+ if (fstop >= cache->fcull_percent)
42601 return cachefiles_daemon_range_error(cache, args);
42602
42603 cache->fstop_percent = fstop;
42604@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
42605 if (args[0] != '%' || args[1] != '\0')
42606 return -EINVAL;
42607
42608- if (bstop < 0 || bstop >= cache->bcull_percent)
42609+ if (bstop >= cache->bcull_percent)
42610 return cachefiles_daemon_range_error(cache, args);
42611
42612 cache->bstop_percent = bstop;
42613diff -urNp linux-2.6.32.46/fs/cachefiles/internal.h linux-2.6.32.46/fs/cachefiles/internal.h
42614--- linux-2.6.32.46/fs/cachefiles/internal.h 2011-03-27 14:31:47.000000000 -0400
42615+++ linux-2.6.32.46/fs/cachefiles/internal.h 2011-05-04 17:56:28.000000000 -0400
42616@@ -56,7 +56,7 @@ struct cachefiles_cache {
42617 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
42618 struct rb_root active_nodes; /* active nodes (can't be culled) */
42619 rwlock_t active_lock; /* lock for active_nodes */
42620- atomic_t gravecounter; /* graveyard uniquifier */
42621+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
42622 unsigned frun_percent; /* when to stop culling (% files) */
42623 unsigned fcull_percent; /* when to start culling (% files) */
42624 unsigned fstop_percent; /* when to stop allocating (% files) */
42625@@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struc
42626 * proc.c
42627 */
42628 #ifdef CONFIG_CACHEFILES_HISTOGRAM
42629-extern atomic_t cachefiles_lookup_histogram[HZ];
42630-extern atomic_t cachefiles_mkdir_histogram[HZ];
42631-extern atomic_t cachefiles_create_histogram[HZ];
42632+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42633+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42634+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
42635
42636 extern int __init cachefiles_proc_init(void);
42637 extern void cachefiles_proc_cleanup(void);
42638 static inline
42639-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
42640+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
42641 {
42642 unsigned long jif = jiffies - start_jif;
42643 if (jif >= HZ)
42644 jif = HZ - 1;
42645- atomic_inc(&histogram[jif]);
42646+ atomic_inc_unchecked(&histogram[jif]);
42647 }
42648
42649 #else
42650diff -urNp linux-2.6.32.46/fs/cachefiles/namei.c linux-2.6.32.46/fs/cachefiles/namei.c
42651--- linux-2.6.32.46/fs/cachefiles/namei.c 2011-03-27 14:31:47.000000000 -0400
42652+++ linux-2.6.32.46/fs/cachefiles/namei.c 2011-05-04 17:56:28.000000000 -0400
42653@@ -250,7 +250,7 @@ try_again:
42654 /* first step is to make up a grave dentry in the graveyard */
42655 sprintf(nbuffer, "%08x%08x",
42656 (uint32_t) get_seconds(),
42657- (uint32_t) atomic_inc_return(&cache->gravecounter));
42658+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
42659
42660 /* do the multiway lock magic */
42661 trap = lock_rename(cache->graveyard, dir);
42662diff -urNp linux-2.6.32.46/fs/cachefiles/proc.c linux-2.6.32.46/fs/cachefiles/proc.c
42663--- linux-2.6.32.46/fs/cachefiles/proc.c 2011-03-27 14:31:47.000000000 -0400
42664+++ linux-2.6.32.46/fs/cachefiles/proc.c 2011-05-04 17:56:28.000000000 -0400
42665@@ -14,9 +14,9 @@
42666 #include <linux/seq_file.h>
42667 #include "internal.h"
42668
42669-atomic_t cachefiles_lookup_histogram[HZ];
42670-atomic_t cachefiles_mkdir_histogram[HZ];
42671-atomic_t cachefiles_create_histogram[HZ];
42672+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
42673+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
42674+atomic_unchecked_t cachefiles_create_histogram[HZ];
42675
42676 /*
42677 * display the latency histogram
42678@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
42679 return 0;
42680 default:
42681 index = (unsigned long) v - 3;
42682- x = atomic_read(&cachefiles_lookup_histogram[index]);
42683- y = atomic_read(&cachefiles_mkdir_histogram[index]);
42684- z = atomic_read(&cachefiles_create_histogram[index]);
42685+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
42686+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
42687+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
42688 if (x == 0 && y == 0 && z == 0)
42689 return 0;
42690
42691diff -urNp linux-2.6.32.46/fs/cachefiles/rdwr.c linux-2.6.32.46/fs/cachefiles/rdwr.c
42692--- linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400
42693+++ linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-04-17 15:56:46.000000000 -0400
42694@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
42695 old_fs = get_fs();
42696 set_fs(KERNEL_DS);
42697 ret = file->f_op->write(
42698- file, (const void __user *) data, len, &pos);
42699+ file, (__force const void __user *) data, len, &pos);
42700 set_fs(old_fs);
42701 kunmap(page);
42702 if (ret != len)
42703diff -urNp linux-2.6.32.46/fs/cifs/cifs_debug.c linux-2.6.32.46/fs/cifs/cifs_debug.c
42704--- linux-2.6.32.46/fs/cifs/cifs_debug.c 2011-03-27 14:31:47.000000000 -0400
42705+++ linux-2.6.32.46/fs/cifs/cifs_debug.c 2011-05-04 17:56:28.000000000 -0400
42706@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(str
42707 tcon = list_entry(tmp3,
42708 struct cifsTconInfo,
42709 tcon_list);
42710- atomic_set(&tcon->num_smbs_sent, 0);
42711- atomic_set(&tcon->num_writes, 0);
42712- atomic_set(&tcon->num_reads, 0);
42713- atomic_set(&tcon->num_oplock_brks, 0);
42714- atomic_set(&tcon->num_opens, 0);
42715- atomic_set(&tcon->num_posixopens, 0);
42716- atomic_set(&tcon->num_posixmkdirs, 0);
42717- atomic_set(&tcon->num_closes, 0);
42718- atomic_set(&tcon->num_deletes, 0);
42719- atomic_set(&tcon->num_mkdirs, 0);
42720- atomic_set(&tcon->num_rmdirs, 0);
42721- atomic_set(&tcon->num_renames, 0);
42722- atomic_set(&tcon->num_t2renames, 0);
42723- atomic_set(&tcon->num_ffirst, 0);
42724- atomic_set(&tcon->num_fnext, 0);
42725- atomic_set(&tcon->num_fclose, 0);
42726- atomic_set(&tcon->num_hardlinks, 0);
42727- atomic_set(&tcon->num_symlinks, 0);
42728- atomic_set(&tcon->num_locks, 0);
42729+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
42730+ atomic_set_unchecked(&tcon->num_writes, 0);
42731+ atomic_set_unchecked(&tcon->num_reads, 0);
42732+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
42733+ atomic_set_unchecked(&tcon->num_opens, 0);
42734+ atomic_set_unchecked(&tcon->num_posixopens, 0);
42735+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
42736+ atomic_set_unchecked(&tcon->num_closes, 0);
42737+ atomic_set_unchecked(&tcon->num_deletes, 0);
42738+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
42739+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
42740+ atomic_set_unchecked(&tcon->num_renames, 0);
42741+ atomic_set_unchecked(&tcon->num_t2renames, 0);
42742+ atomic_set_unchecked(&tcon->num_ffirst, 0);
42743+ atomic_set_unchecked(&tcon->num_fnext, 0);
42744+ atomic_set_unchecked(&tcon->num_fclose, 0);
42745+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
42746+ atomic_set_unchecked(&tcon->num_symlinks, 0);
42747+ atomic_set_unchecked(&tcon->num_locks, 0);
42748 }
42749 }
42750 }
42751@@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct s
42752 if (tcon->need_reconnect)
42753 seq_puts(m, "\tDISCONNECTED ");
42754 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
42755- atomic_read(&tcon->num_smbs_sent),
42756- atomic_read(&tcon->num_oplock_brks));
42757+ atomic_read_unchecked(&tcon->num_smbs_sent),
42758+ atomic_read_unchecked(&tcon->num_oplock_brks));
42759 seq_printf(m, "\nReads: %d Bytes: %lld",
42760- atomic_read(&tcon->num_reads),
42761+ atomic_read_unchecked(&tcon->num_reads),
42762 (long long)(tcon->bytes_read));
42763 seq_printf(m, "\nWrites: %d Bytes: %lld",
42764- atomic_read(&tcon->num_writes),
42765+ atomic_read_unchecked(&tcon->num_writes),
42766 (long long)(tcon->bytes_written));
42767 seq_printf(m, "\nFlushes: %d",
42768- atomic_read(&tcon->num_flushes));
42769+ atomic_read_unchecked(&tcon->num_flushes));
42770 seq_printf(m, "\nLocks: %d HardLinks: %d "
42771 "Symlinks: %d",
42772- atomic_read(&tcon->num_locks),
42773- atomic_read(&tcon->num_hardlinks),
42774- atomic_read(&tcon->num_symlinks));
42775+ atomic_read_unchecked(&tcon->num_locks),
42776+ atomic_read_unchecked(&tcon->num_hardlinks),
42777+ atomic_read_unchecked(&tcon->num_symlinks));
42778 seq_printf(m, "\nOpens: %d Closes: %d "
42779 "Deletes: %d",
42780- atomic_read(&tcon->num_opens),
42781- atomic_read(&tcon->num_closes),
42782- atomic_read(&tcon->num_deletes));
42783+ atomic_read_unchecked(&tcon->num_opens),
42784+ atomic_read_unchecked(&tcon->num_closes),
42785+ atomic_read_unchecked(&tcon->num_deletes));
42786 seq_printf(m, "\nPosix Opens: %d "
42787 "Posix Mkdirs: %d",
42788- atomic_read(&tcon->num_posixopens),
42789- atomic_read(&tcon->num_posixmkdirs));
42790+ atomic_read_unchecked(&tcon->num_posixopens),
42791+ atomic_read_unchecked(&tcon->num_posixmkdirs));
42792 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
42793- atomic_read(&tcon->num_mkdirs),
42794- atomic_read(&tcon->num_rmdirs));
42795+ atomic_read_unchecked(&tcon->num_mkdirs),
42796+ atomic_read_unchecked(&tcon->num_rmdirs));
42797 seq_printf(m, "\nRenames: %d T2 Renames %d",
42798- atomic_read(&tcon->num_renames),
42799- atomic_read(&tcon->num_t2renames));
42800+ atomic_read_unchecked(&tcon->num_renames),
42801+ atomic_read_unchecked(&tcon->num_t2renames));
42802 seq_printf(m, "\nFindFirst: %d FNext %d "
42803 "FClose %d",
42804- atomic_read(&tcon->num_ffirst),
42805- atomic_read(&tcon->num_fnext),
42806- atomic_read(&tcon->num_fclose));
42807+ atomic_read_unchecked(&tcon->num_ffirst),
42808+ atomic_read_unchecked(&tcon->num_fnext),
42809+ atomic_read_unchecked(&tcon->num_fclose));
42810 }
42811 }
42812 }
42813diff -urNp linux-2.6.32.46/fs/cifs/cifsfs.c linux-2.6.32.46/fs/cifs/cifsfs.c
42814--- linux-2.6.32.46/fs/cifs/cifsfs.c 2011-03-27 14:31:47.000000000 -0400
42815+++ linux-2.6.32.46/fs/cifs/cifsfs.c 2011-08-25 17:17:57.000000000 -0400
42816@@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
42817 cifs_req_cachep = kmem_cache_create("cifs_request",
42818 CIFSMaxBufSize +
42819 MAX_CIFS_HDR_SIZE, 0,
42820- SLAB_HWCACHE_ALIGN, NULL);
42821+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
42822 if (cifs_req_cachep == NULL)
42823 return -ENOMEM;
42824
42825@@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
42826 efficient to alloc 1 per page off the slab compared to 17K (5page)
42827 alloc of large cifs buffers even when page debugging is on */
42828 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
42829- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
42830+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
42831 NULL);
42832 if (cifs_sm_req_cachep == NULL) {
42833 mempool_destroy(cifs_req_poolp);
42834@@ -991,8 +991,8 @@ init_cifs(void)
42835 atomic_set(&bufAllocCount, 0);
42836 atomic_set(&smBufAllocCount, 0);
42837 #ifdef CONFIG_CIFS_STATS2
42838- atomic_set(&totBufAllocCount, 0);
42839- atomic_set(&totSmBufAllocCount, 0);
42840+ atomic_set_unchecked(&totBufAllocCount, 0);
42841+ atomic_set_unchecked(&totSmBufAllocCount, 0);
42842 #endif /* CONFIG_CIFS_STATS2 */
42843
42844 atomic_set(&midCount, 0);
42845diff -urNp linux-2.6.32.46/fs/cifs/cifsglob.h linux-2.6.32.46/fs/cifs/cifsglob.h
42846--- linux-2.6.32.46/fs/cifs/cifsglob.h 2011-08-09 18:35:29.000000000 -0400
42847+++ linux-2.6.32.46/fs/cifs/cifsglob.h 2011-08-25 17:17:57.000000000 -0400
42848@@ -252,28 +252,28 @@ struct cifsTconInfo {
42849 __u16 Flags; /* optional support bits */
42850 enum statusEnum tidStatus;
42851 #ifdef CONFIG_CIFS_STATS
42852- atomic_t num_smbs_sent;
42853- atomic_t num_writes;
42854- atomic_t num_reads;
42855- atomic_t num_flushes;
42856- atomic_t num_oplock_brks;
42857- atomic_t num_opens;
42858- atomic_t num_closes;
42859- atomic_t num_deletes;
42860- atomic_t num_mkdirs;
42861- atomic_t num_posixopens;
42862- atomic_t num_posixmkdirs;
42863- atomic_t num_rmdirs;
42864- atomic_t num_renames;
42865- atomic_t num_t2renames;
42866- atomic_t num_ffirst;
42867- atomic_t num_fnext;
42868- atomic_t num_fclose;
42869- atomic_t num_hardlinks;
42870- atomic_t num_symlinks;
42871- atomic_t num_locks;
42872- atomic_t num_acl_get;
42873- atomic_t num_acl_set;
42874+ atomic_unchecked_t num_smbs_sent;
42875+ atomic_unchecked_t num_writes;
42876+ atomic_unchecked_t num_reads;
42877+ atomic_unchecked_t num_flushes;
42878+ atomic_unchecked_t num_oplock_brks;
42879+ atomic_unchecked_t num_opens;
42880+ atomic_unchecked_t num_closes;
42881+ atomic_unchecked_t num_deletes;
42882+ atomic_unchecked_t num_mkdirs;
42883+ atomic_unchecked_t num_posixopens;
42884+ atomic_unchecked_t num_posixmkdirs;
42885+ atomic_unchecked_t num_rmdirs;
42886+ atomic_unchecked_t num_renames;
42887+ atomic_unchecked_t num_t2renames;
42888+ atomic_unchecked_t num_ffirst;
42889+ atomic_unchecked_t num_fnext;
42890+ atomic_unchecked_t num_fclose;
42891+ atomic_unchecked_t num_hardlinks;
42892+ atomic_unchecked_t num_symlinks;
42893+ atomic_unchecked_t num_locks;
42894+ atomic_unchecked_t num_acl_get;
42895+ atomic_unchecked_t num_acl_set;
42896 #ifdef CONFIG_CIFS_STATS2
42897 unsigned long long time_writes;
42898 unsigned long long time_reads;
42899@@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const st
42900 }
42901
42902 #ifdef CONFIG_CIFS_STATS
42903-#define cifs_stats_inc atomic_inc
42904+#define cifs_stats_inc atomic_inc_unchecked
42905
42906 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
42907 unsigned int bytes)
42908@@ -701,8 +701,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect
42909 /* Various Debug counters */
42910 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
42911 #ifdef CONFIG_CIFS_STATS2
42912-GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
42913-GLOBAL_EXTERN atomic_t totSmBufAllocCount;
42914+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
42915+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
42916 #endif
42917 GLOBAL_EXTERN atomic_t smBufAllocCount;
42918 GLOBAL_EXTERN atomic_t midCount;
42919diff -urNp linux-2.6.32.46/fs/cifs/link.c linux-2.6.32.46/fs/cifs/link.c
42920--- linux-2.6.32.46/fs/cifs/link.c 2011-03-27 14:31:47.000000000 -0400
42921+++ linux-2.6.32.46/fs/cifs/link.c 2011-04-17 15:56:46.000000000 -0400
42922@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
42923
42924 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
42925 {
42926- char *p = nd_get_link(nd);
42927+ const char *p = nd_get_link(nd);
42928 if (!IS_ERR(p))
42929 kfree(p);
42930 }
42931diff -urNp linux-2.6.32.46/fs/cifs/misc.c linux-2.6.32.46/fs/cifs/misc.c
42932--- linux-2.6.32.46/fs/cifs/misc.c 2011-03-27 14:31:47.000000000 -0400
42933+++ linux-2.6.32.46/fs/cifs/misc.c 2011-08-25 17:17:57.000000000 -0400
42934@@ -155,7 +155,7 @@ cifs_buf_get(void)
42935 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
42936 atomic_inc(&bufAllocCount);
42937 #ifdef CONFIG_CIFS_STATS2
42938- atomic_inc(&totBufAllocCount);
42939+ atomic_inc_unchecked(&totBufAllocCount);
42940 #endif /* CONFIG_CIFS_STATS2 */
42941 }
42942
42943@@ -190,7 +190,7 @@ cifs_small_buf_get(void)
42944 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
42945 atomic_inc(&smBufAllocCount);
42946 #ifdef CONFIG_CIFS_STATS2
42947- atomic_inc(&totSmBufAllocCount);
42948+ atomic_inc_unchecked(&totSmBufAllocCount);
42949 #endif /* CONFIG_CIFS_STATS2 */
42950
42951 }
42952diff -urNp linux-2.6.32.46/fs/coda/cache.c linux-2.6.32.46/fs/coda/cache.c
42953--- linux-2.6.32.46/fs/coda/cache.c 2011-03-27 14:31:47.000000000 -0400
42954+++ linux-2.6.32.46/fs/coda/cache.c 2011-05-04 17:56:28.000000000 -0400
42955@@ -24,14 +24,14 @@
42956 #include <linux/coda_fs_i.h>
42957 #include <linux/coda_cache.h>
42958
42959-static atomic_t permission_epoch = ATOMIC_INIT(0);
42960+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
42961
42962 /* replace or extend an acl cache hit */
42963 void coda_cache_enter(struct inode *inode, int mask)
42964 {
42965 struct coda_inode_info *cii = ITOC(inode);
42966
42967- cii->c_cached_epoch = atomic_read(&permission_epoch);
42968+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
42969 if (cii->c_uid != current_fsuid()) {
42970 cii->c_uid = current_fsuid();
42971 cii->c_cached_perm = mask;
42972@@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inod
42973 void coda_cache_clear_inode(struct inode *inode)
42974 {
42975 struct coda_inode_info *cii = ITOC(inode);
42976- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
42977+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
42978 }
42979
42980 /* remove all acl caches */
42981 void coda_cache_clear_all(struct super_block *sb)
42982 {
42983- atomic_inc(&permission_epoch);
42984+ atomic_inc_unchecked(&permission_epoch);
42985 }
42986
42987
42988@@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode
42989
42990 hit = (mask & cii->c_cached_perm) == mask &&
42991 cii->c_uid == current_fsuid() &&
42992- cii->c_cached_epoch == atomic_read(&permission_epoch);
42993+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
42994
42995 return hit;
42996 }
42997diff -urNp linux-2.6.32.46/fs/compat_binfmt_elf.c linux-2.6.32.46/fs/compat_binfmt_elf.c
42998--- linux-2.6.32.46/fs/compat_binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
42999+++ linux-2.6.32.46/fs/compat_binfmt_elf.c 2011-04-17 15:56:46.000000000 -0400
43000@@ -29,10 +29,12 @@
43001 #undef elfhdr
43002 #undef elf_phdr
43003 #undef elf_note
43004+#undef elf_dyn
43005 #undef elf_addr_t
43006 #define elfhdr elf32_hdr
43007 #define elf_phdr elf32_phdr
43008 #define elf_note elf32_note
43009+#define elf_dyn Elf32_Dyn
43010 #define elf_addr_t Elf32_Addr
43011
43012 /*
43013diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c
43014--- linux-2.6.32.46/fs/compat.c 2011-04-17 17:00:52.000000000 -0400
43015+++ linux-2.6.32.46/fs/compat.c 2011-08-11 19:56:56.000000000 -0400
43016@@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
43017
43018 struct compat_readdir_callback {
43019 struct compat_old_linux_dirent __user *dirent;
43020+ struct file * file;
43021 int result;
43022 };
43023
43024@@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf
43025 buf->result = -EOVERFLOW;
43026 return -EOVERFLOW;
43027 }
43028+
43029+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43030+ return 0;
43031+
43032 buf->result++;
43033 dirent = buf->dirent;
43034 if (!access_ok(VERIFY_WRITE, dirent,
43035@@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(u
43036
43037 buf.result = 0;
43038 buf.dirent = dirent;
43039+ buf.file = file;
43040
43041 error = vfs_readdir(file, compat_fillonedir, &buf);
43042 if (buf.result)
43043@@ -899,6 +905,7 @@ struct compat_linux_dirent {
43044 struct compat_getdents_callback {
43045 struct compat_linux_dirent __user *current_dir;
43046 struct compat_linux_dirent __user *previous;
43047+ struct file * file;
43048 int count;
43049 int error;
43050 };
43051@@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, c
43052 buf->error = -EOVERFLOW;
43053 return -EOVERFLOW;
43054 }
43055+
43056+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43057+ return 0;
43058+
43059 dirent = buf->previous;
43060 if (dirent) {
43061 if (__put_user(offset, &dirent->d_off))
43062@@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsi
43063 buf.previous = NULL;
43064 buf.count = count;
43065 buf.error = 0;
43066+ buf.file = file;
43067
43068 error = vfs_readdir(file, compat_filldir, &buf);
43069 if (error >= 0)
43070@@ -987,6 +999,7 @@ out:
43071 struct compat_getdents_callback64 {
43072 struct linux_dirent64 __user *current_dir;
43073 struct linux_dirent64 __user *previous;
43074+ struct file * file;
43075 int count;
43076 int error;
43077 };
43078@@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf
43079 buf->error = -EINVAL; /* only used if we fail.. */
43080 if (reclen > buf->count)
43081 return -EINVAL;
43082+
43083+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
43084+ return 0;
43085+
43086 dirent = buf->previous;
43087
43088 if (dirent) {
43089@@ -1054,6 +1071,7 @@ asmlinkage long compat_sys_getdents64(un
43090 buf.previous = NULL;
43091 buf.count = count;
43092 buf.error = 0;
43093+ buf.file = file;
43094
43095 error = vfs_readdir(file, compat_filldir64, &buf);
43096 if (error >= 0)
43097@@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(in
43098 * verify all the pointers
43099 */
43100 ret = -EINVAL;
43101- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
43102+ if (nr_segs > UIO_MAXIOV)
43103 goto out;
43104 if (!file->f_op)
43105 goto out;
43106@@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
43107 compat_uptr_t __user *envp,
43108 struct pt_regs * regs)
43109 {
43110+#ifdef CONFIG_GRKERNSEC
43111+ struct file *old_exec_file;
43112+ struct acl_subject_label *old_acl;
43113+ struct rlimit old_rlim[RLIM_NLIMITS];
43114+#endif
43115 struct linux_binprm *bprm;
43116 struct file *file;
43117 struct files_struct *displaced;
43118 bool clear_in_exec;
43119 int retval;
43120+ const struct cred *cred = current_cred();
43121+
43122+ /*
43123+ * We move the actual failure in case of RLIMIT_NPROC excess from
43124+ * set*uid() to execve() because too many poorly written programs
43125+ * don't check setuid() return code. Here we additionally recheck
43126+ * whether NPROC limit is still exceeded.
43127+ */
43128+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
43129+
43130+ if ((current->flags & PF_NPROC_EXCEEDED) &&
43131+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
43132+ retval = -EAGAIN;
43133+ goto out_ret;
43134+ }
43135+
43136+ /* We're below the limit (still or again), so we don't want to make
43137+ * further execve() calls fail. */
43138+ current->flags &= ~PF_NPROC_EXCEEDED;
43139
43140 retval = unshare_files(&displaced);
43141 if (retval)
43142@@ -1499,6 +1541,15 @@ int compat_do_execve(char * filename,
43143 bprm->filename = filename;
43144 bprm->interp = filename;
43145
43146+ if (gr_process_user_ban()) {
43147+ retval = -EPERM;
43148+ goto out_file;
43149+ }
43150+
43151+ retval = -EACCES;
43152+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
43153+ goto out_file;
43154+
43155 retval = bprm_mm_init(bprm);
43156 if (retval)
43157 goto out_file;
43158@@ -1528,9 +1579,40 @@ int compat_do_execve(char * filename,
43159 if (retval < 0)
43160 goto out;
43161
43162+ if (!gr_tpe_allow(file)) {
43163+ retval = -EACCES;
43164+ goto out;
43165+ }
43166+
43167+ if (gr_check_crash_exec(file)) {
43168+ retval = -EACCES;
43169+ goto out;
43170+ }
43171+
43172+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
43173+
43174+ gr_handle_exec_args_compat(bprm, argv);
43175+
43176+#ifdef CONFIG_GRKERNSEC
43177+ old_acl = current->acl;
43178+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
43179+ old_exec_file = current->exec_file;
43180+ get_file(file);
43181+ current->exec_file = file;
43182+#endif
43183+
43184+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
43185+ bprm->unsafe & LSM_UNSAFE_SHARE);
43186+ if (retval < 0)
43187+ goto out_fail;
43188+
43189 retval = search_binary_handler(bprm, regs);
43190 if (retval < 0)
43191- goto out;
43192+ goto out_fail;
43193+#ifdef CONFIG_GRKERNSEC
43194+ if (old_exec_file)
43195+ fput(old_exec_file);
43196+#endif
43197
43198 /* execve succeeded */
43199 current->fs->in_exec = 0;
43200@@ -1541,6 +1623,14 @@ int compat_do_execve(char * filename,
43201 put_files_struct(displaced);
43202 return retval;
43203
43204+out_fail:
43205+#ifdef CONFIG_GRKERNSEC
43206+ current->acl = old_acl;
43207+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
43208+ fput(current->exec_file);
43209+ current->exec_file = old_exec_file;
43210+#endif
43211+
43212 out:
43213 if (bprm->mm) {
43214 acct_arg_size(bprm, 0);
43215@@ -1711,6 +1801,8 @@ int compat_core_sys_select(int n, compat
43216 struct fdtable *fdt;
43217 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
43218
43219+ pax_track_stack();
43220+
43221 if (n < 0)
43222 goto out_nofds;
43223
43224diff -urNp linux-2.6.32.46/fs/compat_ioctl.c linux-2.6.32.46/fs/compat_ioctl.c
43225--- linux-2.6.32.46/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
43226+++ linux-2.6.32.46/fs/compat_ioctl.c 2011-04-23 12:56:11.000000000 -0400
43227@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi
43228 up = (struct compat_video_spu_palette __user *) arg;
43229 err = get_user(palp, &up->palette);
43230 err |= get_user(length, &up->length);
43231+ if (err)
43232+ return -EFAULT;
43233
43234 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
43235 err = put_user(compat_ptr(palp), &up_native->palette);
43236diff -urNp linux-2.6.32.46/fs/configfs/dir.c linux-2.6.32.46/fs/configfs/dir.c
43237--- linux-2.6.32.46/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400
43238+++ linux-2.6.32.46/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400
43239@@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file
43240 }
43241 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
43242 struct configfs_dirent *next;
43243- const char * name;
43244+ const unsigned char * name;
43245+ char d_name[sizeof(next->s_dentry->d_iname)];
43246 int len;
43247
43248 next = list_entry(p, struct configfs_dirent,
43249@@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file
43250 continue;
43251
43252 name = configfs_get_name(next);
43253- len = strlen(name);
43254+ if (next->s_dentry && name == next->s_dentry->d_iname) {
43255+ len = next->s_dentry->d_name.len;
43256+ memcpy(d_name, name, len);
43257+ name = d_name;
43258+ } else
43259+ len = strlen(name);
43260 if (next->s_dentry)
43261 ino = next->s_dentry->d_inode->i_ino;
43262 else
43263diff -urNp linux-2.6.32.46/fs/dcache.c linux-2.6.32.46/fs/dcache.c
43264--- linux-2.6.32.46/fs/dcache.c 2011-03-27 14:31:47.000000000 -0400
43265+++ linux-2.6.32.46/fs/dcache.c 2011-04-23 13:32:21.000000000 -0400
43266@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
43267
43268 static struct kmem_cache *dentry_cache __read_mostly;
43269
43270-#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
43271-
43272 /*
43273 * This is the single most critical data structure when it comes
43274 * to the dcache: the hashtable for lookups. Somebody should try
43275@@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned lon
43276 mempages -= reserve;
43277
43278 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
43279- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
43280+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
43281
43282 dcache_init();
43283 inode_init();
43284diff -urNp linux-2.6.32.46/fs/dlm/lockspace.c linux-2.6.32.46/fs/dlm/lockspace.c
43285--- linux-2.6.32.46/fs/dlm/lockspace.c 2011-03-27 14:31:47.000000000 -0400
43286+++ linux-2.6.32.46/fs/dlm/lockspace.c 2011-04-17 15:56:46.000000000 -0400
43287@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
43288 kfree(ls);
43289 }
43290
43291-static struct sysfs_ops dlm_attr_ops = {
43292+static const struct sysfs_ops dlm_attr_ops = {
43293 .show = dlm_attr_show,
43294 .store = dlm_attr_store,
43295 };
43296diff -urNp linux-2.6.32.46/fs/ecryptfs/inode.c linux-2.6.32.46/fs/ecryptfs/inode.c
43297--- linux-2.6.32.46/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400
43298+++ linux-2.6.32.46/fs/ecryptfs/inode.c 2011-04-17 15:56:46.000000000 -0400
43299@@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc
43300 old_fs = get_fs();
43301 set_fs(get_ds());
43302 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
43303- (char __user *)lower_buf,
43304+ (__force char __user *)lower_buf,
43305 lower_bufsiz);
43306 set_fs(old_fs);
43307 if (rc < 0)
43308@@ -706,7 +706,7 @@ static void *ecryptfs_follow_link(struct
43309 }
43310 old_fs = get_fs();
43311 set_fs(get_ds());
43312- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
43313+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
43314 set_fs(old_fs);
43315 if (rc < 0)
43316 goto out_free;
43317diff -urNp linux-2.6.32.46/fs/exec.c linux-2.6.32.46/fs/exec.c
43318--- linux-2.6.32.46/fs/exec.c 2011-06-25 12:55:34.000000000 -0400
43319+++ linux-2.6.32.46/fs/exec.c 2011-08-11 19:56:19.000000000 -0400
43320@@ -56,12 +56,24 @@
43321 #include <linux/fsnotify.h>
43322 #include <linux/fs_struct.h>
43323 #include <linux/pipe_fs_i.h>
43324+#include <linux/random.h>
43325+#include <linux/seq_file.h>
43326+
43327+#ifdef CONFIG_PAX_REFCOUNT
43328+#include <linux/kallsyms.h>
43329+#include <linux/kdebug.h>
43330+#endif
43331
43332 #include <asm/uaccess.h>
43333 #include <asm/mmu_context.h>
43334 #include <asm/tlb.h>
43335 #include "internal.h"
43336
43337+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
43338+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
43339+EXPORT_SYMBOL(pax_set_initial_flags_func);
43340+#endif
43341+
43342 int core_uses_pid;
43343 char core_pattern[CORENAME_MAX_SIZE] = "core";
43344 unsigned int core_pipe_limit;
43345@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
43346 goto out;
43347
43348 file = do_filp_open(AT_FDCWD, tmp,
43349- O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
43350+ O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
43351 MAY_READ | MAY_EXEC | MAY_OPEN);
43352 putname(tmp);
43353 error = PTR_ERR(file);
43354@@ -178,18 +190,10 @@ struct page *get_arg_page(struct linux_b
43355 int write)
43356 {
43357 struct page *page;
43358- int ret;
43359
43360-#ifdef CONFIG_STACK_GROWSUP
43361- if (write) {
43362- ret = expand_stack_downwards(bprm->vma, pos);
43363- if (ret < 0)
43364- return NULL;
43365- }
43366-#endif
43367- ret = get_user_pages(current, bprm->mm, pos,
43368- 1, write, 1, &page, NULL);
43369- if (ret <= 0)
43370+ if (0 > expand_stack_downwards(bprm->vma, pos))
43371+ return NULL;
43372+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
43373 return NULL;
43374
43375 if (write) {
43376@@ -263,6 +267,11 @@ static int __bprm_mm_init(struct linux_b
43377 vma->vm_end = STACK_TOP_MAX;
43378 vma->vm_start = vma->vm_end - PAGE_SIZE;
43379 vma->vm_flags = VM_STACK_FLAGS;
43380+
43381+#ifdef CONFIG_PAX_SEGMEXEC
43382+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
43383+#endif
43384+
43385 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
43386
43387 err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
43388@@ -276,6 +285,12 @@ static int __bprm_mm_init(struct linux_b
43389 mm->stack_vm = mm->total_vm = 1;
43390 up_write(&mm->mmap_sem);
43391 bprm->p = vma->vm_end - sizeof(void *);
43392+
43393+#ifdef CONFIG_PAX_RANDUSTACK
43394+ if (randomize_va_space)
43395+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
43396+#endif
43397+
43398 return 0;
43399 err:
43400 up_write(&mm->mmap_sem);
43401@@ -510,7 +525,7 @@ int copy_strings_kernel(int argc,char **
43402 int r;
43403 mm_segment_t oldfs = get_fs();
43404 set_fs(KERNEL_DS);
43405- r = copy_strings(argc, (char __user * __user *)argv, bprm);
43406+ r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
43407 set_fs(oldfs);
43408 return r;
43409 }
43410@@ -540,7 +555,8 @@ static int shift_arg_pages(struct vm_are
43411 unsigned long new_end = old_end - shift;
43412 struct mmu_gather *tlb;
43413
43414- BUG_ON(new_start > new_end);
43415+ if (new_start >= new_end || new_start < mmap_min_addr)
43416+ return -ENOMEM;
43417
43418 /*
43419 * ensure there are no vmas between where we want to go
43420@@ -549,6 +565,10 @@ static int shift_arg_pages(struct vm_are
43421 if (vma != find_vma(mm, new_start))
43422 return -EFAULT;
43423
43424+#ifdef CONFIG_PAX_SEGMEXEC
43425+ BUG_ON(pax_find_mirror_vma(vma));
43426+#endif
43427+
43428 /*
43429 * cover the whole range: [new_start, old_end)
43430 */
43431@@ -630,10 +650,6 @@ int setup_arg_pages(struct linux_binprm
43432 stack_top = arch_align_stack(stack_top);
43433 stack_top = PAGE_ALIGN(stack_top);
43434
43435- if (unlikely(stack_top < mmap_min_addr) ||
43436- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
43437- return -ENOMEM;
43438-
43439 stack_shift = vma->vm_end - stack_top;
43440
43441 bprm->p -= stack_shift;
43442@@ -645,6 +661,14 @@ int setup_arg_pages(struct linux_binprm
43443 bprm->exec -= stack_shift;
43444
43445 down_write(&mm->mmap_sem);
43446+
43447+ /* Move stack pages down in memory. */
43448+ if (stack_shift) {
43449+ ret = shift_arg_pages(vma, stack_shift);
43450+ if (ret)
43451+ goto out_unlock;
43452+ }
43453+
43454 vm_flags = VM_STACK_FLAGS;
43455
43456 /*
43457@@ -658,19 +682,24 @@ int setup_arg_pages(struct linux_binprm
43458 vm_flags &= ~VM_EXEC;
43459 vm_flags |= mm->def_flags;
43460
43461+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43462+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43463+ vm_flags &= ~VM_EXEC;
43464+
43465+#ifdef CONFIG_PAX_MPROTECT
43466+ if (mm->pax_flags & MF_PAX_MPROTECT)
43467+ vm_flags &= ~VM_MAYEXEC;
43468+#endif
43469+
43470+ }
43471+#endif
43472+
43473 ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
43474 vm_flags);
43475 if (ret)
43476 goto out_unlock;
43477 BUG_ON(prev != vma);
43478
43479- /* Move stack pages down in memory. */
43480- if (stack_shift) {
43481- ret = shift_arg_pages(vma, stack_shift);
43482- if (ret)
43483- goto out_unlock;
43484- }
43485-
43486 stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
43487 stack_size = vma->vm_end - vma->vm_start;
43488 /*
43489@@ -707,7 +736,7 @@ struct file *open_exec(const char *name)
43490 int err;
43491
43492 file = do_filp_open(AT_FDCWD, name,
43493- O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
43494+ O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
43495 MAY_EXEC | MAY_OPEN);
43496 if (IS_ERR(file))
43497 goto out;
43498@@ -744,7 +773,7 @@ int kernel_read(struct file *file, loff_
43499 old_fs = get_fs();
43500 set_fs(get_ds());
43501 /* The cast to a user pointer is valid due to the set_fs() */
43502- result = vfs_read(file, (void __user *)addr, count, &pos);
43503+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
43504 set_fs(old_fs);
43505 return result;
43506 }
43507@@ -1152,7 +1181,7 @@ int check_unsafe_exec(struct linux_binpr
43508 }
43509 rcu_read_unlock();
43510
43511- if (p->fs->users > n_fs) {
43512+ if (atomic_read(&p->fs->users) > n_fs) {
43513 bprm->unsafe |= LSM_UNSAFE_SHARE;
43514 } else {
43515 res = -EAGAIN;
43516@@ -1347,11 +1376,35 @@ int do_execve(char * filename,
43517 char __user *__user *envp,
43518 struct pt_regs * regs)
43519 {
43520+#ifdef CONFIG_GRKERNSEC
43521+ struct file *old_exec_file;
43522+ struct acl_subject_label *old_acl;
43523+ struct rlimit old_rlim[RLIM_NLIMITS];
43524+#endif
43525 struct linux_binprm *bprm;
43526 struct file *file;
43527 struct files_struct *displaced;
43528 bool clear_in_exec;
43529 int retval;
43530+ const struct cred *cred = current_cred();
43531+
43532+ /*
43533+ * We move the actual failure in case of RLIMIT_NPROC excess from
43534+ * set*uid() to execve() because too many poorly written programs
43535+ * don't check setuid() return code. Here we additionally recheck
43536+ * whether NPROC limit is still exceeded.
43537+ */
43538+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
43539+
43540+ if ((current->flags & PF_NPROC_EXCEEDED) &&
43541+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
43542+ retval = -EAGAIN;
43543+ goto out_ret;
43544+ }
43545+
43546+ /* We're below the limit (still or again), so we don't want to make
43547+ * further execve() calls fail. */
43548+ current->flags &= ~PF_NPROC_EXCEEDED;
43549
43550 retval = unshare_files(&displaced);
43551 if (retval)
43552@@ -1383,6 +1436,16 @@ int do_execve(char * filename,
43553 bprm->filename = filename;
43554 bprm->interp = filename;
43555
43556+ if (gr_process_user_ban()) {
43557+ retval = -EPERM;
43558+ goto out_file;
43559+ }
43560+
43561+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
43562+ retval = -EACCES;
43563+ goto out_file;
43564+ }
43565+
43566 retval = bprm_mm_init(bprm);
43567 if (retval)
43568 goto out_file;
43569@@ -1412,10 +1475,41 @@ int do_execve(char * filename,
43570 if (retval < 0)
43571 goto out;
43572
43573+ if (!gr_tpe_allow(file)) {
43574+ retval = -EACCES;
43575+ goto out;
43576+ }
43577+
43578+ if (gr_check_crash_exec(file)) {
43579+ retval = -EACCES;
43580+ goto out;
43581+ }
43582+
43583+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
43584+
43585+ gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
43586+
43587+#ifdef CONFIG_GRKERNSEC
43588+ old_acl = current->acl;
43589+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
43590+ old_exec_file = current->exec_file;
43591+ get_file(file);
43592+ current->exec_file = file;
43593+#endif
43594+
43595+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
43596+ bprm->unsafe & LSM_UNSAFE_SHARE);
43597+ if (retval < 0)
43598+ goto out_fail;
43599+
43600 current->flags &= ~PF_KTHREAD;
43601 retval = search_binary_handler(bprm,regs);
43602 if (retval < 0)
43603- goto out;
43604+ goto out_fail;
43605+#ifdef CONFIG_GRKERNSEC
43606+ if (old_exec_file)
43607+ fput(old_exec_file);
43608+#endif
43609
43610 /* execve succeeded */
43611 current->fs->in_exec = 0;
43612@@ -1426,6 +1520,14 @@ int do_execve(char * filename,
43613 put_files_struct(displaced);
43614 return retval;
43615
43616+out_fail:
43617+#ifdef CONFIG_GRKERNSEC
43618+ current->acl = old_acl;
43619+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
43620+ fput(current->exec_file);
43621+ current->exec_file = old_exec_file;
43622+#endif
43623+
43624 out:
43625 if (bprm->mm) {
43626 acct_arg_size(bprm, 0);
43627@@ -1591,6 +1693,220 @@ out:
43628 return ispipe;
43629 }
43630
43631+int pax_check_flags(unsigned long *flags)
43632+{
43633+ int retval = 0;
43634+
43635+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
43636+ if (*flags & MF_PAX_SEGMEXEC)
43637+ {
43638+ *flags &= ~MF_PAX_SEGMEXEC;
43639+ retval = -EINVAL;
43640+ }
43641+#endif
43642+
43643+ if ((*flags & MF_PAX_PAGEEXEC)
43644+
43645+#ifdef CONFIG_PAX_PAGEEXEC
43646+ && (*flags & MF_PAX_SEGMEXEC)
43647+#endif
43648+
43649+ )
43650+ {
43651+ *flags &= ~MF_PAX_PAGEEXEC;
43652+ retval = -EINVAL;
43653+ }
43654+
43655+ if ((*flags & MF_PAX_MPROTECT)
43656+
43657+#ifdef CONFIG_PAX_MPROTECT
43658+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43659+#endif
43660+
43661+ )
43662+ {
43663+ *flags &= ~MF_PAX_MPROTECT;
43664+ retval = -EINVAL;
43665+ }
43666+
43667+ if ((*flags & MF_PAX_EMUTRAMP)
43668+
43669+#ifdef CONFIG_PAX_EMUTRAMP
43670+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
43671+#endif
43672+
43673+ )
43674+ {
43675+ *flags &= ~MF_PAX_EMUTRAMP;
43676+ retval = -EINVAL;
43677+ }
43678+
43679+ return retval;
43680+}
43681+
43682+EXPORT_SYMBOL(pax_check_flags);
43683+
43684+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43685+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
43686+{
43687+ struct task_struct *tsk = current;
43688+ struct mm_struct *mm = current->mm;
43689+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
43690+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
43691+ char *path_exec = NULL;
43692+ char *path_fault = NULL;
43693+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
43694+
43695+ if (buffer_exec && buffer_fault) {
43696+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
43697+
43698+ down_read(&mm->mmap_sem);
43699+ vma = mm->mmap;
43700+ while (vma && (!vma_exec || !vma_fault)) {
43701+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
43702+ vma_exec = vma;
43703+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
43704+ vma_fault = vma;
43705+ vma = vma->vm_next;
43706+ }
43707+ if (vma_exec) {
43708+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
43709+ if (IS_ERR(path_exec))
43710+ path_exec = "<path too long>";
43711+ else {
43712+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
43713+ if (path_exec) {
43714+ *path_exec = 0;
43715+ path_exec = buffer_exec;
43716+ } else
43717+ path_exec = "<path too long>";
43718+ }
43719+ }
43720+ if (vma_fault) {
43721+ start = vma_fault->vm_start;
43722+ end = vma_fault->vm_end;
43723+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
43724+ if (vma_fault->vm_file) {
43725+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
43726+ if (IS_ERR(path_fault))
43727+ path_fault = "<path too long>";
43728+ else {
43729+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
43730+ if (path_fault) {
43731+ *path_fault = 0;
43732+ path_fault = buffer_fault;
43733+ } else
43734+ path_fault = "<path too long>";
43735+ }
43736+ } else
43737+ path_fault = "<anonymous mapping>";
43738+ }
43739+ up_read(&mm->mmap_sem);
43740+ }
43741+ if (tsk->signal->curr_ip)
43742+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
43743+ else
43744+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
43745+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
43746+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
43747+ task_uid(tsk), task_euid(tsk), pc, sp);
43748+ free_page((unsigned long)buffer_exec);
43749+ free_page((unsigned long)buffer_fault);
43750+ pax_report_insns(pc, sp);
43751+ do_coredump(SIGKILL, SIGKILL, regs);
43752+}
43753+#endif
43754+
43755+#ifdef CONFIG_PAX_REFCOUNT
43756+void pax_report_refcount_overflow(struct pt_regs *regs)
43757+{
43758+ if (current->signal->curr_ip)
43759+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
43760+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
43761+ else
43762+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
43763+ current->comm, task_pid_nr(current), current_uid(), current_euid());
43764+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
43765+ show_regs(regs);
43766+ force_sig_specific(SIGKILL, current);
43767+}
43768+#endif
43769+
43770+#ifdef CONFIG_PAX_USERCOPY
43771+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
43772+int object_is_on_stack(const void *obj, unsigned long len)
43773+{
43774+ const void * const stack = task_stack_page(current);
43775+ const void * const stackend = stack + THREAD_SIZE;
43776+
43777+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
43778+ const void *frame = NULL;
43779+ const void *oldframe;
43780+#endif
43781+
43782+ if (obj + len < obj)
43783+ return -1;
43784+
43785+ if (obj + len <= stack || stackend <= obj)
43786+ return 0;
43787+
43788+ if (obj < stack || stackend < obj + len)
43789+ return -1;
43790+
43791+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
43792+ oldframe = __builtin_frame_address(1);
43793+ if (oldframe)
43794+ frame = __builtin_frame_address(2);
43795+ /*
43796+ low ----------------------------------------------> high
43797+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
43798+ ^----------------^
43799+ allow copies only within here
43800+ */
43801+ while (stack <= frame && frame < stackend) {
43802+ /* if obj + len extends past the last frame, this
43803+ check won't pass and the next frame will be 0,
43804+ causing us to bail out and correctly report
43805+ the copy as invalid
43806+ */
43807+ if (obj + len <= frame)
43808+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
43809+ oldframe = frame;
43810+ frame = *(const void * const *)frame;
43811+ }
43812+ return -1;
43813+#else
43814+ return 1;
43815+#endif
43816+}
43817+
43818+
43819+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
43820+{
43821+ if (current->signal->curr_ip)
43822+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
43823+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
43824+ else
43825+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
43826+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
43827+
43828+ dump_stack();
43829+ gr_handle_kernel_exploit();
43830+ do_group_exit(SIGKILL);
43831+}
43832+#endif
43833+
43834+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
43835+void pax_track_stack(void)
43836+{
43837+ unsigned long sp = (unsigned long)&sp;
43838+ if (sp < current_thread_info()->lowest_stack &&
43839+ sp > (unsigned long)task_stack_page(current))
43840+ current_thread_info()->lowest_stack = sp;
43841+}
43842+EXPORT_SYMBOL(pax_track_stack);
43843+#endif
43844+
43845 static int zap_process(struct task_struct *start)
43846 {
43847 struct task_struct *t;
43848@@ -1793,17 +2109,17 @@ static void wait_for_dump_helpers(struct
43849 pipe = file->f_path.dentry->d_inode->i_pipe;
43850
43851 pipe_lock(pipe);
43852- pipe->readers++;
43853- pipe->writers--;
43854+ atomic_inc(&pipe->readers);
43855+ atomic_dec(&pipe->writers);
43856
43857- while ((pipe->readers > 1) && (!signal_pending(current))) {
43858+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
43859 wake_up_interruptible_sync(&pipe->wait);
43860 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
43861 pipe_wait(pipe);
43862 }
43863
43864- pipe->readers--;
43865- pipe->writers++;
43866+ atomic_dec(&pipe->readers);
43867+ atomic_inc(&pipe->writers);
43868 pipe_unlock(pipe);
43869
43870 }
43871@@ -1826,10 +2142,13 @@ void do_coredump(long signr, int exit_co
43872 char **helper_argv = NULL;
43873 int helper_argc = 0;
43874 int dump_count = 0;
43875- static atomic_t core_dump_count = ATOMIC_INIT(0);
43876+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
43877
43878 audit_core_dumps(signr);
43879
43880+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
43881+ gr_handle_brute_attach(current, mm->flags);
43882+
43883 binfmt = mm->binfmt;
43884 if (!binfmt || !binfmt->core_dump)
43885 goto fail;
43886@@ -1874,6 +2193,8 @@ void do_coredump(long signr, int exit_co
43887 */
43888 clear_thread_flag(TIF_SIGPENDING);
43889
43890+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
43891+
43892 /*
43893 * lock_kernel() because format_corename() is controlled by sysctl, which
43894 * uses lock_kernel()
43895@@ -1908,7 +2229,7 @@ void do_coredump(long signr, int exit_co
43896 goto fail_unlock;
43897 }
43898
43899- dump_count = atomic_inc_return(&core_dump_count);
43900+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
43901 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
43902 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
43903 task_tgid_vnr(current), current->comm);
43904@@ -1972,7 +2293,7 @@ close_fail:
43905 filp_close(file, NULL);
43906 fail_dropcount:
43907 if (dump_count)
43908- atomic_dec(&core_dump_count);
43909+ atomic_dec_unchecked(&core_dump_count);
43910 fail_unlock:
43911 if (helper_argv)
43912 argv_free(helper_argv);
43913diff -urNp linux-2.6.32.46/fs/ext2/balloc.c linux-2.6.32.46/fs/ext2/balloc.c
43914--- linux-2.6.32.46/fs/ext2/balloc.c 2011-03-27 14:31:47.000000000 -0400
43915+++ linux-2.6.32.46/fs/ext2/balloc.c 2011-04-17 15:56:46.000000000 -0400
43916@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
43917
43918 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
43919 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
43920- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
43921+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
43922 sbi->s_resuid != current_fsuid() &&
43923 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
43924 return 0;
43925diff -urNp linux-2.6.32.46/fs/ext3/balloc.c linux-2.6.32.46/fs/ext3/balloc.c
43926--- linux-2.6.32.46/fs/ext3/balloc.c 2011-03-27 14:31:47.000000000 -0400
43927+++ linux-2.6.32.46/fs/ext3/balloc.c 2011-04-17 15:56:46.000000000 -0400
43928@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
43929
43930 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
43931 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
43932- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
43933+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
43934 sbi->s_resuid != current_fsuid() &&
43935 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
43936 return 0;
43937diff -urNp linux-2.6.32.46/fs/ext4/balloc.c linux-2.6.32.46/fs/ext4/balloc.c
43938--- linux-2.6.32.46/fs/ext4/balloc.c 2011-03-27 14:31:47.000000000 -0400
43939+++ linux-2.6.32.46/fs/ext4/balloc.c 2011-04-17 15:56:46.000000000 -0400
43940@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_
43941 /* Hm, nope. Are (enough) root reserved blocks available? */
43942 if (sbi->s_resuid == current_fsuid() ||
43943 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
43944- capable(CAP_SYS_RESOURCE)) {
43945+ capable_nolog(CAP_SYS_RESOURCE)) {
43946 if (free_blocks >= (nblocks + dirty_blocks))
43947 return 1;
43948 }
43949diff -urNp linux-2.6.32.46/fs/ext4/ext4.h linux-2.6.32.46/fs/ext4/ext4.h
43950--- linux-2.6.32.46/fs/ext4/ext4.h 2011-03-27 14:31:47.000000000 -0400
43951+++ linux-2.6.32.46/fs/ext4/ext4.h 2011-04-17 15:56:46.000000000 -0400
43952@@ -1078,19 +1078,19 @@ struct ext4_sb_info {
43953
43954 /* stats for buddy allocator */
43955 spinlock_t s_mb_pa_lock;
43956- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
43957- atomic_t s_bal_success; /* we found long enough chunks */
43958- atomic_t s_bal_allocated; /* in blocks */
43959- atomic_t s_bal_ex_scanned; /* total extents scanned */
43960- atomic_t s_bal_goals; /* goal hits */
43961- atomic_t s_bal_breaks; /* too long searches */
43962- atomic_t s_bal_2orders; /* 2^order hits */
43963+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
43964+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
43965+ atomic_unchecked_t s_bal_allocated; /* in blocks */
43966+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
43967+ atomic_unchecked_t s_bal_goals; /* goal hits */
43968+ atomic_unchecked_t s_bal_breaks; /* too long searches */
43969+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
43970 spinlock_t s_bal_lock;
43971 unsigned long s_mb_buddies_generated;
43972 unsigned long long s_mb_generation_time;
43973- atomic_t s_mb_lost_chunks;
43974- atomic_t s_mb_preallocated;
43975- atomic_t s_mb_discarded;
43976+ atomic_unchecked_t s_mb_lost_chunks;
43977+ atomic_unchecked_t s_mb_preallocated;
43978+ atomic_unchecked_t s_mb_discarded;
43979 atomic_t s_lock_busy;
43980
43981 /* locality groups */
43982diff -urNp linux-2.6.32.46/fs/ext4/mballoc.c linux-2.6.32.46/fs/ext4/mballoc.c
43983--- linux-2.6.32.46/fs/ext4/mballoc.c 2011-06-25 12:55:34.000000000 -0400
43984+++ linux-2.6.32.46/fs/ext4/mballoc.c 2011-06-25 12:56:37.000000000 -0400
43985@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ex
43986 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
43987
43988 if (EXT4_SB(sb)->s_mb_stats)
43989- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
43990+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
43991
43992 break;
43993 }
43994@@ -2131,7 +2131,7 @@ repeat:
43995 ac->ac_status = AC_STATUS_CONTINUE;
43996 ac->ac_flags |= EXT4_MB_HINT_FIRST;
43997 cr = 3;
43998- atomic_inc(&sbi->s_mb_lost_chunks);
43999+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
44000 goto repeat;
44001 }
44002 }
44003@@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struc
44004 ext4_grpblk_t counters[16];
44005 } sg;
44006
44007+ pax_track_stack();
44008+
44009 group--;
44010 if (group == 0)
44011 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
44012@@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *
44013 if (sbi->s_mb_stats) {
44014 printk(KERN_INFO
44015 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
44016- atomic_read(&sbi->s_bal_allocated),
44017- atomic_read(&sbi->s_bal_reqs),
44018- atomic_read(&sbi->s_bal_success));
44019+ atomic_read_unchecked(&sbi->s_bal_allocated),
44020+ atomic_read_unchecked(&sbi->s_bal_reqs),
44021+ atomic_read_unchecked(&sbi->s_bal_success));
44022 printk(KERN_INFO
44023 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
44024 "%u 2^N hits, %u breaks, %u lost\n",
44025- atomic_read(&sbi->s_bal_ex_scanned),
44026- atomic_read(&sbi->s_bal_goals),
44027- atomic_read(&sbi->s_bal_2orders),
44028- atomic_read(&sbi->s_bal_breaks),
44029- atomic_read(&sbi->s_mb_lost_chunks));
44030+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
44031+ atomic_read_unchecked(&sbi->s_bal_goals),
44032+ atomic_read_unchecked(&sbi->s_bal_2orders),
44033+ atomic_read_unchecked(&sbi->s_bal_breaks),
44034+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
44035 printk(KERN_INFO
44036 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
44037 sbi->s_mb_buddies_generated++,
44038 sbi->s_mb_generation_time);
44039 printk(KERN_INFO
44040 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
44041- atomic_read(&sbi->s_mb_preallocated),
44042- atomic_read(&sbi->s_mb_discarded));
44043+ atomic_read_unchecked(&sbi->s_mb_preallocated),
44044+ atomic_read_unchecked(&sbi->s_mb_discarded));
44045 }
44046
44047 free_percpu(sbi->s_locality_groups);
44048@@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct
44049 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
44050
44051 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
44052- atomic_inc(&sbi->s_bal_reqs);
44053- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44054+ atomic_inc_unchecked(&sbi->s_bal_reqs);
44055+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
44056 if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
44057- atomic_inc(&sbi->s_bal_success);
44058- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
44059+ atomic_inc_unchecked(&sbi->s_bal_success);
44060+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
44061 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
44062 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
44063- atomic_inc(&sbi->s_bal_goals);
44064+ atomic_inc_unchecked(&sbi->s_bal_goals);
44065 if (ac->ac_found > sbi->s_mb_max_to_scan)
44066- atomic_inc(&sbi->s_bal_breaks);
44067+ atomic_inc_unchecked(&sbi->s_bal_breaks);
44068 }
44069
44070 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
44071@@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
44072 trace_ext4_mb_new_inode_pa(ac, pa);
44073
44074 ext4_mb_use_inode_pa(ac, pa);
44075- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44076+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44077
44078 ei = EXT4_I(ac->ac_inode);
44079 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44080@@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
44081 trace_ext4_mb_new_group_pa(ac, pa);
44082
44083 ext4_mb_use_group_pa(ac, pa);
44084- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44085+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
44086
44087 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
44088 lg = ac->ac_lg;
44089@@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
44090 * from the bitmap and continue.
44091 */
44092 }
44093- atomic_add(free, &sbi->s_mb_discarded);
44094+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
44095
44096 return err;
44097 }
44098@@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_bud
44099 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
44100 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
44101 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
44102- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44103+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
44104
44105 if (ac) {
44106 ac->ac_sb = sb;
44107diff -urNp linux-2.6.32.46/fs/ext4/super.c linux-2.6.32.46/fs/ext4/super.c
44108--- linux-2.6.32.46/fs/ext4/super.c 2011-03-27 14:31:47.000000000 -0400
44109+++ linux-2.6.32.46/fs/ext4/super.c 2011-04-17 15:56:46.000000000 -0400
44110@@ -2287,7 +2287,7 @@ static void ext4_sb_release(struct kobje
44111 }
44112
44113
44114-static struct sysfs_ops ext4_attr_ops = {
44115+static const struct sysfs_ops ext4_attr_ops = {
44116 .show = ext4_attr_show,
44117 .store = ext4_attr_store,
44118 };
44119diff -urNp linux-2.6.32.46/fs/fcntl.c linux-2.6.32.46/fs/fcntl.c
44120--- linux-2.6.32.46/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400
44121+++ linux-2.6.32.46/fs/fcntl.c 2011-04-17 15:56:46.000000000 -0400
44122@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct
44123 if (err)
44124 return err;
44125
44126+ if (gr_handle_chroot_fowner(pid, type))
44127+ return -ENOENT;
44128+ if (gr_check_protected_task_fowner(pid, type))
44129+ return -EACCES;
44130+
44131 f_modown(filp, pid, type, force);
44132 return 0;
44133 }
44134@@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned in
44135 switch (cmd) {
44136 case F_DUPFD:
44137 case F_DUPFD_CLOEXEC:
44138+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
44139 if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
44140 break;
44141 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
44142diff -urNp linux-2.6.32.46/fs/fifo.c linux-2.6.32.46/fs/fifo.c
44143--- linux-2.6.32.46/fs/fifo.c 2011-03-27 14:31:47.000000000 -0400
44144+++ linux-2.6.32.46/fs/fifo.c 2011-04-17 15:56:46.000000000 -0400
44145@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
44146 */
44147 filp->f_op = &read_pipefifo_fops;
44148 pipe->r_counter++;
44149- if (pipe->readers++ == 0)
44150+ if (atomic_inc_return(&pipe->readers) == 1)
44151 wake_up_partner(inode);
44152
44153- if (!pipe->writers) {
44154+ if (!atomic_read(&pipe->writers)) {
44155 if ((filp->f_flags & O_NONBLOCK)) {
44156 /* suppress POLLHUP until we have
44157 * seen a writer */
44158@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
44159 * errno=ENXIO when there is no process reading the FIFO.
44160 */
44161 ret = -ENXIO;
44162- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
44163+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
44164 goto err;
44165
44166 filp->f_op = &write_pipefifo_fops;
44167 pipe->w_counter++;
44168- if (!pipe->writers++)
44169+ if (atomic_inc_return(&pipe->writers) == 1)
44170 wake_up_partner(inode);
44171
44172- if (!pipe->readers) {
44173+ if (!atomic_read(&pipe->readers)) {
44174 wait_for_partner(inode, &pipe->r_counter);
44175 if (signal_pending(current))
44176 goto err_wr;
44177@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
44178 */
44179 filp->f_op = &rdwr_pipefifo_fops;
44180
44181- pipe->readers++;
44182- pipe->writers++;
44183+ atomic_inc(&pipe->readers);
44184+ atomic_inc(&pipe->writers);
44185 pipe->r_counter++;
44186 pipe->w_counter++;
44187- if (pipe->readers == 1 || pipe->writers == 1)
44188+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
44189 wake_up_partner(inode);
44190 break;
44191
44192@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
44193 return 0;
44194
44195 err_rd:
44196- if (!--pipe->readers)
44197+ if (atomic_dec_and_test(&pipe->readers))
44198 wake_up_interruptible(&pipe->wait);
44199 ret = -ERESTARTSYS;
44200 goto err;
44201
44202 err_wr:
44203- if (!--pipe->writers)
44204+ if (atomic_dec_and_test(&pipe->writers))
44205 wake_up_interruptible(&pipe->wait);
44206 ret = -ERESTARTSYS;
44207 goto err;
44208
44209 err:
44210- if (!pipe->readers && !pipe->writers)
44211+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
44212 free_pipe_info(inode);
44213
44214 err_nocleanup:
44215diff -urNp linux-2.6.32.46/fs/file.c linux-2.6.32.46/fs/file.c
44216--- linux-2.6.32.46/fs/file.c 2011-03-27 14:31:47.000000000 -0400
44217+++ linux-2.6.32.46/fs/file.c 2011-04-17 15:56:46.000000000 -0400
44218@@ -14,6 +14,7 @@
44219 #include <linux/slab.h>
44220 #include <linux/vmalloc.h>
44221 #include <linux/file.h>
44222+#include <linux/security.h>
44223 #include <linux/fdtable.h>
44224 #include <linux/bitops.h>
44225 #include <linux/interrupt.h>
44226@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
44227 * N.B. For clone tasks sharing a files structure, this test
44228 * will limit the total number of files that can be opened.
44229 */
44230+
44231+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
44232 if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
44233 return -EMFILE;
44234
44235diff -urNp linux-2.6.32.46/fs/filesystems.c linux-2.6.32.46/fs/filesystems.c
44236--- linux-2.6.32.46/fs/filesystems.c 2011-03-27 14:31:47.000000000 -0400
44237+++ linux-2.6.32.46/fs/filesystems.c 2011-04-17 15:56:46.000000000 -0400
44238@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(con
44239 int len = dot ? dot - name : strlen(name);
44240
44241 fs = __get_fs_type(name, len);
44242+
44243+#ifdef CONFIG_GRKERNSEC_MODHARDEN
44244+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
44245+#else
44246 if (!fs && (request_module("%.*s", len, name) == 0))
44247+#endif
44248 fs = __get_fs_type(name, len);
44249
44250 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
44251diff -urNp linux-2.6.32.46/fs/fscache/cookie.c linux-2.6.32.46/fs/fscache/cookie.c
44252--- linux-2.6.32.46/fs/fscache/cookie.c 2011-03-27 14:31:47.000000000 -0400
44253+++ linux-2.6.32.46/fs/fscache/cookie.c 2011-05-04 17:56:28.000000000 -0400
44254@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
44255 parent ? (char *) parent->def->name : "<no-parent>",
44256 def->name, netfs_data);
44257
44258- fscache_stat(&fscache_n_acquires);
44259+ fscache_stat_unchecked(&fscache_n_acquires);
44260
44261 /* if there's no parent cookie, then we don't create one here either */
44262 if (!parent) {
44263- fscache_stat(&fscache_n_acquires_null);
44264+ fscache_stat_unchecked(&fscache_n_acquires_null);
44265 _leave(" [no parent]");
44266 return NULL;
44267 }
44268@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
44269 /* allocate and initialise a cookie */
44270 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
44271 if (!cookie) {
44272- fscache_stat(&fscache_n_acquires_oom);
44273+ fscache_stat_unchecked(&fscache_n_acquires_oom);
44274 _leave(" [ENOMEM]");
44275 return NULL;
44276 }
44277@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
44278
44279 switch (cookie->def->type) {
44280 case FSCACHE_COOKIE_TYPE_INDEX:
44281- fscache_stat(&fscache_n_cookie_index);
44282+ fscache_stat_unchecked(&fscache_n_cookie_index);
44283 break;
44284 case FSCACHE_COOKIE_TYPE_DATAFILE:
44285- fscache_stat(&fscache_n_cookie_data);
44286+ fscache_stat_unchecked(&fscache_n_cookie_data);
44287 break;
44288 default:
44289- fscache_stat(&fscache_n_cookie_special);
44290+ fscache_stat_unchecked(&fscache_n_cookie_special);
44291 break;
44292 }
44293
44294@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
44295 if (fscache_acquire_non_index_cookie(cookie) < 0) {
44296 atomic_dec(&parent->n_children);
44297 __fscache_cookie_put(cookie);
44298- fscache_stat(&fscache_n_acquires_nobufs);
44299+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
44300 _leave(" = NULL");
44301 return NULL;
44302 }
44303 }
44304
44305- fscache_stat(&fscache_n_acquires_ok);
44306+ fscache_stat_unchecked(&fscache_n_acquires_ok);
44307 _leave(" = %p", cookie);
44308 return cookie;
44309 }
44310@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
44311 cache = fscache_select_cache_for_object(cookie->parent);
44312 if (!cache) {
44313 up_read(&fscache_addremove_sem);
44314- fscache_stat(&fscache_n_acquires_no_cache);
44315+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
44316 _leave(" = -ENOMEDIUM [no cache]");
44317 return -ENOMEDIUM;
44318 }
44319@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
44320 object = cache->ops->alloc_object(cache, cookie);
44321 fscache_stat_d(&fscache_n_cop_alloc_object);
44322 if (IS_ERR(object)) {
44323- fscache_stat(&fscache_n_object_no_alloc);
44324+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
44325 ret = PTR_ERR(object);
44326 goto error;
44327 }
44328
44329- fscache_stat(&fscache_n_object_alloc);
44330+ fscache_stat_unchecked(&fscache_n_object_alloc);
44331
44332 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
44333
44334@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
44335 struct fscache_object *object;
44336 struct hlist_node *_p;
44337
44338- fscache_stat(&fscache_n_updates);
44339+ fscache_stat_unchecked(&fscache_n_updates);
44340
44341 if (!cookie) {
44342- fscache_stat(&fscache_n_updates_null);
44343+ fscache_stat_unchecked(&fscache_n_updates_null);
44344 _leave(" [no cookie]");
44345 return;
44346 }
44347@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
44348 struct fscache_object *object;
44349 unsigned long event;
44350
44351- fscache_stat(&fscache_n_relinquishes);
44352+ fscache_stat_unchecked(&fscache_n_relinquishes);
44353 if (retire)
44354- fscache_stat(&fscache_n_relinquishes_retire);
44355+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
44356
44357 if (!cookie) {
44358- fscache_stat(&fscache_n_relinquishes_null);
44359+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
44360 _leave(" [no cookie]");
44361 return;
44362 }
44363@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
44364
44365 /* wait for the cookie to finish being instantiated (or to fail) */
44366 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
44367- fscache_stat(&fscache_n_relinquishes_waitcrt);
44368+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
44369 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
44370 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
44371 }
44372diff -urNp linux-2.6.32.46/fs/fscache/internal.h linux-2.6.32.46/fs/fscache/internal.h
44373--- linux-2.6.32.46/fs/fscache/internal.h 2011-03-27 14:31:47.000000000 -0400
44374+++ linux-2.6.32.46/fs/fscache/internal.h 2011-05-04 17:56:28.000000000 -0400
44375@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
44376 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
44377 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
44378
44379-extern atomic_t fscache_n_op_pend;
44380-extern atomic_t fscache_n_op_run;
44381-extern atomic_t fscache_n_op_enqueue;
44382-extern atomic_t fscache_n_op_deferred_release;
44383-extern atomic_t fscache_n_op_release;
44384-extern atomic_t fscache_n_op_gc;
44385-extern atomic_t fscache_n_op_cancelled;
44386-extern atomic_t fscache_n_op_rejected;
44387-
44388-extern atomic_t fscache_n_attr_changed;
44389-extern atomic_t fscache_n_attr_changed_ok;
44390-extern atomic_t fscache_n_attr_changed_nobufs;
44391-extern atomic_t fscache_n_attr_changed_nomem;
44392-extern atomic_t fscache_n_attr_changed_calls;
44393-
44394-extern atomic_t fscache_n_allocs;
44395-extern atomic_t fscache_n_allocs_ok;
44396-extern atomic_t fscache_n_allocs_wait;
44397-extern atomic_t fscache_n_allocs_nobufs;
44398-extern atomic_t fscache_n_allocs_intr;
44399-extern atomic_t fscache_n_allocs_object_dead;
44400-extern atomic_t fscache_n_alloc_ops;
44401-extern atomic_t fscache_n_alloc_op_waits;
44402-
44403-extern atomic_t fscache_n_retrievals;
44404-extern atomic_t fscache_n_retrievals_ok;
44405-extern atomic_t fscache_n_retrievals_wait;
44406-extern atomic_t fscache_n_retrievals_nodata;
44407-extern atomic_t fscache_n_retrievals_nobufs;
44408-extern atomic_t fscache_n_retrievals_intr;
44409-extern atomic_t fscache_n_retrievals_nomem;
44410-extern atomic_t fscache_n_retrievals_object_dead;
44411-extern atomic_t fscache_n_retrieval_ops;
44412-extern atomic_t fscache_n_retrieval_op_waits;
44413-
44414-extern atomic_t fscache_n_stores;
44415-extern atomic_t fscache_n_stores_ok;
44416-extern atomic_t fscache_n_stores_again;
44417-extern atomic_t fscache_n_stores_nobufs;
44418-extern atomic_t fscache_n_stores_oom;
44419-extern atomic_t fscache_n_store_ops;
44420-extern atomic_t fscache_n_store_calls;
44421-extern atomic_t fscache_n_store_pages;
44422-extern atomic_t fscache_n_store_radix_deletes;
44423-extern atomic_t fscache_n_store_pages_over_limit;
44424-
44425-extern atomic_t fscache_n_store_vmscan_not_storing;
44426-extern atomic_t fscache_n_store_vmscan_gone;
44427-extern atomic_t fscache_n_store_vmscan_busy;
44428-extern atomic_t fscache_n_store_vmscan_cancelled;
44429-
44430-extern atomic_t fscache_n_marks;
44431-extern atomic_t fscache_n_uncaches;
44432-
44433-extern atomic_t fscache_n_acquires;
44434-extern atomic_t fscache_n_acquires_null;
44435-extern atomic_t fscache_n_acquires_no_cache;
44436-extern atomic_t fscache_n_acquires_ok;
44437-extern atomic_t fscache_n_acquires_nobufs;
44438-extern atomic_t fscache_n_acquires_oom;
44439-
44440-extern atomic_t fscache_n_updates;
44441-extern atomic_t fscache_n_updates_null;
44442-extern atomic_t fscache_n_updates_run;
44443-
44444-extern atomic_t fscache_n_relinquishes;
44445-extern atomic_t fscache_n_relinquishes_null;
44446-extern atomic_t fscache_n_relinquishes_waitcrt;
44447-extern atomic_t fscache_n_relinquishes_retire;
44448-
44449-extern atomic_t fscache_n_cookie_index;
44450-extern atomic_t fscache_n_cookie_data;
44451-extern atomic_t fscache_n_cookie_special;
44452-
44453-extern atomic_t fscache_n_object_alloc;
44454-extern atomic_t fscache_n_object_no_alloc;
44455-extern atomic_t fscache_n_object_lookups;
44456-extern atomic_t fscache_n_object_lookups_negative;
44457-extern atomic_t fscache_n_object_lookups_positive;
44458-extern atomic_t fscache_n_object_lookups_timed_out;
44459-extern atomic_t fscache_n_object_created;
44460-extern atomic_t fscache_n_object_avail;
44461-extern atomic_t fscache_n_object_dead;
44462-
44463-extern atomic_t fscache_n_checkaux_none;
44464-extern atomic_t fscache_n_checkaux_okay;
44465-extern atomic_t fscache_n_checkaux_update;
44466-extern atomic_t fscache_n_checkaux_obsolete;
44467+extern atomic_unchecked_t fscache_n_op_pend;
44468+extern atomic_unchecked_t fscache_n_op_run;
44469+extern atomic_unchecked_t fscache_n_op_enqueue;
44470+extern atomic_unchecked_t fscache_n_op_deferred_release;
44471+extern atomic_unchecked_t fscache_n_op_release;
44472+extern atomic_unchecked_t fscache_n_op_gc;
44473+extern atomic_unchecked_t fscache_n_op_cancelled;
44474+extern atomic_unchecked_t fscache_n_op_rejected;
44475+
44476+extern atomic_unchecked_t fscache_n_attr_changed;
44477+extern atomic_unchecked_t fscache_n_attr_changed_ok;
44478+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
44479+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
44480+extern atomic_unchecked_t fscache_n_attr_changed_calls;
44481+
44482+extern atomic_unchecked_t fscache_n_allocs;
44483+extern atomic_unchecked_t fscache_n_allocs_ok;
44484+extern atomic_unchecked_t fscache_n_allocs_wait;
44485+extern atomic_unchecked_t fscache_n_allocs_nobufs;
44486+extern atomic_unchecked_t fscache_n_allocs_intr;
44487+extern atomic_unchecked_t fscache_n_allocs_object_dead;
44488+extern atomic_unchecked_t fscache_n_alloc_ops;
44489+extern atomic_unchecked_t fscache_n_alloc_op_waits;
44490+
44491+extern atomic_unchecked_t fscache_n_retrievals;
44492+extern atomic_unchecked_t fscache_n_retrievals_ok;
44493+extern atomic_unchecked_t fscache_n_retrievals_wait;
44494+extern atomic_unchecked_t fscache_n_retrievals_nodata;
44495+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
44496+extern atomic_unchecked_t fscache_n_retrievals_intr;
44497+extern atomic_unchecked_t fscache_n_retrievals_nomem;
44498+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
44499+extern atomic_unchecked_t fscache_n_retrieval_ops;
44500+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
44501+
44502+extern atomic_unchecked_t fscache_n_stores;
44503+extern atomic_unchecked_t fscache_n_stores_ok;
44504+extern atomic_unchecked_t fscache_n_stores_again;
44505+extern atomic_unchecked_t fscache_n_stores_nobufs;
44506+extern atomic_unchecked_t fscache_n_stores_oom;
44507+extern atomic_unchecked_t fscache_n_store_ops;
44508+extern atomic_unchecked_t fscache_n_store_calls;
44509+extern atomic_unchecked_t fscache_n_store_pages;
44510+extern atomic_unchecked_t fscache_n_store_radix_deletes;
44511+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
44512+
44513+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
44514+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
44515+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
44516+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
44517+
44518+extern atomic_unchecked_t fscache_n_marks;
44519+extern atomic_unchecked_t fscache_n_uncaches;
44520+
44521+extern atomic_unchecked_t fscache_n_acquires;
44522+extern atomic_unchecked_t fscache_n_acquires_null;
44523+extern atomic_unchecked_t fscache_n_acquires_no_cache;
44524+extern atomic_unchecked_t fscache_n_acquires_ok;
44525+extern atomic_unchecked_t fscache_n_acquires_nobufs;
44526+extern atomic_unchecked_t fscache_n_acquires_oom;
44527+
44528+extern atomic_unchecked_t fscache_n_updates;
44529+extern atomic_unchecked_t fscache_n_updates_null;
44530+extern atomic_unchecked_t fscache_n_updates_run;
44531+
44532+extern atomic_unchecked_t fscache_n_relinquishes;
44533+extern atomic_unchecked_t fscache_n_relinquishes_null;
44534+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
44535+extern atomic_unchecked_t fscache_n_relinquishes_retire;
44536+
44537+extern atomic_unchecked_t fscache_n_cookie_index;
44538+extern atomic_unchecked_t fscache_n_cookie_data;
44539+extern atomic_unchecked_t fscache_n_cookie_special;
44540+
44541+extern atomic_unchecked_t fscache_n_object_alloc;
44542+extern atomic_unchecked_t fscache_n_object_no_alloc;
44543+extern atomic_unchecked_t fscache_n_object_lookups;
44544+extern atomic_unchecked_t fscache_n_object_lookups_negative;
44545+extern atomic_unchecked_t fscache_n_object_lookups_positive;
44546+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
44547+extern atomic_unchecked_t fscache_n_object_created;
44548+extern atomic_unchecked_t fscache_n_object_avail;
44549+extern atomic_unchecked_t fscache_n_object_dead;
44550+
44551+extern atomic_unchecked_t fscache_n_checkaux_none;
44552+extern atomic_unchecked_t fscache_n_checkaux_okay;
44553+extern atomic_unchecked_t fscache_n_checkaux_update;
44554+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
44555
44556 extern atomic_t fscache_n_cop_alloc_object;
44557 extern atomic_t fscache_n_cop_lookup_object;
44558@@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t
44559 atomic_inc(stat);
44560 }
44561
44562+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
44563+{
44564+ atomic_inc_unchecked(stat);
44565+}
44566+
44567 static inline void fscache_stat_d(atomic_t *stat)
44568 {
44569 atomic_dec(stat);
44570@@ -259,6 +264,7 @@ extern const struct file_operations fsca
44571
44572 #define __fscache_stat(stat) (NULL)
44573 #define fscache_stat(stat) do {} while (0)
44574+#define fscache_stat_unchecked(stat) do {} while (0)
44575 #define fscache_stat_d(stat) do {} while (0)
44576 #endif
44577
44578diff -urNp linux-2.6.32.46/fs/fscache/object.c linux-2.6.32.46/fs/fscache/object.c
44579--- linux-2.6.32.46/fs/fscache/object.c 2011-03-27 14:31:47.000000000 -0400
44580+++ linux-2.6.32.46/fs/fscache/object.c 2011-05-04 17:56:28.000000000 -0400
44581@@ -144,7 +144,7 @@ static void fscache_object_state_machine
44582 /* update the object metadata on disk */
44583 case FSCACHE_OBJECT_UPDATING:
44584 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
44585- fscache_stat(&fscache_n_updates_run);
44586+ fscache_stat_unchecked(&fscache_n_updates_run);
44587 fscache_stat(&fscache_n_cop_update_object);
44588 object->cache->ops->update_object(object);
44589 fscache_stat_d(&fscache_n_cop_update_object);
44590@@ -233,7 +233,7 @@ static void fscache_object_state_machine
44591 spin_lock(&object->lock);
44592 object->state = FSCACHE_OBJECT_DEAD;
44593 spin_unlock(&object->lock);
44594- fscache_stat(&fscache_n_object_dead);
44595+ fscache_stat_unchecked(&fscache_n_object_dead);
44596 goto terminal_transit;
44597
44598 /* handle the parent cache of this object being withdrawn from
44599@@ -248,7 +248,7 @@ static void fscache_object_state_machine
44600 spin_lock(&object->lock);
44601 object->state = FSCACHE_OBJECT_DEAD;
44602 spin_unlock(&object->lock);
44603- fscache_stat(&fscache_n_object_dead);
44604+ fscache_stat_unchecked(&fscache_n_object_dead);
44605 goto terminal_transit;
44606
44607 /* complain about the object being woken up once it is
44608@@ -492,7 +492,7 @@ static void fscache_lookup_object(struct
44609 parent->cookie->def->name, cookie->def->name,
44610 object->cache->tag->name);
44611
44612- fscache_stat(&fscache_n_object_lookups);
44613+ fscache_stat_unchecked(&fscache_n_object_lookups);
44614 fscache_stat(&fscache_n_cop_lookup_object);
44615 ret = object->cache->ops->lookup_object(object);
44616 fscache_stat_d(&fscache_n_cop_lookup_object);
44617@@ -503,7 +503,7 @@ static void fscache_lookup_object(struct
44618 if (ret == -ETIMEDOUT) {
44619 /* probably stuck behind another object, so move this one to
44620 * the back of the queue */
44621- fscache_stat(&fscache_n_object_lookups_timed_out);
44622+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
44623 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
44624 }
44625
44626@@ -526,7 +526,7 @@ void fscache_object_lookup_negative(stru
44627
44628 spin_lock(&object->lock);
44629 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
44630- fscache_stat(&fscache_n_object_lookups_negative);
44631+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
44632
44633 /* transit here to allow write requests to begin stacking up
44634 * and read requests to begin returning ENODATA */
44635@@ -572,7 +572,7 @@ void fscache_obtained_object(struct fsca
44636 * result, in which case there may be data available */
44637 spin_lock(&object->lock);
44638 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
44639- fscache_stat(&fscache_n_object_lookups_positive);
44640+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
44641
44642 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
44643
44644@@ -586,7 +586,7 @@ void fscache_obtained_object(struct fsca
44645 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
44646 } else {
44647 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
44648- fscache_stat(&fscache_n_object_created);
44649+ fscache_stat_unchecked(&fscache_n_object_created);
44650
44651 object->state = FSCACHE_OBJECT_AVAILABLE;
44652 spin_unlock(&object->lock);
44653@@ -633,7 +633,7 @@ static void fscache_object_available(str
44654 fscache_enqueue_dependents(object);
44655
44656 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
44657- fscache_stat(&fscache_n_object_avail);
44658+ fscache_stat_unchecked(&fscache_n_object_avail);
44659
44660 _leave("");
44661 }
44662@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
44663 enum fscache_checkaux result;
44664
44665 if (!object->cookie->def->check_aux) {
44666- fscache_stat(&fscache_n_checkaux_none);
44667+ fscache_stat_unchecked(&fscache_n_checkaux_none);
44668 return FSCACHE_CHECKAUX_OKAY;
44669 }
44670
44671@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
44672 switch (result) {
44673 /* entry okay as is */
44674 case FSCACHE_CHECKAUX_OKAY:
44675- fscache_stat(&fscache_n_checkaux_okay);
44676+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
44677 break;
44678
44679 /* entry requires update */
44680 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
44681- fscache_stat(&fscache_n_checkaux_update);
44682+ fscache_stat_unchecked(&fscache_n_checkaux_update);
44683 break;
44684
44685 /* entry requires deletion */
44686 case FSCACHE_CHECKAUX_OBSOLETE:
44687- fscache_stat(&fscache_n_checkaux_obsolete);
44688+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
44689 break;
44690
44691 default:
44692diff -urNp linux-2.6.32.46/fs/fscache/operation.c linux-2.6.32.46/fs/fscache/operation.c
44693--- linux-2.6.32.46/fs/fscache/operation.c 2011-03-27 14:31:47.000000000 -0400
44694+++ linux-2.6.32.46/fs/fscache/operation.c 2011-05-04 17:56:28.000000000 -0400
44695@@ -16,7 +16,7 @@
44696 #include <linux/seq_file.h>
44697 #include "internal.h"
44698
44699-atomic_t fscache_op_debug_id;
44700+atomic_unchecked_t fscache_op_debug_id;
44701 EXPORT_SYMBOL(fscache_op_debug_id);
44702
44703 /**
44704@@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fs
44705 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
44706 ASSERTCMP(atomic_read(&op->usage), >, 0);
44707
44708- fscache_stat(&fscache_n_op_enqueue);
44709+ fscache_stat_unchecked(&fscache_n_op_enqueue);
44710 switch (op->flags & FSCACHE_OP_TYPE) {
44711 case FSCACHE_OP_FAST:
44712 _debug("queue fast");
44713@@ -76,7 +76,7 @@ static void fscache_run_op(struct fscach
44714 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
44715 if (op->processor)
44716 fscache_enqueue_operation(op);
44717- fscache_stat(&fscache_n_op_run);
44718+ fscache_stat_unchecked(&fscache_n_op_run);
44719 }
44720
44721 /*
44722@@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct f
44723 if (object->n_ops > 0) {
44724 atomic_inc(&op->usage);
44725 list_add_tail(&op->pend_link, &object->pending_ops);
44726- fscache_stat(&fscache_n_op_pend);
44727+ fscache_stat_unchecked(&fscache_n_op_pend);
44728 } else if (!list_empty(&object->pending_ops)) {
44729 atomic_inc(&op->usage);
44730 list_add_tail(&op->pend_link, &object->pending_ops);
44731- fscache_stat(&fscache_n_op_pend);
44732+ fscache_stat_unchecked(&fscache_n_op_pend);
44733 fscache_start_operations(object);
44734 } else {
44735 ASSERTCMP(object->n_in_progress, ==, 0);
44736@@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct f
44737 object->n_exclusive++; /* reads and writes must wait */
44738 atomic_inc(&op->usage);
44739 list_add_tail(&op->pend_link, &object->pending_ops);
44740- fscache_stat(&fscache_n_op_pend);
44741+ fscache_stat_unchecked(&fscache_n_op_pend);
44742 ret = 0;
44743 } else {
44744 /* not allowed to submit ops in any other state */
44745@@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_obj
44746 if (object->n_exclusive > 0) {
44747 atomic_inc(&op->usage);
44748 list_add_tail(&op->pend_link, &object->pending_ops);
44749- fscache_stat(&fscache_n_op_pend);
44750+ fscache_stat_unchecked(&fscache_n_op_pend);
44751 } else if (!list_empty(&object->pending_ops)) {
44752 atomic_inc(&op->usage);
44753 list_add_tail(&op->pend_link, &object->pending_ops);
44754- fscache_stat(&fscache_n_op_pend);
44755+ fscache_stat_unchecked(&fscache_n_op_pend);
44756 fscache_start_operations(object);
44757 } else {
44758 ASSERTCMP(object->n_exclusive, ==, 0);
44759@@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_obj
44760 object->n_ops++;
44761 atomic_inc(&op->usage);
44762 list_add_tail(&op->pend_link, &object->pending_ops);
44763- fscache_stat(&fscache_n_op_pend);
44764+ fscache_stat_unchecked(&fscache_n_op_pend);
44765 ret = 0;
44766 } else if (object->state == FSCACHE_OBJECT_DYING ||
44767 object->state == FSCACHE_OBJECT_LC_DYING ||
44768 object->state == FSCACHE_OBJECT_WITHDRAWING) {
44769- fscache_stat(&fscache_n_op_rejected);
44770+ fscache_stat_unchecked(&fscache_n_op_rejected);
44771 ret = -ENOBUFS;
44772 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
44773 fscache_report_unexpected_submission(object, op, ostate);
44774@@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_ope
44775
44776 ret = -EBUSY;
44777 if (!list_empty(&op->pend_link)) {
44778- fscache_stat(&fscache_n_op_cancelled);
44779+ fscache_stat_unchecked(&fscache_n_op_cancelled);
44780 list_del_init(&op->pend_link);
44781 object->n_ops--;
44782 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
44783@@ -344,7 +344,7 @@ void fscache_put_operation(struct fscach
44784 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
44785 BUG();
44786
44787- fscache_stat(&fscache_n_op_release);
44788+ fscache_stat_unchecked(&fscache_n_op_release);
44789
44790 if (op->release) {
44791 op->release(op);
44792@@ -361,7 +361,7 @@ void fscache_put_operation(struct fscach
44793 * lock, and defer it otherwise */
44794 if (!spin_trylock(&object->lock)) {
44795 _debug("defer put");
44796- fscache_stat(&fscache_n_op_deferred_release);
44797+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
44798
44799 cache = object->cache;
44800 spin_lock(&cache->op_gc_list_lock);
44801@@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_st
44802
44803 _debug("GC DEFERRED REL OBJ%x OP%x",
44804 object->debug_id, op->debug_id);
44805- fscache_stat(&fscache_n_op_gc);
44806+ fscache_stat_unchecked(&fscache_n_op_gc);
44807
44808 ASSERTCMP(atomic_read(&op->usage), ==, 0);
44809
44810diff -urNp linux-2.6.32.46/fs/fscache/page.c linux-2.6.32.46/fs/fscache/page.c
44811--- linux-2.6.32.46/fs/fscache/page.c 2011-03-27 14:31:47.000000000 -0400
44812+++ linux-2.6.32.46/fs/fscache/page.c 2011-05-04 17:56:28.000000000 -0400
44813@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct
44814 val = radix_tree_lookup(&cookie->stores, page->index);
44815 if (!val) {
44816 rcu_read_unlock();
44817- fscache_stat(&fscache_n_store_vmscan_not_storing);
44818+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
44819 __fscache_uncache_page(cookie, page);
44820 return true;
44821 }
44822@@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct
44823 spin_unlock(&cookie->stores_lock);
44824
44825 if (xpage) {
44826- fscache_stat(&fscache_n_store_vmscan_cancelled);
44827- fscache_stat(&fscache_n_store_radix_deletes);
44828+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
44829+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
44830 ASSERTCMP(xpage, ==, page);
44831 } else {
44832- fscache_stat(&fscache_n_store_vmscan_gone);
44833+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
44834 }
44835
44836 wake_up_bit(&cookie->flags, 0);
44837@@ -106,7 +106,7 @@ page_busy:
44838 /* we might want to wait here, but that could deadlock the allocator as
44839 * the slow-work threads writing to the cache may all end up sleeping
44840 * on memory allocation */
44841- fscache_stat(&fscache_n_store_vmscan_busy);
44842+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
44843 return false;
44844 }
44845 EXPORT_SYMBOL(__fscache_maybe_release_page);
44846@@ -130,7 +130,7 @@ static void fscache_end_page_write(struc
44847 FSCACHE_COOKIE_STORING_TAG);
44848 if (!radix_tree_tag_get(&cookie->stores, page->index,
44849 FSCACHE_COOKIE_PENDING_TAG)) {
44850- fscache_stat(&fscache_n_store_radix_deletes);
44851+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
44852 xpage = radix_tree_delete(&cookie->stores, page->index);
44853 }
44854 spin_unlock(&cookie->stores_lock);
44855@@ -151,7 +151,7 @@ static void fscache_attr_changed_op(stru
44856
44857 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
44858
44859- fscache_stat(&fscache_n_attr_changed_calls);
44860+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
44861
44862 if (fscache_object_is_active(object)) {
44863 fscache_set_op_state(op, "CallFS");
44864@@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscach
44865
44866 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
44867
44868- fscache_stat(&fscache_n_attr_changed);
44869+ fscache_stat_unchecked(&fscache_n_attr_changed);
44870
44871 op = kzalloc(sizeof(*op), GFP_KERNEL);
44872 if (!op) {
44873- fscache_stat(&fscache_n_attr_changed_nomem);
44874+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
44875 _leave(" = -ENOMEM");
44876 return -ENOMEM;
44877 }
44878@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
44879 if (fscache_submit_exclusive_op(object, op) < 0)
44880 goto nobufs;
44881 spin_unlock(&cookie->lock);
44882- fscache_stat(&fscache_n_attr_changed_ok);
44883+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
44884 fscache_put_operation(op);
44885 _leave(" = 0");
44886 return 0;
44887@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
44888 nobufs:
44889 spin_unlock(&cookie->lock);
44890 kfree(op);
44891- fscache_stat(&fscache_n_attr_changed_nobufs);
44892+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
44893 _leave(" = %d", -ENOBUFS);
44894 return -ENOBUFS;
44895 }
44896@@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache
44897 /* allocate a retrieval operation and attempt to submit it */
44898 op = kzalloc(sizeof(*op), GFP_NOIO);
44899 if (!op) {
44900- fscache_stat(&fscache_n_retrievals_nomem);
44901+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
44902 return NULL;
44903 }
44904
44905@@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_loo
44906 return 0;
44907 }
44908
44909- fscache_stat(&fscache_n_retrievals_wait);
44910+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
44911
44912 jif = jiffies;
44913 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
44914 fscache_wait_bit_interruptible,
44915 TASK_INTERRUPTIBLE) != 0) {
44916- fscache_stat(&fscache_n_retrievals_intr);
44917+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
44918 _leave(" = -ERESTARTSYS");
44919 return -ERESTARTSYS;
44920 }
44921@@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_loo
44922 */
44923 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
44924 struct fscache_retrieval *op,
44925- atomic_t *stat_op_waits,
44926- atomic_t *stat_object_dead)
44927+ atomic_unchecked_t *stat_op_waits,
44928+ atomic_unchecked_t *stat_object_dead)
44929 {
44930 int ret;
44931
44932@@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_ac
44933 goto check_if_dead;
44934
44935 _debug(">>> WT");
44936- fscache_stat(stat_op_waits);
44937+ fscache_stat_unchecked(stat_op_waits);
44938 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
44939 fscache_wait_bit_interruptible,
44940 TASK_INTERRUPTIBLE) < 0) {
44941@@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_ac
44942
44943 check_if_dead:
44944 if (unlikely(fscache_object_is_dead(object))) {
44945- fscache_stat(stat_object_dead);
44946+ fscache_stat_unchecked(stat_object_dead);
44947 return -ENOBUFS;
44948 }
44949 return 0;
44950@@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct
44951
44952 _enter("%p,%p,,,", cookie, page);
44953
44954- fscache_stat(&fscache_n_retrievals);
44955+ fscache_stat_unchecked(&fscache_n_retrievals);
44956
44957 if (hlist_empty(&cookie->backing_objects))
44958 goto nobufs;
44959@@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct
44960 goto nobufs_unlock;
44961 spin_unlock(&cookie->lock);
44962
44963- fscache_stat(&fscache_n_retrieval_ops);
44964+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
44965
44966 /* pin the netfs read context in case we need to do the actual netfs
44967 * read because we've encountered a cache read failure */
44968@@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct
44969
44970 error:
44971 if (ret == -ENOMEM)
44972- fscache_stat(&fscache_n_retrievals_nomem);
44973+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
44974 else if (ret == -ERESTARTSYS)
44975- fscache_stat(&fscache_n_retrievals_intr);
44976+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
44977 else if (ret == -ENODATA)
44978- fscache_stat(&fscache_n_retrievals_nodata);
44979+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
44980 else if (ret < 0)
44981- fscache_stat(&fscache_n_retrievals_nobufs);
44982+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
44983 else
44984- fscache_stat(&fscache_n_retrievals_ok);
44985+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
44986
44987 fscache_put_retrieval(op);
44988 _leave(" = %d", ret);
44989@@ -453,7 +453,7 @@ nobufs_unlock:
44990 spin_unlock(&cookie->lock);
44991 kfree(op);
44992 nobufs:
44993- fscache_stat(&fscache_n_retrievals_nobufs);
44994+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
44995 _leave(" = -ENOBUFS");
44996 return -ENOBUFS;
44997 }
44998@@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct
44999
45000 _enter("%p,,%d,,,", cookie, *nr_pages);
45001
45002- fscache_stat(&fscache_n_retrievals);
45003+ fscache_stat_unchecked(&fscache_n_retrievals);
45004
45005 if (hlist_empty(&cookie->backing_objects))
45006 goto nobufs;
45007@@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct
45008 goto nobufs_unlock;
45009 spin_unlock(&cookie->lock);
45010
45011- fscache_stat(&fscache_n_retrieval_ops);
45012+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
45013
45014 /* pin the netfs read context in case we need to do the actual netfs
45015 * read because we've encountered a cache read failure */
45016@@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct
45017
45018 error:
45019 if (ret == -ENOMEM)
45020- fscache_stat(&fscache_n_retrievals_nomem);
45021+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
45022 else if (ret == -ERESTARTSYS)
45023- fscache_stat(&fscache_n_retrievals_intr);
45024+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
45025 else if (ret == -ENODATA)
45026- fscache_stat(&fscache_n_retrievals_nodata);
45027+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
45028 else if (ret < 0)
45029- fscache_stat(&fscache_n_retrievals_nobufs);
45030+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45031 else
45032- fscache_stat(&fscache_n_retrievals_ok);
45033+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
45034
45035 fscache_put_retrieval(op);
45036 _leave(" = %d", ret);
45037@@ -570,7 +570,7 @@ nobufs_unlock:
45038 spin_unlock(&cookie->lock);
45039 kfree(op);
45040 nobufs:
45041- fscache_stat(&fscache_n_retrievals_nobufs);
45042+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
45043 _leave(" = -ENOBUFS");
45044 return -ENOBUFS;
45045 }
45046@@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_
45047
45048 _enter("%p,%p,,,", cookie, page);
45049
45050- fscache_stat(&fscache_n_allocs);
45051+ fscache_stat_unchecked(&fscache_n_allocs);
45052
45053 if (hlist_empty(&cookie->backing_objects))
45054 goto nobufs;
45055@@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_
45056 goto nobufs_unlock;
45057 spin_unlock(&cookie->lock);
45058
45059- fscache_stat(&fscache_n_alloc_ops);
45060+ fscache_stat_unchecked(&fscache_n_alloc_ops);
45061
45062 ret = fscache_wait_for_retrieval_activation(
45063 object, op,
45064@@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_
45065
45066 error:
45067 if (ret == -ERESTARTSYS)
45068- fscache_stat(&fscache_n_allocs_intr);
45069+ fscache_stat_unchecked(&fscache_n_allocs_intr);
45070 else if (ret < 0)
45071- fscache_stat(&fscache_n_allocs_nobufs);
45072+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45073 else
45074- fscache_stat(&fscache_n_allocs_ok);
45075+ fscache_stat_unchecked(&fscache_n_allocs_ok);
45076
45077 fscache_put_retrieval(op);
45078 _leave(" = %d", ret);
45079@@ -651,7 +651,7 @@ nobufs_unlock:
45080 spin_unlock(&cookie->lock);
45081 kfree(op);
45082 nobufs:
45083- fscache_stat(&fscache_n_allocs_nobufs);
45084+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
45085 _leave(" = -ENOBUFS");
45086 return -ENOBUFS;
45087 }
45088@@ -694,7 +694,7 @@ static void fscache_write_op(struct fsca
45089
45090 spin_lock(&cookie->stores_lock);
45091
45092- fscache_stat(&fscache_n_store_calls);
45093+ fscache_stat_unchecked(&fscache_n_store_calls);
45094
45095 /* find a page to store */
45096 page = NULL;
45097@@ -705,7 +705,7 @@ static void fscache_write_op(struct fsca
45098 page = results[0];
45099 _debug("gang %d [%lx]", n, page->index);
45100 if (page->index > op->store_limit) {
45101- fscache_stat(&fscache_n_store_pages_over_limit);
45102+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
45103 goto superseded;
45104 }
45105
45106@@ -721,7 +721,7 @@ static void fscache_write_op(struct fsca
45107
45108 if (page) {
45109 fscache_set_op_state(&op->op, "Store");
45110- fscache_stat(&fscache_n_store_pages);
45111+ fscache_stat_unchecked(&fscache_n_store_pages);
45112 fscache_stat(&fscache_n_cop_write_page);
45113 ret = object->cache->ops->write_page(op, page);
45114 fscache_stat_d(&fscache_n_cop_write_page);
45115@@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_
45116 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45117 ASSERT(PageFsCache(page));
45118
45119- fscache_stat(&fscache_n_stores);
45120+ fscache_stat_unchecked(&fscache_n_stores);
45121
45122 op = kzalloc(sizeof(*op), GFP_NOIO);
45123 if (!op)
45124@@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_
45125 spin_unlock(&cookie->stores_lock);
45126 spin_unlock(&object->lock);
45127
45128- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
45129+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
45130 op->store_limit = object->store_limit;
45131
45132 if (fscache_submit_op(object, &op->op) < 0)
45133@@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_
45134
45135 spin_unlock(&cookie->lock);
45136 radix_tree_preload_end();
45137- fscache_stat(&fscache_n_store_ops);
45138- fscache_stat(&fscache_n_stores_ok);
45139+ fscache_stat_unchecked(&fscache_n_store_ops);
45140+ fscache_stat_unchecked(&fscache_n_stores_ok);
45141
45142 /* the slow work queue now carries its own ref on the object */
45143 fscache_put_operation(&op->op);
45144@@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_
45145 return 0;
45146
45147 already_queued:
45148- fscache_stat(&fscache_n_stores_again);
45149+ fscache_stat_unchecked(&fscache_n_stores_again);
45150 already_pending:
45151 spin_unlock(&cookie->stores_lock);
45152 spin_unlock(&object->lock);
45153 spin_unlock(&cookie->lock);
45154 radix_tree_preload_end();
45155 kfree(op);
45156- fscache_stat(&fscache_n_stores_ok);
45157+ fscache_stat_unchecked(&fscache_n_stores_ok);
45158 _leave(" = 0");
45159 return 0;
45160
45161@@ -886,14 +886,14 @@ nobufs:
45162 spin_unlock(&cookie->lock);
45163 radix_tree_preload_end();
45164 kfree(op);
45165- fscache_stat(&fscache_n_stores_nobufs);
45166+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
45167 _leave(" = -ENOBUFS");
45168 return -ENOBUFS;
45169
45170 nomem_free:
45171 kfree(op);
45172 nomem:
45173- fscache_stat(&fscache_n_stores_oom);
45174+ fscache_stat_unchecked(&fscache_n_stores_oom);
45175 _leave(" = -ENOMEM");
45176 return -ENOMEM;
45177 }
45178@@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscac
45179 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
45180 ASSERTCMP(page, !=, NULL);
45181
45182- fscache_stat(&fscache_n_uncaches);
45183+ fscache_stat_unchecked(&fscache_n_uncaches);
45184
45185 /* cache withdrawal may beat us to it */
45186 if (!PageFsCache(page))
45187@@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fs
45188 unsigned long loop;
45189
45190 #ifdef CONFIG_FSCACHE_STATS
45191- atomic_add(pagevec->nr, &fscache_n_marks);
45192+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
45193 #endif
45194
45195 for (loop = 0; loop < pagevec->nr; loop++) {
45196diff -urNp linux-2.6.32.46/fs/fscache/stats.c linux-2.6.32.46/fs/fscache/stats.c
45197--- linux-2.6.32.46/fs/fscache/stats.c 2011-03-27 14:31:47.000000000 -0400
45198+++ linux-2.6.32.46/fs/fscache/stats.c 2011-05-04 17:56:28.000000000 -0400
45199@@ -18,95 +18,95 @@
45200 /*
45201 * operation counters
45202 */
45203-atomic_t fscache_n_op_pend;
45204-atomic_t fscache_n_op_run;
45205-atomic_t fscache_n_op_enqueue;
45206-atomic_t fscache_n_op_requeue;
45207-atomic_t fscache_n_op_deferred_release;
45208-atomic_t fscache_n_op_release;
45209-atomic_t fscache_n_op_gc;
45210-atomic_t fscache_n_op_cancelled;
45211-atomic_t fscache_n_op_rejected;
45212-
45213-atomic_t fscache_n_attr_changed;
45214-atomic_t fscache_n_attr_changed_ok;
45215-atomic_t fscache_n_attr_changed_nobufs;
45216-atomic_t fscache_n_attr_changed_nomem;
45217-atomic_t fscache_n_attr_changed_calls;
45218-
45219-atomic_t fscache_n_allocs;
45220-atomic_t fscache_n_allocs_ok;
45221-atomic_t fscache_n_allocs_wait;
45222-atomic_t fscache_n_allocs_nobufs;
45223-atomic_t fscache_n_allocs_intr;
45224-atomic_t fscache_n_allocs_object_dead;
45225-atomic_t fscache_n_alloc_ops;
45226-atomic_t fscache_n_alloc_op_waits;
45227-
45228-atomic_t fscache_n_retrievals;
45229-atomic_t fscache_n_retrievals_ok;
45230-atomic_t fscache_n_retrievals_wait;
45231-atomic_t fscache_n_retrievals_nodata;
45232-atomic_t fscache_n_retrievals_nobufs;
45233-atomic_t fscache_n_retrievals_intr;
45234-atomic_t fscache_n_retrievals_nomem;
45235-atomic_t fscache_n_retrievals_object_dead;
45236-atomic_t fscache_n_retrieval_ops;
45237-atomic_t fscache_n_retrieval_op_waits;
45238-
45239-atomic_t fscache_n_stores;
45240-atomic_t fscache_n_stores_ok;
45241-atomic_t fscache_n_stores_again;
45242-atomic_t fscache_n_stores_nobufs;
45243-atomic_t fscache_n_stores_oom;
45244-atomic_t fscache_n_store_ops;
45245-atomic_t fscache_n_store_calls;
45246-atomic_t fscache_n_store_pages;
45247-atomic_t fscache_n_store_radix_deletes;
45248-atomic_t fscache_n_store_pages_over_limit;
45249-
45250-atomic_t fscache_n_store_vmscan_not_storing;
45251-atomic_t fscache_n_store_vmscan_gone;
45252-atomic_t fscache_n_store_vmscan_busy;
45253-atomic_t fscache_n_store_vmscan_cancelled;
45254-
45255-atomic_t fscache_n_marks;
45256-atomic_t fscache_n_uncaches;
45257-
45258-atomic_t fscache_n_acquires;
45259-atomic_t fscache_n_acquires_null;
45260-atomic_t fscache_n_acquires_no_cache;
45261-atomic_t fscache_n_acquires_ok;
45262-atomic_t fscache_n_acquires_nobufs;
45263-atomic_t fscache_n_acquires_oom;
45264-
45265-atomic_t fscache_n_updates;
45266-atomic_t fscache_n_updates_null;
45267-atomic_t fscache_n_updates_run;
45268-
45269-atomic_t fscache_n_relinquishes;
45270-atomic_t fscache_n_relinquishes_null;
45271-atomic_t fscache_n_relinquishes_waitcrt;
45272-atomic_t fscache_n_relinquishes_retire;
45273-
45274-atomic_t fscache_n_cookie_index;
45275-atomic_t fscache_n_cookie_data;
45276-atomic_t fscache_n_cookie_special;
45277-
45278-atomic_t fscache_n_object_alloc;
45279-atomic_t fscache_n_object_no_alloc;
45280-atomic_t fscache_n_object_lookups;
45281-atomic_t fscache_n_object_lookups_negative;
45282-atomic_t fscache_n_object_lookups_positive;
45283-atomic_t fscache_n_object_lookups_timed_out;
45284-atomic_t fscache_n_object_created;
45285-atomic_t fscache_n_object_avail;
45286-atomic_t fscache_n_object_dead;
45287-
45288-atomic_t fscache_n_checkaux_none;
45289-atomic_t fscache_n_checkaux_okay;
45290-atomic_t fscache_n_checkaux_update;
45291-atomic_t fscache_n_checkaux_obsolete;
45292+atomic_unchecked_t fscache_n_op_pend;
45293+atomic_unchecked_t fscache_n_op_run;
45294+atomic_unchecked_t fscache_n_op_enqueue;
45295+atomic_unchecked_t fscache_n_op_requeue;
45296+atomic_unchecked_t fscache_n_op_deferred_release;
45297+atomic_unchecked_t fscache_n_op_release;
45298+atomic_unchecked_t fscache_n_op_gc;
45299+atomic_unchecked_t fscache_n_op_cancelled;
45300+atomic_unchecked_t fscache_n_op_rejected;
45301+
45302+atomic_unchecked_t fscache_n_attr_changed;
45303+atomic_unchecked_t fscache_n_attr_changed_ok;
45304+atomic_unchecked_t fscache_n_attr_changed_nobufs;
45305+atomic_unchecked_t fscache_n_attr_changed_nomem;
45306+atomic_unchecked_t fscache_n_attr_changed_calls;
45307+
45308+atomic_unchecked_t fscache_n_allocs;
45309+atomic_unchecked_t fscache_n_allocs_ok;
45310+atomic_unchecked_t fscache_n_allocs_wait;
45311+atomic_unchecked_t fscache_n_allocs_nobufs;
45312+atomic_unchecked_t fscache_n_allocs_intr;
45313+atomic_unchecked_t fscache_n_allocs_object_dead;
45314+atomic_unchecked_t fscache_n_alloc_ops;
45315+atomic_unchecked_t fscache_n_alloc_op_waits;
45316+
45317+atomic_unchecked_t fscache_n_retrievals;
45318+atomic_unchecked_t fscache_n_retrievals_ok;
45319+atomic_unchecked_t fscache_n_retrievals_wait;
45320+atomic_unchecked_t fscache_n_retrievals_nodata;
45321+atomic_unchecked_t fscache_n_retrievals_nobufs;
45322+atomic_unchecked_t fscache_n_retrievals_intr;
45323+atomic_unchecked_t fscache_n_retrievals_nomem;
45324+atomic_unchecked_t fscache_n_retrievals_object_dead;
45325+atomic_unchecked_t fscache_n_retrieval_ops;
45326+atomic_unchecked_t fscache_n_retrieval_op_waits;
45327+
45328+atomic_unchecked_t fscache_n_stores;
45329+atomic_unchecked_t fscache_n_stores_ok;
45330+atomic_unchecked_t fscache_n_stores_again;
45331+atomic_unchecked_t fscache_n_stores_nobufs;
45332+atomic_unchecked_t fscache_n_stores_oom;
45333+atomic_unchecked_t fscache_n_store_ops;
45334+atomic_unchecked_t fscache_n_store_calls;
45335+atomic_unchecked_t fscache_n_store_pages;
45336+atomic_unchecked_t fscache_n_store_radix_deletes;
45337+atomic_unchecked_t fscache_n_store_pages_over_limit;
45338+
45339+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45340+atomic_unchecked_t fscache_n_store_vmscan_gone;
45341+atomic_unchecked_t fscache_n_store_vmscan_busy;
45342+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45343+
45344+atomic_unchecked_t fscache_n_marks;
45345+atomic_unchecked_t fscache_n_uncaches;
45346+
45347+atomic_unchecked_t fscache_n_acquires;
45348+atomic_unchecked_t fscache_n_acquires_null;
45349+atomic_unchecked_t fscache_n_acquires_no_cache;
45350+atomic_unchecked_t fscache_n_acquires_ok;
45351+atomic_unchecked_t fscache_n_acquires_nobufs;
45352+atomic_unchecked_t fscache_n_acquires_oom;
45353+
45354+atomic_unchecked_t fscache_n_updates;
45355+atomic_unchecked_t fscache_n_updates_null;
45356+atomic_unchecked_t fscache_n_updates_run;
45357+
45358+atomic_unchecked_t fscache_n_relinquishes;
45359+atomic_unchecked_t fscache_n_relinquishes_null;
45360+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45361+atomic_unchecked_t fscache_n_relinquishes_retire;
45362+
45363+atomic_unchecked_t fscache_n_cookie_index;
45364+atomic_unchecked_t fscache_n_cookie_data;
45365+atomic_unchecked_t fscache_n_cookie_special;
45366+
45367+atomic_unchecked_t fscache_n_object_alloc;
45368+atomic_unchecked_t fscache_n_object_no_alloc;
45369+atomic_unchecked_t fscache_n_object_lookups;
45370+atomic_unchecked_t fscache_n_object_lookups_negative;
45371+atomic_unchecked_t fscache_n_object_lookups_positive;
45372+atomic_unchecked_t fscache_n_object_lookups_timed_out;
45373+atomic_unchecked_t fscache_n_object_created;
45374+atomic_unchecked_t fscache_n_object_avail;
45375+atomic_unchecked_t fscache_n_object_dead;
45376+
45377+atomic_unchecked_t fscache_n_checkaux_none;
45378+atomic_unchecked_t fscache_n_checkaux_okay;
45379+atomic_unchecked_t fscache_n_checkaux_update;
45380+atomic_unchecked_t fscache_n_checkaux_obsolete;
45381
45382 atomic_t fscache_n_cop_alloc_object;
45383 atomic_t fscache_n_cop_lookup_object;
45384@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
45385 seq_puts(m, "FS-Cache statistics\n");
45386
45387 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
45388- atomic_read(&fscache_n_cookie_index),
45389- atomic_read(&fscache_n_cookie_data),
45390- atomic_read(&fscache_n_cookie_special));
45391+ atomic_read_unchecked(&fscache_n_cookie_index),
45392+ atomic_read_unchecked(&fscache_n_cookie_data),
45393+ atomic_read_unchecked(&fscache_n_cookie_special));
45394
45395 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
45396- atomic_read(&fscache_n_object_alloc),
45397- atomic_read(&fscache_n_object_no_alloc),
45398- atomic_read(&fscache_n_object_avail),
45399- atomic_read(&fscache_n_object_dead));
45400+ atomic_read_unchecked(&fscache_n_object_alloc),
45401+ atomic_read_unchecked(&fscache_n_object_no_alloc),
45402+ atomic_read_unchecked(&fscache_n_object_avail),
45403+ atomic_read_unchecked(&fscache_n_object_dead));
45404 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
45405- atomic_read(&fscache_n_checkaux_none),
45406- atomic_read(&fscache_n_checkaux_okay),
45407- atomic_read(&fscache_n_checkaux_update),
45408- atomic_read(&fscache_n_checkaux_obsolete));
45409+ atomic_read_unchecked(&fscache_n_checkaux_none),
45410+ atomic_read_unchecked(&fscache_n_checkaux_okay),
45411+ atomic_read_unchecked(&fscache_n_checkaux_update),
45412+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
45413
45414 seq_printf(m, "Pages : mrk=%u unc=%u\n",
45415- atomic_read(&fscache_n_marks),
45416- atomic_read(&fscache_n_uncaches));
45417+ atomic_read_unchecked(&fscache_n_marks),
45418+ atomic_read_unchecked(&fscache_n_uncaches));
45419
45420 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
45421 " oom=%u\n",
45422- atomic_read(&fscache_n_acquires),
45423- atomic_read(&fscache_n_acquires_null),
45424- atomic_read(&fscache_n_acquires_no_cache),
45425- atomic_read(&fscache_n_acquires_ok),
45426- atomic_read(&fscache_n_acquires_nobufs),
45427- atomic_read(&fscache_n_acquires_oom));
45428+ atomic_read_unchecked(&fscache_n_acquires),
45429+ atomic_read_unchecked(&fscache_n_acquires_null),
45430+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
45431+ atomic_read_unchecked(&fscache_n_acquires_ok),
45432+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
45433+ atomic_read_unchecked(&fscache_n_acquires_oom));
45434
45435 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
45436- atomic_read(&fscache_n_object_lookups),
45437- atomic_read(&fscache_n_object_lookups_negative),
45438- atomic_read(&fscache_n_object_lookups_positive),
45439- atomic_read(&fscache_n_object_lookups_timed_out),
45440- atomic_read(&fscache_n_object_created));
45441+ atomic_read_unchecked(&fscache_n_object_lookups),
45442+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
45443+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
45444+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
45445+ atomic_read_unchecked(&fscache_n_object_created));
45446
45447 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
45448- atomic_read(&fscache_n_updates),
45449- atomic_read(&fscache_n_updates_null),
45450- atomic_read(&fscache_n_updates_run));
45451+ atomic_read_unchecked(&fscache_n_updates),
45452+ atomic_read_unchecked(&fscache_n_updates_null),
45453+ atomic_read_unchecked(&fscache_n_updates_run));
45454
45455 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
45456- atomic_read(&fscache_n_relinquishes),
45457- atomic_read(&fscache_n_relinquishes_null),
45458- atomic_read(&fscache_n_relinquishes_waitcrt),
45459- atomic_read(&fscache_n_relinquishes_retire));
45460+ atomic_read_unchecked(&fscache_n_relinquishes),
45461+ atomic_read_unchecked(&fscache_n_relinquishes_null),
45462+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
45463+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
45464
45465 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
45466- atomic_read(&fscache_n_attr_changed),
45467- atomic_read(&fscache_n_attr_changed_ok),
45468- atomic_read(&fscache_n_attr_changed_nobufs),
45469- atomic_read(&fscache_n_attr_changed_nomem),
45470- atomic_read(&fscache_n_attr_changed_calls));
45471+ atomic_read_unchecked(&fscache_n_attr_changed),
45472+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
45473+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
45474+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
45475+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
45476
45477 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
45478- atomic_read(&fscache_n_allocs),
45479- atomic_read(&fscache_n_allocs_ok),
45480- atomic_read(&fscache_n_allocs_wait),
45481- atomic_read(&fscache_n_allocs_nobufs),
45482- atomic_read(&fscache_n_allocs_intr));
45483+ atomic_read_unchecked(&fscache_n_allocs),
45484+ atomic_read_unchecked(&fscache_n_allocs_ok),
45485+ atomic_read_unchecked(&fscache_n_allocs_wait),
45486+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
45487+ atomic_read_unchecked(&fscache_n_allocs_intr));
45488 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
45489- atomic_read(&fscache_n_alloc_ops),
45490- atomic_read(&fscache_n_alloc_op_waits),
45491- atomic_read(&fscache_n_allocs_object_dead));
45492+ atomic_read_unchecked(&fscache_n_alloc_ops),
45493+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
45494+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
45495
45496 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
45497 " int=%u oom=%u\n",
45498- atomic_read(&fscache_n_retrievals),
45499- atomic_read(&fscache_n_retrievals_ok),
45500- atomic_read(&fscache_n_retrievals_wait),
45501- atomic_read(&fscache_n_retrievals_nodata),
45502- atomic_read(&fscache_n_retrievals_nobufs),
45503- atomic_read(&fscache_n_retrievals_intr),
45504- atomic_read(&fscache_n_retrievals_nomem));
45505+ atomic_read_unchecked(&fscache_n_retrievals),
45506+ atomic_read_unchecked(&fscache_n_retrievals_ok),
45507+ atomic_read_unchecked(&fscache_n_retrievals_wait),
45508+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
45509+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
45510+ atomic_read_unchecked(&fscache_n_retrievals_intr),
45511+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
45512 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
45513- atomic_read(&fscache_n_retrieval_ops),
45514- atomic_read(&fscache_n_retrieval_op_waits),
45515- atomic_read(&fscache_n_retrievals_object_dead));
45516+ atomic_read_unchecked(&fscache_n_retrieval_ops),
45517+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
45518+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
45519
45520 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
45521- atomic_read(&fscache_n_stores),
45522- atomic_read(&fscache_n_stores_ok),
45523- atomic_read(&fscache_n_stores_again),
45524- atomic_read(&fscache_n_stores_nobufs),
45525- atomic_read(&fscache_n_stores_oom));
45526+ atomic_read_unchecked(&fscache_n_stores),
45527+ atomic_read_unchecked(&fscache_n_stores_ok),
45528+ atomic_read_unchecked(&fscache_n_stores_again),
45529+ atomic_read_unchecked(&fscache_n_stores_nobufs),
45530+ atomic_read_unchecked(&fscache_n_stores_oom));
45531 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
45532- atomic_read(&fscache_n_store_ops),
45533- atomic_read(&fscache_n_store_calls),
45534- atomic_read(&fscache_n_store_pages),
45535- atomic_read(&fscache_n_store_radix_deletes),
45536- atomic_read(&fscache_n_store_pages_over_limit));
45537+ atomic_read_unchecked(&fscache_n_store_ops),
45538+ atomic_read_unchecked(&fscache_n_store_calls),
45539+ atomic_read_unchecked(&fscache_n_store_pages),
45540+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
45541+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
45542
45543 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
45544- atomic_read(&fscache_n_store_vmscan_not_storing),
45545- atomic_read(&fscache_n_store_vmscan_gone),
45546- atomic_read(&fscache_n_store_vmscan_busy),
45547- atomic_read(&fscache_n_store_vmscan_cancelled));
45548+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
45549+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
45550+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
45551+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
45552
45553 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
45554- atomic_read(&fscache_n_op_pend),
45555- atomic_read(&fscache_n_op_run),
45556- atomic_read(&fscache_n_op_enqueue),
45557- atomic_read(&fscache_n_op_cancelled),
45558- atomic_read(&fscache_n_op_rejected));
45559+ atomic_read_unchecked(&fscache_n_op_pend),
45560+ atomic_read_unchecked(&fscache_n_op_run),
45561+ atomic_read_unchecked(&fscache_n_op_enqueue),
45562+ atomic_read_unchecked(&fscache_n_op_cancelled),
45563+ atomic_read_unchecked(&fscache_n_op_rejected));
45564 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
45565- atomic_read(&fscache_n_op_deferred_release),
45566- atomic_read(&fscache_n_op_release),
45567- atomic_read(&fscache_n_op_gc));
45568+ atomic_read_unchecked(&fscache_n_op_deferred_release),
45569+ atomic_read_unchecked(&fscache_n_op_release),
45570+ atomic_read_unchecked(&fscache_n_op_gc));
45571
45572 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
45573 atomic_read(&fscache_n_cop_alloc_object),
45574diff -urNp linux-2.6.32.46/fs/fs_struct.c linux-2.6.32.46/fs/fs_struct.c
45575--- linux-2.6.32.46/fs/fs_struct.c 2011-03-27 14:31:47.000000000 -0400
45576+++ linux-2.6.32.46/fs/fs_struct.c 2011-04-17 15:56:46.000000000 -0400
45577@@ -4,6 +4,7 @@
45578 #include <linux/path.h>
45579 #include <linux/slab.h>
45580 #include <linux/fs_struct.h>
45581+#include <linux/grsecurity.h>
45582
45583 /*
45584 * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
45585@@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, s
45586 old_root = fs->root;
45587 fs->root = *path;
45588 path_get(path);
45589+ gr_set_chroot_entries(current, path);
45590 write_unlock(&fs->lock);
45591 if (old_root.dentry)
45592 path_put(&old_root);
45593@@ -56,6 +58,7 @@ void chroot_fs_refs(struct path *old_roo
45594 && fs->root.mnt == old_root->mnt) {
45595 path_get(new_root);
45596 fs->root = *new_root;
45597+ gr_set_chroot_entries(p, new_root);
45598 count++;
45599 }
45600 if (fs->pwd.dentry == old_root->dentry
45601@@ -89,7 +92,8 @@ void exit_fs(struct task_struct *tsk)
45602 task_lock(tsk);
45603 write_lock(&fs->lock);
45604 tsk->fs = NULL;
45605- kill = !--fs->users;
45606+ gr_clear_chroot_entries(tsk);
45607+ kill = !atomic_dec_return(&fs->users);
45608 write_unlock(&fs->lock);
45609 task_unlock(tsk);
45610 if (kill)
45611@@ -102,7 +106,7 @@ struct fs_struct *copy_fs_struct(struct
45612 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
45613 /* We don't need to lock fs - think why ;-) */
45614 if (fs) {
45615- fs->users = 1;
45616+ atomic_set(&fs->users, 1);
45617 fs->in_exec = 0;
45618 rwlock_init(&fs->lock);
45619 fs->umask = old->umask;
45620@@ -127,8 +131,9 @@ int unshare_fs_struct(void)
45621
45622 task_lock(current);
45623 write_lock(&fs->lock);
45624- kill = !--fs->users;
45625+ kill = !atomic_dec_return(&fs->users);
45626 current->fs = new_fs;
45627+ gr_set_chroot_entries(current, &new_fs->root);
45628 write_unlock(&fs->lock);
45629 task_unlock(current);
45630
45631@@ -147,7 +152,7 @@ EXPORT_SYMBOL(current_umask);
45632
45633 /* to be mentioned only in INIT_TASK */
45634 struct fs_struct init_fs = {
45635- .users = 1,
45636+ .users = ATOMIC_INIT(1),
45637 .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
45638 .umask = 0022,
45639 };
45640@@ -162,12 +167,13 @@ void daemonize_fs_struct(void)
45641 task_lock(current);
45642
45643 write_lock(&init_fs.lock);
45644- init_fs.users++;
45645+ atomic_inc(&init_fs.users);
45646 write_unlock(&init_fs.lock);
45647
45648 write_lock(&fs->lock);
45649 current->fs = &init_fs;
45650- kill = !--fs->users;
45651+ gr_set_chroot_entries(current, &current->fs->root);
45652+ kill = !atomic_dec_return(&fs->users);
45653 write_unlock(&fs->lock);
45654
45655 task_unlock(current);
45656diff -urNp linux-2.6.32.46/fs/fuse/cuse.c linux-2.6.32.46/fs/fuse/cuse.c
45657--- linux-2.6.32.46/fs/fuse/cuse.c 2011-03-27 14:31:47.000000000 -0400
45658+++ linux-2.6.32.46/fs/fuse/cuse.c 2011-08-05 20:33:55.000000000 -0400
45659@@ -576,10 +576,12 @@ static int __init cuse_init(void)
45660 INIT_LIST_HEAD(&cuse_conntbl[i]);
45661
45662 /* inherit and extend fuse_dev_operations */
45663- cuse_channel_fops = fuse_dev_operations;
45664- cuse_channel_fops.owner = THIS_MODULE;
45665- cuse_channel_fops.open = cuse_channel_open;
45666- cuse_channel_fops.release = cuse_channel_release;
45667+ pax_open_kernel();
45668+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
45669+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
45670+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
45671+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
45672+ pax_close_kernel();
45673
45674 cuse_class = class_create(THIS_MODULE, "cuse");
45675 if (IS_ERR(cuse_class))
45676diff -urNp linux-2.6.32.46/fs/fuse/dev.c linux-2.6.32.46/fs/fuse/dev.c
45677--- linux-2.6.32.46/fs/fuse/dev.c 2011-08-29 22:24:44.000000000 -0400
45678+++ linux-2.6.32.46/fs/fuse/dev.c 2011-08-29 22:25:07.000000000 -0400
45679@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struc
45680 {
45681 struct fuse_notify_inval_entry_out outarg;
45682 int err = -EINVAL;
45683- char buf[FUSE_NAME_MAX+1];
45684+ char *buf = NULL;
45685 struct qstr name;
45686
45687 if (size < sizeof(outarg))
45688@@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struc
45689 if (outarg.namelen > FUSE_NAME_MAX)
45690 goto err;
45691
45692+ err = -ENOMEM;
45693+ buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
45694+ if (!buf)
45695+ goto err;
45696+
45697 err = -EINVAL;
45698 if (size != sizeof(outarg) + outarg.namelen + 1)
45699 goto err;
45700@@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struc
45701
45702 down_read(&fc->killsb);
45703 err = -ENOENT;
45704- if (!fc->sb)
45705- goto err_unlock;
45706-
45707- err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
45708-
45709-err_unlock:
45710+ if (fc->sb)
45711+ err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
45712 up_read(&fc->killsb);
45713+ kfree(buf);
45714 return err;
45715
45716 err:
45717 fuse_copy_finish(cs);
45718+ kfree(buf);
45719 return err;
45720 }
45721
45722diff -urNp linux-2.6.32.46/fs/fuse/dir.c linux-2.6.32.46/fs/fuse/dir.c
45723--- linux-2.6.32.46/fs/fuse/dir.c 2011-03-27 14:31:47.000000000 -0400
45724+++ linux-2.6.32.46/fs/fuse/dir.c 2011-04-17 15:56:46.000000000 -0400
45725@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
45726 return link;
45727 }
45728
45729-static void free_link(char *link)
45730+static void free_link(const char *link)
45731 {
45732 if (!IS_ERR(link))
45733 free_page((unsigned long) link);
45734diff -urNp linux-2.6.32.46/fs/gfs2/ops_inode.c linux-2.6.32.46/fs/gfs2/ops_inode.c
45735--- linux-2.6.32.46/fs/gfs2/ops_inode.c 2011-03-27 14:31:47.000000000 -0400
45736+++ linux-2.6.32.46/fs/gfs2/ops_inode.c 2011-05-16 21:46:57.000000000 -0400
45737@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odi
45738 unsigned int x;
45739 int error;
45740
45741+ pax_track_stack();
45742+
45743 if (ndentry->d_inode) {
45744 nip = GFS2_I(ndentry->d_inode);
45745 if (ip == nip)
45746diff -urNp linux-2.6.32.46/fs/gfs2/sys.c linux-2.6.32.46/fs/gfs2/sys.c
45747--- linux-2.6.32.46/fs/gfs2/sys.c 2011-03-27 14:31:47.000000000 -0400
45748+++ linux-2.6.32.46/fs/gfs2/sys.c 2011-04-17 15:56:46.000000000 -0400
45749@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
45750 return a->store ? a->store(sdp, buf, len) : len;
45751 }
45752
45753-static struct sysfs_ops gfs2_attr_ops = {
45754+static const struct sysfs_ops gfs2_attr_ops = {
45755 .show = gfs2_attr_show,
45756 .store = gfs2_attr_store,
45757 };
45758@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
45759 return 0;
45760 }
45761
45762-static struct kset_uevent_ops gfs2_uevent_ops = {
45763+static const struct kset_uevent_ops gfs2_uevent_ops = {
45764 .uevent = gfs2_uevent,
45765 };
45766
45767diff -urNp linux-2.6.32.46/fs/hfsplus/catalog.c linux-2.6.32.46/fs/hfsplus/catalog.c
45768--- linux-2.6.32.46/fs/hfsplus/catalog.c 2011-03-27 14:31:47.000000000 -0400
45769+++ linux-2.6.32.46/fs/hfsplus/catalog.c 2011-05-16 21:46:57.000000000 -0400
45770@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block
45771 int err;
45772 u16 type;
45773
45774+ pax_track_stack();
45775+
45776 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
45777 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
45778 if (err)
45779@@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct
45780 int entry_size;
45781 int err;
45782
45783+ pax_track_stack();
45784+
45785 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
45786 sb = dir->i_sb;
45787 hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
45788@@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
45789 int entry_size, type;
45790 int err = 0;
45791
45792+ pax_track_stack();
45793+
45794 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
45795 dst_dir->i_ino, dst_name->name);
45796 sb = src_dir->i_sb;
45797diff -urNp linux-2.6.32.46/fs/hfsplus/dir.c linux-2.6.32.46/fs/hfsplus/dir.c
45798--- linux-2.6.32.46/fs/hfsplus/dir.c 2011-03-27 14:31:47.000000000 -0400
45799+++ linux-2.6.32.46/fs/hfsplus/dir.c 2011-05-16 21:46:57.000000000 -0400
45800@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *
45801 struct hfsplus_readdir_data *rd;
45802 u16 type;
45803
45804+ pax_track_stack();
45805+
45806 if (filp->f_pos >= inode->i_size)
45807 return 0;
45808
45809diff -urNp linux-2.6.32.46/fs/hfsplus/inode.c linux-2.6.32.46/fs/hfsplus/inode.c
45810--- linux-2.6.32.46/fs/hfsplus/inode.c 2011-03-27 14:31:47.000000000 -0400
45811+++ linux-2.6.32.46/fs/hfsplus/inode.c 2011-05-16 21:46:57.000000000 -0400
45812@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode
45813 int res = 0;
45814 u16 type;
45815
45816+ pax_track_stack();
45817+
45818 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
45819
45820 HFSPLUS_I(inode).dev = 0;
45821@@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode
45822 struct hfs_find_data fd;
45823 hfsplus_cat_entry entry;
45824
45825+ pax_track_stack();
45826+
45827 if (HFSPLUS_IS_RSRC(inode))
45828 main_inode = HFSPLUS_I(inode).rsrc_inode;
45829
45830diff -urNp linux-2.6.32.46/fs/hfsplus/ioctl.c linux-2.6.32.46/fs/hfsplus/ioctl.c
45831--- linux-2.6.32.46/fs/hfsplus/ioctl.c 2011-03-27 14:31:47.000000000 -0400
45832+++ linux-2.6.32.46/fs/hfsplus/ioctl.c 2011-05-16 21:46:57.000000000 -0400
45833@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dent
45834 struct hfsplus_cat_file *file;
45835 int res;
45836
45837+ pax_track_stack();
45838+
45839 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
45840 return -EOPNOTSUPP;
45841
45842@@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *
45843 struct hfsplus_cat_file *file;
45844 ssize_t res = 0;
45845
45846+ pax_track_stack();
45847+
45848 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
45849 return -EOPNOTSUPP;
45850
45851diff -urNp linux-2.6.32.46/fs/hfsplus/super.c linux-2.6.32.46/fs/hfsplus/super.c
45852--- linux-2.6.32.46/fs/hfsplus/super.c 2011-03-27 14:31:47.000000000 -0400
45853+++ linux-2.6.32.46/fs/hfsplus/super.c 2011-05-16 21:46:57.000000000 -0400
45854@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct sup
45855 struct nls_table *nls = NULL;
45856 int err = -EINVAL;
45857
45858+ pax_track_stack();
45859+
45860 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
45861 if (!sbi)
45862 return -ENOMEM;
45863diff -urNp linux-2.6.32.46/fs/hugetlbfs/inode.c linux-2.6.32.46/fs/hugetlbfs/inode.c
45864--- linux-2.6.32.46/fs/hugetlbfs/inode.c 2011-03-27 14:31:47.000000000 -0400
45865+++ linux-2.6.32.46/fs/hugetlbfs/inode.c 2011-04-17 15:56:46.000000000 -0400
45866@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
45867 .kill_sb = kill_litter_super,
45868 };
45869
45870-static struct vfsmount *hugetlbfs_vfsmount;
45871+struct vfsmount *hugetlbfs_vfsmount;
45872
45873 static int can_do_hugetlb_shm(void)
45874 {
45875diff -urNp linux-2.6.32.46/fs/ioctl.c linux-2.6.32.46/fs/ioctl.c
45876--- linux-2.6.32.46/fs/ioctl.c 2011-03-27 14:31:47.000000000 -0400
45877+++ linux-2.6.32.46/fs/ioctl.c 2011-04-17 15:56:46.000000000 -0400
45878@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
45879 u64 phys, u64 len, u32 flags)
45880 {
45881 struct fiemap_extent extent;
45882- struct fiemap_extent *dest = fieinfo->fi_extents_start;
45883+ struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
45884
45885 /* only count the extents */
45886 if (fieinfo->fi_extents_max == 0) {
45887@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
45888
45889 fieinfo.fi_flags = fiemap.fm_flags;
45890 fieinfo.fi_extents_max = fiemap.fm_extent_count;
45891- fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
45892+ fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
45893
45894 if (fiemap.fm_extent_count != 0 &&
45895 !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
45896@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
45897 error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
45898 fiemap.fm_flags = fieinfo.fi_flags;
45899 fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
45900- if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
45901+ if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
45902 error = -EFAULT;
45903
45904 return error;
45905diff -urNp linux-2.6.32.46/fs/jbd/checkpoint.c linux-2.6.32.46/fs/jbd/checkpoint.c
45906--- linux-2.6.32.46/fs/jbd/checkpoint.c 2011-03-27 14:31:47.000000000 -0400
45907+++ linux-2.6.32.46/fs/jbd/checkpoint.c 2011-05-16 21:46:57.000000000 -0400
45908@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal
45909 tid_t this_tid;
45910 int result;
45911
45912+ pax_track_stack();
45913+
45914 jbd_debug(1, "Start checkpoint\n");
45915
45916 /*
45917diff -urNp linux-2.6.32.46/fs/jffs2/compr_rtime.c linux-2.6.32.46/fs/jffs2/compr_rtime.c
45918--- linux-2.6.32.46/fs/jffs2/compr_rtime.c 2011-03-27 14:31:47.000000000 -0400
45919+++ linux-2.6.32.46/fs/jffs2/compr_rtime.c 2011-05-16 21:46:57.000000000 -0400
45920@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
45921 int outpos = 0;
45922 int pos=0;
45923
45924+ pax_track_stack();
45925+
45926 memset(positions,0,sizeof(positions));
45927
45928 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
45929@@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsign
45930 int outpos = 0;
45931 int pos=0;
45932
45933+ pax_track_stack();
45934+
45935 memset(positions,0,sizeof(positions));
45936
45937 while (outpos<destlen) {
45938diff -urNp linux-2.6.32.46/fs/jffs2/compr_rubin.c linux-2.6.32.46/fs/jffs2/compr_rubin.c
45939--- linux-2.6.32.46/fs/jffs2/compr_rubin.c 2011-03-27 14:31:47.000000000 -0400
45940+++ linux-2.6.32.46/fs/jffs2/compr_rubin.c 2011-05-16 21:46:57.000000000 -0400
45941@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
45942 int ret;
45943 uint32_t mysrclen, mydstlen;
45944
45945+ pax_track_stack();
45946+
45947 mysrclen = *sourcelen;
45948 mydstlen = *dstlen - 8;
45949
45950diff -urNp linux-2.6.32.46/fs/jffs2/erase.c linux-2.6.32.46/fs/jffs2/erase.c
45951--- linux-2.6.32.46/fs/jffs2/erase.c 2011-03-27 14:31:47.000000000 -0400
45952+++ linux-2.6.32.46/fs/jffs2/erase.c 2011-04-17 15:56:46.000000000 -0400
45953@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
45954 struct jffs2_unknown_node marker = {
45955 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
45956 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
45957- .totlen = cpu_to_je32(c->cleanmarker_size)
45958+ .totlen = cpu_to_je32(c->cleanmarker_size),
45959+ .hdr_crc = cpu_to_je32(0)
45960 };
45961
45962 jffs2_prealloc_raw_node_refs(c, jeb, 1);
45963diff -urNp linux-2.6.32.46/fs/jffs2/wbuf.c linux-2.6.32.46/fs/jffs2/wbuf.c
45964--- linux-2.6.32.46/fs/jffs2/wbuf.c 2011-03-27 14:31:47.000000000 -0400
45965+++ linux-2.6.32.46/fs/jffs2/wbuf.c 2011-04-17 15:56:46.000000000 -0400
45966@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
45967 {
45968 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
45969 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
45970- .totlen = constant_cpu_to_je32(8)
45971+ .totlen = constant_cpu_to_je32(8),
45972+ .hdr_crc = constant_cpu_to_je32(0)
45973 };
45974
45975 /*
45976diff -urNp linux-2.6.32.46/fs/jffs2/xattr.c linux-2.6.32.46/fs/jffs2/xattr.c
45977--- linux-2.6.32.46/fs/jffs2/xattr.c 2011-03-27 14:31:47.000000000 -0400
45978+++ linux-2.6.32.46/fs/jffs2/xattr.c 2011-05-16 21:46:57.000000000 -0400
45979@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
45980
45981 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
45982
45983+ pax_track_stack();
45984+
45985 /* Phase.1 : Merge same xref */
45986 for (i=0; i < XREF_TMPHASH_SIZE; i++)
45987 xref_tmphash[i] = NULL;
45988diff -urNp linux-2.6.32.46/fs/jfs/super.c linux-2.6.32.46/fs/jfs/super.c
45989--- linux-2.6.32.46/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400
45990+++ linux-2.6.32.46/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400
45991@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
45992
45993 jfs_inode_cachep =
45994 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
45995- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
45996+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
45997 init_once);
45998 if (jfs_inode_cachep == NULL)
45999 return -ENOMEM;
46000diff -urNp linux-2.6.32.46/fs/Kconfig.binfmt linux-2.6.32.46/fs/Kconfig.binfmt
46001--- linux-2.6.32.46/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400
46002+++ linux-2.6.32.46/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400
46003@@ -86,7 +86,7 @@ config HAVE_AOUT
46004
46005 config BINFMT_AOUT
46006 tristate "Kernel support for a.out and ECOFF binaries"
46007- depends on HAVE_AOUT
46008+ depends on HAVE_AOUT && BROKEN
46009 ---help---
46010 A.out (Assembler.OUTput) is a set of formats for libraries and
46011 executables used in the earliest versions of UNIX. Linux used
46012diff -urNp linux-2.6.32.46/fs/libfs.c linux-2.6.32.46/fs/libfs.c
46013--- linux-2.6.32.46/fs/libfs.c 2011-03-27 14:31:47.000000000 -0400
46014+++ linux-2.6.32.46/fs/libfs.c 2011-05-11 18:25:15.000000000 -0400
46015@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, v
46016
46017 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
46018 struct dentry *next;
46019+ char d_name[sizeof(next->d_iname)];
46020+ const unsigned char *name;
46021+
46022 next = list_entry(p, struct dentry, d_u.d_child);
46023 if (d_unhashed(next) || !next->d_inode)
46024 continue;
46025
46026 spin_unlock(&dcache_lock);
46027- if (filldir(dirent, next->d_name.name,
46028+ name = next->d_name.name;
46029+ if (name == next->d_iname) {
46030+ memcpy(d_name, name, next->d_name.len);
46031+ name = d_name;
46032+ }
46033+ if (filldir(dirent, name,
46034 next->d_name.len, filp->f_pos,
46035 next->d_inode->i_ino,
46036 dt_type(next->d_inode)) < 0)
46037diff -urNp linux-2.6.32.46/fs/lockd/clntproc.c linux-2.6.32.46/fs/lockd/clntproc.c
46038--- linux-2.6.32.46/fs/lockd/clntproc.c 2011-03-27 14:31:47.000000000 -0400
46039+++ linux-2.6.32.46/fs/lockd/clntproc.c 2011-05-16 21:46:57.000000000 -0400
46040@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
46041 /*
46042 * Cookie counter for NLM requests
46043 */
46044-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
46045+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
46046
46047 void nlmclnt_next_cookie(struct nlm_cookie *c)
46048 {
46049- u32 cookie = atomic_inc_return(&nlm_cookie);
46050+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
46051
46052 memcpy(c->data, &cookie, 4);
46053 c->len=4;
46054@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
46055 struct nlm_rqst reqst, *req;
46056 int status;
46057
46058+ pax_track_stack();
46059+
46060 req = &reqst;
46061 memset(req, 0, sizeof(*req));
46062 locks_init_lock(&req->a_args.lock.fl);
46063diff -urNp linux-2.6.32.46/fs/lockd/svc.c linux-2.6.32.46/fs/lockd/svc.c
46064--- linux-2.6.32.46/fs/lockd/svc.c 2011-03-27 14:31:47.000000000 -0400
46065+++ linux-2.6.32.46/fs/lockd/svc.c 2011-04-17 15:56:46.000000000 -0400
46066@@ -43,7 +43,7 @@
46067
46068 static struct svc_program nlmsvc_program;
46069
46070-struct nlmsvc_binding * nlmsvc_ops;
46071+const struct nlmsvc_binding * nlmsvc_ops;
46072 EXPORT_SYMBOL_GPL(nlmsvc_ops);
46073
46074 static DEFINE_MUTEX(nlmsvc_mutex);
46075diff -urNp linux-2.6.32.46/fs/locks.c linux-2.6.32.46/fs/locks.c
46076--- linux-2.6.32.46/fs/locks.c 2011-03-27 14:31:47.000000000 -0400
46077+++ linux-2.6.32.46/fs/locks.c 2011-07-06 19:47:11.000000000 -0400
46078@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
46079
46080 static struct kmem_cache *filelock_cache __read_mostly;
46081
46082+static void locks_init_lock_always(struct file_lock *fl)
46083+{
46084+ fl->fl_next = NULL;
46085+ fl->fl_fasync = NULL;
46086+ fl->fl_owner = NULL;
46087+ fl->fl_pid = 0;
46088+ fl->fl_nspid = NULL;
46089+ fl->fl_file = NULL;
46090+ fl->fl_flags = 0;
46091+ fl->fl_type = 0;
46092+ fl->fl_start = fl->fl_end = 0;
46093+}
46094+
46095 /* Allocate an empty lock structure. */
46096 static struct file_lock *locks_alloc_lock(void)
46097 {
46098- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
46099+ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
46100+
46101+ if (fl)
46102+ locks_init_lock_always(fl);
46103+
46104+ return fl;
46105 }
46106
46107 void locks_release_private(struct file_lock *fl)
46108@@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *f
46109 INIT_LIST_HEAD(&fl->fl_link);
46110 INIT_LIST_HEAD(&fl->fl_block);
46111 init_waitqueue_head(&fl->fl_wait);
46112- fl->fl_next = NULL;
46113- fl->fl_fasync = NULL;
46114- fl->fl_owner = NULL;
46115- fl->fl_pid = 0;
46116- fl->fl_nspid = NULL;
46117- fl->fl_file = NULL;
46118- fl->fl_flags = 0;
46119- fl->fl_type = 0;
46120- fl->fl_start = fl->fl_end = 0;
46121 fl->fl_ops = NULL;
46122 fl->fl_lmops = NULL;
46123+ locks_init_lock_always(fl);
46124 }
46125
46126 EXPORT_SYMBOL(locks_init_lock);
46127@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *fil
46128 return;
46129
46130 if (filp->f_op && filp->f_op->flock) {
46131- struct file_lock fl = {
46132+ struct file_lock flock = {
46133 .fl_pid = current->tgid,
46134 .fl_file = filp,
46135 .fl_flags = FL_FLOCK,
46136 .fl_type = F_UNLCK,
46137 .fl_end = OFFSET_MAX,
46138 };
46139- filp->f_op->flock(filp, F_SETLKW, &fl);
46140- if (fl.fl_ops && fl.fl_ops->fl_release_private)
46141- fl.fl_ops->fl_release_private(&fl);
46142+ filp->f_op->flock(filp, F_SETLKW, &flock);
46143+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
46144+ flock.fl_ops->fl_release_private(&flock);
46145 }
46146
46147 lock_kernel();
46148diff -urNp linux-2.6.32.46/fs/mbcache.c linux-2.6.32.46/fs/mbcache.c
46149--- linux-2.6.32.46/fs/mbcache.c 2011-03-27 14:31:47.000000000 -0400
46150+++ linux-2.6.32.46/fs/mbcache.c 2011-08-05 20:33:55.000000000 -0400
46151@@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct
46152 if (!cache)
46153 goto fail;
46154 cache->c_name = name;
46155- cache->c_op.free = NULL;
46156+ *(void **)&cache->c_op.free = NULL;
46157 if (cache_op)
46158- cache->c_op.free = cache_op->free;
46159+ *(void **)&cache->c_op.free = cache_op->free;
46160 atomic_set(&cache->c_entry_count, 0);
46161 cache->c_bucket_bits = bucket_bits;
46162 #ifdef MB_CACHE_INDEXES_COUNT
46163diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c
46164--- linux-2.6.32.46/fs/namei.c 2011-03-27 14:31:47.000000000 -0400
46165+++ linux-2.6.32.46/fs/namei.c 2011-05-16 21:46:57.000000000 -0400
46166@@ -224,14 +224,6 @@ int generic_permission(struct inode *ino
46167 return ret;
46168
46169 /*
46170- * Read/write DACs are always overridable.
46171- * Executable DACs are overridable if at least one exec bit is set.
46172- */
46173- if (!(mask & MAY_EXEC) || execute_ok(inode))
46174- if (capable(CAP_DAC_OVERRIDE))
46175- return 0;
46176-
46177- /*
46178 * Searching includes executable on directories, else just read.
46179 */
46180 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
46181@@ -239,6 +231,14 @@ int generic_permission(struct inode *ino
46182 if (capable(CAP_DAC_READ_SEARCH))
46183 return 0;
46184
46185+ /*
46186+ * Read/write DACs are always overridable.
46187+ * Executable DACs are overridable if at least one exec bit is set.
46188+ */
46189+ if (!(mask & MAY_EXEC) || execute_ok(inode))
46190+ if (capable(CAP_DAC_OVERRIDE))
46191+ return 0;
46192+
46193 return -EACCES;
46194 }
46195
46196@@ -458,7 +458,8 @@ static int exec_permission_lite(struct i
46197 if (!ret)
46198 goto ok;
46199
46200- if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
46201+ if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
46202+ capable(CAP_DAC_OVERRIDE))
46203 goto ok;
46204
46205 return ret;
46206@@ -638,7 +639,7 @@ static __always_inline int __do_follow_l
46207 cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
46208 error = PTR_ERR(cookie);
46209 if (!IS_ERR(cookie)) {
46210- char *s = nd_get_link(nd);
46211+ const char *s = nd_get_link(nd);
46212 error = 0;
46213 if (s)
46214 error = __vfs_follow_link(nd, s);
46215@@ -669,6 +670,13 @@ static inline int do_follow_link(struct
46216 err = security_inode_follow_link(path->dentry, nd);
46217 if (err)
46218 goto loop;
46219+
46220+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
46221+ path->dentry->d_inode, path->dentry, nd->path.mnt)) {
46222+ err = -EACCES;
46223+ goto loop;
46224+ }
46225+
46226 current->link_count++;
46227 current->total_link_count++;
46228 nd->depth++;
46229@@ -1016,11 +1024,18 @@ return_reval:
46230 break;
46231 }
46232 return_base:
46233+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
46234+ path_put(&nd->path);
46235+ return -ENOENT;
46236+ }
46237 return 0;
46238 out_dput:
46239 path_put_conditional(&next, nd);
46240 break;
46241 }
46242+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
46243+ err = -ENOENT;
46244+
46245 path_put(&nd->path);
46246 return_err:
46247 return err;
46248@@ -1091,13 +1106,20 @@ static int do_path_lookup(int dfd, const
46249 int retval = path_init(dfd, name, flags, nd);
46250 if (!retval)
46251 retval = path_walk(name, nd);
46252- if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
46253- nd->path.dentry->d_inode))
46254- audit_inode(name, nd->path.dentry);
46255+
46256+ if (likely(!retval)) {
46257+ if (nd->path.dentry && nd->path.dentry->d_inode) {
46258+ if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
46259+ retval = -ENOENT;
46260+ if (!audit_dummy_context())
46261+ audit_inode(name, nd->path.dentry);
46262+ }
46263+ }
46264 if (nd->root.mnt) {
46265 path_put(&nd->root);
46266 nd->root.mnt = NULL;
46267 }
46268+
46269 return retval;
46270 }
46271
46272@@ -1576,6 +1598,20 @@ int may_open(struct path *path, int acc_
46273 if (error)
46274 goto err_out;
46275
46276+
46277+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
46278+ error = -EPERM;
46279+ goto err_out;
46280+ }
46281+ if (gr_handle_rawio(inode)) {
46282+ error = -EPERM;
46283+ goto err_out;
46284+ }
46285+ if (!gr_acl_handle_open(dentry, path->mnt, flag)) {
46286+ error = -EACCES;
46287+ goto err_out;
46288+ }
46289+
46290 if (flag & O_TRUNC) {
46291 error = get_write_access(inode);
46292 if (error)
46293@@ -1621,12 +1657,19 @@ static int __open_namei_create(struct na
46294 int error;
46295 struct dentry *dir = nd->path.dentry;
46296
46297+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
46298+ error = -EACCES;
46299+ goto out_unlock;
46300+ }
46301+
46302 if (!IS_POSIXACL(dir->d_inode))
46303 mode &= ~current_umask();
46304 error = security_path_mknod(&nd->path, path->dentry, mode, 0);
46305 if (error)
46306 goto out_unlock;
46307 error = vfs_create(dir->d_inode, path->dentry, mode, nd);
46308+ if (!error)
46309+ gr_handle_create(path->dentry, nd->path.mnt);
46310 out_unlock:
46311 mutex_unlock(&dir->d_inode->i_mutex);
46312 dput(nd->path.dentry);
46313@@ -1709,6 +1752,22 @@ struct file *do_filp_open(int dfd, const
46314 &nd, flag);
46315 if (error)
46316 return ERR_PTR(error);
46317+
46318+ if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
46319+ error = -EPERM;
46320+ goto exit;
46321+ }
46322+
46323+ if (gr_handle_rawio(nd.path.dentry->d_inode)) {
46324+ error = -EPERM;
46325+ goto exit;
46326+ }
46327+
46328+ if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
46329+ error = -EACCES;
46330+ goto exit;
46331+ }
46332+
46333 goto ok;
46334 }
46335
46336@@ -1795,6 +1854,14 @@ do_last:
46337 /*
46338 * It already exists.
46339 */
46340+
46341+ /* only check if O_CREAT is specified, all other checks need
46342+ to go into may_open */
46343+ if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
46344+ error = -EACCES;
46345+ goto exit_mutex_unlock;
46346+ }
46347+
46348 mutex_unlock(&dir->d_inode->i_mutex);
46349 audit_inode(pathname, path.dentry);
46350
46351@@ -1887,6 +1954,13 @@ do_link:
46352 error = security_inode_follow_link(path.dentry, &nd);
46353 if (error)
46354 goto exit_dput;
46355+
46356+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
46357+ path.dentry, nd.path.mnt)) {
46358+ error = -EACCES;
46359+ goto exit_dput;
46360+ }
46361+
46362 error = __do_follow_link(&path, &nd);
46363 if (error) {
46364 /* Does someone understand code flow here? Or it is only
46365@@ -2061,6 +2135,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
46366 error = may_mknod(mode);
46367 if (error)
46368 goto out_dput;
46369+
46370+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
46371+ error = -EPERM;
46372+ goto out_dput;
46373+ }
46374+
46375+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
46376+ error = -EACCES;
46377+ goto out_dput;
46378+ }
46379+
46380 error = mnt_want_write(nd.path.mnt);
46381 if (error)
46382 goto out_dput;
46383@@ -2081,6 +2166,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
46384 }
46385 out_drop_write:
46386 mnt_drop_write(nd.path.mnt);
46387+
46388+ if (!error)
46389+ gr_handle_create(dentry, nd.path.mnt);
46390 out_dput:
46391 dput(dentry);
46392 out_unlock:
46393@@ -2134,6 +2222,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
46394 if (IS_ERR(dentry))
46395 goto out_unlock;
46396
46397+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
46398+ error = -EACCES;
46399+ goto out_dput;
46400+ }
46401+
46402 if (!IS_POSIXACL(nd.path.dentry->d_inode))
46403 mode &= ~current_umask();
46404 error = mnt_want_write(nd.path.mnt);
46405@@ -2145,6 +2238,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
46406 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
46407 out_drop_write:
46408 mnt_drop_write(nd.path.mnt);
46409+
46410+ if (!error)
46411+ gr_handle_create(dentry, nd.path.mnt);
46412+
46413 out_dput:
46414 dput(dentry);
46415 out_unlock:
46416@@ -2226,6 +2323,8 @@ static long do_rmdir(int dfd, const char
46417 char * name;
46418 struct dentry *dentry;
46419 struct nameidata nd;
46420+ ino_t saved_ino = 0;
46421+ dev_t saved_dev = 0;
46422
46423 error = user_path_parent(dfd, pathname, &nd, &name);
46424 if (error)
46425@@ -2250,6 +2349,19 @@ static long do_rmdir(int dfd, const char
46426 error = PTR_ERR(dentry);
46427 if (IS_ERR(dentry))
46428 goto exit2;
46429+
46430+ if (dentry->d_inode != NULL) {
46431+ if (dentry->d_inode->i_nlink <= 1) {
46432+ saved_ino = dentry->d_inode->i_ino;
46433+ saved_dev = gr_get_dev_from_dentry(dentry);
46434+ }
46435+
46436+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
46437+ error = -EACCES;
46438+ goto exit3;
46439+ }
46440+ }
46441+
46442 error = mnt_want_write(nd.path.mnt);
46443 if (error)
46444 goto exit3;
46445@@ -2257,6 +2369,8 @@ static long do_rmdir(int dfd, const char
46446 if (error)
46447 goto exit4;
46448 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
46449+ if (!error && (saved_dev || saved_ino))
46450+ gr_handle_delete(saved_ino, saved_dev);
46451 exit4:
46452 mnt_drop_write(nd.path.mnt);
46453 exit3:
46454@@ -2318,6 +2432,8 @@ static long do_unlinkat(int dfd, const c
46455 struct dentry *dentry;
46456 struct nameidata nd;
46457 struct inode *inode = NULL;
46458+ ino_t saved_ino = 0;
46459+ dev_t saved_dev = 0;
46460
46461 error = user_path_parent(dfd, pathname, &nd, &name);
46462 if (error)
46463@@ -2337,8 +2453,19 @@ static long do_unlinkat(int dfd, const c
46464 if (nd.last.name[nd.last.len])
46465 goto slashes;
46466 inode = dentry->d_inode;
46467- if (inode)
46468+ if (inode) {
46469+ if (inode->i_nlink <= 1) {
46470+ saved_ino = inode->i_ino;
46471+ saved_dev = gr_get_dev_from_dentry(dentry);
46472+ }
46473+
46474 atomic_inc(&inode->i_count);
46475+
46476+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
46477+ error = -EACCES;
46478+ goto exit2;
46479+ }
46480+ }
46481 error = mnt_want_write(nd.path.mnt);
46482 if (error)
46483 goto exit2;
46484@@ -2346,6 +2473,8 @@ static long do_unlinkat(int dfd, const c
46485 if (error)
46486 goto exit3;
46487 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
46488+ if (!error && (saved_ino || saved_dev))
46489+ gr_handle_delete(saved_ino, saved_dev);
46490 exit3:
46491 mnt_drop_write(nd.path.mnt);
46492 exit2:
46493@@ -2424,6 +2553,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
46494 if (IS_ERR(dentry))
46495 goto out_unlock;
46496
46497+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
46498+ error = -EACCES;
46499+ goto out_dput;
46500+ }
46501+
46502 error = mnt_want_write(nd.path.mnt);
46503 if (error)
46504 goto out_dput;
46505@@ -2431,6 +2565,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
46506 if (error)
46507 goto out_drop_write;
46508 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
46509+ if (!error)
46510+ gr_handle_create(dentry, nd.path.mnt);
46511 out_drop_write:
46512 mnt_drop_write(nd.path.mnt);
46513 out_dput:
46514@@ -2524,6 +2660,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
46515 error = PTR_ERR(new_dentry);
46516 if (IS_ERR(new_dentry))
46517 goto out_unlock;
46518+
46519+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
46520+ old_path.dentry->d_inode,
46521+ old_path.dentry->d_inode->i_mode, to)) {
46522+ error = -EACCES;
46523+ goto out_dput;
46524+ }
46525+
46526+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
46527+ old_path.dentry, old_path.mnt, to)) {
46528+ error = -EACCES;
46529+ goto out_dput;
46530+ }
46531+
46532 error = mnt_want_write(nd.path.mnt);
46533 if (error)
46534 goto out_dput;
46535@@ -2531,6 +2681,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
46536 if (error)
46537 goto out_drop_write;
46538 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
46539+ if (!error)
46540+ gr_handle_create(new_dentry, nd.path.mnt);
46541 out_drop_write:
46542 mnt_drop_write(nd.path.mnt);
46543 out_dput:
46544@@ -2708,6 +2860,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
46545 char *to;
46546 int error;
46547
46548+ pax_track_stack();
46549+
46550 error = user_path_parent(olddfd, oldname, &oldnd, &from);
46551 if (error)
46552 goto exit;
46553@@ -2764,6 +2918,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
46554 if (new_dentry == trap)
46555 goto exit5;
46556
46557+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
46558+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
46559+ to);
46560+ if (error)
46561+ goto exit5;
46562+
46563 error = mnt_want_write(oldnd.path.mnt);
46564 if (error)
46565 goto exit5;
46566@@ -2773,6 +2933,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
46567 goto exit6;
46568 error = vfs_rename(old_dir->d_inode, old_dentry,
46569 new_dir->d_inode, new_dentry);
46570+ if (!error)
46571+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
46572+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
46573 exit6:
46574 mnt_drop_write(oldnd.path.mnt);
46575 exit5:
46576@@ -2798,6 +2961,8 @@ SYSCALL_DEFINE2(rename, const char __use
46577
46578 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
46579 {
46580+ char tmpbuf[64];
46581+ const char *newlink;
46582 int len;
46583
46584 len = PTR_ERR(link);
46585@@ -2807,7 +2972,14 @@ int vfs_readlink(struct dentry *dentry,
46586 len = strlen(link);
46587 if (len > (unsigned) buflen)
46588 len = buflen;
46589- if (copy_to_user(buffer, link, len))
46590+
46591+ if (len < sizeof(tmpbuf)) {
46592+ memcpy(tmpbuf, link, len);
46593+ newlink = tmpbuf;
46594+ } else
46595+ newlink = link;
46596+
46597+ if (copy_to_user(buffer, newlink, len))
46598 len = -EFAULT;
46599 out:
46600 return len;
46601diff -urNp linux-2.6.32.46/fs/namespace.c linux-2.6.32.46/fs/namespace.c
46602--- linux-2.6.32.46/fs/namespace.c 2011-03-27 14:31:47.000000000 -0400
46603+++ linux-2.6.32.46/fs/namespace.c 2011-04-17 15:56:46.000000000 -0400
46604@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
46605 if (!(sb->s_flags & MS_RDONLY))
46606 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
46607 up_write(&sb->s_umount);
46608+
46609+ gr_log_remount(mnt->mnt_devname, retval);
46610+
46611 return retval;
46612 }
46613
46614@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
46615 security_sb_umount_busy(mnt);
46616 up_write(&namespace_sem);
46617 release_mounts(&umount_list);
46618+
46619+ gr_log_unmount(mnt->mnt_devname, retval);
46620+
46621 return retval;
46622 }
46623
46624@@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_
46625 if (retval)
46626 goto dput_out;
46627
46628+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
46629+ retval = -EPERM;
46630+ goto dput_out;
46631+ }
46632+
46633+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
46634+ retval = -EPERM;
46635+ goto dput_out;
46636+ }
46637+
46638 if (flags & MS_REMOUNT)
46639 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
46640 data_page);
46641@@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_
46642 dev_name, data_page);
46643 dput_out:
46644 path_put(&path);
46645+
46646+ gr_log_mount(dev_name, dir_name, retval);
46647+
46648 return retval;
46649 }
46650
46651@@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
46652 goto out1;
46653 }
46654
46655+ if (gr_handle_chroot_pivot()) {
46656+ error = -EPERM;
46657+ path_put(&old);
46658+ goto out1;
46659+ }
46660+
46661 read_lock(&current->fs->lock);
46662 root = current->fs->root;
46663 path_get(&current->fs->root);
46664diff -urNp linux-2.6.32.46/fs/ncpfs/dir.c linux-2.6.32.46/fs/ncpfs/dir.c
46665--- linux-2.6.32.46/fs/ncpfs/dir.c 2011-03-27 14:31:47.000000000 -0400
46666+++ linux-2.6.32.46/fs/ncpfs/dir.c 2011-05-16 21:46:57.000000000 -0400
46667@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *den
46668 int res, val = 0, len;
46669 __u8 __name[NCP_MAXPATHLEN + 1];
46670
46671+ pax_track_stack();
46672+
46673 parent = dget_parent(dentry);
46674 dir = parent->d_inode;
46675
46676@@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct
46677 int error, res, len;
46678 __u8 __name[NCP_MAXPATHLEN + 1];
46679
46680+ pax_track_stack();
46681+
46682 lock_kernel();
46683 error = -EIO;
46684 if (!ncp_conn_valid(server))
46685@@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, st
46686 int error, result, len;
46687 int opmode;
46688 __u8 __name[NCP_MAXPATHLEN + 1];
46689-
46690+
46691 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
46692 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
46693
46694+ pax_track_stack();
46695+
46696 error = -EIO;
46697 lock_kernel();
46698 if (!ncp_conn_valid(server))
46699@@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir,
46700 int error, len;
46701 __u8 __name[NCP_MAXPATHLEN + 1];
46702
46703+ pax_track_stack();
46704+
46705 DPRINTK("ncp_mkdir: making %s/%s\n",
46706 dentry->d_parent->d_name.name, dentry->d_name.name);
46707
46708@@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir,
46709 if (!ncp_conn_valid(server))
46710 goto out;
46711
46712+ pax_track_stack();
46713+
46714 ncp_age_dentry(server, dentry);
46715 len = sizeof(__name);
46716 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
46717@@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_
46718 int old_len, new_len;
46719 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
46720
46721+ pax_track_stack();
46722+
46723 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
46724 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
46725 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
46726diff -urNp linux-2.6.32.46/fs/ncpfs/inode.c linux-2.6.32.46/fs/ncpfs/inode.c
46727--- linux-2.6.32.46/fs/ncpfs/inode.c 2011-03-27 14:31:47.000000000 -0400
46728+++ linux-2.6.32.46/fs/ncpfs/inode.c 2011-05-16 21:46:57.000000000 -0400
46729@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_b
46730 #endif
46731 struct ncp_entry_info finfo;
46732
46733+ pax_track_stack();
46734+
46735 data.wdog_pid = NULL;
46736 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
46737 if (!server)
46738diff -urNp linux-2.6.32.46/fs/nfs/inode.c linux-2.6.32.46/fs/nfs/inode.c
46739--- linux-2.6.32.46/fs/nfs/inode.c 2011-05-10 22:12:01.000000000 -0400
46740+++ linux-2.6.32.46/fs/nfs/inode.c 2011-07-06 19:53:33.000000000 -0400
46741@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct
46742 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
46743 nfsi->attrtimeo_timestamp = jiffies;
46744
46745- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
46746+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
46747 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
46748 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
46749 else
46750@@ -973,16 +973,16 @@ static int nfs_size_need_update(const st
46751 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
46752 }
46753
46754-static atomic_long_t nfs_attr_generation_counter;
46755+static atomic_long_unchecked_t nfs_attr_generation_counter;
46756
46757 static unsigned long nfs_read_attr_generation_counter(void)
46758 {
46759- return atomic_long_read(&nfs_attr_generation_counter);
46760+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
46761 }
46762
46763 unsigned long nfs_inc_attr_generation_counter(void)
46764 {
46765- return atomic_long_inc_return(&nfs_attr_generation_counter);
46766+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
46767 }
46768
46769 void nfs_fattr_init(struct nfs_fattr *fattr)
46770diff -urNp linux-2.6.32.46/fs/nfsd/lockd.c linux-2.6.32.46/fs/nfsd/lockd.c
46771--- linux-2.6.32.46/fs/nfsd/lockd.c 2011-04-17 17:00:52.000000000 -0400
46772+++ linux-2.6.32.46/fs/nfsd/lockd.c 2011-04-17 17:03:15.000000000 -0400
46773@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
46774 fput(filp);
46775 }
46776
46777-static struct nlmsvc_binding nfsd_nlm_ops = {
46778+static const struct nlmsvc_binding nfsd_nlm_ops = {
46779 .fopen = nlm_fopen, /* open file for locking */
46780 .fclose = nlm_fclose, /* close file */
46781 };
46782diff -urNp linux-2.6.32.46/fs/nfsd/nfs4state.c linux-2.6.32.46/fs/nfsd/nfs4state.c
46783--- linux-2.6.32.46/fs/nfsd/nfs4state.c 2011-03-27 14:31:47.000000000 -0400
46784+++ linux-2.6.32.46/fs/nfsd/nfs4state.c 2011-05-16 21:46:57.000000000 -0400
46785@@ -3457,6 +3457,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
46786 unsigned int cmd;
46787 int err;
46788
46789+ pax_track_stack();
46790+
46791 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
46792 (long long) lock->lk_offset,
46793 (long long) lock->lk_length);
46794diff -urNp linux-2.6.32.46/fs/nfsd/nfs4xdr.c linux-2.6.32.46/fs/nfsd/nfs4xdr.c
46795--- linux-2.6.32.46/fs/nfsd/nfs4xdr.c 2011-03-27 14:31:47.000000000 -0400
46796+++ linux-2.6.32.46/fs/nfsd/nfs4xdr.c 2011-05-16 21:46:57.000000000 -0400
46797@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
46798 struct nfsd4_compoundres *resp = rqstp->rq_resp;
46799 u32 minorversion = resp->cstate.minorversion;
46800
46801+ pax_track_stack();
46802+
46803 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
46804 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
46805 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
46806diff -urNp linux-2.6.32.46/fs/nfsd/vfs.c linux-2.6.32.46/fs/nfsd/vfs.c
46807--- linux-2.6.32.46/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400
46808+++ linux-2.6.32.46/fs/nfsd/vfs.c 2011-05-10 22:12:33.000000000 -0400
46809@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
46810 } else {
46811 oldfs = get_fs();
46812 set_fs(KERNEL_DS);
46813- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
46814+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
46815 set_fs(oldfs);
46816 }
46817
46818@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
46819
46820 /* Write the data. */
46821 oldfs = get_fs(); set_fs(KERNEL_DS);
46822- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
46823+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
46824 set_fs(oldfs);
46825 if (host_err < 0)
46826 goto out_nfserr;
46827@@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
46828 */
46829
46830 oldfs = get_fs(); set_fs(KERNEL_DS);
46831- host_err = inode->i_op->readlink(dentry, buf, *lenp);
46832+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
46833 set_fs(oldfs);
46834
46835 if (host_err < 0)
46836diff -urNp linux-2.6.32.46/fs/nilfs2/ioctl.c linux-2.6.32.46/fs/nilfs2/ioctl.c
46837--- linux-2.6.32.46/fs/nilfs2/ioctl.c 2011-03-27 14:31:47.000000000 -0400
46838+++ linux-2.6.32.46/fs/nilfs2/ioctl.c 2011-05-04 17:56:28.000000000 -0400
46839@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(st
46840 unsigned int cmd, void __user *argp)
46841 {
46842 struct nilfs_argv argv[5];
46843- const static size_t argsz[5] = {
46844+ static const size_t argsz[5] = {
46845 sizeof(struct nilfs_vdesc),
46846 sizeof(struct nilfs_period),
46847 sizeof(__u64),
46848diff -urNp linux-2.6.32.46/fs/notify/dnotify/dnotify.c linux-2.6.32.46/fs/notify/dnotify/dnotify.c
46849--- linux-2.6.32.46/fs/notify/dnotify/dnotify.c 2011-03-27 14:31:47.000000000 -0400
46850+++ linux-2.6.32.46/fs/notify/dnotify/dnotify.c 2011-04-17 15:56:46.000000000 -0400
46851@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsn
46852 kmem_cache_free(dnotify_mark_entry_cache, dnentry);
46853 }
46854
46855-static struct fsnotify_ops dnotify_fsnotify_ops = {
46856+static const struct fsnotify_ops dnotify_fsnotify_ops = {
46857 .handle_event = dnotify_handle_event,
46858 .should_send_event = dnotify_should_send_event,
46859 .free_group_priv = NULL,
46860diff -urNp linux-2.6.32.46/fs/notify/notification.c linux-2.6.32.46/fs/notify/notification.c
46861--- linux-2.6.32.46/fs/notify/notification.c 2011-03-27 14:31:47.000000000 -0400
46862+++ linux-2.6.32.46/fs/notify/notification.c 2011-05-04 17:56:28.000000000 -0400
46863@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
46864 * get set to 0 so it will never get 'freed'
46865 */
46866 static struct fsnotify_event q_overflow_event;
46867-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
46868+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
46869
46870 /**
46871 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
46872@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
46873 */
46874 u32 fsnotify_get_cookie(void)
46875 {
46876- return atomic_inc_return(&fsnotify_sync_cookie);
46877+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
46878 }
46879 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
46880
46881diff -urNp linux-2.6.32.46/fs/ntfs/dir.c linux-2.6.32.46/fs/ntfs/dir.c
46882--- linux-2.6.32.46/fs/ntfs/dir.c 2011-03-27 14:31:47.000000000 -0400
46883+++ linux-2.6.32.46/fs/ntfs/dir.c 2011-04-17 15:56:46.000000000 -0400
46884@@ -1328,7 +1328,7 @@ find_next_index_buffer:
46885 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
46886 ~(s64)(ndir->itype.index.block_size - 1)));
46887 /* Bounds checks. */
46888- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
46889+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
46890 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
46891 "inode 0x%lx or driver bug.", vdir->i_ino);
46892 goto err_out;
46893diff -urNp linux-2.6.32.46/fs/ntfs/file.c linux-2.6.32.46/fs/ntfs/file.c
46894--- linux-2.6.32.46/fs/ntfs/file.c 2011-03-27 14:31:47.000000000 -0400
46895+++ linux-2.6.32.46/fs/ntfs/file.c 2011-04-17 15:56:46.000000000 -0400
46896@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
46897 #endif /* NTFS_RW */
46898 };
46899
46900-const struct file_operations ntfs_empty_file_ops = {};
46901+const struct file_operations ntfs_empty_file_ops __read_only;
46902
46903-const struct inode_operations ntfs_empty_inode_ops = {};
46904+const struct inode_operations ntfs_empty_inode_ops __read_only;
46905diff -urNp linux-2.6.32.46/fs/ocfs2/cluster/masklog.c linux-2.6.32.46/fs/ocfs2/cluster/masklog.c
46906--- linux-2.6.32.46/fs/ocfs2/cluster/masklog.c 2011-03-27 14:31:47.000000000 -0400
46907+++ linux-2.6.32.46/fs/ocfs2/cluster/masklog.c 2011-04-17 15:56:46.000000000 -0400
46908@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
46909 return mlog_mask_store(mlog_attr->mask, buf, count);
46910 }
46911
46912-static struct sysfs_ops mlog_attr_ops = {
46913+static const struct sysfs_ops mlog_attr_ops = {
46914 .show = mlog_show,
46915 .store = mlog_store,
46916 };
46917diff -urNp linux-2.6.32.46/fs/ocfs2/localalloc.c linux-2.6.32.46/fs/ocfs2/localalloc.c
46918--- linux-2.6.32.46/fs/ocfs2/localalloc.c 2011-03-27 14:31:47.000000000 -0400
46919+++ linux-2.6.32.46/fs/ocfs2/localalloc.c 2011-04-17 15:56:46.000000000 -0400
46920@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
46921 goto bail;
46922 }
46923
46924- atomic_inc(&osb->alloc_stats.moves);
46925+ atomic_inc_unchecked(&osb->alloc_stats.moves);
46926
46927 status = 0;
46928 bail:
46929diff -urNp linux-2.6.32.46/fs/ocfs2/namei.c linux-2.6.32.46/fs/ocfs2/namei.c
46930--- linux-2.6.32.46/fs/ocfs2/namei.c 2011-03-27 14:31:47.000000000 -0400
46931+++ linux-2.6.32.46/fs/ocfs2/namei.c 2011-05-16 21:46:57.000000000 -0400
46932@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *ol
46933 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
46934 struct ocfs2_dir_lookup_result target_insert = { NULL, };
46935
46936+ pax_track_stack();
46937+
46938 /* At some point it might be nice to break this function up a
46939 * bit. */
46940
46941diff -urNp linux-2.6.32.46/fs/ocfs2/ocfs2.h linux-2.6.32.46/fs/ocfs2/ocfs2.h
46942--- linux-2.6.32.46/fs/ocfs2/ocfs2.h 2011-03-27 14:31:47.000000000 -0400
46943+++ linux-2.6.32.46/fs/ocfs2/ocfs2.h 2011-04-17 15:56:46.000000000 -0400
46944@@ -217,11 +217,11 @@ enum ocfs2_vol_state
46945
46946 struct ocfs2_alloc_stats
46947 {
46948- atomic_t moves;
46949- atomic_t local_data;
46950- atomic_t bitmap_data;
46951- atomic_t bg_allocs;
46952- atomic_t bg_extends;
46953+ atomic_unchecked_t moves;
46954+ atomic_unchecked_t local_data;
46955+ atomic_unchecked_t bitmap_data;
46956+ atomic_unchecked_t bg_allocs;
46957+ atomic_unchecked_t bg_extends;
46958 };
46959
46960 enum ocfs2_local_alloc_state
46961diff -urNp linux-2.6.32.46/fs/ocfs2/suballoc.c linux-2.6.32.46/fs/ocfs2/suballoc.c
46962--- linux-2.6.32.46/fs/ocfs2/suballoc.c 2011-03-27 14:31:47.000000000 -0400
46963+++ linux-2.6.32.46/fs/ocfs2/suballoc.c 2011-04-17 15:56:46.000000000 -0400
46964@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
46965 mlog_errno(status);
46966 goto bail;
46967 }
46968- atomic_inc(&osb->alloc_stats.bg_extends);
46969+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
46970
46971 /* You should never ask for this much metadata */
46972 BUG_ON(bits_wanted >
46973@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
46974 mlog_errno(status);
46975 goto bail;
46976 }
46977- atomic_inc(&osb->alloc_stats.bg_allocs);
46978+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
46979
46980 *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
46981 ac->ac_bits_given += (*num_bits);
46982@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
46983 mlog_errno(status);
46984 goto bail;
46985 }
46986- atomic_inc(&osb->alloc_stats.bg_allocs);
46987+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
46988
46989 BUG_ON(num_bits != 1);
46990
46991@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
46992 cluster_start,
46993 num_clusters);
46994 if (!status)
46995- atomic_inc(&osb->alloc_stats.local_data);
46996+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
46997 } else {
46998 if (min_clusters > (osb->bitmap_cpg - 1)) {
46999 /* The only paths asking for contiguousness
47000@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
47001 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
47002 bg_blkno,
47003 bg_bit_off);
47004- atomic_inc(&osb->alloc_stats.bitmap_data);
47005+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
47006 }
47007 }
47008 if (status < 0) {
47009diff -urNp linux-2.6.32.46/fs/ocfs2/super.c linux-2.6.32.46/fs/ocfs2/super.c
47010--- linux-2.6.32.46/fs/ocfs2/super.c 2011-03-27 14:31:47.000000000 -0400
47011+++ linux-2.6.32.46/fs/ocfs2/super.c 2011-04-17 15:56:46.000000000 -0400
47012@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
47013 "%10s => GlobalAllocs: %d LocalAllocs: %d "
47014 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
47015 "Stats",
47016- atomic_read(&osb->alloc_stats.bitmap_data),
47017- atomic_read(&osb->alloc_stats.local_data),
47018- atomic_read(&osb->alloc_stats.bg_allocs),
47019- atomic_read(&osb->alloc_stats.moves),
47020- atomic_read(&osb->alloc_stats.bg_extends));
47021+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
47022+ atomic_read_unchecked(&osb->alloc_stats.local_data),
47023+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
47024+ atomic_read_unchecked(&osb->alloc_stats.moves),
47025+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
47026
47027 out += snprintf(buf + out, len - out,
47028 "%10s => State: %u Descriptor: %llu Size: %u bits "
47029@@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct
47030 spin_lock_init(&osb->osb_xattr_lock);
47031 ocfs2_init_inode_steal_slot(osb);
47032
47033- atomic_set(&osb->alloc_stats.moves, 0);
47034- atomic_set(&osb->alloc_stats.local_data, 0);
47035- atomic_set(&osb->alloc_stats.bitmap_data, 0);
47036- atomic_set(&osb->alloc_stats.bg_allocs, 0);
47037- atomic_set(&osb->alloc_stats.bg_extends, 0);
47038+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
47039+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
47040+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
47041+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
47042+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
47043
47044 /* Copy the blockcheck stats from the superblock probe */
47045 osb->osb_ecc_stats = *stats;
47046diff -urNp linux-2.6.32.46/fs/open.c linux-2.6.32.46/fs/open.c
47047--- linux-2.6.32.46/fs/open.c 2011-03-27 14:31:47.000000000 -0400
47048+++ linux-2.6.32.46/fs/open.c 2011-09-13 16:03:56.000000000 -0400
47049@@ -275,6 +275,10 @@ static long do_sys_truncate(const char _
47050 error = locks_verify_truncate(inode, NULL, length);
47051 if (!error)
47052 error = security_path_truncate(&path, length, 0);
47053+
47054+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
47055+ error = -EACCES;
47056+
47057 if (!error) {
47058 vfs_dq_init(inode);
47059 error = do_truncate(path.dentry, length, 0, NULL);
47060@@ -511,6 +515,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
47061 if (__mnt_is_readonly(path.mnt))
47062 res = -EROFS;
47063
47064+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
47065+ res = -EACCES;
47066+
47067 out_path_release:
47068 path_put(&path);
47069 out:
47070@@ -537,6 +544,8 @@ SYSCALL_DEFINE1(chdir, const char __user
47071 if (error)
47072 goto dput_and_out;
47073
47074+ gr_log_chdir(path.dentry, path.mnt);
47075+
47076 set_fs_pwd(current->fs, &path);
47077
47078 dput_and_out:
47079@@ -563,6 +572,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
47080 goto out_putf;
47081
47082 error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
47083+
47084+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
47085+ error = -EPERM;
47086+
47087+ if (!error)
47088+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
47089+
47090 if (!error)
47091 set_fs_pwd(current->fs, &file->f_path);
47092 out_putf:
47093@@ -588,7 +604,13 @@ SYSCALL_DEFINE1(chroot, const char __use
47094 if (!capable(CAP_SYS_CHROOT))
47095 goto dput_and_out;
47096
47097+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
47098+ goto dput_and_out;
47099+
47100 set_fs_root(current->fs, &path);
47101+
47102+ gr_handle_chroot_chdir(&path);
47103+
47104 error = 0;
47105 dput_and_out:
47106 path_put(&path);
47107@@ -616,12 +638,27 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
47108 err = mnt_want_write_file(file);
47109 if (err)
47110 goto out_putf;
47111+
47112 mutex_lock(&inode->i_mutex);
47113+
47114+ if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
47115+ err = -EACCES;
47116+ goto out_unlock;
47117+ }
47118+
47119 if (mode == (mode_t) -1)
47120 mode = inode->i_mode;
47121+
47122+ if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
47123+ err = -EPERM;
47124+ goto out_unlock;
47125+ }
47126+
47127 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
47128 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
47129 err = notify_change(dentry, &newattrs);
47130+
47131+out_unlock:
47132 mutex_unlock(&inode->i_mutex);
47133 mnt_drop_write(file->f_path.mnt);
47134 out_putf:
47135@@ -645,12 +682,27 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
47136 error = mnt_want_write(path.mnt);
47137 if (error)
47138 goto dput_and_out;
47139+
47140 mutex_lock(&inode->i_mutex);
47141+
47142+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
47143+ error = -EACCES;
47144+ goto out_unlock;
47145+ }
47146+
47147 if (mode == (mode_t) -1)
47148 mode = inode->i_mode;
47149+
47150+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
47151+ error = -EACCES;
47152+ goto out_unlock;
47153+ }
47154+
47155 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
47156 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
47157 error = notify_change(path.dentry, &newattrs);
47158+
47159+out_unlock:
47160 mutex_unlock(&inode->i_mutex);
47161 mnt_drop_write(path.mnt);
47162 dput_and_out:
47163@@ -664,12 +716,15 @@ SYSCALL_DEFINE2(chmod, const char __user
47164 return sys_fchmodat(AT_FDCWD, filename, mode);
47165 }
47166
47167-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
47168+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
47169 {
47170 struct inode *inode = dentry->d_inode;
47171 int error;
47172 struct iattr newattrs;
47173
47174+ if (!gr_acl_handle_chown(dentry, mnt))
47175+ return -EACCES;
47176+
47177 newattrs.ia_valid = ATTR_CTIME;
47178 if (user != (uid_t) -1) {
47179 newattrs.ia_valid |= ATTR_UID;
47180@@ -700,7 +755,7 @@ SYSCALL_DEFINE3(chown, const char __user
47181 error = mnt_want_write(path.mnt);
47182 if (error)
47183 goto out_release;
47184- error = chown_common(path.dentry, user, group);
47185+ error = chown_common(path.dentry, user, group, path.mnt);
47186 mnt_drop_write(path.mnt);
47187 out_release:
47188 path_put(&path);
47189@@ -725,7 +780,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
47190 error = mnt_want_write(path.mnt);
47191 if (error)
47192 goto out_release;
47193- error = chown_common(path.dentry, user, group);
47194+ error = chown_common(path.dentry, user, group, path.mnt);
47195 mnt_drop_write(path.mnt);
47196 out_release:
47197 path_put(&path);
47198@@ -744,7 +799,7 @@ SYSCALL_DEFINE3(lchown, const char __use
47199 error = mnt_want_write(path.mnt);
47200 if (error)
47201 goto out_release;
47202- error = chown_common(path.dentry, user, group);
47203+ error = chown_common(path.dentry, user, group, path.mnt);
47204 mnt_drop_write(path.mnt);
47205 out_release:
47206 path_put(&path);
47207@@ -767,7 +822,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
47208 goto out_fput;
47209 dentry = file->f_path.dentry;
47210 audit_inode(NULL, dentry);
47211- error = chown_common(dentry, user, group);
47212+ error = chown_common(dentry, user, group, file->f_path.mnt);
47213 mnt_drop_write(file->f_path.mnt);
47214 out_fput:
47215 fput(file);
47216@@ -1036,7 +1091,10 @@ long do_sys_open(int dfd, const char __u
47217 if (!IS_ERR(tmp)) {
47218 fd = get_unused_fd_flags(flags);
47219 if (fd >= 0) {
47220- struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
47221+ struct file *f;
47222+ /* don't allow to be set by userland */
47223+ flags &= ~FMODE_GREXEC;
47224+ f = do_filp_open(dfd, tmp, flags, mode, 0);
47225 if (IS_ERR(f)) {
47226 put_unused_fd(fd);
47227 fd = PTR_ERR(f);
47228diff -urNp linux-2.6.32.46/fs/partitions/ldm.c linux-2.6.32.46/fs/partitions/ldm.c
47229--- linux-2.6.32.46/fs/partitions/ldm.c 2011-06-25 12:55:34.000000000 -0400
47230+++ linux-2.6.32.46/fs/partitions/ldm.c 2011-06-25 12:56:37.000000000 -0400
47231@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
47232 ldm_error ("A VBLK claims to have %d parts.", num);
47233 return false;
47234 }
47235+
47236 if (rec >= num) {
47237 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
47238 return false;
47239@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
47240 goto found;
47241 }
47242
47243- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
47244+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
47245 if (!f) {
47246 ldm_crit ("Out of memory.");
47247 return false;
47248diff -urNp linux-2.6.32.46/fs/partitions/mac.c linux-2.6.32.46/fs/partitions/mac.c
47249--- linux-2.6.32.46/fs/partitions/mac.c 2011-03-27 14:31:47.000000000 -0400
47250+++ linux-2.6.32.46/fs/partitions/mac.c 2011-04-17 15:56:46.000000000 -0400
47251@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitio
47252 return 0; /* not a MacOS disk */
47253 }
47254 blocks_in_map = be32_to_cpu(part->map_count);
47255+ printk(" [mac]");
47256 if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
47257 put_dev_sector(sect);
47258 return 0;
47259 }
47260- printk(" [mac]");
47261 for (slot = 1; slot <= blocks_in_map; ++slot) {
47262 int pos = slot * secsize;
47263 put_dev_sector(sect);
47264diff -urNp linux-2.6.32.46/fs/pipe.c linux-2.6.32.46/fs/pipe.c
47265--- linux-2.6.32.46/fs/pipe.c 2011-03-27 14:31:47.000000000 -0400
47266+++ linux-2.6.32.46/fs/pipe.c 2011-04-23 13:37:17.000000000 -0400
47267@@ -401,9 +401,9 @@ redo:
47268 }
47269 if (bufs) /* More to do? */
47270 continue;
47271- if (!pipe->writers)
47272+ if (!atomic_read(&pipe->writers))
47273 break;
47274- if (!pipe->waiting_writers) {
47275+ if (!atomic_read(&pipe->waiting_writers)) {
47276 /* syscall merging: Usually we must not sleep
47277 * if O_NONBLOCK is set, or if we got some data.
47278 * But if a writer sleeps in kernel space, then
47279@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
47280 mutex_lock(&inode->i_mutex);
47281 pipe = inode->i_pipe;
47282
47283- if (!pipe->readers) {
47284+ if (!atomic_read(&pipe->readers)) {
47285 send_sig(SIGPIPE, current, 0);
47286 ret = -EPIPE;
47287 goto out;
47288@@ -511,7 +511,7 @@ redo1:
47289 for (;;) {
47290 int bufs;
47291
47292- if (!pipe->readers) {
47293+ if (!atomic_read(&pipe->readers)) {
47294 send_sig(SIGPIPE, current, 0);
47295 if (!ret)
47296 ret = -EPIPE;
47297@@ -597,9 +597,9 @@ redo2:
47298 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
47299 do_wakeup = 0;
47300 }
47301- pipe->waiting_writers++;
47302+ atomic_inc(&pipe->waiting_writers);
47303 pipe_wait(pipe);
47304- pipe->waiting_writers--;
47305+ atomic_dec(&pipe->waiting_writers);
47306 }
47307 out:
47308 mutex_unlock(&inode->i_mutex);
47309@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table
47310 mask = 0;
47311 if (filp->f_mode & FMODE_READ) {
47312 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
47313- if (!pipe->writers && filp->f_version != pipe->w_counter)
47314+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
47315 mask |= POLLHUP;
47316 }
47317
47318@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table
47319 * Most Unices do not set POLLERR for FIFOs but on Linux they
47320 * behave exactly like pipes for poll().
47321 */
47322- if (!pipe->readers)
47323+ if (!atomic_read(&pipe->readers))
47324 mask |= POLLERR;
47325 }
47326
47327@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
47328
47329 mutex_lock(&inode->i_mutex);
47330 pipe = inode->i_pipe;
47331- pipe->readers -= decr;
47332- pipe->writers -= decw;
47333+ atomic_sub(decr, &pipe->readers);
47334+ atomic_sub(decw, &pipe->writers);
47335
47336- if (!pipe->readers && !pipe->writers) {
47337+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
47338 free_pipe_info(inode);
47339 } else {
47340 wake_up_interruptible_sync(&pipe->wait);
47341@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
47342
47343 if (inode->i_pipe) {
47344 ret = 0;
47345- inode->i_pipe->readers++;
47346+ atomic_inc(&inode->i_pipe->readers);
47347 }
47348
47349 mutex_unlock(&inode->i_mutex);
47350@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
47351
47352 if (inode->i_pipe) {
47353 ret = 0;
47354- inode->i_pipe->writers++;
47355+ atomic_inc(&inode->i_pipe->writers);
47356 }
47357
47358 mutex_unlock(&inode->i_mutex);
47359@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
47360 if (inode->i_pipe) {
47361 ret = 0;
47362 if (filp->f_mode & FMODE_READ)
47363- inode->i_pipe->readers++;
47364+ atomic_inc(&inode->i_pipe->readers);
47365 if (filp->f_mode & FMODE_WRITE)
47366- inode->i_pipe->writers++;
47367+ atomic_inc(&inode->i_pipe->writers);
47368 }
47369
47370 mutex_unlock(&inode->i_mutex);
47371@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
47372 inode->i_pipe = NULL;
47373 }
47374
47375-static struct vfsmount *pipe_mnt __read_mostly;
47376+struct vfsmount *pipe_mnt __read_mostly;
47377 static int pipefs_delete_dentry(struct dentry *dentry)
47378 {
47379 /*
47380@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
47381 goto fail_iput;
47382 inode->i_pipe = pipe;
47383
47384- pipe->readers = pipe->writers = 1;
47385+ atomic_set(&pipe->readers, 1);
47386+ atomic_set(&pipe->writers, 1);
47387 inode->i_fop = &rdwr_pipefifo_fops;
47388
47389 /*
47390diff -urNp linux-2.6.32.46/fs/proc/array.c linux-2.6.32.46/fs/proc/array.c
47391--- linux-2.6.32.46/fs/proc/array.c 2011-03-27 14:31:47.000000000 -0400
47392+++ linux-2.6.32.46/fs/proc/array.c 2011-05-16 21:46:57.000000000 -0400
47393@@ -60,6 +60,7 @@
47394 #include <linux/tty.h>
47395 #include <linux/string.h>
47396 #include <linux/mman.h>
47397+#include <linux/grsecurity.h>
47398 #include <linux/proc_fs.h>
47399 #include <linux/ioport.h>
47400 #include <linux/uaccess.h>
47401@@ -321,6 +322,21 @@ static inline void task_context_switch_c
47402 p->nivcsw);
47403 }
47404
47405+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47406+static inline void task_pax(struct seq_file *m, struct task_struct *p)
47407+{
47408+ if (p->mm)
47409+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
47410+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
47411+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
47412+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
47413+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
47414+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
47415+ else
47416+ seq_printf(m, "PaX:\t-----\n");
47417+}
47418+#endif
47419+
47420 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
47421 struct pid *pid, struct task_struct *task)
47422 {
47423@@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m,
47424 task_cap(m, task);
47425 cpuset_task_status_allowed(m, task);
47426 task_context_switch_counts(m, task);
47427+
47428+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
47429+ task_pax(m, task);
47430+#endif
47431+
47432+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
47433+ task_grsec_rbac(m, task);
47434+#endif
47435+
47436 return 0;
47437 }
47438
47439+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47440+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47441+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47442+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47443+#endif
47444+
47445 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
47446 struct pid *pid, struct task_struct *task, int whole)
47447 {
47448@@ -358,9 +389,11 @@ static int do_task_stat(struct seq_file
47449 cputime_t cutime, cstime, utime, stime;
47450 cputime_t cgtime, gtime;
47451 unsigned long rsslim = 0;
47452- char tcomm[sizeof(task->comm)];
47453+ char tcomm[sizeof(task->comm)] = { 0 };
47454 unsigned long flags;
47455
47456+ pax_track_stack();
47457+
47458 state = *get_task_state(task);
47459 vsize = eip = esp = 0;
47460 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
47461@@ -433,6 +466,19 @@ static int do_task_stat(struct seq_file
47462 gtime = task_gtime(task);
47463 }
47464
47465+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47466+ if (PAX_RAND_FLAGS(mm)) {
47467+ eip = 0;
47468+ esp = 0;
47469+ wchan = 0;
47470+ }
47471+#endif
47472+#ifdef CONFIG_GRKERNSEC_HIDESYM
47473+ wchan = 0;
47474+ eip =0;
47475+ esp =0;
47476+#endif
47477+
47478 /* scale priority and nice values from timeslices to -20..20 */
47479 /* to make it look like a "normal" Unix priority/nice value */
47480 priority = task_prio(task);
47481@@ -473,9 +519,15 @@ static int do_task_stat(struct seq_file
47482 vsize,
47483 mm ? get_mm_rss(mm) : 0,
47484 rsslim,
47485+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47486+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
47487+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
47488+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
47489+#else
47490 mm ? (permitted ? mm->start_code : 1) : 0,
47491 mm ? (permitted ? mm->end_code : 1) : 0,
47492 (permitted && mm) ? mm->start_stack : 0,
47493+#endif
47494 esp,
47495 eip,
47496 /* The signal information here is obsolete.
47497@@ -528,3 +580,18 @@ int proc_pid_statm(struct seq_file *m, s
47498
47499 return 0;
47500 }
47501+
47502+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
47503+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
47504+{
47505+ u32 curr_ip = 0;
47506+ unsigned long flags;
47507+
47508+ if (lock_task_sighand(task, &flags)) {
47509+ curr_ip = task->signal->curr_ip;
47510+ unlock_task_sighand(task, &flags);
47511+ }
47512+
47513+ return sprintf(buffer, "%pI4\n", &curr_ip);
47514+}
47515+#endif
47516diff -urNp linux-2.6.32.46/fs/proc/base.c linux-2.6.32.46/fs/proc/base.c
47517--- linux-2.6.32.46/fs/proc/base.c 2011-08-09 18:35:30.000000000 -0400
47518+++ linux-2.6.32.46/fs/proc/base.c 2011-09-13 14:51:06.000000000 -0400
47519@@ -102,6 +102,22 @@ struct pid_entry {
47520 union proc_op op;
47521 };
47522
47523+struct getdents_callback {
47524+ struct linux_dirent __user * current_dir;
47525+ struct linux_dirent __user * previous;
47526+ struct file * file;
47527+ int count;
47528+ int error;
47529+};
47530+
47531+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
47532+ loff_t offset, u64 ino, unsigned int d_type)
47533+{
47534+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
47535+ buf->error = -EINVAL;
47536+ return 0;
47537+}
47538+
47539 #define NOD(NAME, MODE, IOP, FOP, OP) { \
47540 .name = (NAME), \
47541 .len = sizeof(NAME) - 1, \
47542@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
47543 if (task == current)
47544 return 0;
47545
47546+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
47547+ return -EPERM;
47548+
47549 /*
47550 * If current is actively ptrace'ing, and would also be
47551 * permitted to freshly attach with ptrace now, permit it.
47552@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
47553 if (!mm->arg_end)
47554 goto out_mm; /* Shh! No looking before we're done */
47555
47556+ if (gr_acl_handle_procpidmem(task))
47557+ goto out_mm;
47558+
47559 len = mm->arg_end - mm->arg_start;
47560
47561 if (len > PAGE_SIZE)
47562@@ -287,12 +309,28 @@ out:
47563 return res;
47564 }
47565
47566+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47567+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
47568+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
47569+ _mm->pax_flags & MF_PAX_SEGMEXEC))
47570+#endif
47571+
47572 static int proc_pid_auxv(struct task_struct *task, char *buffer)
47573 {
47574 int res = 0;
47575 struct mm_struct *mm = get_task_mm(task);
47576 if (mm) {
47577 unsigned int nwords = 0;
47578+
47579+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
47580+ /* allow if we're currently ptracing this task */
47581+ if (PAX_RAND_FLAGS(mm) &&
47582+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
47583+ mmput(mm);
47584+ return 0;
47585+ }
47586+#endif
47587+
47588 do {
47589 nwords += 2;
47590 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
47591@@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_str
47592 }
47593
47594
47595-#ifdef CONFIG_KALLSYMS
47596+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47597 /*
47598 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
47599 * Returns the resolved symbol. If that fails, simply return the address.
47600@@ -328,7 +366,7 @@ static int proc_pid_wchan(struct task_st
47601 }
47602 #endif /* CONFIG_KALLSYMS */
47603
47604-#ifdef CONFIG_STACKTRACE
47605+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47606
47607 #define MAX_STACK_TRACE_DEPTH 64
47608
47609@@ -522,7 +560,7 @@ static int proc_pid_limits(struct task_s
47610 return count;
47611 }
47612
47613-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47614+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47615 static int proc_pid_syscall(struct task_struct *task, char *buffer)
47616 {
47617 long nr;
47618@@ -547,7 +585,7 @@ static int proc_pid_syscall(struct task_
47619 /************************************************************************/
47620
47621 /* permission checks */
47622-static int proc_fd_access_allowed(struct inode *inode)
47623+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
47624 {
47625 struct task_struct *task;
47626 int allowed = 0;
47627@@ -557,7 +595,10 @@ static int proc_fd_access_allowed(struct
47628 */
47629 task = get_proc_task(inode);
47630 if (task) {
47631- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
47632+ if (log)
47633+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
47634+ else
47635+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
47636 put_task_struct(task);
47637 }
47638 return allowed;
47639@@ -936,6 +977,9 @@ static ssize_t environ_read(struct file
47640 if (!task)
47641 goto out_no_task;
47642
47643+ if (gr_acl_handle_procpidmem(task))
47644+ goto out;
47645+
47646 if (!ptrace_may_access(task, PTRACE_MODE_READ))
47647 goto out;
47648
47649@@ -1350,7 +1394,7 @@ static void *proc_pid_follow_link(struct
47650 path_put(&nd->path);
47651
47652 /* Are we allowed to snoop on the tasks file descriptors? */
47653- if (!proc_fd_access_allowed(inode))
47654+ if (!proc_fd_access_allowed(inode,0))
47655 goto out;
47656
47657 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
47658@@ -1390,8 +1434,18 @@ static int proc_pid_readlink(struct dent
47659 struct path path;
47660
47661 /* Are we allowed to snoop on the tasks file descriptors? */
47662- if (!proc_fd_access_allowed(inode))
47663- goto out;
47664+ /* logging this is needed for learning on chromium to work properly,
47665+ but we don't want to flood the logs from 'ps' which does a readlink
47666+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
47667+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
47668+ */
47669+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
47670+ if (!proc_fd_access_allowed(inode,0))
47671+ goto out;
47672+ } else {
47673+ if (!proc_fd_access_allowed(inode,1))
47674+ goto out;
47675+ }
47676
47677 error = PROC_I(inode)->op.proc_get_link(inode, &path);
47678 if (error)
47679@@ -1456,7 +1510,11 @@ static struct inode *proc_pid_make_inode
47680 rcu_read_lock();
47681 cred = __task_cred(task);
47682 inode->i_uid = cred->euid;
47683+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47684+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
47685+#else
47686 inode->i_gid = cred->egid;
47687+#endif
47688 rcu_read_unlock();
47689 }
47690 security_task_to_inode(task, inode);
47691@@ -1474,6 +1532,9 @@ static int pid_getattr(struct vfsmount *
47692 struct inode *inode = dentry->d_inode;
47693 struct task_struct *task;
47694 const struct cred *cred;
47695+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47696+ const struct cred *tmpcred = current_cred();
47697+#endif
47698
47699 generic_fillattr(inode, stat);
47700
47701@@ -1481,13 +1542,41 @@ static int pid_getattr(struct vfsmount *
47702 stat->uid = 0;
47703 stat->gid = 0;
47704 task = pid_task(proc_pid(inode), PIDTYPE_PID);
47705+
47706+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
47707+ rcu_read_unlock();
47708+ return -ENOENT;
47709+ }
47710+
47711 if (task) {
47712+ cred = __task_cred(task);
47713+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47714+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
47715+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47716+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
47717+#endif
47718+ ) {
47719+#endif
47720 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
47721+#ifdef CONFIG_GRKERNSEC_PROC_USER
47722+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
47723+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47724+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
47725+#endif
47726 task_dumpable(task)) {
47727- cred = __task_cred(task);
47728 stat->uid = cred->euid;
47729+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47730+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
47731+#else
47732 stat->gid = cred->egid;
47733+#endif
47734 }
47735+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47736+ } else {
47737+ rcu_read_unlock();
47738+ return -ENOENT;
47739+ }
47740+#endif
47741 }
47742 rcu_read_unlock();
47743 return 0;
47744@@ -1518,11 +1607,20 @@ static int pid_revalidate(struct dentry
47745
47746 if (task) {
47747 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
47748+#ifdef CONFIG_GRKERNSEC_PROC_USER
47749+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
47750+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47751+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
47752+#endif
47753 task_dumpable(task)) {
47754 rcu_read_lock();
47755 cred = __task_cred(task);
47756 inode->i_uid = cred->euid;
47757+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47758+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
47759+#else
47760 inode->i_gid = cred->egid;
47761+#endif
47762 rcu_read_unlock();
47763 } else {
47764 inode->i_uid = 0;
47765@@ -1643,7 +1741,8 @@ static int proc_fd_info(struct inode *in
47766 int fd = proc_fd(inode);
47767
47768 if (task) {
47769- files = get_files_struct(task);
47770+ if (!gr_acl_handle_procpidmem(task))
47771+ files = get_files_struct(task);
47772 put_task_struct(task);
47773 }
47774 if (files) {
47775@@ -1895,12 +1994,22 @@ static const struct file_operations proc
47776 static int proc_fd_permission(struct inode *inode, int mask)
47777 {
47778 int rv;
47779+ struct task_struct *task;
47780
47781 rv = generic_permission(inode, mask, NULL);
47782- if (rv == 0)
47783- return 0;
47784+
47785 if (task_pid(current) == proc_pid(inode))
47786 rv = 0;
47787+
47788+ task = get_proc_task(inode);
47789+ if (task == NULL)
47790+ return rv;
47791+
47792+ if (gr_acl_handle_procpidmem(task))
47793+ rv = -EACCES;
47794+
47795+ put_task_struct(task);
47796+
47797 return rv;
47798 }
47799
47800@@ -2009,6 +2118,9 @@ static struct dentry *proc_pident_lookup
47801 if (!task)
47802 goto out_no_task;
47803
47804+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
47805+ goto out;
47806+
47807 /*
47808 * Yes, it does not scale. And it should not. Don't add
47809 * new entries into /proc/<tgid>/ without very good reasons.
47810@@ -2053,6 +2165,9 @@ static int proc_pident_readdir(struct fi
47811 if (!task)
47812 goto out_no_task;
47813
47814+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
47815+ goto out;
47816+
47817 ret = 0;
47818 i = filp->f_pos;
47819 switch (i) {
47820@@ -2320,7 +2435,7 @@ static void *proc_self_follow_link(struc
47821 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
47822 void *cookie)
47823 {
47824- char *s = nd_get_link(nd);
47825+ const char *s = nd_get_link(nd);
47826 if (!IS_ERR(s))
47827 __putname(s);
47828 }
47829@@ -2522,7 +2637,7 @@ static const struct pid_entry tgid_base_
47830 #ifdef CONFIG_SCHED_DEBUG
47831 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
47832 #endif
47833-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47834+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47835 INF("syscall", S_IRUSR, proc_pid_syscall),
47836 #endif
47837 INF("cmdline", S_IRUGO, proc_pid_cmdline),
47838@@ -2547,10 +2662,10 @@ static const struct pid_entry tgid_base_
47839 #ifdef CONFIG_SECURITY
47840 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
47841 #endif
47842-#ifdef CONFIG_KALLSYMS
47843+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47844 INF("wchan", S_IRUGO, proc_pid_wchan),
47845 #endif
47846-#ifdef CONFIG_STACKTRACE
47847+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47848 ONE("stack", S_IRUSR, proc_pid_stack),
47849 #endif
47850 #ifdef CONFIG_SCHEDSTATS
47851@@ -2580,6 +2695,9 @@ static const struct pid_entry tgid_base_
47852 #ifdef CONFIG_TASK_IO_ACCOUNTING
47853 INF("io", S_IRUSR, proc_tgid_io_accounting),
47854 #endif
47855+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
47856+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
47857+#endif
47858 };
47859
47860 static int proc_tgid_base_readdir(struct file * filp,
47861@@ -2704,7 +2822,14 @@ static struct dentry *proc_pid_instantia
47862 if (!inode)
47863 goto out;
47864
47865+#ifdef CONFIG_GRKERNSEC_PROC_USER
47866+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
47867+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47868+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
47869+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
47870+#else
47871 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
47872+#endif
47873 inode->i_op = &proc_tgid_base_inode_operations;
47874 inode->i_fop = &proc_tgid_base_operations;
47875 inode->i_flags|=S_IMMUTABLE;
47876@@ -2746,7 +2871,11 @@ struct dentry *proc_pid_lookup(struct in
47877 if (!task)
47878 goto out;
47879
47880+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
47881+ goto out_put_task;
47882+
47883 result = proc_pid_instantiate(dir, dentry, task, NULL);
47884+out_put_task:
47885 put_task_struct(task);
47886 out:
47887 return result;
47888@@ -2811,6 +2940,11 @@ int proc_pid_readdir(struct file * filp,
47889 {
47890 unsigned int nr;
47891 struct task_struct *reaper;
47892+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47893+ const struct cred *tmpcred = current_cred();
47894+ const struct cred *itercred;
47895+#endif
47896+ filldir_t __filldir = filldir;
47897 struct tgid_iter iter;
47898 struct pid_namespace *ns;
47899
47900@@ -2834,8 +2968,27 @@ int proc_pid_readdir(struct file * filp,
47901 for (iter = next_tgid(ns, iter);
47902 iter.task;
47903 iter.tgid += 1, iter = next_tgid(ns, iter)) {
47904+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47905+ rcu_read_lock();
47906+ itercred = __task_cred(iter.task);
47907+#endif
47908+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
47909+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47910+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
47911+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47912+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
47913+#endif
47914+ )
47915+#endif
47916+ )
47917+ __filldir = &gr_fake_filldir;
47918+ else
47919+ __filldir = filldir;
47920+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47921+ rcu_read_unlock();
47922+#endif
47923 filp->f_pos = iter.tgid + TGID_OFFSET;
47924- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
47925+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
47926 put_task_struct(iter.task);
47927 goto out;
47928 }
47929@@ -2861,7 +3014,7 @@ static const struct pid_entry tid_base_s
47930 #ifdef CONFIG_SCHED_DEBUG
47931 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
47932 #endif
47933-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
47934+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
47935 INF("syscall", S_IRUSR, proc_pid_syscall),
47936 #endif
47937 INF("cmdline", S_IRUGO, proc_pid_cmdline),
47938@@ -2885,10 +3038,10 @@ static const struct pid_entry tid_base_s
47939 #ifdef CONFIG_SECURITY
47940 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
47941 #endif
47942-#ifdef CONFIG_KALLSYMS
47943+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47944 INF("wchan", S_IRUGO, proc_pid_wchan),
47945 #endif
47946-#ifdef CONFIG_STACKTRACE
47947+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
47948 ONE("stack", S_IRUSR, proc_pid_stack),
47949 #endif
47950 #ifdef CONFIG_SCHEDSTATS
47951diff -urNp linux-2.6.32.46/fs/proc/cmdline.c linux-2.6.32.46/fs/proc/cmdline.c
47952--- linux-2.6.32.46/fs/proc/cmdline.c 2011-03-27 14:31:47.000000000 -0400
47953+++ linux-2.6.32.46/fs/proc/cmdline.c 2011-04-17 15:56:46.000000000 -0400
47954@@ -23,7 +23,11 @@ static const struct file_operations cmdl
47955
47956 static int __init proc_cmdline_init(void)
47957 {
47958+#ifdef CONFIG_GRKERNSEC_PROC_ADD
47959+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
47960+#else
47961 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
47962+#endif
47963 return 0;
47964 }
47965 module_init(proc_cmdline_init);
47966diff -urNp linux-2.6.32.46/fs/proc/devices.c linux-2.6.32.46/fs/proc/devices.c
47967--- linux-2.6.32.46/fs/proc/devices.c 2011-03-27 14:31:47.000000000 -0400
47968+++ linux-2.6.32.46/fs/proc/devices.c 2011-04-17 15:56:46.000000000 -0400
47969@@ -64,7 +64,11 @@ static const struct file_operations proc
47970
47971 static int __init proc_devices_init(void)
47972 {
47973+#ifdef CONFIG_GRKERNSEC_PROC_ADD
47974+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
47975+#else
47976 proc_create("devices", 0, NULL, &proc_devinfo_operations);
47977+#endif
47978 return 0;
47979 }
47980 module_init(proc_devices_init);
47981diff -urNp linux-2.6.32.46/fs/proc/inode.c linux-2.6.32.46/fs/proc/inode.c
47982--- linux-2.6.32.46/fs/proc/inode.c 2011-03-27 14:31:47.000000000 -0400
47983+++ linux-2.6.32.46/fs/proc/inode.c 2011-04-17 15:56:46.000000000 -0400
47984@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
47985 if (de->mode) {
47986 inode->i_mode = de->mode;
47987 inode->i_uid = de->uid;
47988+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
47989+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
47990+#else
47991 inode->i_gid = de->gid;
47992+#endif
47993 }
47994 if (de->size)
47995 inode->i_size = de->size;
47996diff -urNp linux-2.6.32.46/fs/proc/internal.h linux-2.6.32.46/fs/proc/internal.h
47997--- linux-2.6.32.46/fs/proc/internal.h 2011-03-27 14:31:47.000000000 -0400
47998+++ linux-2.6.32.46/fs/proc/internal.h 2011-04-17 15:56:46.000000000 -0400
47999@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
48000 struct pid *pid, struct task_struct *task);
48001 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48002 struct pid *pid, struct task_struct *task);
48003+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48004+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
48005+#endif
48006 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
48007
48008 extern const struct file_operations proc_maps_operations;
48009diff -urNp linux-2.6.32.46/fs/proc/Kconfig linux-2.6.32.46/fs/proc/Kconfig
48010--- linux-2.6.32.46/fs/proc/Kconfig 2011-03-27 14:31:47.000000000 -0400
48011+++ linux-2.6.32.46/fs/proc/Kconfig 2011-04-17 15:56:46.000000000 -0400
48012@@ -30,12 +30,12 @@ config PROC_FS
48013
48014 config PROC_KCORE
48015 bool "/proc/kcore support" if !ARM
48016- depends on PROC_FS && MMU
48017+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
48018
48019 config PROC_VMCORE
48020 bool "/proc/vmcore support (EXPERIMENTAL)"
48021- depends on PROC_FS && CRASH_DUMP
48022- default y
48023+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
48024+ default n
48025 help
48026 Exports the dump image of crashed kernel in ELF format.
48027
48028@@ -59,8 +59,8 @@ config PROC_SYSCTL
48029 limited in memory.
48030
48031 config PROC_PAGE_MONITOR
48032- default y
48033- depends on PROC_FS && MMU
48034+ default n
48035+ depends on PROC_FS && MMU && !GRKERNSEC
48036 bool "Enable /proc page monitoring" if EMBEDDED
48037 help
48038 Various /proc files exist to monitor process memory utilization:
48039diff -urNp linux-2.6.32.46/fs/proc/kcore.c linux-2.6.32.46/fs/proc/kcore.c
48040--- linux-2.6.32.46/fs/proc/kcore.c 2011-03-27 14:31:47.000000000 -0400
48041+++ linux-2.6.32.46/fs/proc/kcore.c 2011-05-16 21:46:57.000000000 -0400
48042@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bu
48043 off_t offset = 0;
48044 struct kcore_list *m;
48045
48046+ pax_track_stack();
48047+
48048 /* setup ELF header */
48049 elf = (struct elfhdr *) bufp;
48050 bufp += sizeof(struct elfhdr);
48051@@ -477,9 +479,10 @@ read_kcore(struct file *file, char __use
48052 * the addresses in the elf_phdr on our list.
48053 */
48054 start = kc_offset_to_vaddr(*fpos - elf_buflen);
48055- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
48056+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
48057+ if (tsz > buflen)
48058 tsz = buflen;
48059-
48060+
48061 while (buflen) {
48062 struct kcore_list *m;
48063
48064@@ -508,20 +511,23 @@ read_kcore(struct file *file, char __use
48065 kfree(elf_buf);
48066 } else {
48067 if (kern_addr_valid(start)) {
48068- unsigned long n;
48069+ char *elf_buf;
48070+ mm_segment_t oldfs;
48071
48072- n = copy_to_user(buffer, (char *)start, tsz);
48073- /*
48074- * We cannot distingush between fault on source
48075- * and fault on destination. When this happens
48076- * we clear too and hope it will trigger the
48077- * EFAULT again.
48078- */
48079- if (n) {
48080- if (clear_user(buffer + tsz - n,
48081- n))
48082+ elf_buf = kmalloc(tsz, GFP_KERNEL);
48083+ if (!elf_buf)
48084+ return -ENOMEM;
48085+ oldfs = get_fs();
48086+ set_fs(KERNEL_DS);
48087+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
48088+ set_fs(oldfs);
48089+ if (copy_to_user(buffer, elf_buf, tsz)) {
48090+ kfree(elf_buf);
48091 return -EFAULT;
48092+ }
48093 }
48094+ set_fs(oldfs);
48095+ kfree(elf_buf);
48096 } else {
48097 if (clear_user(buffer, tsz))
48098 return -EFAULT;
48099@@ -541,6 +547,9 @@ read_kcore(struct file *file, char __use
48100
48101 static int open_kcore(struct inode *inode, struct file *filp)
48102 {
48103+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
48104+ return -EPERM;
48105+#endif
48106 if (!capable(CAP_SYS_RAWIO))
48107 return -EPERM;
48108 if (kcore_need_update)
48109diff -urNp linux-2.6.32.46/fs/proc/meminfo.c linux-2.6.32.46/fs/proc/meminfo.c
48110--- linux-2.6.32.46/fs/proc/meminfo.c 2011-03-27 14:31:47.000000000 -0400
48111+++ linux-2.6.32.46/fs/proc/meminfo.c 2011-05-16 21:46:57.000000000 -0400
48112@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
48113 unsigned long pages[NR_LRU_LISTS];
48114 int lru;
48115
48116+ pax_track_stack();
48117+
48118 /*
48119 * display in kilobytes.
48120 */
48121@@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_
48122 vmi.used >> 10,
48123 vmi.largest_chunk >> 10
48124 #ifdef CONFIG_MEMORY_FAILURE
48125- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
48126+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
48127 #endif
48128 );
48129
48130diff -urNp linux-2.6.32.46/fs/proc/nommu.c linux-2.6.32.46/fs/proc/nommu.c
48131--- linux-2.6.32.46/fs/proc/nommu.c 2011-03-27 14:31:47.000000000 -0400
48132+++ linux-2.6.32.46/fs/proc/nommu.c 2011-04-17 15:56:46.000000000 -0400
48133@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
48134 if (len < 1)
48135 len = 1;
48136 seq_printf(m, "%*c", len, ' ');
48137- seq_path(m, &file->f_path, "");
48138+ seq_path(m, &file->f_path, "\n\\");
48139 }
48140
48141 seq_putc(m, '\n');
48142diff -urNp linux-2.6.32.46/fs/proc/proc_net.c linux-2.6.32.46/fs/proc/proc_net.c
48143--- linux-2.6.32.46/fs/proc/proc_net.c 2011-03-27 14:31:47.000000000 -0400
48144+++ linux-2.6.32.46/fs/proc/proc_net.c 2011-04-17 15:56:46.000000000 -0400
48145@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
48146 struct task_struct *task;
48147 struct nsproxy *ns;
48148 struct net *net = NULL;
48149+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48150+ const struct cred *cred = current_cred();
48151+#endif
48152+
48153+#ifdef CONFIG_GRKERNSEC_PROC_USER
48154+ if (cred->fsuid)
48155+ return net;
48156+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48157+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
48158+ return net;
48159+#endif
48160
48161 rcu_read_lock();
48162 task = pid_task(proc_pid(dir), PIDTYPE_PID);
48163diff -urNp linux-2.6.32.46/fs/proc/proc_sysctl.c linux-2.6.32.46/fs/proc/proc_sysctl.c
48164--- linux-2.6.32.46/fs/proc/proc_sysctl.c 2011-03-27 14:31:47.000000000 -0400
48165+++ linux-2.6.32.46/fs/proc/proc_sysctl.c 2011-04-17 15:56:46.000000000 -0400
48166@@ -7,6 +7,8 @@
48167 #include <linux/security.h>
48168 #include "internal.h"
48169
48170+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
48171+
48172 static const struct dentry_operations proc_sys_dentry_operations;
48173 static const struct file_operations proc_sys_file_operations;
48174 static const struct inode_operations proc_sys_inode_operations;
48175@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
48176 if (!p)
48177 goto out;
48178
48179+ if (gr_handle_sysctl(p, MAY_EXEC))
48180+ goto out;
48181+
48182 err = ERR_PTR(-ENOMEM);
48183 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
48184 if (h)
48185@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header
48186 if (*pos < file->f_pos)
48187 continue;
48188
48189+ if (gr_handle_sysctl(table, 0))
48190+ continue;
48191+
48192 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
48193 if (res)
48194 return res;
48195@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
48196 if (IS_ERR(head))
48197 return PTR_ERR(head);
48198
48199+ if (table && gr_handle_sysctl(table, MAY_EXEC))
48200+ return -ENOENT;
48201+
48202 generic_fillattr(inode, stat);
48203 if (table)
48204 stat->mode = (stat->mode & S_IFMT) | table->mode;
48205diff -urNp linux-2.6.32.46/fs/proc/root.c linux-2.6.32.46/fs/proc/root.c
48206--- linux-2.6.32.46/fs/proc/root.c 2011-03-27 14:31:47.000000000 -0400
48207+++ linux-2.6.32.46/fs/proc/root.c 2011-04-17 15:56:46.000000000 -0400
48208@@ -134,7 +134,15 @@ void __init proc_root_init(void)
48209 #ifdef CONFIG_PROC_DEVICETREE
48210 proc_device_tree_init();
48211 #endif
48212+#ifdef CONFIG_GRKERNSEC_PROC_ADD
48213+#ifdef CONFIG_GRKERNSEC_PROC_USER
48214+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
48215+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48216+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48217+#endif
48218+#else
48219 proc_mkdir("bus", NULL);
48220+#endif
48221 proc_sys_init();
48222 }
48223
48224diff -urNp linux-2.6.32.46/fs/proc/task_mmu.c linux-2.6.32.46/fs/proc/task_mmu.c
48225--- linux-2.6.32.46/fs/proc/task_mmu.c 2011-03-27 14:31:47.000000000 -0400
48226+++ linux-2.6.32.46/fs/proc/task_mmu.c 2011-04-23 13:38:09.000000000 -0400
48227@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
48228 "VmStk:\t%8lu kB\n"
48229 "VmExe:\t%8lu kB\n"
48230 "VmLib:\t%8lu kB\n"
48231- "VmPTE:\t%8lu kB\n",
48232- hiwater_vm << (PAGE_SHIFT-10),
48233+ "VmPTE:\t%8lu kB\n"
48234+
48235+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48236+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
48237+#endif
48238+
48239+ ,hiwater_vm << (PAGE_SHIFT-10),
48240 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
48241 mm->locked_vm << (PAGE_SHIFT-10),
48242 hiwater_rss << (PAGE_SHIFT-10),
48243 total_rss << (PAGE_SHIFT-10),
48244 data << (PAGE_SHIFT-10),
48245 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
48246- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
48247+ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
48248+
48249+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
48250+ , mm->context.user_cs_base, mm->context.user_cs_limit
48251+#endif
48252+
48253+ );
48254 }
48255
48256 unsigned long task_vsize(struct mm_struct *mm)
48257@@ -175,7 +186,8 @@ static void m_stop(struct seq_file *m, v
48258 struct proc_maps_private *priv = m->private;
48259 struct vm_area_struct *vma = v;
48260
48261- vma_stop(priv, vma);
48262+ if (!IS_ERR(vma))
48263+ vma_stop(priv, vma);
48264 if (priv->task)
48265 put_task_struct(priv->task);
48266 }
48267@@ -199,6 +211,12 @@ static int do_maps_open(struct inode *in
48268 return ret;
48269 }
48270
48271+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48272+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48273+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
48274+ _mm->pax_flags & MF_PAX_SEGMEXEC))
48275+#endif
48276+
48277 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
48278 {
48279 struct mm_struct *mm = vma->vm_mm;
48280@@ -206,7 +224,6 @@ static void show_map_vma(struct seq_file
48281 int flags = vma->vm_flags;
48282 unsigned long ino = 0;
48283 unsigned long long pgoff = 0;
48284- unsigned long start;
48285 dev_t dev = 0;
48286 int len;
48287
48288@@ -217,20 +234,23 @@ static void show_map_vma(struct seq_file
48289 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
48290 }
48291
48292- /* We don't show the stack guard page in /proc/maps */
48293- start = vma->vm_start;
48294- if (vma->vm_flags & VM_GROWSDOWN)
48295- if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
48296- start += PAGE_SIZE;
48297-
48298 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
48299- start,
48300+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48301+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
48302+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
48303+#else
48304+ vma->vm_start,
48305 vma->vm_end,
48306+#endif
48307 flags & VM_READ ? 'r' : '-',
48308 flags & VM_WRITE ? 'w' : '-',
48309 flags & VM_EXEC ? 'x' : '-',
48310 flags & VM_MAYSHARE ? 's' : 'p',
48311+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48312+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
48313+#else
48314 pgoff,
48315+#endif
48316 MAJOR(dev), MINOR(dev), ino, &len);
48317
48318 /*
48319@@ -239,7 +259,7 @@ static void show_map_vma(struct seq_file
48320 */
48321 if (file) {
48322 pad_len_spaces(m, len);
48323- seq_path(m, &file->f_path, "\n");
48324+ seq_path(m, &file->f_path, "\n\\");
48325 } else {
48326 const char *name = arch_vma_name(vma);
48327 if (!name) {
48328@@ -247,8 +267,9 @@ static void show_map_vma(struct seq_file
48329 if (vma->vm_start <= mm->brk &&
48330 vma->vm_end >= mm->start_brk) {
48331 name = "[heap]";
48332- } else if (vma->vm_start <= mm->start_stack &&
48333- vma->vm_end >= mm->start_stack) {
48334+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
48335+ (vma->vm_start <= mm->start_stack &&
48336+ vma->vm_end >= mm->start_stack)) {
48337 name = "[stack]";
48338 }
48339 } else {
48340@@ -391,9 +412,16 @@ static int show_smap(struct seq_file *m,
48341 };
48342
48343 memset(&mss, 0, sizeof mss);
48344- mss.vma = vma;
48345- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48346- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48347+
48348+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48349+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
48350+#endif
48351+ mss.vma = vma;
48352+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
48353+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
48354+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48355+ }
48356+#endif
48357
48358 show_map_vma(m, vma);
48359
48360@@ -409,7 +437,11 @@ static int show_smap(struct seq_file *m,
48361 "Swap: %8lu kB\n"
48362 "KernelPageSize: %8lu kB\n"
48363 "MMUPageSize: %8lu kB\n",
48364+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48365+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
48366+#else
48367 (vma->vm_end - vma->vm_start) >> 10,
48368+#endif
48369 mss.resident >> 10,
48370 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
48371 mss.shared_clean >> 10,
48372diff -urNp linux-2.6.32.46/fs/proc/task_nommu.c linux-2.6.32.46/fs/proc/task_nommu.c
48373--- linux-2.6.32.46/fs/proc/task_nommu.c 2011-03-27 14:31:47.000000000 -0400
48374+++ linux-2.6.32.46/fs/proc/task_nommu.c 2011-04-17 15:56:46.000000000 -0400
48375@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
48376 else
48377 bytes += kobjsize(mm);
48378
48379- if (current->fs && current->fs->users > 1)
48380+ if (current->fs && atomic_read(&current->fs->users) > 1)
48381 sbytes += kobjsize(current->fs);
48382 else
48383 bytes += kobjsize(current->fs);
48384@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
48385 if (len < 1)
48386 len = 1;
48387 seq_printf(m, "%*c", len, ' ');
48388- seq_path(m, &file->f_path, "");
48389+ seq_path(m, &file->f_path, "\n\\");
48390 }
48391
48392 seq_putc(m, '\n');
48393diff -urNp linux-2.6.32.46/fs/readdir.c linux-2.6.32.46/fs/readdir.c
48394--- linux-2.6.32.46/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400
48395+++ linux-2.6.32.46/fs/readdir.c 2011-04-17 15:56:46.000000000 -0400
48396@@ -16,6 +16,7 @@
48397 #include <linux/security.h>
48398 #include <linux/syscalls.h>
48399 #include <linux/unistd.h>
48400+#include <linux/namei.h>
48401
48402 #include <asm/uaccess.h>
48403
48404@@ -67,6 +68,7 @@ struct old_linux_dirent {
48405
48406 struct readdir_callback {
48407 struct old_linux_dirent __user * dirent;
48408+ struct file * file;
48409 int result;
48410 };
48411
48412@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
48413 buf->result = -EOVERFLOW;
48414 return -EOVERFLOW;
48415 }
48416+
48417+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48418+ return 0;
48419+
48420 buf->result++;
48421 dirent = buf->dirent;
48422 if (!access_ok(VERIFY_WRITE, dirent,
48423@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
48424
48425 buf.result = 0;
48426 buf.dirent = dirent;
48427+ buf.file = file;
48428
48429 error = vfs_readdir(file, fillonedir, &buf);
48430 if (buf.result)
48431@@ -142,6 +149,7 @@ struct linux_dirent {
48432 struct getdents_callback {
48433 struct linux_dirent __user * current_dir;
48434 struct linux_dirent __user * previous;
48435+ struct file * file;
48436 int count;
48437 int error;
48438 };
48439@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
48440 buf->error = -EOVERFLOW;
48441 return -EOVERFLOW;
48442 }
48443+
48444+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48445+ return 0;
48446+
48447 dirent = buf->previous;
48448 if (dirent) {
48449 if (__put_user(offset, &dirent->d_off))
48450@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
48451 buf.previous = NULL;
48452 buf.count = count;
48453 buf.error = 0;
48454+ buf.file = file;
48455
48456 error = vfs_readdir(file, filldir, &buf);
48457 if (error >= 0)
48458@@ -228,6 +241,7 @@ out:
48459 struct getdents_callback64 {
48460 struct linux_dirent64 __user * current_dir;
48461 struct linux_dirent64 __user * previous;
48462+ struct file *file;
48463 int count;
48464 int error;
48465 };
48466@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
48467 buf->error = -EINVAL; /* only used if we fail.. */
48468 if (reclen > buf->count)
48469 return -EINVAL;
48470+
48471+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
48472+ return 0;
48473+
48474 dirent = buf->previous;
48475 if (dirent) {
48476 if (__put_user(offset, &dirent->d_off))
48477@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
48478
48479 buf.current_dir = dirent;
48480 buf.previous = NULL;
48481+ buf.file = file;
48482 buf.count = count;
48483 buf.error = 0;
48484
48485diff -urNp linux-2.6.32.46/fs/reiserfs/dir.c linux-2.6.32.46/fs/reiserfs/dir.c
48486--- linux-2.6.32.46/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400
48487+++ linux-2.6.32.46/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400
48488@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
48489 struct reiserfs_dir_entry de;
48490 int ret = 0;
48491
48492+ pax_track_stack();
48493+
48494 reiserfs_write_lock(inode->i_sb);
48495
48496 reiserfs_check_lock_depth(inode->i_sb, "readdir");
48497diff -urNp linux-2.6.32.46/fs/reiserfs/do_balan.c linux-2.6.32.46/fs/reiserfs/do_balan.c
48498--- linux-2.6.32.46/fs/reiserfs/do_balan.c 2011-03-27 14:31:47.000000000 -0400
48499+++ linux-2.6.32.46/fs/reiserfs/do_balan.c 2011-04-17 15:56:46.000000000 -0400
48500@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
48501 return;
48502 }
48503
48504- atomic_inc(&(fs_generation(tb->tb_sb)));
48505+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
48506 do_balance_starts(tb);
48507
48508 /* balance leaf returns 0 except if combining L R and S into
48509diff -urNp linux-2.6.32.46/fs/reiserfs/item_ops.c linux-2.6.32.46/fs/reiserfs/item_ops.c
48510--- linux-2.6.32.46/fs/reiserfs/item_ops.c 2011-03-27 14:31:47.000000000 -0400
48511+++ linux-2.6.32.46/fs/reiserfs/item_ops.c 2011-04-17 15:56:46.000000000 -0400
48512@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
48513 vi->vi_index, vi->vi_type, vi->vi_ih);
48514 }
48515
48516-static struct item_operations stat_data_ops = {
48517+static const struct item_operations stat_data_ops = {
48518 .bytes_number = sd_bytes_number,
48519 .decrement_key = sd_decrement_key,
48520 .is_left_mergeable = sd_is_left_mergeable,
48521@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
48522 vi->vi_index, vi->vi_type, vi->vi_ih);
48523 }
48524
48525-static struct item_operations direct_ops = {
48526+static const struct item_operations direct_ops = {
48527 .bytes_number = direct_bytes_number,
48528 .decrement_key = direct_decrement_key,
48529 .is_left_mergeable = direct_is_left_mergeable,
48530@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
48531 vi->vi_index, vi->vi_type, vi->vi_ih);
48532 }
48533
48534-static struct item_operations indirect_ops = {
48535+static const struct item_operations indirect_ops = {
48536 .bytes_number = indirect_bytes_number,
48537 .decrement_key = indirect_decrement_key,
48538 .is_left_mergeable = indirect_is_left_mergeable,
48539@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
48540 printk("\n");
48541 }
48542
48543-static struct item_operations direntry_ops = {
48544+static const struct item_operations direntry_ops = {
48545 .bytes_number = direntry_bytes_number,
48546 .decrement_key = direntry_decrement_key,
48547 .is_left_mergeable = direntry_is_left_mergeable,
48548@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
48549 "Invalid item type observed, run fsck ASAP");
48550 }
48551
48552-static struct item_operations errcatch_ops = {
48553+static const struct item_operations errcatch_ops = {
48554 errcatch_bytes_number,
48555 errcatch_decrement_key,
48556 errcatch_is_left_mergeable,
48557@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
48558 #error Item types must use disk-format assigned values.
48559 #endif
48560
48561-struct item_operations *item_ops[TYPE_ANY + 1] = {
48562+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
48563 &stat_data_ops,
48564 &indirect_ops,
48565 &direct_ops,
48566diff -urNp linux-2.6.32.46/fs/reiserfs/journal.c linux-2.6.32.46/fs/reiserfs/journal.c
48567--- linux-2.6.32.46/fs/reiserfs/journal.c 2011-03-27 14:31:47.000000000 -0400
48568+++ linux-2.6.32.46/fs/reiserfs/journal.c 2011-05-16 21:46:57.000000000 -0400
48569@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_brea
48570 struct buffer_head *bh;
48571 int i, j;
48572
48573+ pax_track_stack();
48574+
48575 bh = __getblk(dev, block, bufsize);
48576 if (buffer_uptodate(bh))
48577 return (bh);
48578diff -urNp linux-2.6.32.46/fs/reiserfs/namei.c linux-2.6.32.46/fs/reiserfs/namei.c
48579--- linux-2.6.32.46/fs/reiserfs/namei.c 2011-03-27 14:31:47.000000000 -0400
48580+++ linux-2.6.32.46/fs/reiserfs/namei.c 2011-05-16 21:46:57.000000000 -0400
48581@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode
48582 unsigned long savelink = 1;
48583 struct timespec ctime;
48584
48585+ pax_track_stack();
48586+
48587 /* three balancings: (1) old name removal, (2) new name insertion
48588 and (3) maybe "save" link insertion
48589 stat data updates: (1) old directory,
48590diff -urNp linux-2.6.32.46/fs/reiserfs/procfs.c linux-2.6.32.46/fs/reiserfs/procfs.c
48591--- linux-2.6.32.46/fs/reiserfs/procfs.c 2011-03-27 14:31:47.000000000 -0400
48592+++ linux-2.6.32.46/fs/reiserfs/procfs.c 2011-05-16 21:46:57.000000000 -0400
48593@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
48594 "SMALL_TAILS " : "NO_TAILS ",
48595 replay_only(sb) ? "REPLAY_ONLY " : "",
48596 convert_reiserfs(sb) ? "CONV " : "",
48597- atomic_read(&r->s_generation_counter),
48598+ atomic_read_unchecked(&r->s_generation_counter),
48599 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
48600 SF(s_do_balance), SF(s_unneeded_left_neighbor),
48601 SF(s_good_search_by_key_reada), SF(s_bmaps),
48602@@ -309,6 +309,8 @@ static int show_journal(struct seq_file
48603 struct journal_params *jp = &rs->s_v1.s_journal;
48604 char b[BDEVNAME_SIZE];
48605
48606+ pax_track_stack();
48607+
48608 seq_printf(m, /* on-disk fields */
48609 "jp_journal_1st_block: \t%i\n"
48610 "jp_journal_dev: \t%s[%x]\n"
48611diff -urNp linux-2.6.32.46/fs/reiserfs/stree.c linux-2.6.32.46/fs/reiserfs/stree.c
48612--- linux-2.6.32.46/fs/reiserfs/stree.c 2011-03-27 14:31:47.000000000 -0400
48613+++ linux-2.6.32.46/fs/reiserfs/stree.c 2011-05-16 21:46:57.000000000 -0400
48614@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs
48615 int iter = 0;
48616 #endif
48617
48618+ pax_track_stack();
48619+
48620 BUG_ON(!th->t_trans_id);
48621
48622 init_tb_struct(th, &s_del_balance, sb, path,
48623@@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct r
48624 int retval;
48625 int quota_cut_bytes = 0;
48626
48627+ pax_track_stack();
48628+
48629 BUG_ON(!th->t_trans_id);
48630
48631 le_key2cpu_key(&cpu_key, key);
48632@@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiser
48633 int quota_cut_bytes;
48634 loff_t tail_pos = 0;
48635
48636+ pax_track_stack();
48637+
48638 BUG_ON(!th->t_trans_id);
48639
48640 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
48641@@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reis
48642 int retval;
48643 int fs_gen;
48644
48645+ pax_track_stack();
48646+
48647 BUG_ON(!th->t_trans_id);
48648
48649 fs_gen = get_generation(inode->i_sb);
48650@@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs
48651 int fs_gen = 0;
48652 int quota_bytes = 0;
48653
48654+ pax_track_stack();
48655+
48656 BUG_ON(!th->t_trans_id);
48657
48658 if (inode) { /* Do we count quotas for item? */
48659diff -urNp linux-2.6.32.46/fs/reiserfs/super.c linux-2.6.32.46/fs/reiserfs/super.c
48660--- linux-2.6.32.46/fs/reiserfs/super.c 2011-03-27 14:31:47.000000000 -0400
48661+++ linux-2.6.32.46/fs/reiserfs/super.c 2011-05-16 21:46:57.000000000 -0400
48662@@ -912,6 +912,8 @@ static int reiserfs_parse_options(struct
48663 {.option_name = NULL}
48664 };
48665
48666+ pax_track_stack();
48667+
48668 *blocks = 0;
48669 if (!options || !*options)
48670 /* use default configuration: create tails, journaling on, no
48671diff -urNp linux-2.6.32.46/fs/select.c linux-2.6.32.46/fs/select.c
48672--- linux-2.6.32.46/fs/select.c 2011-03-27 14:31:47.000000000 -0400
48673+++ linux-2.6.32.46/fs/select.c 2011-05-16 21:46:57.000000000 -0400
48674@@ -20,6 +20,7 @@
48675 #include <linux/module.h>
48676 #include <linux/slab.h>
48677 #include <linux/poll.h>
48678+#include <linux/security.h>
48679 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
48680 #include <linux/file.h>
48681 #include <linux/fdtable.h>
48682@@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, s
48683 int retval, i, timed_out = 0;
48684 unsigned long slack = 0;
48685
48686+ pax_track_stack();
48687+
48688 rcu_read_lock();
48689 retval = max_select_fd(n, fds);
48690 rcu_read_unlock();
48691@@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user
48692 /* Allocate small arguments on the stack to save memory and be faster */
48693 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
48694
48695+ pax_track_stack();
48696+
48697 ret = -EINVAL;
48698 if (n < 0)
48699 goto out_nofds;
48700@@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *uf
48701 struct poll_list *walk = head;
48702 unsigned long todo = nfds;
48703
48704+ pax_track_stack();
48705+
48706+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
48707 if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
48708 return -EINVAL;
48709
48710diff -urNp linux-2.6.32.46/fs/seq_file.c linux-2.6.32.46/fs/seq_file.c
48711--- linux-2.6.32.46/fs/seq_file.c 2011-03-27 14:31:47.000000000 -0400
48712+++ linux-2.6.32.46/fs/seq_file.c 2011-08-23 21:22:32.000000000 -0400
48713@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
48714 return 0;
48715 }
48716 if (!m->buf) {
48717- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
48718+ m->size = PAGE_SIZE;
48719+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
48720 if (!m->buf)
48721 return -ENOMEM;
48722 }
48723@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
48724 Eoverflow:
48725 m->op->stop(m, p);
48726 kfree(m->buf);
48727- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
48728+ m->size <<= 1;
48729+ m->buf = kmalloc(m->size, GFP_KERNEL);
48730 return !m->buf ? -ENOMEM : -EAGAIN;
48731 }
48732
48733@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
48734 m->version = file->f_version;
48735 /* grab buffer if we didn't have one */
48736 if (!m->buf) {
48737- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
48738+ m->size = PAGE_SIZE;
48739+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
48740 if (!m->buf)
48741 goto Enomem;
48742 }
48743@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
48744 goto Fill;
48745 m->op->stop(m, p);
48746 kfree(m->buf);
48747- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
48748+ m->size <<= 1;
48749+ m->buf = kmalloc(m->size, GFP_KERNEL);
48750 if (!m->buf)
48751 goto Enomem;
48752 m->count = 0;
48753@@ -551,7 +555,7 @@ static void single_stop(struct seq_file
48754 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
48755 void *data)
48756 {
48757- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
48758+ seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
48759 int res = -ENOMEM;
48760
48761 if (op) {
48762diff -urNp linux-2.6.32.46/fs/smbfs/proc.c linux-2.6.32.46/fs/smbfs/proc.c
48763--- linux-2.6.32.46/fs/smbfs/proc.c 2011-03-27 14:31:47.000000000 -0400
48764+++ linux-2.6.32.46/fs/smbfs/proc.c 2011-08-05 20:33:55.000000000 -0400
48765@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *
48766
48767 out:
48768 if (server->local_nls != NULL && server->remote_nls != NULL)
48769- server->ops->convert = convert_cp;
48770+ *(void **)&server->ops->convert = convert_cp;
48771 else
48772- server->ops->convert = convert_memcpy;
48773+ *(void **)&server->ops->convert = convert_memcpy;
48774
48775 smb_unlock_server(server);
48776 return n;
48777@@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server,
48778
48779 /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
48780 if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
48781- server->ops->getattr = smb_proc_getattr_core;
48782+ *(void **)&server->ops->getattr = smb_proc_getattr_core;
48783 } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
48784- server->ops->getattr = smb_proc_getattr_ff;
48785+ *(void **)&server->ops->getattr = smb_proc_getattr_ff;
48786 }
48787
48788 /* Decode server capabilities */
48789@@ -3439,7 +3439,7 @@ out:
48790 static void
48791 install_ops(struct smb_ops *dst, struct smb_ops *src)
48792 {
48793- memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
48794+ memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
48795 }
48796
48797 /* < LANMAN2 */
48798diff -urNp linux-2.6.32.46/fs/smbfs/symlink.c linux-2.6.32.46/fs/smbfs/symlink.c
48799--- linux-2.6.32.46/fs/smbfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
48800+++ linux-2.6.32.46/fs/smbfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
48801@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
48802
48803 static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
48804 {
48805- char *s = nd_get_link(nd);
48806+ const char *s = nd_get_link(nd);
48807 if (!IS_ERR(s))
48808 __putname(s);
48809 }
48810diff -urNp linux-2.6.32.46/fs/splice.c linux-2.6.32.46/fs/splice.c
48811--- linux-2.6.32.46/fs/splice.c 2011-03-27 14:31:47.000000000 -0400
48812+++ linux-2.6.32.46/fs/splice.c 2011-05-16 21:46:57.000000000 -0400
48813@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
48814 pipe_lock(pipe);
48815
48816 for (;;) {
48817- if (!pipe->readers) {
48818+ if (!atomic_read(&pipe->readers)) {
48819 send_sig(SIGPIPE, current, 0);
48820 if (!ret)
48821 ret = -EPIPE;
48822@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
48823 do_wakeup = 0;
48824 }
48825
48826- pipe->waiting_writers++;
48827+ atomic_inc(&pipe->waiting_writers);
48828 pipe_wait(pipe);
48829- pipe->waiting_writers--;
48830+ atomic_dec(&pipe->waiting_writers);
48831 }
48832
48833 pipe_unlock(pipe);
48834@@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *
48835 .spd_release = spd_release_page,
48836 };
48837
48838+ pax_track_stack();
48839+
48840 index = *ppos >> PAGE_CACHE_SHIFT;
48841 loff = *ppos & ~PAGE_CACHE_MASK;
48842 req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
48843@@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file
48844 old_fs = get_fs();
48845 set_fs(get_ds());
48846 /* The cast to a user pointer is valid due to the set_fs() */
48847- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
48848+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
48849 set_fs(old_fs);
48850
48851 return res;
48852@@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file
48853 old_fs = get_fs();
48854 set_fs(get_ds());
48855 /* The cast to a user pointer is valid due to the set_fs() */
48856- res = vfs_write(file, (const char __user *)buf, count, &pos);
48857+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
48858 set_fs(old_fs);
48859
48860 return res;
48861@@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct
48862 .spd_release = spd_release_page,
48863 };
48864
48865+ pax_track_stack();
48866+
48867 index = *ppos >> PAGE_CACHE_SHIFT;
48868 offset = *ppos & ~PAGE_CACHE_MASK;
48869 nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
48870@@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct
48871 goto err;
48872
48873 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
48874- vec[i].iov_base = (void __user *) page_address(page);
48875+ vec[i].iov_base = (__force void __user *) page_address(page);
48876 vec[i].iov_len = this_len;
48877 pages[i] = page;
48878 spd.nr_pages++;
48879@@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
48880 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
48881 {
48882 while (!pipe->nrbufs) {
48883- if (!pipe->writers)
48884+ if (!atomic_read(&pipe->writers))
48885 return 0;
48886
48887- if (!pipe->waiting_writers && sd->num_spliced)
48888+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
48889 return 0;
48890
48891 if (sd->flags & SPLICE_F_NONBLOCK)
48892@@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct fi
48893 * out of the pipe right after the splice_to_pipe(). So set
48894 * PIPE_READERS appropriately.
48895 */
48896- pipe->readers = 1;
48897+ atomic_set(&pipe->readers, 1);
48898
48899 current->splice_pipe = pipe;
48900 }
48901@@ -1592,6 +1596,8 @@ static long vmsplice_to_pipe(struct file
48902 .spd_release = spd_release_page,
48903 };
48904
48905+ pax_track_stack();
48906+
48907 pipe = pipe_info(file->f_path.dentry->d_inode);
48908 if (!pipe)
48909 return -EBADF;
48910@@ -1700,9 +1706,9 @@ static int ipipe_prep(struct pipe_inode_
48911 ret = -ERESTARTSYS;
48912 break;
48913 }
48914- if (!pipe->writers)
48915+ if (!atomic_read(&pipe->writers))
48916 break;
48917- if (!pipe->waiting_writers) {
48918+ if (!atomic_read(&pipe->waiting_writers)) {
48919 if (flags & SPLICE_F_NONBLOCK) {
48920 ret = -EAGAIN;
48921 break;
48922@@ -1734,7 +1740,7 @@ static int opipe_prep(struct pipe_inode_
48923 pipe_lock(pipe);
48924
48925 while (pipe->nrbufs >= PIPE_BUFFERS) {
48926- if (!pipe->readers) {
48927+ if (!atomic_read(&pipe->readers)) {
48928 send_sig(SIGPIPE, current, 0);
48929 ret = -EPIPE;
48930 break;
48931@@ -1747,9 +1753,9 @@ static int opipe_prep(struct pipe_inode_
48932 ret = -ERESTARTSYS;
48933 break;
48934 }
48935- pipe->waiting_writers++;
48936+ atomic_inc(&pipe->waiting_writers);
48937 pipe_wait(pipe);
48938- pipe->waiting_writers--;
48939+ atomic_dec(&pipe->waiting_writers);
48940 }
48941
48942 pipe_unlock(pipe);
48943@@ -1785,14 +1791,14 @@ retry:
48944 pipe_double_lock(ipipe, opipe);
48945
48946 do {
48947- if (!opipe->readers) {
48948+ if (!atomic_read(&opipe->readers)) {
48949 send_sig(SIGPIPE, current, 0);
48950 if (!ret)
48951 ret = -EPIPE;
48952 break;
48953 }
48954
48955- if (!ipipe->nrbufs && !ipipe->writers)
48956+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
48957 break;
48958
48959 /*
48960@@ -1892,7 +1898,7 @@ static int link_pipe(struct pipe_inode_i
48961 pipe_double_lock(ipipe, opipe);
48962
48963 do {
48964- if (!opipe->readers) {
48965+ if (!atomic_read(&opipe->readers)) {
48966 send_sig(SIGPIPE, current, 0);
48967 if (!ret)
48968 ret = -EPIPE;
48969@@ -1937,7 +1943,7 @@ static int link_pipe(struct pipe_inode_i
48970 * return EAGAIN if we have the potential of some data in the
48971 * future, otherwise just return 0
48972 */
48973- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
48974+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
48975 ret = -EAGAIN;
48976
48977 pipe_unlock(ipipe);
48978diff -urNp linux-2.6.32.46/fs/sysfs/file.c linux-2.6.32.46/fs/sysfs/file.c
48979--- linux-2.6.32.46/fs/sysfs/file.c 2011-03-27 14:31:47.000000000 -0400
48980+++ linux-2.6.32.46/fs/sysfs/file.c 2011-05-04 17:56:20.000000000 -0400
48981@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
48982
48983 struct sysfs_open_dirent {
48984 atomic_t refcnt;
48985- atomic_t event;
48986+ atomic_unchecked_t event;
48987 wait_queue_head_t poll;
48988 struct list_head buffers; /* goes through sysfs_buffer.list */
48989 };
48990@@ -53,7 +53,7 @@ struct sysfs_buffer {
48991 size_t count;
48992 loff_t pos;
48993 char * page;
48994- struct sysfs_ops * ops;
48995+ const struct sysfs_ops * ops;
48996 struct mutex mutex;
48997 int needs_read_fill;
48998 int event;
48999@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
49000 {
49001 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
49002 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
49003- struct sysfs_ops * ops = buffer->ops;
49004+ const struct sysfs_ops * ops = buffer->ops;
49005 int ret = 0;
49006 ssize_t count;
49007
49008@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
49009 if (!sysfs_get_active_two(attr_sd))
49010 return -ENODEV;
49011
49012- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
49013+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
49014 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
49015
49016 sysfs_put_active_two(attr_sd);
49017@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
49018 {
49019 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
49020 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
49021- struct sysfs_ops * ops = buffer->ops;
49022+ const struct sysfs_ops * ops = buffer->ops;
49023 int rc;
49024
49025 /* need attr_sd for attr and ops, its parent for kobj */
49026@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
49027 return -ENOMEM;
49028
49029 atomic_set(&new_od->refcnt, 0);
49030- atomic_set(&new_od->event, 1);
49031+ atomic_set_unchecked(&new_od->event, 1);
49032 init_waitqueue_head(&new_od->poll);
49033 INIT_LIST_HEAD(&new_od->buffers);
49034 goto retry;
49035@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode
49036 struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
49037 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
49038 struct sysfs_buffer *buffer;
49039- struct sysfs_ops *ops;
49040+ const struct sysfs_ops *ops;
49041 int error = -EACCES;
49042 char *p;
49043
49044@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
49045
49046 sysfs_put_active_two(attr_sd);
49047
49048- if (buffer->event != atomic_read(&od->event))
49049+ if (buffer->event != atomic_read_unchecked(&od->event))
49050 goto trigger;
49051
49052 return DEFAULT_POLLMASK;
49053@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
49054
49055 od = sd->s_attr.open;
49056 if (od) {
49057- atomic_inc(&od->event);
49058+ atomic_inc_unchecked(&od->event);
49059 wake_up_interruptible(&od->poll);
49060 }
49061
49062diff -urNp linux-2.6.32.46/fs/sysfs/mount.c linux-2.6.32.46/fs/sysfs/mount.c
49063--- linux-2.6.32.46/fs/sysfs/mount.c 2011-03-27 14:31:47.000000000 -0400
49064+++ linux-2.6.32.46/fs/sysfs/mount.c 2011-04-17 15:56:46.000000000 -0400
49065@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
49066 .s_name = "",
49067 .s_count = ATOMIC_INIT(1),
49068 .s_flags = SYSFS_DIR,
49069+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
49070+ .s_mode = S_IFDIR | S_IRWXU,
49071+#else
49072 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
49073+#endif
49074 .s_ino = 1,
49075 };
49076
49077diff -urNp linux-2.6.32.46/fs/sysfs/symlink.c linux-2.6.32.46/fs/sysfs/symlink.c
49078--- linux-2.6.32.46/fs/sysfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
49079+++ linux-2.6.32.46/fs/sysfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
49080@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
49081
49082 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49083 {
49084- char *page = nd_get_link(nd);
49085+ const char *page = nd_get_link(nd);
49086 if (!IS_ERR(page))
49087 free_page((unsigned long)page);
49088 }
49089diff -urNp linux-2.6.32.46/fs/udf/balloc.c linux-2.6.32.46/fs/udf/balloc.c
49090--- linux-2.6.32.46/fs/udf/balloc.c 2011-03-27 14:31:47.000000000 -0400
49091+++ linux-2.6.32.46/fs/udf/balloc.c 2011-04-17 15:56:46.000000000 -0400
49092@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
49093
49094 mutex_lock(&sbi->s_alloc_mutex);
49095 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
49096- if (bloc->logicalBlockNum < 0 ||
49097- (bloc->logicalBlockNum + count) >
49098- partmap->s_partition_len) {
49099+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
49100 udf_debug("%d < %d || %d + %d > %d\n",
49101 bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
49102 count, partmap->s_partition_len);
49103@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
49104
49105 mutex_lock(&sbi->s_alloc_mutex);
49106 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
49107- if (bloc->logicalBlockNum < 0 ||
49108- (bloc->logicalBlockNum + count) >
49109- partmap->s_partition_len) {
49110+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
49111 udf_debug("%d < %d || %d + %d > %d\n",
49112 bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
49113 partmap->s_partition_len);
49114diff -urNp linux-2.6.32.46/fs/udf/inode.c linux-2.6.32.46/fs/udf/inode.c
49115--- linux-2.6.32.46/fs/udf/inode.c 2011-03-27 14:31:47.000000000 -0400
49116+++ linux-2.6.32.46/fs/udf/inode.c 2011-05-16 21:46:57.000000000 -0400
49117@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(
49118 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
49119 int lastblock = 0;
49120
49121+ pax_track_stack();
49122+
49123 prev_epos.offset = udf_file_entry_alloc_offset(inode);
49124 prev_epos.block = iinfo->i_location;
49125 prev_epos.bh = NULL;
49126diff -urNp linux-2.6.32.46/fs/udf/misc.c linux-2.6.32.46/fs/udf/misc.c
49127--- linux-2.6.32.46/fs/udf/misc.c 2011-03-27 14:31:47.000000000 -0400
49128+++ linux-2.6.32.46/fs/udf/misc.c 2011-04-23 12:56:11.000000000 -0400
49129@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
49130
49131 u8 udf_tag_checksum(const struct tag *t)
49132 {
49133- u8 *data = (u8 *)t;
49134+ const u8 *data = (const u8 *)t;
49135 u8 checksum = 0;
49136 int i;
49137 for (i = 0; i < sizeof(struct tag); ++i)
49138diff -urNp linux-2.6.32.46/fs/utimes.c linux-2.6.32.46/fs/utimes.c
49139--- linux-2.6.32.46/fs/utimes.c 2011-03-27 14:31:47.000000000 -0400
49140+++ linux-2.6.32.46/fs/utimes.c 2011-04-17 15:56:46.000000000 -0400
49141@@ -1,6 +1,7 @@
49142 #include <linux/compiler.h>
49143 #include <linux/file.h>
49144 #include <linux/fs.h>
49145+#include <linux/security.h>
49146 #include <linux/linkage.h>
49147 #include <linux/mount.h>
49148 #include <linux/namei.h>
49149@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
49150 goto mnt_drop_write_and_out;
49151 }
49152 }
49153+
49154+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
49155+ error = -EACCES;
49156+ goto mnt_drop_write_and_out;
49157+ }
49158+
49159 mutex_lock(&inode->i_mutex);
49160 error = notify_change(path->dentry, &newattrs);
49161 mutex_unlock(&inode->i_mutex);
49162diff -urNp linux-2.6.32.46/fs/xattr_acl.c linux-2.6.32.46/fs/xattr_acl.c
49163--- linux-2.6.32.46/fs/xattr_acl.c 2011-03-27 14:31:47.000000000 -0400
49164+++ linux-2.6.32.46/fs/xattr_acl.c 2011-04-17 15:56:46.000000000 -0400
49165@@ -17,8 +17,8 @@
49166 struct posix_acl *
49167 posix_acl_from_xattr(const void *value, size_t size)
49168 {
49169- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
49170- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
49171+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
49172+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
49173 int count;
49174 struct posix_acl *acl;
49175 struct posix_acl_entry *acl_e;
49176diff -urNp linux-2.6.32.46/fs/xattr.c linux-2.6.32.46/fs/xattr.c
49177--- linux-2.6.32.46/fs/xattr.c 2011-03-27 14:31:47.000000000 -0400
49178+++ linux-2.6.32.46/fs/xattr.c 2011-04-17 15:56:46.000000000 -0400
49179@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
49180 * Extended attribute SET operations
49181 */
49182 static long
49183-setxattr(struct dentry *d, const char __user *name, const void __user *value,
49184+setxattr(struct path *path, const char __user *name, const void __user *value,
49185 size_t size, int flags)
49186 {
49187 int error;
49188@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
49189 return PTR_ERR(kvalue);
49190 }
49191
49192- error = vfs_setxattr(d, kname, kvalue, size, flags);
49193+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
49194+ error = -EACCES;
49195+ goto out;
49196+ }
49197+
49198+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
49199+out:
49200 kfree(kvalue);
49201 return error;
49202 }
49203@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
49204 return error;
49205 error = mnt_want_write(path.mnt);
49206 if (!error) {
49207- error = setxattr(path.dentry, name, value, size, flags);
49208+ error = setxattr(&path, name, value, size, flags);
49209 mnt_drop_write(path.mnt);
49210 }
49211 path_put(&path);
49212@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
49213 return error;
49214 error = mnt_want_write(path.mnt);
49215 if (!error) {
49216- error = setxattr(path.dentry, name, value, size, flags);
49217+ error = setxattr(&path, name, value, size, flags);
49218 mnt_drop_write(path.mnt);
49219 }
49220 path_put(&path);
49221@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
49222 const void __user *,value, size_t, size, int, flags)
49223 {
49224 struct file *f;
49225- struct dentry *dentry;
49226 int error = -EBADF;
49227
49228 f = fget(fd);
49229 if (!f)
49230 return error;
49231- dentry = f->f_path.dentry;
49232- audit_inode(NULL, dentry);
49233+ audit_inode(NULL, f->f_path.dentry);
49234 error = mnt_want_write_file(f);
49235 if (!error) {
49236- error = setxattr(dentry, name, value, size, flags);
49237+ error = setxattr(&f->f_path, name, value, size, flags);
49238 mnt_drop_write(f->f_path.mnt);
49239 }
49240 fput(f);
49241diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c
49242--- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-03-27 14:31:47.000000000 -0400
49243+++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-04-17 15:56:46.000000000 -0400
49244@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
49245 xfs_fsop_geom_t fsgeo;
49246 int error;
49247
49248+ memset(&fsgeo, 0, sizeof(fsgeo));
49249 error = xfs_fs_geometry(mp, &fsgeo, 3);
49250 if (error)
49251 return -error;
49252diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c
49253--- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 17:00:52.000000000 -0400
49254+++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 20:07:09.000000000 -0400
49255@@ -134,7 +134,7 @@ xfs_find_handle(
49256 }
49257
49258 error = -EFAULT;
49259- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
49260+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
49261 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
49262 goto out_put;
49263
49264@@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
49265 if (IS_ERR(dentry))
49266 return PTR_ERR(dentry);
49267
49268- kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
49269+ kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
49270 if (!kbuf)
49271 goto out_dput;
49272
49273@@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
49274 xfs_mount_t *mp,
49275 void __user *arg)
49276 {
49277- xfs_fsop_geom_t fsgeo;
49278+ xfs_fsop_geom_t fsgeo;
49279 int error;
49280
49281 error = xfs_fs_geometry(mp, &fsgeo, 3);
49282diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c
49283--- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c 2011-03-27 14:31:47.000000000 -0400
49284+++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c 2011-04-17 15:56:46.000000000 -0400
49285@@ -468,7 +468,7 @@ xfs_vn_put_link(
49286 struct nameidata *nd,
49287 void *p)
49288 {
49289- char *s = nd_get_link(nd);
49290+ const char *s = nd_get_link(nd);
49291
49292 if (!IS_ERR(s))
49293 kfree(s);
49294diff -urNp linux-2.6.32.46/fs/xfs/xfs_bmap.c linux-2.6.32.46/fs/xfs/xfs_bmap.c
49295--- linux-2.6.32.46/fs/xfs/xfs_bmap.c 2011-03-27 14:31:47.000000000 -0400
49296+++ linux-2.6.32.46/fs/xfs/xfs_bmap.c 2011-04-17 15:56:46.000000000 -0400
49297@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
49298 int nmap,
49299 int ret_nmap);
49300 #else
49301-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
49302+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
49303 #endif /* DEBUG */
49304
49305 #if defined(XFS_RW_TRACE)
49306diff -urNp linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c
49307--- linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c 2011-03-27 14:31:47.000000000 -0400
49308+++ linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c 2011-04-18 22:07:30.000000000 -0400
49309@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
49310 }
49311
49312 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
49313- if (filldir(dirent, sfep->name, sfep->namelen,
49314+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
49315+ char name[sfep->namelen];
49316+ memcpy(name, sfep->name, sfep->namelen);
49317+ if (filldir(dirent, name, sfep->namelen,
49318+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
49319+ *offset = off & 0x7fffffff;
49320+ return 0;
49321+ }
49322+ } else if (filldir(dirent, sfep->name, sfep->namelen,
49323 off & 0x7fffffff, ino, DT_UNKNOWN)) {
49324 *offset = off & 0x7fffffff;
49325 return 0;
49326diff -urNp linux-2.6.32.46/grsecurity/gracl_alloc.c linux-2.6.32.46/grsecurity/gracl_alloc.c
49327--- linux-2.6.32.46/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
49328+++ linux-2.6.32.46/grsecurity/gracl_alloc.c 2011-04-17 15:56:46.000000000 -0400
49329@@ -0,0 +1,105 @@
49330+#include <linux/kernel.h>
49331+#include <linux/mm.h>
49332+#include <linux/slab.h>
49333+#include <linux/vmalloc.h>
49334+#include <linux/gracl.h>
49335+#include <linux/grsecurity.h>
49336+
49337+static unsigned long alloc_stack_next = 1;
49338+static unsigned long alloc_stack_size = 1;
49339+static void **alloc_stack;
49340+
49341+static __inline__ int
49342+alloc_pop(void)
49343+{
49344+ if (alloc_stack_next == 1)
49345+ return 0;
49346+
49347+ kfree(alloc_stack[alloc_stack_next - 2]);
49348+
49349+ alloc_stack_next--;
49350+
49351+ return 1;
49352+}
49353+
49354+static __inline__ int
49355+alloc_push(void *buf)
49356+{
49357+ if (alloc_stack_next >= alloc_stack_size)
49358+ return 1;
49359+
49360+ alloc_stack[alloc_stack_next - 1] = buf;
49361+
49362+ alloc_stack_next++;
49363+
49364+ return 0;
49365+}
49366+
49367+void *
49368+acl_alloc(unsigned long len)
49369+{
49370+ void *ret = NULL;
49371+
49372+ if (!len || len > PAGE_SIZE)
49373+ goto out;
49374+
49375+ ret = kmalloc(len, GFP_KERNEL);
49376+
49377+ if (ret) {
49378+ if (alloc_push(ret)) {
49379+ kfree(ret);
49380+ ret = NULL;
49381+ }
49382+ }
49383+
49384+out:
49385+ return ret;
49386+}
49387+
49388+void *
49389+acl_alloc_num(unsigned long num, unsigned long len)
49390+{
49391+ if (!len || (num > (PAGE_SIZE / len)))
49392+ return NULL;
49393+
49394+ return acl_alloc(num * len);
49395+}
49396+
49397+void
49398+acl_free_all(void)
49399+{
49400+ if (gr_acl_is_enabled() || !alloc_stack)
49401+ return;
49402+
49403+ while (alloc_pop()) ;
49404+
49405+ if (alloc_stack) {
49406+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
49407+ kfree(alloc_stack);
49408+ else
49409+ vfree(alloc_stack);
49410+ }
49411+
49412+ alloc_stack = NULL;
49413+ alloc_stack_size = 1;
49414+ alloc_stack_next = 1;
49415+
49416+ return;
49417+}
49418+
49419+int
49420+acl_alloc_stack_init(unsigned long size)
49421+{
49422+ if ((size * sizeof (void *)) <= PAGE_SIZE)
49423+ alloc_stack =
49424+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
49425+ else
49426+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
49427+
49428+ alloc_stack_size = size;
49429+
49430+ if (!alloc_stack)
49431+ return 0;
49432+ else
49433+ return 1;
49434+}
49435diff -urNp linux-2.6.32.46/grsecurity/gracl.c linux-2.6.32.46/grsecurity/gracl.c
49436--- linux-2.6.32.46/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
49437+++ linux-2.6.32.46/grsecurity/gracl.c 2011-07-14 20:02:48.000000000 -0400
49438@@ -0,0 +1,4082 @@
49439+#include <linux/kernel.h>
49440+#include <linux/module.h>
49441+#include <linux/sched.h>
49442+#include <linux/mm.h>
49443+#include <linux/file.h>
49444+#include <linux/fs.h>
49445+#include <linux/namei.h>
49446+#include <linux/mount.h>
49447+#include <linux/tty.h>
49448+#include <linux/proc_fs.h>
49449+#include <linux/smp_lock.h>
49450+#include <linux/slab.h>
49451+#include <linux/vmalloc.h>
49452+#include <linux/types.h>
49453+#include <linux/sysctl.h>
49454+#include <linux/netdevice.h>
49455+#include <linux/ptrace.h>
49456+#include <linux/gracl.h>
49457+#include <linux/gralloc.h>
49458+#include <linux/grsecurity.h>
49459+#include <linux/grinternal.h>
49460+#include <linux/pid_namespace.h>
49461+#include <linux/fdtable.h>
49462+#include <linux/percpu.h>
49463+
49464+#include <asm/uaccess.h>
49465+#include <asm/errno.h>
49466+#include <asm/mman.h>
49467+
49468+static struct acl_role_db acl_role_set;
49469+static struct name_db name_set;
49470+static struct inodev_db inodev_set;
49471+
49472+/* for keeping track of userspace pointers used for subjects, so we
49473+ can share references in the kernel as well
49474+*/
49475+
49476+static struct dentry *real_root;
49477+static struct vfsmount *real_root_mnt;
49478+
49479+static struct acl_subj_map_db subj_map_set;
49480+
49481+static struct acl_role_label *default_role;
49482+
49483+static struct acl_role_label *role_list;
49484+
49485+static u16 acl_sp_role_value;
49486+
49487+extern char *gr_shared_page[4];
49488+static DEFINE_MUTEX(gr_dev_mutex);
49489+DEFINE_RWLOCK(gr_inode_lock);
49490+
49491+struct gr_arg *gr_usermode;
49492+
49493+static unsigned int gr_status __read_only = GR_STATUS_INIT;
49494+
49495+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
49496+extern void gr_clear_learn_entries(void);
49497+
49498+#ifdef CONFIG_GRKERNSEC_RESLOG
49499+extern void gr_log_resource(const struct task_struct *task,
49500+ const int res, const unsigned long wanted, const int gt);
49501+#endif
49502+
49503+unsigned char *gr_system_salt;
49504+unsigned char *gr_system_sum;
49505+
49506+static struct sprole_pw **acl_special_roles = NULL;
49507+static __u16 num_sprole_pws = 0;
49508+
49509+static struct acl_role_label *kernel_role = NULL;
49510+
49511+static unsigned int gr_auth_attempts = 0;
49512+static unsigned long gr_auth_expires = 0UL;
49513+
49514+#ifdef CONFIG_NET
49515+extern struct vfsmount *sock_mnt;
49516+#endif
49517+extern struct vfsmount *pipe_mnt;
49518+extern struct vfsmount *shm_mnt;
49519+#ifdef CONFIG_HUGETLBFS
49520+extern struct vfsmount *hugetlbfs_vfsmount;
49521+#endif
49522+
49523+static struct acl_object_label *fakefs_obj_rw;
49524+static struct acl_object_label *fakefs_obj_rwx;
49525+
49526+extern int gr_init_uidset(void);
49527+extern void gr_free_uidset(void);
49528+extern void gr_remove_uid(uid_t uid);
49529+extern int gr_find_uid(uid_t uid);
49530+
49531+__inline__ int
49532+gr_acl_is_enabled(void)
49533+{
49534+ return (gr_status & GR_READY);
49535+}
49536+
49537+#ifdef CONFIG_BTRFS_FS
49538+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
49539+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
49540+#endif
49541+
49542+static inline dev_t __get_dev(const struct dentry *dentry)
49543+{
49544+#ifdef CONFIG_BTRFS_FS
49545+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
49546+ return get_btrfs_dev_from_inode(dentry->d_inode);
49547+ else
49548+#endif
49549+ return dentry->d_inode->i_sb->s_dev;
49550+}
49551+
49552+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
49553+{
49554+ return __get_dev(dentry);
49555+}
49556+
49557+static char gr_task_roletype_to_char(struct task_struct *task)
49558+{
49559+ switch (task->role->roletype &
49560+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
49561+ GR_ROLE_SPECIAL)) {
49562+ case GR_ROLE_DEFAULT:
49563+ return 'D';
49564+ case GR_ROLE_USER:
49565+ return 'U';
49566+ case GR_ROLE_GROUP:
49567+ return 'G';
49568+ case GR_ROLE_SPECIAL:
49569+ return 'S';
49570+ }
49571+
49572+ return 'X';
49573+}
49574+
49575+char gr_roletype_to_char(void)
49576+{
49577+ return gr_task_roletype_to_char(current);
49578+}
49579+
49580+__inline__ int
49581+gr_acl_tpe_check(void)
49582+{
49583+ if (unlikely(!(gr_status & GR_READY)))
49584+ return 0;
49585+ if (current->role->roletype & GR_ROLE_TPE)
49586+ return 1;
49587+ else
49588+ return 0;
49589+}
49590+
49591+int
49592+gr_handle_rawio(const struct inode *inode)
49593+{
49594+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
49595+ if (inode && S_ISBLK(inode->i_mode) &&
49596+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
49597+ !capable(CAP_SYS_RAWIO))
49598+ return 1;
49599+#endif
49600+ return 0;
49601+}
49602+
49603+static int
49604+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
49605+{
49606+ if (likely(lena != lenb))
49607+ return 0;
49608+
49609+ return !memcmp(a, b, lena);
49610+}
49611+
49612+/* this must be called with vfsmount_lock and dcache_lock held */
49613+
49614+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
49615+ struct dentry *root, struct vfsmount *rootmnt,
49616+ char *buffer, int buflen)
49617+{
49618+ char * end = buffer+buflen;
49619+ char * retval;
49620+ int namelen;
49621+
49622+ *--end = '\0';
49623+ buflen--;
49624+
49625+ if (buflen < 1)
49626+ goto Elong;
49627+ /* Get '/' right */
49628+ retval = end-1;
49629+ *retval = '/';
49630+
49631+ for (;;) {
49632+ struct dentry * parent;
49633+
49634+ if (dentry == root && vfsmnt == rootmnt)
49635+ break;
49636+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
49637+ /* Global root? */
49638+ if (vfsmnt->mnt_parent == vfsmnt)
49639+ goto global_root;
49640+ dentry = vfsmnt->mnt_mountpoint;
49641+ vfsmnt = vfsmnt->mnt_parent;
49642+ continue;
49643+ }
49644+ parent = dentry->d_parent;
49645+ prefetch(parent);
49646+ namelen = dentry->d_name.len;
49647+ buflen -= namelen + 1;
49648+ if (buflen < 0)
49649+ goto Elong;
49650+ end -= namelen;
49651+ memcpy(end, dentry->d_name.name, namelen);
49652+ *--end = '/';
49653+ retval = end;
49654+ dentry = parent;
49655+ }
49656+
49657+out:
49658+ return retval;
49659+
49660+global_root:
49661+ namelen = dentry->d_name.len;
49662+ buflen -= namelen;
49663+ if (buflen < 0)
49664+ goto Elong;
49665+ retval -= namelen-1; /* hit the slash */
49666+ memcpy(retval, dentry->d_name.name, namelen);
49667+ goto out;
49668+Elong:
49669+ retval = ERR_PTR(-ENAMETOOLONG);
49670+ goto out;
49671+}
49672+
49673+static char *
49674+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
49675+ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
49676+{
49677+ char *retval;
49678+
49679+ retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
49680+ if (unlikely(IS_ERR(retval)))
49681+ retval = strcpy(buf, "<path too long>");
49682+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
49683+ retval[1] = '\0';
49684+
49685+ return retval;
49686+}
49687+
49688+static char *
49689+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
49690+ char *buf, int buflen)
49691+{
49692+ char *res;
49693+
49694+ /* we can use real_root, real_root_mnt, because this is only called
49695+ by the RBAC system */
49696+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
49697+
49698+ return res;
49699+}
49700+
49701+static char *
49702+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
49703+ char *buf, int buflen)
49704+{
49705+ char *res;
49706+ struct dentry *root;
49707+ struct vfsmount *rootmnt;
49708+ struct task_struct *reaper = &init_task;
49709+
49710+ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
49711+ read_lock(&reaper->fs->lock);
49712+ root = dget(reaper->fs->root.dentry);
49713+ rootmnt = mntget(reaper->fs->root.mnt);
49714+ read_unlock(&reaper->fs->lock);
49715+
49716+ spin_lock(&dcache_lock);
49717+ spin_lock(&vfsmount_lock);
49718+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
49719+ spin_unlock(&vfsmount_lock);
49720+ spin_unlock(&dcache_lock);
49721+
49722+ dput(root);
49723+ mntput(rootmnt);
49724+ return res;
49725+}
49726+
49727+static char *
49728+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
49729+{
49730+ char *ret;
49731+ spin_lock(&dcache_lock);
49732+ spin_lock(&vfsmount_lock);
49733+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
49734+ PAGE_SIZE);
49735+ spin_unlock(&vfsmount_lock);
49736+ spin_unlock(&dcache_lock);
49737+ return ret;
49738+}
49739+
49740+char *
49741+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
49742+{
49743+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
49744+ PAGE_SIZE);
49745+}
49746+
49747+char *
49748+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
49749+{
49750+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
49751+ PAGE_SIZE);
49752+}
49753+
49754+char *
49755+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
49756+{
49757+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
49758+ PAGE_SIZE);
49759+}
49760+
49761+char *
49762+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
49763+{
49764+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
49765+ PAGE_SIZE);
49766+}
49767+
49768+char *
49769+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
49770+{
49771+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
49772+ PAGE_SIZE);
49773+}
49774+
49775+__inline__ __u32
49776+to_gr_audit(const __u32 reqmode)
49777+{
49778+ /* masks off auditable permission flags, then shifts them to create
49779+ auditing flags, and adds the special case of append auditing if
49780+ we're requesting write */
49781+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
49782+}
49783+
49784+struct acl_subject_label *
49785+lookup_subject_map(const struct acl_subject_label *userp)
49786+{
49787+ unsigned int index = shash(userp, subj_map_set.s_size);
49788+ struct subject_map *match;
49789+
49790+ match = subj_map_set.s_hash[index];
49791+
49792+ while (match && match->user != userp)
49793+ match = match->next;
49794+
49795+ if (match != NULL)
49796+ return match->kernel;
49797+ else
49798+ return NULL;
49799+}
49800+
49801+static void
49802+insert_subj_map_entry(struct subject_map *subjmap)
49803+{
49804+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
49805+ struct subject_map **curr;
49806+
49807+ subjmap->prev = NULL;
49808+
49809+ curr = &subj_map_set.s_hash[index];
49810+ if (*curr != NULL)
49811+ (*curr)->prev = subjmap;
49812+
49813+ subjmap->next = *curr;
49814+ *curr = subjmap;
49815+
49816+ return;
49817+}
49818+
49819+static struct acl_role_label *
49820+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
49821+ const gid_t gid)
49822+{
49823+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
49824+ struct acl_role_label *match;
49825+ struct role_allowed_ip *ipp;
49826+ unsigned int x;
49827+ u32 curr_ip = task->signal->curr_ip;
49828+
49829+ task->signal->saved_ip = curr_ip;
49830+
49831+ match = acl_role_set.r_hash[index];
49832+
49833+ while (match) {
49834+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
49835+ for (x = 0; x < match->domain_child_num; x++) {
49836+ if (match->domain_children[x] == uid)
49837+ goto found;
49838+ }
49839+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
49840+ break;
49841+ match = match->next;
49842+ }
49843+found:
49844+ if (match == NULL) {
49845+ try_group:
49846+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
49847+ match = acl_role_set.r_hash[index];
49848+
49849+ while (match) {
49850+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
49851+ for (x = 0; x < match->domain_child_num; x++) {
49852+ if (match->domain_children[x] == gid)
49853+ goto found2;
49854+ }
49855+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
49856+ break;
49857+ match = match->next;
49858+ }
49859+found2:
49860+ if (match == NULL)
49861+ match = default_role;
49862+ if (match->allowed_ips == NULL)
49863+ return match;
49864+ else {
49865+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
49866+ if (likely
49867+ ((ntohl(curr_ip) & ipp->netmask) ==
49868+ (ntohl(ipp->addr) & ipp->netmask)))
49869+ return match;
49870+ }
49871+ match = default_role;
49872+ }
49873+ } else if (match->allowed_ips == NULL) {
49874+ return match;
49875+ } else {
49876+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
49877+ if (likely
49878+ ((ntohl(curr_ip) & ipp->netmask) ==
49879+ (ntohl(ipp->addr) & ipp->netmask)))
49880+ return match;
49881+ }
49882+ goto try_group;
49883+ }
49884+
49885+ return match;
49886+}
49887+
49888+struct acl_subject_label *
49889+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
49890+ const struct acl_role_label *role)
49891+{
49892+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
49893+ struct acl_subject_label *match;
49894+
49895+ match = role->subj_hash[index];
49896+
49897+ while (match && (match->inode != ino || match->device != dev ||
49898+ (match->mode & GR_DELETED))) {
49899+ match = match->next;
49900+ }
49901+
49902+ if (match && !(match->mode & GR_DELETED))
49903+ return match;
49904+ else
49905+ return NULL;
49906+}
49907+
49908+struct acl_subject_label *
49909+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
49910+ const struct acl_role_label *role)
49911+{
49912+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
49913+ struct acl_subject_label *match;
49914+
49915+ match = role->subj_hash[index];
49916+
49917+ while (match && (match->inode != ino || match->device != dev ||
49918+ !(match->mode & GR_DELETED))) {
49919+ match = match->next;
49920+ }
49921+
49922+ if (match && (match->mode & GR_DELETED))
49923+ return match;
49924+ else
49925+ return NULL;
49926+}
49927+
49928+static struct acl_object_label *
49929+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
49930+ const struct acl_subject_label *subj)
49931+{
49932+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
49933+ struct acl_object_label *match;
49934+
49935+ match = subj->obj_hash[index];
49936+
49937+ while (match && (match->inode != ino || match->device != dev ||
49938+ (match->mode & GR_DELETED))) {
49939+ match = match->next;
49940+ }
49941+
49942+ if (match && !(match->mode & GR_DELETED))
49943+ return match;
49944+ else
49945+ return NULL;
49946+}
49947+
49948+static struct acl_object_label *
49949+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
49950+ const struct acl_subject_label *subj)
49951+{
49952+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
49953+ struct acl_object_label *match;
49954+
49955+ match = subj->obj_hash[index];
49956+
49957+ while (match && (match->inode != ino || match->device != dev ||
49958+ !(match->mode & GR_DELETED))) {
49959+ match = match->next;
49960+ }
49961+
49962+ if (match && (match->mode & GR_DELETED))
49963+ return match;
49964+
49965+ match = subj->obj_hash[index];
49966+
49967+ while (match && (match->inode != ino || match->device != dev ||
49968+ (match->mode & GR_DELETED))) {
49969+ match = match->next;
49970+ }
49971+
49972+ if (match && !(match->mode & GR_DELETED))
49973+ return match;
49974+ else
49975+ return NULL;
49976+}
49977+
49978+static struct name_entry *
49979+lookup_name_entry(const char *name)
49980+{
49981+ unsigned int len = strlen(name);
49982+ unsigned int key = full_name_hash(name, len);
49983+ unsigned int index = key % name_set.n_size;
49984+ struct name_entry *match;
49985+
49986+ match = name_set.n_hash[index];
49987+
49988+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
49989+ match = match->next;
49990+
49991+ return match;
49992+}
49993+
49994+static struct name_entry *
49995+lookup_name_entry_create(const char *name)
49996+{
49997+ unsigned int len = strlen(name);
49998+ unsigned int key = full_name_hash(name, len);
49999+ unsigned int index = key % name_set.n_size;
50000+ struct name_entry *match;
50001+
50002+ match = name_set.n_hash[index];
50003+
50004+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
50005+ !match->deleted))
50006+ match = match->next;
50007+
50008+ if (match && match->deleted)
50009+ return match;
50010+
50011+ match = name_set.n_hash[index];
50012+
50013+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
50014+ match->deleted))
50015+ match = match->next;
50016+
50017+ if (match && !match->deleted)
50018+ return match;
50019+ else
50020+ return NULL;
50021+}
50022+
50023+static struct inodev_entry *
50024+lookup_inodev_entry(const ino_t ino, const dev_t dev)
50025+{
50026+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
50027+ struct inodev_entry *match;
50028+
50029+ match = inodev_set.i_hash[index];
50030+
50031+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
50032+ match = match->next;
50033+
50034+ return match;
50035+}
50036+
50037+static void
50038+insert_inodev_entry(struct inodev_entry *entry)
50039+{
50040+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
50041+ inodev_set.i_size);
50042+ struct inodev_entry **curr;
50043+
50044+ entry->prev = NULL;
50045+
50046+ curr = &inodev_set.i_hash[index];
50047+ if (*curr != NULL)
50048+ (*curr)->prev = entry;
50049+
50050+ entry->next = *curr;
50051+ *curr = entry;
50052+
50053+ return;
50054+}
50055+
50056+static void
50057+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
50058+{
50059+ unsigned int index =
50060+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
50061+ struct acl_role_label **curr;
50062+ struct acl_role_label *tmp;
50063+
50064+ curr = &acl_role_set.r_hash[index];
50065+
50066+ /* if role was already inserted due to domains and already has
50067+ a role in the same bucket as it attached, then we need to
50068+ combine these two buckets
50069+ */
50070+ if (role->next) {
50071+ tmp = role->next;
50072+ while (tmp->next)
50073+ tmp = tmp->next;
50074+ tmp->next = *curr;
50075+ } else
50076+ role->next = *curr;
50077+ *curr = role;
50078+
50079+ return;
50080+}
50081+
50082+static void
50083+insert_acl_role_label(struct acl_role_label *role)
50084+{
50085+ int i;
50086+
50087+ if (role_list == NULL) {
50088+ role_list = role;
50089+ role->prev = NULL;
50090+ } else {
50091+ role->prev = role_list;
50092+ role_list = role;
50093+ }
50094+
50095+ /* used for hash chains */
50096+ role->next = NULL;
50097+
50098+ if (role->roletype & GR_ROLE_DOMAIN) {
50099+ for (i = 0; i < role->domain_child_num; i++)
50100+ __insert_acl_role_label(role, role->domain_children[i]);
50101+ } else
50102+ __insert_acl_role_label(role, role->uidgid);
50103+}
50104+
50105+static int
50106+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
50107+{
50108+ struct name_entry **curr, *nentry;
50109+ struct inodev_entry *ientry;
50110+ unsigned int len = strlen(name);
50111+ unsigned int key = full_name_hash(name, len);
50112+ unsigned int index = key % name_set.n_size;
50113+
50114+ curr = &name_set.n_hash[index];
50115+
50116+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
50117+ curr = &((*curr)->next);
50118+
50119+ if (*curr != NULL)
50120+ return 1;
50121+
50122+ nentry = acl_alloc(sizeof (struct name_entry));
50123+ if (nentry == NULL)
50124+ return 0;
50125+ ientry = acl_alloc(sizeof (struct inodev_entry));
50126+ if (ientry == NULL)
50127+ return 0;
50128+ ientry->nentry = nentry;
50129+
50130+ nentry->key = key;
50131+ nentry->name = name;
50132+ nentry->inode = inode;
50133+ nentry->device = device;
50134+ nentry->len = len;
50135+ nentry->deleted = deleted;
50136+
50137+ nentry->prev = NULL;
50138+ curr = &name_set.n_hash[index];
50139+ if (*curr != NULL)
50140+ (*curr)->prev = nentry;
50141+ nentry->next = *curr;
50142+ *curr = nentry;
50143+
50144+ /* insert us into the table searchable by inode/dev */
50145+ insert_inodev_entry(ientry);
50146+
50147+ return 1;
50148+}
50149+
50150+static void
50151+insert_acl_obj_label(struct acl_object_label *obj,
50152+ struct acl_subject_label *subj)
50153+{
50154+ unsigned int index =
50155+ fhash(obj->inode, obj->device, subj->obj_hash_size);
50156+ struct acl_object_label **curr;
50157+
50158+
50159+ obj->prev = NULL;
50160+
50161+ curr = &subj->obj_hash[index];
50162+ if (*curr != NULL)
50163+ (*curr)->prev = obj;
50164+
50165+ obj->next = *curr;
50166+ *curr = obj;
50167+
50168+ return;
50169+}
50170+
50171+static void
50172+insert_acl_subj_label(struct acl_subject_label *obj,
50173+ struct acl_role_label *role)
50174+{
50175+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
50176+ struct acl_subject_label **curr;
50177+
50178+ obj->prev = NULL;
50179+
50180+ curr = &role->subj_hash[index];
50181+ if (*curr != NULL)
50182+ (*curr)->prev = obj;
50183+
50184+ obj->next = *curr;
50185+ *curr = obj;
50186+
50187+ return;
50188+}
50189+
50190+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
50191+
50192+static void *
50193+create_table(__u32 * len, int elementsize)
50194+{
50195+ unsigned int table_sizes[] = {
50196+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
50197+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
50198+ 4194301, 8388593, 16777213, 33554393, 67108859
50199+ };
50200+ void *newtable = NULL;
50201+ unsigned int pwr = 0;
50202+
50203+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
50204+ table_sizes[pwr] <= *len)
50205+ pwr++;
50206+
50207+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
50208+ return newtable;
50209+
50210+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
50211+ newtable =
50212+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
50213+ else
50214+ newtable = vmalloc(table_sizes[pwr] * elementsize);
50215+
50216+ *len = table_sizes[pwr];
50217+
50218+ return newtable;
50219+}
50220+
50221+static int
50222+init_variables(const struct gr_arg *arg)
50223+{
50224+ struct task_struct *reaper = &init_task;
50225+ unsigned int stacksize;
50226+
50227+ subj_map_set.s_size = arg->role_db.num_subjects;
50228+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
50229+ name_set.n_size = arg->role_db.num_objects;
50230+ inodev_set.i_size = arg->role_db.num_objects;
50231+
50232+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
50233+ !name_set.n_size || !inodev_set.i_size)
50234+ return 1;
50235+
50236+ if (!gr_init_uidset())
50237+ return 1;
50238+
50239+ /* set up the stack that holds allocation info */
50240+
50241+ stacksize = arg->role_db.num_pointers + 5;
50242+
50243+ if (!acl_alloc_stack_init(stacksize))
50244+ return 1;
50245+
50246+ /* grab reference for the real root dentry and vfsmount */
50247+ read_lock(&reaper->fs->lock);
50248+ real_root = dget(reaper->fs->root.dentry);
50249+ real_root_mnt = mntget(reaper->fs->root.mnt);
50250+ read_unlock(&reaper->fs->lock);
50251+
50252+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50253+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
50254+#endif
50255+
50256+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
50257+ if (fakefs_obj_rw == NULL)
50258+ return 1;
50259+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
50260+
50261+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
50262+ if (fakefs_obj_rwx == NULL)
50263+ return 1;
50264+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
50265+
50266+ subj_map_set.s_hash =
50267+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
50268+ acl_role_set.r_hash =
50269+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
50270+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
50271+ inodev_set.i_hash =
50272+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
50273+
50274+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
50275+ !name_set.n_hash || !inodev_set.i_hash)
50276+ return 1;
50277+
50278+ memset(subj_map_set.s_hash, 0,
50279+ sizeof(struct subject_map *) * subj_map_set.s_size);
50280+ memset(acl_role_set.r_hash, 0,
50281+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
50282+ memset(name_set.n_hash, 0,
50283+ sizeof (struct name_entry *) * name_set.n_size);
50284+ memset(inodev_set.i_hash, 0,
50285+ sizeof (struct inodev_entry *) * inodev_set.i_size);
50286+
50287+ return 0;
50288+}
50289+
50290+/* free information not needed after startup
50291+ currently contains user->kernel pointer mappings for subjects
50292+*/
50293+
50294+static void
50295+free_init_variables(void)
50296+{
50297+ __u32 i;
50298+
50299+ if (subj_map_set.s_hash) {
50300+ for (i = 0; i < subj_map_set.s_size; i++) {
50301+ if (subj_map_set.s_hash[i]) {
50302+ kfree(subj_map_set.s_hash[i]);
50303+ subj_map_set.s_hash[i] = NULL;
50304+ }
50305+ }
50306+
50307+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
50308+ PAGE_SIZE)
50309+ kfree(subj_map_set.s_hash);
50310+ else
50311+ vfree(subj_map_set.s_hash);
50312+ }
50313+
50314+ return;
50315+}
50316+
50317+static void
50318+free_variables(void)
50319+{
50320+ struct acl_subject_label *s;
50321+ struct acl_role_label *r;
50322+ struct task_struct *task, *task2;
50323+ unsigned int x;
50324+
50325+ gr_clear_learn_entries();
50326+
50327+ read_lock(&tasklist_lock);
50328+ do_each_thread(task2, task) {
50329+ task->acl_sp_role = 0;
50330+ task->acl_role_id = 0;
50331+ task->acl = NULL;
50332+ task->role = NULL;
50333+ } while_each_thread(task2, task);
50334+ read_unlock(&tasklist_lock);
50335+
50336+ /* release the reference to the real root dentry and vfsmount */
50337+ if (real_root)
50338+ dput(real_root);
50339+ real_root = NULL;
50340+ if (real_root_mnt)
50341+ mntput(real_root_mnt);
50342+ real_root_mnt = NULL;
50343+
50344+ /* free all object hash tables */
50345+
50346+ FOR_EACH_ROLE_START(r)
50347+ if (r->subj_hash == NULL)
50348+ goto next_role;
50349+ FOR_EACH_SUBJECT_START(r, s, x)
50350+ if (s->obj_hash == NULL)
50351+ break;
50352+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
50353+ kfree(s->obj_hash);
50354+ else
50355+ vfree(s->obj_hash);
50356+ FOR_EACH_SUBJECT_END(s, x)
50357+ FOR_EACH_NESTED_SUBJECT_START(r, s)
50358+ if (s->obj_hash == NULL)
50359+ break;
50360+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
50361+ kfree(s->obj_hash);
50362+ else
50363+ vfree(s->obj_hash);
50364+ FOR_EACH_NESTED_SUBJECT_END(s)
50365+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
50366+ kfree(r->subj_hash);
50367+ else
50368+ vfree(r->subj_hash);
50369+ r->subj_hash = NULL;
50370+next_role:
50371+ FOR_EACH_ROLE_END(r)
50372+
50373+ acl_free_all();
50374+
50375+ if (acl_role_set.r_hash) {
50376+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
50377+ PAGE_SIZE)
50378+ kfree(acl_role_set.r_hash);
50379+ else
50380+ vfree(acl_role_set.r_hash);
50381+ }
50382+ if (name_set.n_hash) {
50383+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
50384+ PAGE_SIZE)
50385+ kfree(name_set.n_hash);
50386+ else
50387+ vfree(name_set.n_hash);
50388+ }
50389+
50390+ if (inodev_set.i_hash) {
50391+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
50392+ PAGE_SIZE)
50393+ kfree(inodev_set.i_hash);
50394+ else
50395+ vfree(inodev_set.i_hash);
50396+ }
50397+
50398+ gr_free_uidset();
50399+
50400+ memset(&name_set, 0, sizeof (struct name_db));
50401+ memset(&inodev_set, 0, sizeof (struct inodev_db));
50402+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
50403+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
50404+
50405+ default_role = NULL;
50406+ role_list = NULL;
50407+
50408+ return;
50409+}
50410+
50411+static __u32
50412+count_user_objs(struct acl_object_label *userp)
50413+{
50414+ struct acl_object_label o_tmp;
50415+ __u32 num = 0;
50416+
50417+ while (userp) {
50418+ if (copy_from_user(&o_tmp, userp,
50419+ sizeof (struct acl_object_label)))
50420+ break;
50421+
50422+ userp = o_tmp.prev;
50423+ num++;
50424+ }
50425+
50426+ return num;
50427+}
50428+
50429+static struct acl_subject_label *
50430+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
50431+
50432+static int
50433+copy_user_glob(struct acl_object_label *obj)
50434+{
50435+ struct acl_object_label *g_tmp, **guser;
50436+ unsigned int len;
50437+ char *tmp;
50438+
50439+ if (obj->globbed == NULL)
50440+ return 0;
50441+
50442+ guser = &obj->globbed;
50443+ while (*guser) {
50444+ g_tmp = (struct acl_object_label *)
50445+ acl_alloc(sizeof (struct acl_object_label));
50446+ if (g_tmp == NULL)
50447+ return -ENOMEM;
50448+
50449+ if (copy_from_user(g_tmp, *guser,
50450+ sizeof (struct acl_object_label)))
50451+ return -EFAULT;
50452+
50453+ len = strnlen_user(g_tmp->filename, PATH_MAX);
50454+
50455+ if (!len || len >= PATH_MAX)
50456+ return -EINVAL;
50457+
50458+ if ((tmp = (char *) acl_alloc(len)) == NULL)
50459+ return -ENOMEM;
50460+
50461+ if (copy_from_user(tmp, g_tmp->filename, len))
50462+ return -EFAULT;
50463+ tmp[len-1] = '\0';
50464+ g_tmp->filename = tmp;
50465+
50466+ *guser = g_tmp;
50467+ guser = &(g_tmp->next);
50468+ }
50469+
50470+ return 0;
50471+}
50472+
50473+static int
50474+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
50475+ struct acl_role_label *role)
50476+{
50477+ struct acl_object_label *o_tmp;
50478+ unsigned int len;
50479+ int ret;
50480+ char *tmp;
50481+
50482+ while (userp) {
50483+ if ((o_tmp = (struct acl_object_label *)
50484+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
50485+ return -ENOMEM;
50486+
50487+ if (copy_from_user(o_tmp, userp,
50488+ sizeof (struct acl_object_label)))
50489+ return -EFAULT;
50490+
50491+ userp = o_tmp->prev;
50492+
50493+ len = strnlen_user(o_tmp->filename, PATH_MAX);
50494+
50495+ if (!len || len >= PATH_MAX)
50496+ return -EINVAL;
50497+
50498+ if ((tmp = (char *) acl_alloc(len)) == NULL)
50499+ return -ENOMEM;
50500+
50501+ if (copy_from_user(tmp, o_tmp->filename, len))
50502+ return -EFAULT;
50503+ tmp[len-1] = '\0';
50504+ o_tmp->filename = tmp;
50505+
50506+ insert_acl_obj_label(o_tmp, subj);
50507+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
50508+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
50509+ return -ENOMEM;
50510+
50511+ ret = copy_user_glob(o_tmp);
50512+ if (ret)
50513+ return ret;
50514+
50515+ if (o_tmp->nested) {
50516+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
50517+ if (IS_ERR(o_tmp->nested))
50518+ return PTR_ERR(o_tmp->nested);
50519+
50520+ /* insert into nested subject list */
50521+ o_tmp->nested->next = role->hash->first;
50522+ role->hash->first = o_tmp->nested;
50523+ }
50524+ }
50525+
50526+ return 0;
50527+}
50528+
50529+static __u32
50530+count_user_subjs(struct acl_subject_label *userp)
50531+{
50532+ struct acl_subject_label s_tmp;
50533+ __u32 num = 0;
50534+
50535+ while (userp) {
50536+ if (copy_from_user(&s_tmp, userp,
50537+ sizeof (struct acl_subject_label)))
50538+ break;
50539+
50540+ userp = s_tmp.prev;
50541+ /* do not count nested subjects against this count, since
50542+ they are not included in the hash table, but are
50543+ attached to objects. We have already counted
50544+ the subjects in userspace for the allocation
50545+ stack
50546+ */
50547+ if (!(s_tmp.mode & GR_NESTED))
50548+ num++;
50549+ }
50550+
50551+ return num;
50552+}
50553+
50554+static int
50555+copy_user_allowedips(struct acl_role_label *rolep)
50556+{
50557+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
50558+
50559+ ruserip = rolep->allowed_ips;
50560+
50561+ while (ruserip) {
50562+ rlast = rtmp;
50563+
50564+ if ((rtmp = (struct role_allowed_ip *)
50565+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
50566+ return -ENOMEM;
50567+
50568+ if (copy_from_user(rtmp, ruserip,
50569+ sizeof (struct role_allowed_ip)))
50570+ return -EFAULT;
50571+
50572+ ruserip = rtmp->prev;
50573+
50574+ if (!rlast) {
50575+ rtmp->prev = NULL;
50576+ rolep->allowed_ips = rtmp;
50577+ } else {
50578+ rlast->next = rtmp;
50579+ rtmp->prev = rlast;
50580+ }
50581+
50582+ if (!ruserip)
50583+ rtmp->next = NULL;
50584+ }
50585+
50586+ return 0;
50587+}
50588+
50589+static int
50590+copy_user_transitions(struct acl_role_label *rolep)
50591+{
50592+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
50593+
50594+ unsigned int len;
50595+ char *tmp;
50596+
50597+ rusertp = rolep->transitions;
50598+
50599+ while (rusertp) {
50600+ rlast = rtmp;
50601+
50602+ if ((rtmp = (struct role_transition *)
50603+ acl_alloc(sizeof (struct role_transition))) == NULL)
50604+ return -ENOMEM;
50605+
50606+ if (copy_from_user(rtmp, rusertp,
50607+ sizeof (struct role_transition)))
50608+ return -EFAULT;
50609+
50610+ rusertp = rtmp->prev;
50611+
50612+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
50613+
50614+ if (!len || len >= GR_SPROLE_LEN)
50615+ return -EINVAL;
50616+
50617+ if ((tmp = (char *) acl_alloc(len)) == NULL)
50618+ return -ENOMEM;
50619+
50620+ if (copy_from_user(tmp, rtmp->rolename, len))
50621+ return -EFAULT;
50622+ tmp[len-1] = '\0';
50623+ rtmp->rolename = tmp;
50624+
50625+ if (!rlast) {
50626+ rtmp->prev = NULL;
50627+ rolep->transitions = rtmp;
50628+ } else {
50629+ rlast->next = rtmp;
50630+ rtmp->prev = rlast;
50631+ }
50632+
50633+ if (!rusertp)
50634+ rtmp->next = NULL;
50635+ }
50636+
50637+ return 0;
50638+}
50639+
50640+static struct acl_subject_label *
50641+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
50642+{
50643+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
50644+ unsigned int len;
50645+ char *tmp;
50646+ __u32 num_objs;
50647+ struct acl_ip_label **i_tmp, *i_utmp2;
50648+ struct gr_hash_struct ghash;
50649+ struct subject_map *subjmap;
50650+ unsigned int i_num;
50651+ int err;
50652+
50653+ s_tmp = lookup_subject_map(userp);
50654+
50655+ /* we've already copied this subject into the kernel, just return
50656+ the reference to it, and don't copy it over again
50657+ */
50658+ if (s_tmp)
50659+ return(s_tmp);
50660+
50661+ if ((s_tmp = (struct acl_subject_label *)
50662+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
50663+ return ERR_PTR(-ENOMEM);
50664+
50665+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
50666+ if (subjmap == NULL)
50667+ return ERR_PTR(-ENOMEM);
50668+
50669+ subjmap->user = userp;
50670+ subjmap->kernel = s_tmp;
50671+ insert_subj_map_entry(subjmap);
50672+
50673+ if (copy_from_user(s_tmp, userp,
50674+ sizeof (struct acl_subject_label)))
50675+ return ERR_PTR(-EFAULT);
50676+
50677+ len = strnlen_user(s_tmp->filename, PATH_MAX);
50678+
50679+ if (!len || len >= PATH_MAX)
50680+ return ERR_PTR(-EINVAL);
50681+
50682+ if ((tmp = (char *) acl_alloc(len)) == NULL)
50683+ return ERR_PTR(-ENOMEM);
50684+
50685+ if (copy_from_user(tmp, s_tmp->filename, len))
50686+ return ERR_PTR(-EFAULT);
50687+ tmp[len-1] = '\0';
50688+ s_tmp->filename = tmp;
50689+
50690+ if (!strcmp(s_tmp->filename, "/"))
50691+ role->root_label = s_tmp;
50692+
50693+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
50694+ return ERR_PTR(-EFAULT);
50695+
50696+ /* copy user and group transition tables */
50697+
50698+ if (s_tmp->user_trans_num) {
50699+ uid_t *uidlist;
50700+
50701+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
50702+ if (uidlist == NULL)
50703+ return ERR_PTR(-ENOMEM);
50704+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
50705+ return ERR_PTR(-EFAULT);
50706+
50707+ s_tmp->user_transitions = uidlist;
50708+ }
50709+
50710+ if (s_tmp->group_trans_num) {
50711+ gid_t *gidlist;
50712+
50713+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
50714+ if (gidlist == NULL)
50715+ return ERR_PTR(-ENOMEM);
50716+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
50717+ return ERR_PTR(-EFAULT);
50718+
50719+ s_tmp->group_transitions = gidlist;
50720+ }
50721+
50722+ /* set up object hash table */
50723+ num_objs = count_user_objs(ghash.first);
50724+
50725+ s_tmp->obj_hash_size = num_objs;
50726+ s_tmp->obj_hash =
50727+ (struct acl_object_label **)
50728+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
50729+
50730+ if (!s_tmp->obj_hash)
50731+ return ERR_PTR(-ENOMEM);
50732+
50733+ memset(s_tmp->obj_hash, 0,
50734+ s_tmp->obj_hash_size *
50735+ sizeof (struct acl_object_label *));
50736+
50737+ /* add in objects */
50738+ err = copy_user_objs(ghash.first, s_tmp, role);
50739+
50740+ if (err)
50741+ return ERR_PTR(err);
50742+
50743+ /* set pointer for parent subject */
50744+ if (s_tmp->parent_subject) {
50745+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
50746+
50747+ if (IS_ERR(s_tmp2))
50748+ return s_tmp2;
50749+
50750+ s_tmp->parent_subject = s_tmp2;
50751+ }
50752+
50753+ /* add in ip acls */
50754+
50755+ if (!s_tmp->ip_num) {
50756+ s_tmp->ips = NULL;
50757+ goto insert;
50758+ }
50759+
50760+ i_tmp =
50761+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
50762+ sizeof (struct acl_ip_label *));
50763+
50764+ if (!i_tmp)
50765+ return ERR_PTR(-ENOMEM);
50766+
50767+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
50768+ *(i_tmp + i_num) =
50769+ (struct acl_ip_label *)
50770+ acl_alloc(sizeof (struct acl_ip_label));
50771+ if (!*(i_tmp + i_num))
50772+ return ERR_PTR(-ENOMEM);
50773+
50774+ if (copy_from_user
50775+ (&i_utmp2, s_tmp->ips + i_num,
50776+ sizeof (struct acl_ip_label *)))
50777+ return ERR_PTR(-EFAULT);
50778+
50779+ if (copy_from_user
50780+ (*(i_tmp + i_num), i_utmp2,
50781+ sizeof (struct acl_ip_label)))
50782+ return ERR_PTR(-EFAULT);
50783+
50784+ if ((*(i_tmp + i_num))->iface == NULL)
50785+ continue;
50786+
50787+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
50788+ if (!len || len >= IFNAMSIZ)
50789+ return ERR_PTR(-EINVAL);
50790+ tmp = acl_alloc(len);
50791+ if (tmp == NULL)
50792+ return ERR_PTR(-ENOMEM);
50793+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
50794+ return ERR_PTR(-EFAULT);
50795+ (*(i_tmp + i_num))->iface = tmp;
50796+ }
50797+
50798+ s_tmp->ips = i_tmp;
50799+
50800+insert:
50801+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
50802+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
50803+ return ERR_PTR(-ENOMEM);
50804+
50805+ return s_tmp;
50806+}
50807+
50808+static int
50809+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
50810+{
50811+ struct acl_subject_label s_pre;
50812+ struct acl_subject_label * ret;
50813+ int err;
50814+
50815+ while (userp) {
50816+ if (copy_from_user(&s_pre, userp,
50817+ sizeof (struct acl_subject_label)))
50818+ return -EFAULT;
50819+
50820+ /* do not add nested subjects here, add
50821+ while parsing objects
50822+ */
50823+
50824+ if (s_pre.mode & GR_NESTED) {
50825+ userp = s_pre.prev;
50826+ continue;
50827+ }
50828+
50829+ ret = do_copy_user_subj(userp, role);
50830+
50831+ err = PTR_ERR(ret);
50832+ if (IS_ERR(ret))
50833+ return err;
50834+
50835+ insert_acl_subj_label(ret, role);
50836+
50837+ userp = s_pre.prev;
50838+ }
50839+
50840+ return 0;
50841+}
50842+
50843+static int
50844+copy_user_acl(struct gr_arg *arg)
50845+{
50846+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
50847+ struct sprole_pw *sptmp;
50848+ struct gr_hash_struct *ghash;
50849+ uid_t *domainlist;
50850+ unsigned int r_num;
50851+ unsigned int len;
50852+ char *tmp;
50853+ int err = 0;
50854+ __u16 i;
50855+ __u32 num_subjs;
50856+
50857+ /* we need a default and kernel role */
50858+ if (arg->role_db.num_roles < 2)
50859+ return -EINVAL;
50860+
50861+ /* copy special role authentication info from userspace */
50862+
50863+ num_sprole_pws = arg->num_sprole_pws;
50864+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
50865+
50866+ if (!acl_special_roles) {
50867+ err = -ENOMEM;
50868+ goto cleanup;
50869+ }
50870+
50871+ for (i = 0; i < num_sprole_pws; i++) {
50872+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
50873+ if (!sptmp) {
50874+ err = -ENOMEM;
50875+ goto cleanup;
50876+ }
50877+ if (copy_from_user(sptmp, arg->sprole_pws + i,
50878+ sizeof (struct sprole_pw))) {
50879+ err = -EFAULT;
50880+ goto cleanup;
50881+ }
50882+
50883+ len =
50884+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
50885+
50886+ if (!len || len >= GR_SPROLE_LEN) {
50887+ err = -EINVAL;
50888+ goto cleanup;
50889+ }
50890+
50891+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
50892+ err = -ENOMEM;
50893+ goto cleanup;
50894+ }
50895+
50896+ if (copy_from_user(tmp, sptmp->rolename, len)) {
50897+ err = -EFAULT;
50898+ goto cleanup;
50899+ }
50900+ tmp[len-1] = '\0';
50901+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50902+ printk(KERN_ALERT "Copying special role %s\n", tmp);
50903+#endif
50904+ sptmp->rolename = tmp;
50905+ acl_special_roles[i] = sptmp;
50906+ }
50907+
50908+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
50909+
50910+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
50911+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
50912+
50913+ if (!r_tmp) {
50914+ err = -ENOMEM;
50915+ goto cleanup;
50916+ }
50917+
50918+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
50919+ sizeof (struct acl_role_label *))) {
50920+ err = -EFAULT;
50921+ goto cleanup;
50922+ }
50923+
50924+ if (copy_from_user(r_tmp, r_utmp2,
50925+ sizeof (struct acl_role_label))) {
50926+ err = -EFAULT;
50927+ goto cleanup;
50928+ }
50929+
50930+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
50931+
50932+ if (!len || len >= PATH_MAX) {
50933+ err = -EINVAL;
50934+ goto cleanup;
50935+ }
50936+
50937+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
50938+ err = -ENOMEM;
50939+ goto cleanup;
50940+ }
50941+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
50942+ err = -EFAULT;
50943+ goto cleanup;
50944+ }
50945+ tmp[len-1] = '\0';
50946+ r_tmp->rolename = tmp;
50947+
50948+ if (!strcmp(r_tmp->rolename, "default")
50949+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
50950+ default_role = r_tmp;
50951+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
50952+ kernel_role = r_tmp;
50953+ }
50954+
50955+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
50956+ err = -ENOMEM;
50957+ goto cleanup;
50958+ }
50959+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
50960+ err = -EFAULT;
50961+ goto cleanup;
50962+ }
50963+
50964+ r_tmp->hash = ghash;
50965+
50966+ num_subjs = count_user_subjs(r_tmp->hash->first);
50967+
50968+ r_tmp->subj_hash_size = num_subjs;
50969+ r_tmp->subj_hash =
50970+ (struct acl_subject_label **)
50971+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
50972+
50973+ if (!r_tmp->subj_hash) {
50974+ err = -ENOMEM;
50975+ goto cleanup;
50976+ }
50977+
50978+ err = copy_user_allowedips(r_tmp);
50979+ if (err)
50980+ goto cleanup;
50981+
50982+ /* copy domain info */
50983+ if (r_tmp->domain_children != NULL) {
50984+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
50985+ if (domainlist == NULL) {
50986+ err = -ENOMEM;
50987+ goto cleanup;
50988+ }
50989+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
50990+ err = -EFAULT;
50991+ goto cleanup;
50992+ }
50993+ r_tmp->domain_children = domainlist;
50994+ }
50995+
50996+ err = copy_user_transitions(r_tmp);
50997+ if (err)
50998+ goto cleanup;
50999+
51000+ memset(r_tmp->subj_hash, 0,
51001+ r_tmp->subj_hash_size *
51002+ sizeof (struct acl_subject_label *));
51003+
51004+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
51005+
51006+ if (err)
51007+ goto cleanup;
51008+
51009+ /* set nested subject list to null */
51010+ r_tmp->hash->first = NULL;
51011+
51012+ insert_acl_role_label(r_tmp);
51013+ }
51014+
51015+ goto return_err;
51016+ cleanup:
51017+ free_variables();
51018+ return_err:
51019+ return err;
51020+
51021+}
51022+
51023+static int
51024+gracl_init(struct gr_arg *args)
51025+{
51026+ int error = 0;
51027+
51028+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
51029+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
51030+
51031+ if (init_variables(args)) {
51032+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
51033+ error = -ENOMEM;
51034+ free_variables();
51035+ goto out;
51036+ }
51037+
51038+ error = copy_user_acl(args);
51039+ free_init_variables();
51040+ if (error) {
51041+ free_variables();
51042+ goto out;
51043+ }
51044+
51045+ if ((error = gr_set_acls(0))) {
51046+ free_variables();
51047+ goto out;
51048+ }
51049+
51050+ pax_open_kernel();
51051+ gr_status |= GR_READY;
51052+ pax_close_kernel();
51053+
51054+ out:
51055+ return error;
51056+}
51057+
51058+/* derived from glibc fnmatch() 0: match, 1: no match*/
51059+
51060+static int
51061+glob_match(const char *p, const char *n)
51062+{
51063+ char c;
51064+
51065+ while ((c = *p++) != '\0') {
51066+ switch (c) {
51067+ case '?':
51068+ if (*n == '\0')
51069+ return 1;
51070+ else if (*n == '/')
51071+ return 1;
51072+ break;
51073+ case '\\':
51074+ if (*n != c)
51075+ return 1;
51076+ break;
51077+ case '*':
51078+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
51079+ if (*n == '/')
51080+ return 1;
51081+ else if (c == '?') {
51082+ if (*n == '\0')
51083+ return 1;
51084+ else
51085+ ++n;
51086+ }
51087+ }
51088+ if (c == '\0') {
51089+ return 0;
51090+ } else {
51091+ const char *endp;
51092+
51093+ if ((endp = strchr(n, '/')) == NULL)
51094+ endp = n + strlen(n);
51095+
51096+ if (c == '[') {
51097+ for (--p; n < endp; ++n)
51098+ if (!glob_match(p, n))
51099+ return 0;
51100+ } else if (c == '/') {
51101+ while (*n != '\0' && *n != '/')
51102+ ++n;
51103+ if (*n == '/' && !glob_match(p, n + 1))
51104+ return 0;
51105+ } else {
51106+ for (--p; n < endp; ++n)
51107+ if (*n == c && !glob_match(p, n))
51108+ return 0;
51109+ }
51110+
51111+ return 1;
51112+ }
51113+ case '[':
51114+ {
51115+ int not;
51116+ char cold;
51117+
51118+ if (*n == '\0' || *n == '/')
51119+ return 1;
51120+
51121+ not = (*p == '!' || *p == '^');
51122+ if (not)
51123+ ++p;
51124+
51125+ c = *p++;
51126+ for (;;) {
51127+ unsigned char fn = (unsigned char)*n;
51128+
51129+ if (c == '\0')
51130+ return 1;
51131+ else {
51132+ if (c == fn)
51133+ goto matched;
51134+ cold = c;
51135+ c = *p++;
51136+
51137+ if (c == '-' && *p != ']') {
51138+ unsigned char cend = *p++;
51139+
51140+ if (cend == '\0')
51141+ return 1;
51142+
51143+ if (cold <= fn && fn <= cend)
51144+ goto matched;
51145+
51146+ c = *p++;
51147+ }
51148+ }
51149+
51150+ if (c == ']')
51151+ break;
51152+ }
51153+ if (!not)
51154+ return 1;
51155+ break;
51156+ matched:
51157+ while (c != ']') {
51158+ if (c == '\0')
51159+ return 1;
51160+
51161+ c = *p++;
51162+ }
51163+ if (not)
51164+ return 1;
51165+ }
51166+ break;
51167+ default:
51168+ if (c != *n)
51169+ return 1;
51170+ }
51171+
51172+ ++n;
51173+ }
51174+
51175+ if (*n == '\0')
51176+ return 0;
51177+
51178+ if (*n == '/')
51179+ return 0;
51180+
51181+ return 1;
51182+}
51183+
51184+static struct acl_object_label *
51185+chk_glob_label(struct acl_object_label *globbed,
51186+ struct dentry *dentry, struct vfsmount *mnt, char **path)
51187+{
51188+ struct acl_object_label *tmp;
51189+
51190+ if (*path == NULL)
51191+ *path = gr_to_filename_nolock(dentry, mnt);
51192+
51193+ tmp = globbed;
51194+
51195+ while (tmp) {
51196+ if (!glob_match(tmp->filename, *path))
51197+ return tmp;
51198+ tmp = tmp->next;
51199+ }
51200+
51201+ return NULL;
51202+}
51203+
51204+static struct acl_object_label *
51205+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
51206+ const ino_t curr_ino, const dev_t curr_dev,
51207+ const struct acl_subject_label *subj, char **path, const int checkglob)
51208+{
51209+ struct acl_subject_label *tmpsubj;
51210+ struct acl_object_label *retval;
51211+ struct acl_object_label *retval2;
51212+
51213+ tmpsubj = (struct acl_subject_label *) subj;
51214+ read_lock(&gr_inode_lock);
51215+ do {
51216+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
51217+ if (retval) {
51218+ if (checkglob && retval->globbed) {
51219+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
51220+ (struct vfsmount *)orig_mnt, path);
51221+ if (retval2)
51222+ retval = retval2;
51223+ }
51224+ break;
51225+ }
51226+ } while ((tmpsubj = tmpsubj->parent_subject));
51227+ read_unlock(&gr_inode_lock);
51228+
51229+ return retval;
51230+}
51231+
51232+static __inline__ struct acl_object_label *
51233+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
51234+ const struct dentry *curr_dentry,
51235+ const struct acl_subject_label *subj, char **path, const int checkglob)
51236+{
51237+ int newglob = checkglob;
51238+
51239+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
51240+ as we don't want a / * rule to match instead of the / object
51241+ don't do this for create lookups that call this function though, since they're looking up
51242+ on the parent and thus need globbing checks on all paths
51243+ */
51244+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
51245+ newglob = GR_NO_GLOB;
51246+
51247+ return __full_lookup(orig_dentry, orig_mnt,
51248+ curr_dentry->d_inode->i_ino,
51249+ __get_dev(curr_dentry), subj, path, newglob);
51250+}
51251+
51252+static struct acl_object_label *
51253+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
51254+ const struct acl_subject_label *subj, char *path, const int checkglob)
51255+{
51256+ struct dentry *dentry = (struct dentry *) l_dentry;
51257+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
51258+ struct acl_object_label *retval;
51259+
51260+ spin_lock(&dcache_lock);
51261+ spin_lock(&vfsmount_lock);
51262+
51263+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
51264+#ifdef CONFIG_NET
51265+ mnt == sock_mnt ||
51266+#endif
51267+#ifdef CONFIG_HUGETLBFS
51268+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
51269+#endif
51270+ /* ignore Eric Biederman */
51271+ IS_PRIVATE(l_dentry->d_inode))) {
51272+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
51273+ goto out;
51274+ }
51275+
51276+ for (;;) {
51277+ if (dentry == real_root && mnt == real_root_mnt)
51278+ break;
51279+
51280+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
51281+ if (mnt->mnt_parent == mnt)
51282+ break;
51283+
51284+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
51285+ if (retval != NULL)
51286+ goto out;
51287+
51288+ dentry = mnt->mnt_mountpoint;
51289+ mnt = mnt->mnt_parent;
51290+ continue;
51291+ }
51292+
51293+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
51294+ if (retval != NULL)
51295+ goto out;
51296+
51297+ dentry = dentry->d_parent;
51298+ }
51299+
51300+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
51301+
51302+ if (retval == NULL)
51303+ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
51304+out:
51305+ spin_unlock(&vfsmount_lock);
51306+ spin_unlock(&dcache_lock);
51307+
51308+ BUG_ON(retval == NULL);
51309+
51310+ return retval;
51311+}
51312+
51313+static __inline__ struct acl_object_label *
51314+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
51315+ const struct acl_subject_label *subj)
51316+{
51317+ char *path = NULL;
51318+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
51319+}
51320+
51321+static __inline__ struct acl_object_label *
51322+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
51323+ const struct acl_subject_label *subj)
51324+{
51325+ char *path = NULL;
51326+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
51327+}
51328+
51329+static __inline__ struct acl_object_label *
51330+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
51331+ const struct acl_subject_label *subj, char *path)
51332+{
51333+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
51334+}
51335+
51336+static struct acl_subject_label *
51337+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
51338+ const struct acl_role_label *role)
51339+{
51340+ struct dentry *dentry = (struct dentry *) l_dentry;
51341+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
51342+ struct acl_subject_label *retval;
51343+
51344+ spin_lock(&dcache_lock);
51345+ spin_lock(&vfsmount_lock);
51346+
51347+ for (;;) {
51348+ if (dentry == real_root && mnt == real_root_mnt)
51349+ break;
51350+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
51351+ if (mnt->mnt_parent == mnt)
51352+ break;
51353+
51354+ read_lock(&gr_inode_lock);
51355+ retval =
51356+ lookup_acl_subj_label(dentry->d_inode->i_ino,
51357+ __get_dev(dentry), role);
51358+ read_unlock(&gr_inode_lock);
51359+ if (retval != NULL)
51360+ goto out;
51361+
51362+ dentry = mnt->mnt_mountpoint;
51363+ mnt = mnt->mnt_parent;
51364+ continue;
51365+ }
51366+
51367+ read_lock(&gr_inode_lock);
51368+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
51369+ __get_dev(dentry), role);
51370+ read_unlock(&gr_inode_lock);
51371+ if (retval != NULL)
51372+ goto out;
51373+
51374+ dentry = dentry->d_parent;
51375+ }
51376+
51377+ read_lock(&gr_inode_lock);
51378+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
51379+ __get_dev(dentry), role);
51380+ read_unlock(&gr_inode_lock);
51381+
51382+ if (unlikely(retval == NULL)) {
51383+ read_lock(&gr_inode_lock);
51384+ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
51385+ __get_dev(real_root), role);
51386+ read_unlock(&gr_inode_lock);
51387+ }
51388+out:
51389+ spin_unlock(&vfsmount_lock);
51390+ spin_unlock(&dcache_lock);
51391+
51392+ BUG_ON(retval == NULL);
51393+
51394+ return retval;
51395+}
51396+
51397+static void
51398+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
51399+{
51400+ struct task_struct *task = current;
51401+ const struct cred *cred = current_cred();
51402+
51403+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
51404+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
51405+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
51406+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
51407+
51408+ return;
51409+}
51410+
51411+static void
51412+gr_log_learn_sysctl(const char *path, const __u32 mode)
51413+{
51414+ struct task_struct *task = current;
51415+ const struct cred *cred = current_cred();
51416+
51417+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
51418+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
51419+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
51420+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
51421+
51422+ return;
51423+}
51424+
51425+static void
51426+gr_log_learn_id_change(const char type, const unsigned int real,
51427+ const unsigned int effective, const unsigned int fs)
51428+{
51429+ struct task_struct *task = current;
51430+ const struct cred *cred = current_cred();
51431+
51432+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
51433+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
51434+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
51435+ type, real, effective, fs, &task->signal->saved_ip);
51436+
51437+ return;
51438+}
51439+
51440+__u32
51441+gr_check_link(const struct dentry * new_dentry,
51442+ const struct dentry * parent_dentry,
51443+ const struct vfsmount * parent_mnt,
51444+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
51445+{
51446+ struct acl_object_label *obj;
51447+ __u32 oldmode, newmode;
51448+ __u32 needmode;
51449+
51450+ if (unlikely(!(gr_status & GR_READY)))
51451+ return (GR_CREATE | GR_LINK);
51452+
51453+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
51454+ oldmode = obj->mode;
51455+
51456+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
51457+ oldmode |= (GR_CREATE | GR_LINK);
51458+
51459+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
51460+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
51461+ needmode |= GR_SETID | GR_AUDIT_SETID;
51462+
51463+ newmode =
51464+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
51465+ oldmode | needmode);
51466+
51467+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
51468+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
51469+ GR_INHERIT | GR_AUDIT_INHERIT);
51470+
51471+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
51472+ goto bad;
51473+
51474+ if ((oldmode & needmode) != needmode)
51475+ goto bad;
51476+
51477+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
51478+ if ((newmode & needmode) != needmode)
51479+ goto bad;
51480+
51481+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
51482+ return newmode;
51483+bad:
51484+ needmode = oldmode;
51485+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
51486+ needmode |= GR_SETID;
51487+
51488+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
51489+ gr_log_learn(old_dentry, old_mnt, needmode);
51490+ return (GR_CREATE | GR_LINK);
51491+ } else if (newmode & GR_SUPPRESS)
51492+ return GR_SUPPRESS;
51493+ else
51494+ return 0;
51495+}
51496+
51497+__u32
51498+gr_search_file(const struct dentry * dentry, const __u32 mode,
51499+ const struct vfsmount * mnt)
51500+{
51501+ __u32 retval = mode;
51502+ struct acl_subject_label *curracl;
51503+ struct acl_object_label *currobj;
51504+
51505+ if (unlikely(!(gr_status & GR_READY)))
51506+ return (mode & ~GR_AUDITS);
51507+
51508+ curracl = current->acl;
51509+
51510+ currobj = chk_obj_label(dentry, mnt, curracl);
51511+ retval = currobj->mode & mode;
51512+
51513+ /* if we're opening a specified transfer file for writing
51514+ (e.g. /dev/initctl), then transfer our role to init
51515+ */
51516+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
51517+ current->role->roletype & GR_ROLE_PERSIST)) {
51518+ struct task_struct *task = init_pid_ns.child_reaper;
51519+
51520+ if (task->role != current->role) {
51521+ task->acl_sp_role = 0;
51522+ task->acl_role_id = current->acl_role_id;
51523+ task->role = current->role;
51524+ rcu_read_lock();
51525+ read_lock(&grsec_exec_file_lock);
51526+ gr_apply_subject_to_task(task);
51527+ read_unlock(&grsec_exec_file_lock);
51528+ rcu_read_unlock();
51529+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
51530+ }
51531+ }
51532+
51533+ if (unlikely
51534+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
51535+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
51536+ __u32 new_mode = mode;
51537+
51538+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
51539+
51540+ retval = new_mode;
51541+
51542+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
51543+ new_mode |= GR_INHERIT;
51544+
51545+ if (!(mode & GR_NOLEARN))
51546+ gr_log_learn(dentry, mnt, new_mode);
51547+ }
51548+
51549+ return retval;
51550+}
51551+
51552+__u32
51553+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
51554+ const struct vfsmount * mnt, const __u32 mode)
51555+{
51556+ struct name_entry *match;
51557+ struct acl_object_label *matchpo;
51558+ struct acl_subject_label *curracl;
51559+ char *path;
51560+ __u32 retval;
51561+
51562+ if (unlikely(!(gr_status & GR_READY)))
51563+ return (mode & ~GR_AUDITS);
51564+
51565+ preempt_disable();
51566+ path = gr_to_filename_rbac(new_dentry, mnt);
51567+ match = lookup_name_entry_create(path);
51568+
51569+ if (!match)
51570+ goto check_parent;
51571+
51572+ curracl = current->acl;
51573+
51574+ read_lock(&gr_inode_lock);
51575+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
51576+ read_unlock(&gr_inode_lock);
51577+
51578+ if (matchpo) {
51579+ if ((matchpo->mode & mode) !=
51580+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
51581+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
51582+ __u32 new_mode = mode;
51583+
51584+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
51585+
51586+ gr_log_learn(new_dentry, mnt, new_mode);
51587+
51588+ preempt_enable();
51589+ return new_mode;
51590+ }
51591+ preempt_enable();
51592+ return (matchpo->mode & mode);
51593+ }
51594+
51595+ check_parent:
51596+ curracl = current->acl;
51597+
51598+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
51599+ retval = matchpo->mode & mode;
51600+
51601+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
51602+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
51603+ __u32 new_mode = mode;
51604+
51605+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
51606+
51607+ gr_log_learn(new_dentry, mnt, new_mode);
51608+ preempt_enable();
51609+ return new_mode;
51610+ }
51611+
51612+ preempt_enable();
51613+ return retval;
51614+}
51615+
51616+int
51617+gr_check_hidden_task(const struct task_struct *task)
51618+{
51619+ if (unlikely(!(gr_status & GR_READY)))
51620+ return 0;
51621+
51622+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
51623+ return 1;
51624+
51625+ return 0;
51626+}
51627+
51628+int
51629+gr_check_protected_task(const struct task_struct *task)
51630+{
51631+ if (unlikely(!(gr_status & GR_READY) || !task))
51632+ return 0;
51633+
51634+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
51635+ task->acl != current->acl)
51636+ return 1;
51637+
51638+ return 0;
51639+}
51640+
51641+int
51642+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
51643+{
51644+ struct task_struct *p;
51645+ int ret = 0;
51646+
51647+ if (unlikely(!(gr_status & GR_READY) || !pid))
51648+ return ret;
51649+
51650+ read_lock(&tasklist_lock);
51651+ do_each_pid_task(pid, type, p) {
51652+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
51653+ p->acl != current->acl) {
51654+ ret = 1;
51655+ goto out;
51656+ }
51657+ } while_each_pid_task(pid, type, p);
51658+out:
51659+ read_unlock(&tasklist_lock);
51660+
51661+ return ret;
51662+}
51663+
51664+void
51665+gr_copy_label(struct task_struct *tsk)
51666+{
51667+ tsk->signal->used_accept = 0;
51668+ tsk->acl_sp_role = 0;
51669+ tsk->acl_role_id = current->acl_role_id;
51670+ tsk->acl = current->acl;
51671+ tsk->role = current->role;
51672+ tsk->signal->curr_ip = current->signal->curr_ip;
51673+ tsk->signal->saved_ip = current->signal->saved_ip;
51674+ if (current->exec_file)
51675+ get_file(current->exec_file);
51676+ tsk->exec_file = current->exec_file;
51677+ tsk->is_writable = current->is_writable;
51678+ if (unlikely(current->signal->used_accept)) {
51679+ current->signal->curr_ip = 0;
51680+ current->signal->saved_ip = 0;
51681+ }
51682+
51683+ return;
51684+}
51685+
51686+static void
51687+gr_set_proc_res(struct task_struct *task)
51688+{
51689+ struct acl_subject_label *proc;
51690+ unsigned short i;
51691+
51692+ proc = task->acl;
51693+
51694+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
51695+ return;
51696+
51697+ for (i = 0; i < RLIM_NLIMITS; i++) {
51698+ if (!(proc->resmask & (1 << i)))
51699+ continue;
51700+
51701+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
51702+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
51703+ }
51704+
51705+ return;
51706+}
51707+
51708+extern int __gr_process_user_ban(struct user_struct *user);
51709+
51710+int
51711+gr_check_user_change(int real, int effective, int fs)
51712+{
51713+ unsigned int i;
51714+ __u16 num;
51715+ uid_t *uidlist;
51716+ int curuid;
51717+ int realok = 0;
51718+ int effectiveok = 0;
51719+ int fsok = 0;
51720+
51721+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
51722+ struct user_struct *user;
51723+
51724+ if (real == -1)
51725+ goto skipit;
51726+
51727+ user = find_user(real);
51728+ if (user == NULL)
51729+ goto skipit;
51730+
51731+ if (__gr_process_user_ban(user)) {
51732+ /* for find_user */
51733+ free_uid(user);
51734+ return 1;
51735+ }
51736+
51737+ /* for find_user */
51738+ free_uid(user);
51739+
51740+skipit:
51741+#endif
51742+
51743+ if (unlikely(!(gr_status & GR_READY)))
51744+ return 0;
51745+
51746+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
51747+ gr_log_learn_id_change('u', real, effective, fs);
51748+
51749+ num = current->acl->user_trans_num;
51750+ uidlist = current->acl->user_transitions;
51751+
51752+ if (uidlist == NULL)
51753+ return 0;
51754+
51755+ if (real == -1)
51756+ realok = 1;
51757+ if (effective == -1)
51758+ effectiveok = 1;
51759+ if (fs == -1)
51760+ fsok = 1;
51761+
51762+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
51763+ for (i = 0; i < num; i++) {
51764+ curuid = (int)uidlist[i];
51765+ if (real == curuid)
51766+ realok = 1;
51767+ if (effective == curuid)
51768+ effectiveok = 1;
51769+ if (fs == curuid)
51770+ fsok = 1;
51771+ }
51772+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
51773+ for (i = 0; i < num; i++) {
51774+ curuid = (int)uidlist[i];
51775+ if (real == curuid)
51776+ break;
51777+ if (effective == curuid)
51778+ break;
51779+ if (fs == curuid)
51780+ break;
51781+ }
51782+ /* not in deny list */
51783+ if (i == num) {
51784+ realok = 1;
51785+ effectiveok = 1;
51786+ fsok = 1;
51787+ }
51788+ }
51789+
51790+ if (realok && effectiveok && fsok)
51791+ return 0;
51792+ else {
51793+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
51794+ return 1;
51795+ }
51796+}
51797+
51798+int
51799+gr_check_group_change(int real, int effective, int fs)
51800+{
51801+ unsigned int i;
51802+ __u16 num;
51803+ gid_t *gidlist;
51804+ int curgid;
51805+ int realok = 0;
51806+ int effectiveok = 0;
51807+ int fsok = 0;
51808+
51809+ if (unlikely(!(gr_status & GR_READY)))
51810+ return 0;
51811+
51812+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
51813+ gr_log_learn_id_change('g', real, effective, fs);
51814+
51815+ num = current->acl->group_trans_num;
51816+ gidlist = current->acl->group_transitions;
51817+
51818+ if (gidlist == NULL)
51819+ return 0;
51820+
51821+ if (real == -1)
51822+ realok = 1;
51823+ if (effective == -1)
51824+ effectiveok = 1;
51825+ if (fs == -1)
51826+ fsok = 1;
51827+
51828+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
51829+ for (i = 0; i < num; i++) {
51830+ curgid = (int)gidlist[i];
51831+ if (real == curgid)
51832+ realok = 1;
51833+ if (effective == curgid)
51834+ effectiveok = 1;
51835+ if (fs == curgid)
51836+ fsok = 1;
51837+ }
51838+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
51839+ for (i = 0; i < num; i++) {
51840+ curgid = (int)gidlist[i];
51841+ if (real == curgid)
51842+ break;
51843+ if (effective == curgid)
51844+ break;
51845+ if (fs == curgid)
51846+ break;
51847+ }
51848+ /* not in deny list */
51849+ if (i == num) {
51850+ realok = 1;
51851+ effectiveok = 1;
51852+ fsok = 1;
51853+ }
51854+ }
51855+
51856+ if (realok && effectiveok && fsok)
51857+ return 0;
51858+ else {
51859+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
51860+ return 1;
51861+ }
51862+}
51863+
51864+void
51865+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
51866+{
51867+ struct acl_role_label *role = task->role;
51868+ struct acl_subject_label *subj = NULL;
51869+ struct acl_object_label *obj;
51870+ struct file *filp;
51871+
51872+ if (unlikely(!(gr_status & GR_READY)))
51873+ return;
51874+
51875+ filp = task->exec_file;
51876+
51877+ /* kernel process, we'll give them the kernel role */
51878+ if (unlikely(!filp)) {
51879+ task->role = kernel_role;
51880+ task->acl = kernel_role->root_label;
51881+ return;
51882+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
51883+ role = lookup_acl_role_label(task, uid, gid);
51884+
51885+ /* perform subject lookup in possibly new role
51886+ we can use this result below in the case where role == task->role
51887+ */
51888+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
51889+
51890+ /* if we changed uid/gid, but result in the same role
51891+ and are using inheritance, don't lose the inherited subject
51892+ if current subject is other than what normal lookup
51893+ would result in, we arrived via inheritance, don't
51894+ lose subject
51895+ */
51896+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
51897+ (subj == task->acl)))
51898+ task->acl = subj;
51899+
51900+ task->role = role;
51901+
51902+ task->is_writable = 0;
51903+
51904+ /* ignore additional mmap checks for processes that are writable
51905+ by the default ACL */
51906+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
51907+ if (unlikely(obj->mode & GR_WRITE))
51908+ task->is_writable = 1;
51909+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
51910+ if (unlikely(obj->mode & GR_WRITE))
51911+ task->is_writable = 1;
51912+
51913+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51914+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
51915+#endif
51916+
51917+ gr_set_proc_res(task);
51918+
51919+ return;
51920+}
51921+
51922+int
51923+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
51924+ const int unsafe_share)
51925+{
51926+ struct task_struct *task = current;
51927+ struct acl_subject_label *newacl;
51928+ struct acl_object_label *obj;
51929+ __u32 retmode;
51930+
51931+ if (unlikely(!(gr_status & GR_READY)))
51932+ return 0;
51933+
51934+ newacl = chk_subj_label(dentry, mnt, task->role);
51935+
51936+ task_lock(task);
51937+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
51938+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
51939+ !(task->role->roletype & GR_ROLE_GOD) &&
51940+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
51941+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
51942+ task_unlock(task);
51943+ if (unsafe_share)
51944+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
51945+ else
51946+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
51947+ return -EACCES;
51948+ }
51949+ task_unlock(task);
51950+
51951+ obj = chk_obj_label(dentry, mnt, task->acl);
51952+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
51953+
51954+ if (!(task->acl->mode & GR_INHERITLEARN) &&
51955+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
51956+ if (obj->nested)
51957+ task->acl = obj->nested;
51958+ else
51959+ task->acl = newacl;
51960+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
51961+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
51962+
51963+ task->is_writable = 0;
51964+
51965+ /* ignore additional mmap checks for processes that are writable
51966+ by the default ACL */
51967+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
51968+ if (unlikely(obj->mode & GR_WRITE))
51969+ task->is_writable = 1;
51970+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
51971+ if (unlikely(obj->mode & GR_WRITE))
51972+ task->is_writable = 1;
51973+
51974+ gr_set_proc_res(task);
51975+
51976+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51977+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
51978+#endif
51979+ return 0;
51980+}
51981+
51982+/* always called with valid inodev ptr */
51983+static void
51984+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
51985+{
51986+ struct acl_object_label *matchpo;
51987+ struct acl_subject_label *matchps;
51988+ struct acl_subject_label *subj;
51989+ struct acl_role_label *role;
51990+ unsigned int x;
51991+
51992+ FOR_EACH_ROLE_START(role)
51993+ FOR_EACH_SUBJECT_START(role, subj, x)
51994+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
51995+ matchpo->mode |= GR_DELETED;
51996+ FOR_EACH_SUBJECT_END(subj,x)
51997+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
51998+ if (subj->inode == ino && subj->device == dev)
51999+ subj->mode |= GR_DELETED;
52000+ FOR_EACH_NESTED_SUBJECT_END(subj)
52001+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
52002+ matchps->mode |= GR_DELETED;
52003+ FOR_EACH_ROLE_END(role)
52004+
52005+ inodev->nentry->deleted = 1;
52006+
52007+ return;
52008+}
52009+
52010+void
52011+gr_handle_delete(const ino_t ino, const dev_t dev)
52012+{
52013+ struct inodev_entry *inodev;
52014+
52015+ if (unlikely(!(gr_status & GR_READY)))
52016+ return;
52017+
52018+ write_lock(&gr_inode_lock);
52019+ inodev = lookup_inodev_entry(ino, dev);
52020+ if (inodev != NULL)
52021+ do_handle_delete(inodev, ino, dev);
52022+ write_unlock(&gr_inode_lock);
52023+
52024+ return;
52025+}
52026+
52027+static void
52028+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
52029+ const ino_t newinode, const dev_t newdevice,
52030+ struct acl_subject_label *subj)
52031+{
52032+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
52033+ struct acl_object_label *match;
52034+
52035+ match = subj->obj_hash[index];
52036+
52037+ while (match && (match->inode != oldinode ||
52038+ match->device != olddevice ||
52039+ !(match->mode & GR_DELETED)))
52040+ match = match->next;
52041+
52042+ if (match && (match->inode == oldinode)
52043+ && (match->device == olddevice)
52044+ && (match->mode & GR_DELETED)) {
52045+ if (match->prev == NULL) {
52046+ subj->obj_hash[index] = match->next;
52047+ if (match->next != NULL)
52048+ match->next->prev = NULL;
52049+ } else {
52050+ match->prev->next = match->next;
52051+ if (match->next != NULL)
52052+ match->next->prev = match->prev;
52053+ }
52054+ match->prev = NULL;
52055+ match->next = NULL;
52056+ match->inode = newinode;
52057+ match->device = newdevice;
52058+ match->mode &= ~GR_DELETED;
52059+
52060+ insert_acl_obj_label(match, subj);
52061+ }
52062+
52063+ return;
52064+}
52065+
52066+static void
52067+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
52068+ const ino_t newinode, const dev_t newdevice,
52069+ struct acl_role_label *role)
52070+{
52071+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
52072+ struct acl_subject_label *match;
52073+
52074+ match = role->subj_hash[index];
52075+
52076+ while (match && (match->inode != oldinode ||
52077+ match->device != olddevice ||
52078+ !(match->mode & GR_DELETED)))
52079+ match = match->next;
52080+
52081+ if (match && (match->inode == oldinode)
52082+ && (match->device == olddevice)
52083+ && (match->mode & GR_DELETED)) {
52084+ if (match->prev == NULL) {
52085+ role->subj_hash[index] = match->next;
52086+ if (match->next != NULL)
52087+ match->next->prev = NULL;
52088+ } else {
52089+ match->prev->next = match->next;
52090+ if (match->next != NULL)
52091+ match->next->prev = match->prev;
52092+ }
52093+ match->prev = NULL;
52094+ match->next = NULL;
52095+ match->inode = newinode;
52096+ match->device = newdevice;
52097+ match->mode &= ~GR_DELETED;
52098+
52099+ insert_acl_subj_label(match, role);
52100+ }
52101+
52102+ return;
52103+}
52104+
52105+static void
52106+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
52107+ const ino_t newinode, const dev_t newdevice)
52108+{
52109+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
52110+ struct inodev_entry *match;
52111+
52112+ match = inodev_set.i_hash[index];
52113+
52114+ while (match && (match->nentry->inode != oldinode ||
52115+ match->nentry->device != olddevice || !match->nentry->deleted))
52116+ match = match->next;
52117+
52118+ if (match && (match->nentry->inode == oldinode)
52119+ && (match->nentry->device == olddevice) &&
52120+ match->nentry->deleted) {
52121+ if (match->prev == NULL) {
52122+ inodev_set.i_hash[index] = match->next;
52123+ if (match->next != NULL)
52124+ match->next->prev = NULL;
52125+ } else {
52126+ match->prev->next = match->next;
52127+ if (match->next != NULL)
52128+ match->next->prev = match->prev;
52129+ }
52130+ match->prev = NULL;
52131+ match->next = NULL;
52132+ match->nentry->inode = newinode;
52133+ match->nentry->device = newdevice;
52134+ match->nentry->deleted = 0;
52135+
52136+ insert_inodev_entry(match);
52137+ }
52138+
52139+ return;
52140+}
52141+
52142+static void
52143+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
52144+ const struct vfsmount *mnt)
52145+{
52146+ struct acl_subject_label *subj;
52147+ struct acl_role_label *role;
52148+ unsigned int x;
52149+ ino_t inode = dentry->d_inode->i_ino;
52150+ dev_t dev = __get_dev(dentry);
52151+
52152+ FOR_EACH_ROLE_START(role)
52153+ update_acl_subj_label(matchn->inode, matchn->device,
52154+ inode, dev, role);
52155+
52156+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
52157+ if ((subj->inode == inode) && (subj->device == dev)) {
52158+ subj->inode = inode;
52159+ subj->device = dev;
52160+ }
52161+ FOR_EACH_NESTED_SUBJECT_END(subj)
52162+ FOR_EACH_SUBJECT_START(role, subj, x)
52163+ update_acl_obj_label(matchn->inode, matchn->device,
52164+ inode, dev, subj);
52165+ FOR_EACH_SUBJECT_END(subj,x)
52166+ FOR_EACH_ROLE_END(role)
52167+
52168+ update_inodev_entry(matchn->inode, matchn->device, inode, dev);
52169+
52170+ return;
52171+}
52172+
52173+void
52174+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
52175+{
52176+ struct name_entry *matchn;
52177+
52178+ if (unlikely(!(gr_status & GR_READY)))
52179+ return;
52180+
52181+ preempt_disable();
52182+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
52183+
52184+ if (unlikely((unsigned long)matchn)) {
52185+ write_lock(&gr_inode_lock);
52186+ do_handle_create(matchn, dentry, mnt);
52187+ write_unlock(&gr_inode_lock);
52188+ }
52189+ preempt_enable();
52190+
52191+ return;
52192+}
52193+
52194+void
52195+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
52196+ struct dentry *old_dentry,
52197+ struct dentry *new_dentry,
52198+ struct vfsmount *mnt, const __u8 replace)
52199+{
52200+ struct name_entry *matchn;
52201+ struct inodev_entry *inodev;
52202+ ino_t oldinode = old_dentry->d_inode->i_ino;
52203+ dev_t olddev = __get_dev(old_dentry);
52204+
52205+ /* vfs_rename swaps the name and parent link for old_dentry and
52206+ new_dentry
52207+ at this point, old_dentry has the new name, parent link, and inode
52208+ for the renamed file
52209+ if a file is being replaced by a rename, new_dentry has the inode
52210+ and name for the replaced file
52211+ */
52212+
52213+ if (unlikely(!(gr_status & GR_READY)))
52214+ return;
52215+
52216+ preempt_disable();
52217+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
52218+
52219+ /* we wouldn't have to check d_inode if it weren't for
52220+ NFS silly-renaming
52221+ */
52222+
52223+ write_lock(&gr_inode_lock);
52224+ if (unlikely(replace && new_dentry->d_inode)) {
52225+ ino_t newinode = new_dentry->d_inode->i_ino;
52226+ dev_t newdev = __get_dev(new_dentry);
52227+ inodev = lookup_inodev_entry(newinode, newdev);
52228+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
52229+ do_handle_delete(inodev, newinode, newdev);
52230+ }
52231+
52232+ inodev = lookup_inodev_entry(oldinode, olddev);
52233+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
52234+ do_handle_delete(inodev, oldinode, olddev);
52235+
52236+ if (unlikely((unsigned long)matchn))
52237+ do_handle_create(matchn, old_dentry, mnt);
52238+
52239+ write_unlock(&gr_inode_lock);
52240+ preempt_enable();
52241+
52242+ return;
52243+}
52244+
52245+static int
52246+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
52247+ unsigned char **sum)
52248+{
52249+ struct acl_role_label *r;
52250+ struct role_allowed_ip *ipp;
52251+ struct role_transition *trans;
52252+ unsigned int i;
52253+ int found = 0;
52254+ u32 curr_ip = current->signal->curr_ip;
52255+
52256+ current->signal->saved_ip = curr_ip;
52257+
52258+ /* check transition table */
52259+
52260+ for (trans = current->role->transitions; trans; trans = trans->next) {
52261+ if (!strcmp(rolename, trans->rolename)) {
52262+ found = 1;
52263+ break;
52264+ }
52265+ }
52266+
52267+ if (!found)
52268+ return 0;
52269+
52270+ /* handle special roles that do not require authentication
52271+ and check ip */
52272+
52273+ FOR_EACH_ROLE_START(r)
52274+ if (!strcmp(rolename, r->rolename) &&
52275+ (r->roletype & GR_ROLE_SPECIAL)) {
52276+ found = 0;
52277+ if (r->allowed_ips != NULL) {
52278+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
52279+ if ((ntohl(curr_ip) & ipp->netmask) ==
52280+ (ntohl(ipp->addr) & ipp->netmask))
52281+ found = 1;
52282+ }
52283+ } else
52284+ found = 2;
52285+ if (!found)
52286+ return 0;
52287+
52288+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
52289+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
52290+ *salt = NULL;
52291+ *sum = NULL;
52292+ return 1;
52293+ }
52294+ }
52295+ FOR_EACH_ROLE_END(r)
52296+
52297+ for (i = 0; i < num_sprole_pws; i++) {
52298+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
52299+ *salt = acl_special_roles[i]->salt;
52300+ *sum = acl_special_roles[i]->sum;
52301+ return 1;
52302+ }
52303+ }
52304+
52305+ return 0;
52306+}
52307+
52308+static void
52309+assign_special_role(char *rolename)
52310+{
52311+ struct acl_object_label *obj;
52312+ struct acl_role_label *r;
52313+ struct acl_role_label *assigned = NULL;
52314+ struct task_struct *tsk;
52315+ struct file *filp;
52316+
52317+ FOR_EACH_ROLE_START(r)
52318+ if (!strcmp(rolename, r->rolename) &&
52319+ (r->roletype & GR_ROLE_SPECIAL)) {
52320+ assigned = r;
52321+ break;
52322+ }
52323+ FOR_EACH_ROLE_END(r)
52324+
52325+ if (!assigned)
52326+ return;
52327+
52328+ read_lock(&tasklist_lock);
52329+ read_lock(&grsec_exec_file_lock);
52330+
52331+ tsk = current->real_parent;
52332+ if (tsk == NULL)
52333+ goto out_unlock;
52334+
52335+ filp = tsk->exec_file;
52336+ if (filp == NULL)
52337+ goto out_unlock;
52338+
52339+ tsk->is_writable = 0;
52340+
52341+ tsk->acl_sp_role = 1;
52342+ tsk->acl_role_id = ++acl_sp_role_value;
52343+ tsk->role = assigned;
52344+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
52345+
52346+ /* ignore additional mmap checks for processes that are writable
52347+ by the default ACL */
52348+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
52349+ if (unlikely(obj->mode & GR_WRITE))
52350+ tsk->is_writable = 1;
52351+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
52352+ if (unlikely(obj->mode & GR_WRITE))
52353+ tsk->is_writable = 1;
52354+
52355+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52356+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
52357+#endif
52358+
52359+out_unlock:
52360+ read_unlock(&grsec_exec_file_lock);
52361+ read_unlock(&tasklist_lock);
52362+ return;
52363+}
52364+
52365+int gr_check_secure_terminal(struct task_struct *task)
52366+{
52367+ struct task_struct *p, *p2, *p3;
52368+ struct files_struct *files;
52369+ struct fdtable *fdt;
52370+ struct file *our_file = NULL, *file;
52371+ int i;
52372+
52373+ if (task->signal->tty == NULL)
52374+ return 1;
52375+
52376+ files = get_files_struct(task);
52377+ if (files != NULL) {
52378+ rcu_read_lock();
52379+ fdt = files_fdtable(files);
52380+ for (i=0; i < fdt->max_fds; i++) {
52381+ file = fcheck_files(files, i);
52382+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
52383+ get_file(file);
52384+ our_file = file;
52385+ }
52386+ }
52387+ rcu_read_unlock();
52388+ put_files_struct(files);
52389+ }
52390+
52391+ if (our_file == NULL)
52392+ return 1;
52393+
52394+ read_lock(&tasklist_lock);
52395+ do_each_thread(p2, p) {
52396+ files = get_files_struct(p);
52397+ if (files == NULL ||
52398+ (p->signal && p->signal->tty == task->signal->tty)) {
52399+ if (files != NULL)
52400+ put_files_struct(files);
52401+ continue;
52402+ }
52403+ rcu_read_lock();
52404+ fdt = files_fdtable(files);
52405+ for (i=0; i < fdt->max_fds; i++) {
52406+ file = fcheck_files(files, i);
52407+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
52408+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
52409+ p3 = task;
52410+ while (p3->pid > 0) {
52411+ if (p3 == p)
52412+ break;
52413+ p3 = p3->real_parent;
52414+ }
52415+ if (p3 == p)
52416+ break;
52417+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
52418+ gr_handle_alertkill(p);
52419+ rcu_read_unlock();
52420+ put_files_struct(files);
52421+ read_unlock(&tasklist_lock);
52422+ fput(our_file);
52423+ return 0;
52424+ }
52425+ }
52426+ rcu_read_unlock();
52427+ put_files_struct(files);
52428+ } while_each_thread(p2, p);
52429+ read_unlock(&tasklist_lock);
52430+
52431+ fput(our_file);
52432+ return 1;
52433+}
52434+
52435+ssize_t
52436+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
52437+{
52438+ struct gr_arg_wrapper uwrap;
52439+ unsigned char *sprole_salt = NULL;
52440+ unsigned char *sprole_sum = NULL;
52441+ int error = sizeof (struct gr_arg_wrapper);
52442+ int error2 = 0;
52443+
52444+ mutex_lock(&gr_dev_mutex);
52445+
52446+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
52447+ error = -EPERM;
52448+ goto out;
52449+ }
52450+
52451+ if (count != sizeof (struct gr_arg_wrapper)) {
52452+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
52453+ error = -EINVAL;
52454+ goto out;
52455+ }
52456+
52457+
52458+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
52459+ gr_auth_expires = 0;
52460+ gr_auth_attempts = 0;
52461+ }
52462+
52463+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
52464+ error = -EFAULT;
52465+ goto out;
52466+ }
52467+
52468+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
52469+ error = -EINVAL;
52470+ goto out;
52471+ }
52472+
52473+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
52474+ error = -EFAULT;
52475+ goto out;
52476+ }
52477+
52478+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
52479+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
52480+ time_after(gr_auth_expires, get_seconds())) {
52481+ error = -EBUSY;
52482+ goto out;
52483+ }
52484+
52485+ /* if non-root trying to do anything other than use a special role,
52486+ do not attempt authentication, do not count towards authentication
52487+ locking
52488+ */
52489+
52490+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
52491+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
52492+ current_uid()) {
52493+ error = -EPERM;
52494+ goto out;
52495+ }
52496+
52497+ /* ensure pw and special role name are null terminated */
52498+
52499+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
52500+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
52501+
52502+ /* Okay.
52503+ * We have our enough of the argument structure..(we have yet
52504+ * to copy_from_user the tables themselves) . Copy the tables
52505+ * only if we need them, i.e. for loading operations. */
52506+
52507+ switch (gr_usermode->mode) {
52508+ case GR_STATUS:
52509+ if (gr_status & GR_READY) {
52510+ error = 1;
52511+ if (!gr_check_secure_terminal(current))
52512+ error = 3;
52513+ } else
52514+ error = 2;
52515+ goto out;
52516+ case GR_SHUTDOWN:
52517+ if ((gr_status & GR_READY)
52518+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
52519+ pax_open_kernel();
52520+ gr_status &= ~GR_READY;
52521+ pax_close_kernel();
52522+
52523+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
52524+ free_variables();
52525+ memset(gr_usermode, 0, sizeof (struct gr_arg));
52526+ memset(gr_system_salt, 0, GR_SALT_LEN);
52527+ memset(gr_system_sum, 0, GR_SHA_LEN);
52528+ } else if (gr_status & GR_READY) {
52529+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
52530+ error = -EPERM;
52531+ } else {
52532+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
52533+ error = -EAGAIN;
52534+ }
52535+ break;
52536+ case GR_ENABLE:
52537+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
52538+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
52539+ else {
52540+ if (gr_status & GR_READY)
52541+ error = -EAGAIN;
52542+ else
52543+ error = error2;
52544+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
52545+ }
52546+ break;
52547+ case GR_RELOAD:
52548+ if (!(gr_status & GR_READY)) {
52549+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
52550+ error = -EAGAIN;
52551+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
52552+ lock_kernel();
52553+
52554+ pax_open_kernel();
52555+ gr_status &= ~GR_READY;
52556+ pax_close_kernel();
52557+
52558+ free_variables();
52559+ if (!(error2 = gracl_init(gr_usermode))) {
52560+ unlock_kernel();
52561+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
52562+ } else {
52563+ unlock_kernel();
52564+ error = error2;
52565+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
52566+ }
52567+ } else {
52568+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
52569+ error = -EPERM;
52570+ }
52571+ break;
52572+ case GR_SEGVMOD:
52573+ if (unlikely(!(gr_status & GR_READY))) {
52574+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
52575+ error = -EAGAIN;
52576+ break;
52577+ }
52578+
52579+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
52580+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
52581+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
52582+ struct acl_subject_label *segvacl;
52583+ segvacl =
52584+ lookup_acl_subj_label(gr_usermode->segv_inode,
52585+ gr_usermode->segv_device,
52586+ current->role);
52587+ if (segvacl) {
52588+ segvacl->crashes = 0;
52589+ segvacl->expires = 0;
52590+ }
52591+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
52592+ gr_remove_uid(gr_usermode->segv_uid);
52593+ }
52594+ } else {
52595+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
52596+ error = -EPERM;
52597+ }
52598+ break;
52599+ case GR_SPROLE:
52600+ case GR_SPROLEPAM:
52601+ if (unlikely(!(gr_status & GR_READY))) {
52602+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
52603+ error = -EAGAIN;
52604+ break;
52605+ }
52606+
52607+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
52608+ current->role->expires = 0;
52609+ current->role->auth_attempts = 0;
52610+ }
52611+
52612+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
52613+ time_after(current->role->expires, get_seconds())) {
52614+ error = -EBUSY;
52615+ goto out;
52616+ }
52617+
52618+ if (lookup_special_role_auth
52619+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
52620+ && ((!sprole_salt && !sprole_sum)
52621+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
52622+ char *p = "";
52623+ assign_special_role(gr_usermode->sp_role);
52624+ read_lock(&tasklist_lock);
52625+ if (current->real_parent)
52626+ p = current->real_parent->role->rolename;
52627+ read_unlock(&tasklist_lock);
52628+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
52629+ p, acl_sp_role_value);
52630+ } else {
52631+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
52632+ error = -EPERM;
52633+ if(!(current->role->auth_attempts++))
52634+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
52635+
52636+ goto out;
52637+ }
52638+ break;
52639+ case GR_UNSPROLE:
52640+ if (unlikely(!(gr_status & GR_READY))) {
52641+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
52642+ error = -EAGAIN;
52643+ break;
52644+ }
52645+
52646+ if (current->role->roletype & GR_ROLE_SPECIAL) {
52647+ char *p = "";
52648+ int i = 0;
52649+
52650+ read_lock(&tasklist_lock);
52651+ if (current->real_parent) {
52652+ p = current->real_parent->role->rolename;
52653+ i = current->real_parent->acl_role_id;
52654+ }
52655+ read_unlock(&tasklist_lock);
52656+
52657+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
52658+ gr_set_acls(1);
52659+ } else {
52660+ error = -EPERM;
52661+ goto out;
52662+ }
52663+ break;
52664+ default:
52665+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
52666+ error = -EINVAL;
52667+ break;
52668+ }
52669+
52670+ if (error != -EPERM)
52671+ goto out;
52672+
52673+ if(!(gr_auth_attempts++))
52674+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
52675+
52676+ out:
52677+ mutex_unlock(&gr_dev_mutex);
52678+ return error;
52679+}
52680+
52681+/* must be called with
52682+ rcu_read_lock();
52683+ read_lock(&tasklist_lock);
52684+ read_lock(&grsec_exec_file_lock);
52685+*/
52686+int gr_apply_subject_to_task(struct task_struct *task)
52687+{
52688+ struct acl_object_label *obj;
52689+ char *tmpname;
52690+ struct acl_subject_label *tmpsubj;
52691+ struct file *filp;
52692+ struct name_entry *nmatch;
52693+
52694+ filp = task->exec_file;
52695+ if (filp == NULL)
52696+ return 0;
52697+
52698+ /* the following is to apply the correct subject
52699+ on binaries running when the RBAC system
52700+ is enabled, when the binaries have been
52701+ replaced or deleted since their execution
52702+ -----
52703+ when the RBAC system starts, the inode/dev
52704+ from exec_file will be one the RBAC system
52705+ is unaware of. It only knows the inode/dev
52706+ of the present file on disk, or the absence
52707+ of it.
52708+ */
52709+ preempt_disable();
52710+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
52711+
52712+ nmatch = lookup_name_entry(tmpname);
52713+ preempt_enable();
52714+ tmpsubj = NULL;
52715+ if (nmatch) {
52716+ if (nmatch->deleted)
52717+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
52718+ else
52719+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
52720+ if (tmpsubj != NULL)
52721+ task->acl = tmpsubj;
52722+ }
52723+ if (tmpsubj == NULL)
52724+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
52725+ task->role);
52726+ if (task->acl) {
52727+ task->is_writable = 0;
52728+ /* ignore additional mmap checks for processes that are writable
52729+ by the default ACL */
52730+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
52731+ if (unlikely(obj->mode & GR_WRITE))
52732+ task->is_writable = 1;
52733+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
52734+ if (unlikely(obj->mode & GR_WRITE))
52735+ task->is_writable = 1;
52736+
52737+ gr_set_proc_res(task);
52738+
52739+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52740+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
52741+#endif
52742+ } else {
52743+ return 1;
52744+ }
52745+
52746+ return 0;
52747+}
52748+
52749+int
52750+gr_set_acls(const int type)
52751+{
52752+ struct task_struct *task, *task2;
52753+ struct acl_role_label *role = current->role;
52754+ __u16 acl_role_id = current->acl_role_id;
52755+ const struct cred *cred;
52756+ int ret;
52757+
52758+ rcu_read_lock();
52759+ read_lock(&tasklist_lock);
52760+ read_lock(&grsec_exec_file_lock);
52761+ do_each_thread(task2, task) {
52762+ /* check to see if we're called from the exit handler,
52763+ if so, only replace ACLs that have inherited the admin
52764+ ACL */
52765+
52766+ if (type && (task->role != role ||
52767+ task->acl_role_id != acl_role_id))
52768+ continue;
52769+
52770+ task->acl_role_id = 0;
52771+ task->acl_sp_role = 0;
52772+
52773+ if (task->exec_file) {
52774+ cred = __task_cred(task);
52775+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
52776+
52777+ ret = gr_apply_subject_to_task(task);
52778+ if (ret) {
52779+ read_unlock(&grsec_exec_file_lock);
52780+ read_unlock(&tasklist_lock);
52781+ rcu_read_unlock();
52782+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
52783+ return ret;
52784+ }
52785+ } else {
52786+ // it's a kernel process
52787+ task->role = kernel_role;
52788+ task->acl = kernel_role->root_label;
52789+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
52790+ task->acl->mode &= ~GR_PROCFIND;
52791+#endif
52792+ }
52793+ } while_each_thread(task2, task);
52794+ read_unlock(&grsec_exec_file_lock);
52795+ read_unlock(&tasklist_lock);
52796+ rcu_read_unlock();
52797+
52798+ return 0;
52799+}
52800+
52801+void
52802+gr_learn_resource(const struct task_struct *task,
52803+ const int res, const unsigned long wanted, const int gt)
52804+{
52805+ struct acl_subject_label *acl;
52806+ const struct cred *cred;
52807+
52808+ if (unlikely((gr_status & GR_READY) &&
52809+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
52810+ goto skip_reslog;
52811+
52812+#ifdef CONFIG_GRKERNSEC_RESLOG
52813+ gr_log_resource(task, res, wanted, gt);
52814+#endif
52815+ skip_reslog:
52816+
52817+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
52818+ return;
52819+
52820+ acl = task->acl;
52821+
52822+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
52823+ !(acl->resmask & (1 << (unsigned short) res))))
52824+ return;
52825+
52826+ if (wanted >= acl->res[res].rlim_cur) {
52827+ unsigned long res_add;
52828+
52829+ res_add = wanted;
52830+ switch (res) {
52831+ case RLIMIT_CPU:
52832+ res_add += GR_RLIM_CPU_BUMP;
52833+ break;
52834+ case RLIMIT_FSIZE:
52835+ res_add += GR_RLIM_FSIZE_BUMP;
52836+ break;
52837+ case RLIMIT_DATA:
52838+ res_add += GR_RLIM_DATA_BUMP;
52839+ break;
52840+ case RLIMIT_STACK:
52841+ res_add += GR_RLIM_STACK_BUMP;
52842+ break;
52843+ case RLIMIT_CORE:
52844+ res_add += GR_RLIM_CORE_BUMP;
52845+ break;
52846+ case RLIMIT_RSS:
52847+ res_add += GR_RLIM_RSS_BUMP;
52848+ break;
52849+ case RLIMIT_NPROC:
52850+ res_add += GR_RLIM_NPROC_BUMP;
52851+ break;
52852+ case RLIMIT_NOFILE:
52853+ res_add += GR_RLIM_NOFILE_BUMP;
52854+ break;
52855+ case RLIMIT_MEMLOCK:
52856+ res_add += GR_RLIM_MEMLOCK_BUMP;
52857+ break;
52858+ case RLIMIT_AS:
52859+ res_add += GR_RLIM_AS_BUMP;
52860+ break;
52861+ case RLIMIT_LOCKS:
52862+ res_add += GR_RLIM_LOCKS_BUMP;
52863+ break;
52864+ case RLIMIT_SIGPENDING:
52865+ res_add += GR_RLIM_SIGPENDING_BUMP;
52866+ break;
52867+ case RLIMIT_MSGQUEUE:
52868+ res_add += GR_RLIM_MSGQUEUE_BUMP;
52869+ break;
52870+ case RLIMIT_NICE:
52871+ res_add += GR_RLIM_NICE_BUMP;
52872+ break;
52873+ case RLIMIT_RTPRIO:
52874+ res_add += GR_RLIM_RTPRIO_BUMP;
52875+ break;
52876+ case RLIMIT_RTTIME:
52877+ res_add += GR_RLIM_RTTIME_BUMP;
52878+ break;
52879+ }
52880+
52881+ acl->res[res].rlim_cur = res_add;
52882+
52883+ if (wanted > acl->res[res].rlim_max)
52884+ acl->res[res].rlim_max = res_add;
52885+
52886+ /* only log the subject filename, since resource logging is supported for
52887+ single-subject learning only */
52888+ rcu_read_lock();
52889+ cred = __task_cred(task);
52890+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
52891+ task->role->roletype, cred->uid, cred->gid, acl->filename,
52892+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
52893+ "", (unsigned long) res, &task->signal->saved_ip);
52894+ rcu_read_unlock();
52895+ }
52896+
52897+ return;
52898+}
52899+
52900+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
52901+void
52902+pax_set_initial_flags(struct linux_binprm *bprm)
52903+{
52904+ struct task_struct *task = current;
52905+ struct acl_subject_label *proc;
52906+ unsigned long flags;
52907+
52908+ if (unlikely(!(gr_status & GR_READY)))
52909+ return;
52910+
52911+ flags = pax_get_flags(task);
52912+
52913+ proc = task->acl;
52914+
52915+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
52916+ flags &= ~MF_PAX_PAGEEXEC;
52917+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
52918+ flags &= ~MF_PAX_SEGMEXEC;
52919+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
52920+ flags &= ~MF_PAX_RANDMMAP;
52921+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
52922+ flags &= ~MF_PAX_EMUTRAMP;
52923+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
52924+ flags &= ~MF_PAX_MPROTECT;
52925+
52926+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
52927+ flags |= MF_PAX_PAGEEXEC;
52928+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
52929+ flags |= MF_PAX_SEGMEXEC;
52930+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
52931+ flags |= MF_PAX_RANDMMAP;
52932+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
52933+ flags |= MF_PAX_EMUTRAMP;
52934+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
52935+ flags |= MF_PAX_MPROTECT;
52936+
52937+ pax_set_flags(task, flags);
52938+
52939+ return;
52940+}
52941+#endif
52942+
52943+#ifdef CONFIG_SYSCTL
52944+/* Eric Biederman likes breaking userland ABI and every inode-based security
52945+ system to save 35kb of memory */
52946+
52947+/* we modify the passed in filename, but adjust it back before returning */
52948+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
52949+{
52950+ struct name_entry *nmatch;
52951+ char *p, *lastp = NULL;
52952+ struct acl_object_label *obj = NULL, *tmp;
52953+ struct acl_subject_label *tmpsubj;
52954+ char c = '\0';
52955+
52956+ read_lock(&gr_inode_lock);
52957+
52958+ p = name + len - 1;
52959+ do {
52960+ nmatch = lookup_name_entry(name);
52961+ if (lastp != NULL)
52962+ *lastp = c;
52963+
52964+ if (nmatch == NULL)
52965+ goto next_component;
52966+ tmpsubj = current->acl;
52967+ do {
52968+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
52969+ if (obj != NULL) {
52970+ tmp = obj->globbed;
52971+ while (tmp) {
52972+ if (!glob_match(tmp->filename, name)) {
52973+ obj = tmp;
52974+ goto found_obj;
52975+ }
52976+ tmp = tmp->next;
52977+ }
52978+ goto found_obj;
52979+ }
52980+ } while ((tmpsubj = tmpsubj->parent_subject));
52981+next_component:
52982+ /* end case */
52983+ if (p == name)
52984+ break;
52985+
52986+ while (*p != '/')
52987+ p--;
52988+ if (p == name)
52989+ lastp = p + 1;
52990+ else {
52991+ lastp = p;
52992+ p--;
52993+ }
52994+ c = *lastp;
52995+ *lastp = '\0';
52996+ } while (1);
52997+found_obj:
52998+ read_unlock(&gr_inode_lock);
52999+ /* obj returned will always be non-null */
53000+ return obj;
53001+}
53002+
53003+/* returns 0 when allowing, non-zero on error
53004+ op of 0 is used for readdir, so we don't log the names of hidden files
53005+*/
53006+__u32
53007+gr_handle_sysctl(const struct ctl_table *table, const int op)
53008+{
53009+ ctl_table *tmp;
53010+ const char *proc_sys = "/proc/sys";
53011+ char *path;
53012+ struct acl_object_label *obj;
53013+ unsigned short len = 0, pos = 0, depth = 0, i;
53014+ __u32 err = 0;
53015+ __u32 mode = 0;
53016+
53017+ if (unlikely(!(gr_status & GR_READY)))
53018+ return 0;
53019+
53020+ /* for now, ignore operations on non-sysctl entries if it's not a
53021+ readdir*/
53022+ if (table->child != NULL && op != 0)
53023+ return 0;
53024+
53025+ mode |= GR_FIND;
53026+ /* it's only a read if it's an entry, read on dirs is for readdir */
53027+ if (op & MAY_READ)
53028+ mode |= GR_READ;
53029+ if (op & MAY_WRITE)
53030+ mode |= GR_WRITE;
53031+
53032+ preempt_disable();
53033+
53034+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
53035+
53036+ /* it's only a read/write if it's an actual entry, not a dir
53037+ (which are opened for readdir)
53038+ */
53039+
53040+ /* convert the requested sysctl entry into a pathname */
53041+
53042+ for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
53043+ len += strlen(tmp->procname);
53044+ len++;
53045+ depth++;
53046+ }
53047+
53048+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
53049+ /* deny */
53050+ goto out;
53051+ }
53052+
53053+ memset(path, 0, PAGE_SIZE);
53054+
53055+ memcpy(path, proc_sys, strlen(proc_sys));
53056+
53057+ pos += strlen(proc_sys);
53058+
53059+ for (; depth > 0; depth--) {
53060+ path[pos] = '/';
53061+ pos++;
53062+ for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
53063+ if (depth == i) {
53064+ memcpy(path + pos, tmp->procname,
53065+ strlen(tmp->procname));
53066+ pos += strlen(tmp->procname);
53067+ }
53068+ i++;
53069+ }
53070+ }
53071+
53072+ obj = gr_lookup_by_name(path, pos);
53073+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
53074+
53075+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
53076+ ((err & mode) != mode))) {
53077+ __u32 new_mode = mode;
53078+
53079+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53080+
53081+ err = 0;
53082+ gr_log_learn_sysctl(path, new_mode);
53083+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
53084+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
53085+ err = -ENOENT;
53086+ } else if (!(err & GR_FIND)) {
53087+ err = -ENOENT;
53088+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
53089+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
53090+ path, (mode & GR_READ) ? " reading" : "",
53091+ (mode & GR_WRITE) ? " writing" : "");
53092+ err = -EACCES;
53093+ } else if ((err & mode) != mode) {
53094+ err = -EACCES;
53095+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
53096+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
53097+ path, (mode & GR_READ) ? " reading" : "",
53098+ (mode & GR_WRITE) ? " writing" : "");
53099+ err = 0;
53100+ } else
53101+ err = 0;
53102+
53103+ out:
53104+ preempt_enable();
53105+
53106+ return err;
53107+}
53108+#endif
53109+
53110+int
53111+gr_handle_proc_ptrace(struct task_struct *task)
53112+{
53113+ struct file *filp;
53114+ struct task_struct *tmp = task;
53115+ struct task_struct *curtemp = current;
53116+ __u32 retmode;
53117+
53118+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
53119+ if (unlikely(!(gr_status & GR_READY)))
53120+ return 0;
53121+#endif
53122+
53123+ read_lock(&tasklist_lock);
53124+ read_lock(&grsec_exec_file_lock);
53125+ filp = task->exec_file;
53126+
53127+ while (tmp->pid > 0) {
53128+ if (tmp == curtemp)
53129+ break;
53130+ tmp = tmp->real_parent;
53131+ }
53132+
53133+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
53134+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
53135+ read_unlock(&grsec_exec_file_lock);
53136+ read_unlock(&tasklist_lock);
53137+ return 1;
53138+ }
53139+
53140+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
53141+ if (!(gr_status & GR_READY)) {
53142+ read_unlock(&grsec_exec_file_lock);
53143+ read_unlock(&tasklist_lock);
53144+ return 0;
53145+ }
53146+#endif
53147+
53148+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
53149+ read_unlock(&grsec_exec_file_lock);
53150+ read_unlock(&tasklist_lock);
53151+
53152+ if (retmode & GR_NOPTRACE)
53153+ return 1;
53154+
53155+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
53156+ && (current->acl != task->acl || (current->acl != current->role->root_label
53157+ && current->pid != task->pid)))
53158+ return 1;
53159+
53160+ return 0;
53161+}
53162+
53163+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
53164+{
53165+ if (unlikely(!(gr_status & GR_READY)))
53166+ return;
53167+
53168+ if (!(current->role->roletype & GR_ROLE_GOD))
53169+ return;
53170+
53171+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
53172+ p->role->rolename, gr_task_roletype_to_char(p),
53173+ p->acl->filename);
53174+}
53175+
53176+int
53177+gr_handle_ptrace(struct task_struct *task, const long request)
53178+{
53179+ struct task_struct *tmp = task;
53180+ struct task_struct *curtemp = current;
53181+ __u32 retmode;
53182+
53183+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
53184+ if (unlikely(!(gr_status & GR_READY)))
53185+ return 0;
53186+#endif
53187+
53188+ read_lock(&tasklist_lock);
53189+ while (tmp->pid > 0) {
53190+ if (tmp == curtemp)
53191+ break;
53192+ tmp = tmp->real_parent;
53193+ }
53194+
53195+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
53196+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
53197+ read_unlock(&tasklist_lock);
53198+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
53199+ return 1;
53200+ }
53201+ read_unlock(&tasklist_lock);
53202+
53203+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
53204+ if (!(gr_status & GR_READY))
53205+ return 0;
53206+#endif
53207+
53208+ read_lock(&grsec_exec_file_lock);
53209+ if (unlikely(!task->exec_file)) {
53210+ read_unlock(&grsec_exec_file_lock);
53211+ return 0;
53212+ }
53213+
53214+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
53215+ read_unlock(&grsec_exec_file_lock);
53216+
53217+ if (retmode & GR_NOPTRACE) {
53218+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
53219+ return 1;
53220+ }
53221+
53222+ if (retmode & GR_PTRACERD) {
53223+ switch (request) {
53224+ case PTRACE_POKETEXT:
53225+ case PTRACE_POKEDATA:
53226+ case PTRACE_POKEUSR:
53227+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
53228+ case PTRACE_SETREGS:
53229+ case PTRACE_SETFPREGS:
53230+#endif
53231+#ifdef CONFIG_X86
53232+ case PTRACE_SETFPXREGS:
53233+#endif
53234+#ifdef CONFIG_ALTIVEC
53235+ case PTRACE_SETVRREGS:
53236+#endif
53237+ return 1;
53238+ default:
53239+ return 0;
53240+ }
53241+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
53242+ !(current->role->roletype & GR_ROLE_GOD) &&
53243+ (current->acl != task->acl)) {
53244+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
53245+ return 1;
53246+ }
53247+
53248+ return 0;
53249+}
53250+
53251+static int is_writable_mmap(const struct file *filp)
53252+{
53253+ struct task_struct *task = current;
53254+ struct acl_object_label *obj, *obj2;
53255+
53256+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
53257+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
53258+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53259+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
53260+ task->role->root_label);
53261+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
53262+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
53263+ return 1;
53264+ }
53265+ }
53266+ return 0;
53267+}
53268+
53269+int
53270+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
53271+{
53272+ __u32 mode;
53273+
53274+ if (unlikely(!file || !(prot & PROT_EXEC)))
53275+ return 1;
53276+
53277+ if (is_writable_mmap(file))
53278+ return 0;
53279+
53280+ mode =
53281+ gr_search_file(file->f_path.dentry,
53282+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
53283+ file->f_path.mnt);
53284+
53285+ if (!gr_tpe_allow(file))
53286+ return 0;
53287+
53288+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
53289+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
53290+ return 0;
53291+ } else if (unlikely(!(mode & GR_EXEC))) {
53292+ return 0;
53293+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
53294+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
53295+ return 1;
53296+ }
53297+
53298+ return 1;
53299+}
53300+
53301+int
53302+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
53303+{
53304+ __u32 mode;
53305+
53306+ if (unlikely(!file || !(prot & PROT_EXEC)))
53307+ return 1;
53308+
53309+ if (is_writable_mmap(file))
53310+ return 0;
53311+
53312+ mode =
53313+ gr_search_file(file->f_path.dentry,
53314+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
53315+ file->f_path.mnt);
53316+
53317+ if (!gr_tpe_allow(file))
53318+ return 0;
53319+
53320+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
53321+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
53322+ return 0;
53323+ } else if (unlikely(!(mode & GR_EXEC))) {
53324+ return 0;
53325+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
53326+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
53327+ return 1;
53328+ }
53329+
53330+ return 1;
53331+}
53332+
53333+void
53334+gr_acl_handle_psacct(struct task_struct *task, const long code)
53335+{
53336+ unsigned long runtime;
53337+ unsigned long cputime;
53338+ unsigned int wday, cday;
53339+ __u8 whr, chr;
53340+ __u8 wmin, cmin;
53341+ __u8 wsec, csec;
53342+ struct timespec timeval;
53343+
53344+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
53345+ !(task->acl->mode & GR_PROCACCT)))
53346+ return;
53347+
53348+ do_posix_clock_monotonic_gettime(&timeval);
53349+ runtime = timeval.tv_sec - task->start_time.tv_sec;
53350+ wday = runtime / (3600 * 24);
53351+ runtime -= wday * (3600 * 24);
53352+ whr = runtime / 3600;
53353+ runtime -= whr * 3600;
53354+ wmin = runtime / 60;
53355+ runtime -= wmin * 60;
53356+ wsec = runtime;
53357+
53358+ cputime = (task->utime + task->stime) / HZ;
53359+ cday = cputime / (3600 * 24);
53360+ cputime -= cday * (3600 * 24);
53361+ chr = cputime / 3600;
53362+ cputime -= chr * 3600;
53363+ cmin = cputime / 60;
53364+ cputime -= cmin * 60;
53365+ csec = cputime;
53366+
53367+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
53368+
53369+ return;
53370+}
53371+
53372+void gr_set_kernel_label(struct task_struct *task)
53373+{
53374+ if (gr_status & GR_READY) {
53375+ task->role = kernel_role;
53376+ task->acl = kernel_role->root_label;
53377+ }
53378+ return;
53379+}
53380+
53381+#ifdef CONFIG_TASKSTATS
53382+int gr_is_taskstats_denied(int pid)
53383+{
53384+ struct task_struct *task;
53385+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
53386+ const struct cred *cred;
53387+#endif
53388+ int ret = 0;
53389+
53390+ /* restrict taskstats viewing to un-chrooted root users
53391+ who have the 'view' subject flag if the RBAC system is enabled
53392+ */
53393+
53394+ rcu_read_lock();
53395+ read_lock(&tasklist_lock);
53396+ task = find_task_by_vpid(pid);
53397+ if (task) {
53398+#ifdef CONFIG_GRKERNSEC_CHROOT
53399+ if (proc_is_chrooted(task))
53400+ ret = -EACCES;
53401+#endif
53402+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
53403+ cred = __task_cred(task);
53404+#ifdef CONFIG_GRKERNSEC_PROC_USER
53405+ if (cred->uid != 0)
53406+ ret = -EACCES;
53407+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
53408+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
53409+ ret = -EACCES;
53410+#endif
53411+#endif
53412+ if (gr_status & GR_READY) {
53413+ if (!(task->acl->mode & GR_VIEW))
53414+ ret = -EACCES;
53415+ }
53416+ } else
53417+ ret = -ENOENT;
53418+
53419+ read_unlock(&tasklist_lock);
53420+ rcu_read_unlock();
53421+
53422+ return ret;
53423+}
53424+#endif
53425+
53426+/* AUXV entries are filled via a descendant of search_binary_handler
53427+ after we've already applied the subject for the target
53428+*/
53429+int gr_acl_enable_at_secure(void)
53430+{
53431+ if (unlikely(!(gr_status & GR_READY)))
53432+ return 0;
53433+
53434+ if (current->acl->mode & GR_ATSECURE)
53435+ return 1;
53436+
53437+ return 0;
53438+}
53439+
53440+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
53441+{
53442+ struct task_struct *task = current;
53443+ struct dentry *dentry = file->f_path.dentry;
53444+ struct vfsmount *mnt = file->f_path.mnt;
53445+ struct acl_object_label *obj, *tmp;
53446+ struct acl_subject_label *subj;
53447+ unsigned int bufsize;
53448+ int is_not_root;
53449+ char *path;
53450+ dev_t dev = __get_dev(dentry);
53451+
53452+ if (unlikely(!(gr_status & GR_READY)))
53453+ return 1;
53454+
53455+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53456+ return 1;
53457+
53458+ /* ignore Eric Biederman */
53459+ if (IS_PRIVATE(dentry->d_inode))
53460+ return 1;
53461+
53462+ subj = task->acl;
53463+ do {
53464+ obj = lookup_acl_obj_label(ino, dev, subj);
53465+ if (obj != NULL)
53466+ return (obj->mode & GR_FIND) ? 1 : 0;
53467+ } while ((subj = subj->parent_subject));
53468+
53469+ /* this is purely an optimization since we're looking for an object
53470+ for the directory we're doing a readdir on
53471+ if it's possible for any globbed object to match the entry we're
53472+ filling into the directory, then the object we find here will be
53473+ an anchor point with attached globbed objects
53474+ */
53475+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
53476+ if (obj->globbed == NULL)
53477+ return (obj->mode & GR_FIND) ? 1 : 0;
53478+
53479+ is_not_root = ((obj->filename[0] == '/') &&
53480+ (obj->filename[1] == '\0')) ? 0 : 1;
53481+ bufsize = PAGE_SIZE - namelen - is_not_root;
53482+
53483+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
53484+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
53485+ return 1;
53486+
53487+ preempt_disable();
53488+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
53489+ bufsize);
53490+
53491+ bufsize = strlen(path);
53492+
53493+ /* if base is "/", don't append an additional slash */
53494+ if (is_not_root)
53495+ *(path + bufsize) = '/';
53496+ memcpy(path + bufsize + is_not_root, name, namelen);
53497+ *(path + bufsize + namelen + is_not_root) = '\0';
53498+
53499+ tmp = obj->globbed;
53500+ while (tmp) {
53501+ if (!glob_match(tmp->filename, path)) {
53502+ preempt_enable();
53503+ return (tmp->mode & GR_FIND) ? 1 : 0;
53504+ }
53505+ tmp = tmp->next;
53506+ }
53507+ preempt_enable();
53508+ return (obj->mode & GR_FIND) ? 1 : 0;
53509+}
53510+
53511+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
53512+EXPORT_SYMBOL(gr_acl_is_enabled);
53513+#endif
53514+EXPORT_SYMBOL(gr_learn_resource);
53515+EXPORT_SYMBOL(gr_set_kernel_label);
53516+#ifdef CONFIG_SECURITY
53517+EXPORT_SYMBOL(gr_check_user_change);
53518+EXPORT_SYMBOL(gr_check_group_change);
53519+#endif
53520+
53521diff -urNp linux-2.6.32.46/grsecurity/gracl_cap.c linux-2.6.32.46/grsecurity/gracl_cap.c
53522--- linux-2.6.32.46/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
53523+++ linux-2.6.32.46/grsecurity/gracl_cap.c 2011-09-14 08:53:50.000000000 -0400
53524@@ -0,0 +1,101 @@
53525+#include <linux/kernel.h>
53526+#include <linux/module.h>
53527+#include <linux/sched.h>
53528+#include <linux/gracl.h>
53529+#include <linux/grsecurity.h>
53530+#include <linux/grinternal.h>
53531+
53532+extern const char *captab_log[];
53533+extern int captab_log_entries;
53534+
53535+int
53536+gr_acl_is_capable(const int cap)
53537+{
53538+ struct task_struct *task = current;
53539+ const struct cred *cred = current_cred();
53540+ struct acl_subject_label *curracl;
53541+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
53542+ kernel_cap_t cap_audit = __cap_empty_set;
53543+
53544+ if (!gr_acl_is_enabled())
53545+ return 1;
53546+
53547+ curracl = task->acl;
53548+
53549+ cap_drop = curracl->cap_lower;
53550+ cap_mask = curracl->cap_mask;
53551+ cap_audit = curracl->cap_invert_audit;
53552+
53553+ while ((curracl = curracl->parent_subject)) {
53554+ /* if the cap isn't specified in the current computed mask but is specified in the
53555+ current level subject, and is lowered in the current level subject, then add
53556+ it to the set of dropped capabilities
53557+ otherwise, add the current level subject's mask to the current computed mask
53558+ */
53559+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
53560+ cap_raise(cap_mask, cap);
53561+ if (cap_raised(curracl->cap_lower, cap))
53562+ cap_raise(cap_drop, cap);
53563+ if (cap_raised(curracl->cap_invert_audit, cap))
53564+ cap_raise(cap_audit, cap);
53565+ }
53566+ }
53567+
53568+ if (!cap_raised(cap_drop, cap)) {
53569+ if (cap_raised(cap_audit, cap))
53570+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
53571+ return 1;
53572+ }
53573+
53574+ curracl = task->acl;
53575+
53576+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
53577+ && cap_raised(cred->cap_effective, cap)) {
53578+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
53579+ task->role->roletype, cred->uid,
53580+ cred->gid, task->exec_file ?
53581+ gr_to_filename(task->exec_file->f_path.dentry,
53582+ task->exec_file->f_path.mnt) : curracl->filename,
53583+ curracl->filename, 0UL,
53584+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
53585+ return 1;
53586+ }
53587+
53588+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
53589+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
53590+ return 0;
53591+}
53592+
53593+int
53594+gr_acl_is_capable_nolog(const int cap)
53595+{
53596+ struct acl_subject_label *curracl;
53597+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
53598+
53599+ if (!gr_acl_is_enabled())
53600+ return 1;
53601+
53602+ curracl = current->acl;
53603+
53604+ cap_drop = curracl->cap_lower;
53605+ cap_mask = curracl->cap_mask;
53606+
53607+ while ((curracl = curracl->parent_subject)) {
53608+ /* if the cap isn't specified in the current computed mask but is specified in the
53609+ current level subject, and is lowered in the current level subject, then add
53610+ it to the set of dropped capabilities
53611+ otherwise, add the current level subject's mask to the current computed mask
53612+ */
53613+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
53614+ cap_raise(cap_mask, cap);
53615+ if (cap_raised(curracl->cap_lower, cap))
53616+ cap_raise(cap_drop, cap);
53617+ }
53618+ }
53619+
53620+ if (!cap_raised(cap_drop, cap))
53621+ return 1;
53622+
53623+ return 0;
53624+}
53625+
53626diff -urNp linux-2.6.32.46/grsecurity/gracl_fs.c linux-2.6.32.46/grsecurity/gracl_fs.c
53627--- linux-2.6.32.46/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
53628+++ linux-2.6.32.46/grsecurity/gracl_fs.c 2011-04-17 15:56:46.000000000 -0400
53629@@ -0,0 +1,431 @@
53630+#include <linux/kernel.h>
53631+#include <linux/sched.h>
53632+#include <linux/types.h>
53633+#include <linux/fs.h>
53634+#include <linux/file.h>
53635+#include <linux/stat.h>
53636+#include <linux/grsecurity.h>
53637+#include <linux/grinternal.h>
53638+#include <linux/gracl.h>
53639+
53640+__u32
53641+gr_acl_handle_hidden_file(const struct dentry * dentry,
53642+ const struct vfsmount * mnt)
53643+{
53644+ __u32 mode;
53645+
53646+ if (unlikely(!dentry->d_inode))
53647+ return GR_FIND;
53648+
53649+ mode =
53650+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
53651+
53652+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
53653+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
53654+ return mode;
53655+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
53656+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
53657+ return 0;
53658+ } else if (unlikely(!(mode & GR_FIND)))
53659+ return 0;
53660+
53661+ return GR_FIND;
53662+}
53663+
53664+__u32
53665+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
53666+ const int fmode)
53667+{
53668+ __u32 reqmode = GR_FIND;
53669+ __u32 mode;
53670+
53671+ if (unlikely(!dentry->d_inode))
53672+ return reqmode;
53673+
53674+ if (unlikely(fmode & O_APPEND))
53675+ reqmode |= GR_APPEND;
53676+ else if (unlikely(fmode & FMODE_WRITE))
53677+ reqmode |= GR_WRITE;
53678+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
53679+ reqmode |= GR_READ;
53680+ if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
53681+ reqmode &= ~GR_READ;
53682+ mode =
53683+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
53684+ mnt);
53685+
53686+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
53687+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
53688+ reqmode & GR_READ ? " reading" : "",
53689+ reqmode & GR_WRITE ? " writing" : reqmode &
53690+ GR_APPEND ? " appending" : "");
53691+ return reqmode;
53692+ } else
53693+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
53694+ {
53695+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
53696+ reqmode & GR_READ ? " reading" : "",
53697+ reqmode & GR_WRITE ? " writing" : reqmode &
53698+ GR_APPEND ? " appending" : "");
53699+ return 0;
53700+ } else if (unlikely((mode & reqmode) != reqmode))
53701+ return 0;
53702+
53703+ return reqmode;
53704+}
53705+
53706+__u32
53707+gr_acl_handle_creat(const struct dentry * dentry,
53708+ const struct dentry * p_dentry,
53709+ const struct vfsmount * p_mnt, const int fmode,
53710+ const int imode)
53711+{
53712+ __u32 reqmode = GR_WRITE | GR_CREATE;
53713+ __u32 mode;
53714+
53715+ if (unlikely(fmode & O_APPEND))
53716+ reqmode |= GR_APPEND;
53717+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
53718+ reqmode |= GR_READ;
53719+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
53720+ reqmode |= GR_SETID;
53721+
53722+ mode =
53723+ gr_check_create(dentry, p_dentry, p_mnt,
53724+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
53725+
53726+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
53727+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
53728+ reqmode & GR_READ ? " reading" : "",
53729+ reqmode & GR_WRITE ? " writing" : reqmode &
53730+ GR_APPEND ? " appending" : "");
53731+ return reqmode;
53732+ } else
53733+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
53734+ {
53735+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
53736+ reqmode & GR_READ ? " reading" : "",
53737+ reqmode & GR_WRITE ? " writing" : reqmode &
53738+ GR_APPEND ? " appending" : "");
53739+ return 0;
53740+ } else if (unlikely((mode & reqmode) != reqmode))
53741+ return 0;
53742+
53743+ return reqmode;
53744+}
53745+
53746+__u32
53747+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
53748+ const int fmode)
53749+{
53750+ __u32 mode, reqmode = GR_FIND;
53751+
53752+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
53753+ reqmode |= GR_EXEC;
53754+ if (fmode & S_IWOTH)
53755+ reqmode |= GR_WRITE;
53756+ if (fmode & S_IROTH)
53757+ reqmode |= GR_READ;
53758+
53759+ mode =
53760+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
53761+ mnt);
53762+
53763+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
53764+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
53765+ reqmode & GR_READ ? " reading" : "",
53766+ reqmode & GR_WRITE ? " writing" : "",
53767+ reqmode & GR_EXEC ? " executing" : "");
53768+ return reqmode;
53769+ } else
53770+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
53771+ {
53772+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
53773+ reqmode & GR_READ ? " reading" : "",
53774+ reqmode & GR_WRITE ? " writing" : "",
53775+ reqmode & GR_EXEC ? " executing" : "");
53776+ return 0;
53777+ } else if (unlikely((mode & reqmode) != reqmode))
53778+ return 0;
53779+
53780+ return reqmode;
53781+}
53782+
53783+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
53784+{
53785+ __u32 mode;
53786+
53787+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
53788+
53789+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
53790+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
53791+ return mode;
53792+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
53793+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
53794+ return 0;
53795+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
53796+ return 0;
53797+
53798+ return (reqmode);
53799+}
53800+
53801+__u32
53802+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
53803+{
53804+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
53805+}
53806+
53807+__u32
53808+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
53809+{
53810+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
53811+}
53812+
53813+__u32
53814+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
53815+{
53816+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
53817+}
53818+
53819+__u32
53820+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
53821+{
53822+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
53823+}
53824+
53825+__u32
53826+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
53827+ mode_t mode)
53828+{
53829+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
53830+ return 1;
53831+
53832+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
53833+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
53834+ GR_FCHMOD_ACL_MSG);
53835+ } else {
53836+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
53837+ }
53838+}
53839+
53840+__u32
53841+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
53842+ mode_t mode)
53843+{
53844+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
53845+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
53846+ GR_CHMOD_ACL_MSG);
53847+ } else {
53848+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
53849+ }
53850+}
53851+
53852+__u32
53853+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
53854+{
53855+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
53856+}
53857+
53858+__u32
53859+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
53860+{
53861+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
53862+}
53863+
53864+__u32
53865+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
53866+{
53867+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
53868+}
53869+
53870+__u32
53871+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
53872+{
53873+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
53874+ GR_UNIXCONNECT_ACL_MSG);
53875+}
53876+
53877+/* hardlinks require at minimum create permission,
53878+ any additional privilege required is based on the
53879+ privilege of the file being linked to
53880+*/
53881+__u32
53882+gr_acl_handle_link(const struct dentry * new_dentry,
53883+ const struct dentry * parent_dentry,
53884+ const struct vfsmount * parent_mnt,
53885+ const struct dentry * old_dentry,
53886+ const struct vfsmount * old_mnt, const char *to)
53887+{
53888+ __u32 mode;
53889+ __u32 needmode = GR_CREATE | GR_LINK;
53890+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
53891+
53892+ mode =
53893+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
53894+ old_mnt);
53895+
53896+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
53897+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
53898+ return mode;
53899+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
53900+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
53901+ return 0;
53902+ } else if (unlikely((mode & needmode) != needmode))
53903+ return 0;
53904+
53905+ return 1;
53906+}
53907+
53908+__u32
53909+gr_acl_handle_symlink(const struct dentry * new_dentry,
53910+ const struct dentry * parent_dentry,
53911+ const struct vfsmount * parent_mnt, const char *from)
53912+{
53913+ __u32 needmode = GR_WRITE | GR_CREATE;
53914+ __u32 mode;
53915+
53916+ mode =
53917+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
53918+ GR_CREATE | GR_AUDIT_CREATE |
53919+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
53920+
53921+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
53922+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
53923+ return mode;
53924+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
53925+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
53926+ return 0;
53927+ } else if (unlikely((mode & needmode) != needmode))
53928+ return 0;
53929+
53930+ return (GR_WRITE | GR_CREATE);
53931+}
53932+
53933+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
53934+{
53935+ __u32 mode;
53936+
53937+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
53938+
53939+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
53940+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
53941+ return mode;
53942+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
53943+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
53944+ return 0;
53945+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
53946+ return 0;
53947+
53948+ return (reqmode);
53949+}
53950+
53951+__u32
53952+gr_acl_handle_mknod(const struct dentry * new_dentry,
53953+ const struct dentry * parent_dentry,
53954+ const struct vfsmount * parent_mnt,
53955+ const int mode)
53956+{
53957+ __u32 reqmode = GR_WRITE | GR_CREATE;
53958+ if (unlikely(mode & (S_ISUID | S_ISGID)))
53959+ reqmode |= GR_SETID;
53960+
53961+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
53962+ reqmode, GR_MKNOD_ACL_MSG);
53963+}
53964+
53965+__u32
53966+gr_acl_handle_mkdir(const struct dentry *new_dentry,
53967+ const struct dentry *parent_dentry,
53968+ const struct vfsmount *parent_mnt)
53969+{
53970+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
53971+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
53972+}
53973+
53974+#define RENAME_CHECK_SUCCESS(old, new) \
53975+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
53976+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
53977+
53978+int
53979+gr_acl_handle_rename(struct dentry *new_dentry,
53980+ struct dentry *parent_dentry,
53981+ const struct vfsmount *parent_mnt,
53982+ struct dentry *old_dentry,
53983+ struct inode *old_parent_inode,
53984+ struct vfsmount *old_mnt, const char *newname)
53985+{
53986+ __u32 comp1, comp2;
53987+ int error = 0;
53988+
53989+ if (unlikely(!gr_acl_is_enabled()))
53990+ return 0;
53991+
53992+ if (!new_dentry->d_inode) {
53993+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
53994+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
53995+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
53996+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
53997+ GR_DELETE | GR_AUDIT_DELETE |
53998+ GR_AUDIT_READ | GR_AUDIT_WRITE |
53999+ GR_SUPPRESS, old_mnt);
54000+ } else {
54001+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
54002+ GR_CREATE | GR_DELETE |
54003+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
54004+ GR_AUDIT_READ | GR_AUDIT_WRITE |
54005+ GR_SUPPRESS, parent_mnt);
54006+ comp2 =
54007+ gr_search_file(old_dentry,
54008+ GR_READ | GR_WRITE | GR_AUDIT_READ |
54009+ GR_DELETE | GR_AUDIT_DELETE |
54010+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
54011+ }
54012+
54013+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
54014+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
54015+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
54016+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
54017+ && !(comp2 & GR_SUPPRESS)) {
54018+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
54019+ error = -EACCES;
54020+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
54021+ error = -EACCES;
54022+
54023+ return error;
54024+}
54025+
54026+void
54027+gr_acl_handle_exit(void)
54028+{
54029+ u16 id;
54030+ char *rolename;
54031+ struct file *exec_file;
54032+
54033+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
54034+ !(current->role->roletype & GR_ROLE_PERSIST))) {
54035+ id = current->acl_role_id;
54036+ rolename = current->role->rolename;
54037+ gr_set_acls(1);
54038+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
54039+ }
54040+
54041+ write_lock(&grsec_exec_file_lock);
54042+ exec_file = current->exec_file;
54043+ current->exec_file = NULL;
54044+ write_unlock(&grsec_exec_file_lock);
54045+
54046+ if (exec_file)
54047+ fput(exec_file);
54048+}
54049+
54050+int
54051+gr_acl_handle_procpidmem(const struct task_struct *task)
54052+{
54053+ if (unlikely(!gr_acl_is_enabled()))
54054+ return 0;
54055+
54056+ if (task != current && task->acl->mode & GR_PROTPROCFD)
54057+ return -EACCES;
54058+
54059+ return 0;
54060+}
54061diff -urNp linux-2.6.32.46/grsecurity/gracl_ip.c linux-2.6.32.46/grsecurity/gracl_ip.c
54062--- linux-2.6.32.46/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
54063+++ linux-2.6.32.46/grsecurity/gracl_ip.c 2011-04-17 15:56:46.000000000 -0400
54064@@ -0,0 +1,382 @@
54065+#include <linux/kernel.h>
54066+#include <asm/uaccess.h>
54067+#include <asm/errno.h>
54068+#include <net/sock.h>
54069+#include <linux/file.h>
54070+#include <linux/fs.h>
54071+#include <linux/net.h>
54072+#include <linux/in.h>
54073+#include <linux/skbuff.h>
54074+#include <linux/ip.h>
54075+#include <linux/udp.h>
54076+#include <linux/smp_lock.h>
54077+#include <linux/types.h>
54078+#include <linux/sched.h>
54079+#include <linux/netdevice.h>
54080+#include <linux/inetdevice.h>
54081+#include <linux/gracl.h>
54082+#include <linux/grsecurity.h>
54083+#include <linux/grinternal.h>
54084+
54085+#define GR_BIND 0x01
54086+#define GR_CONNECT 0x02
54087+#define GR_INVERT 0x04
54088+#define GR_BINDOVERRIDE 0x08
54089+#define GR_CONNECTOVERRIDE 0x10
54090+#define GR_SOCK_FAMILY 0x20
54091+
54092+static const char * gr_protocols[IPPROTO_MAX] = {
54093+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
54094+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
54095+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
54096+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
54097+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
54098+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
54099+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
54100+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
54101+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
54102+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
54103+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
54104+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
54105+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
54106+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
54107+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
54108+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
54109+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
54110+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
54111+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
54112+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
54113+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
54114+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
54115+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
54116+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
54117+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
54118+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
54119+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
54120+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
54121+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
54122+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
54123+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
54124+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
54125+ };
54126+
54127+static const char * gr_socktypes[SOCK_MAX] = {
54128+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
54129+ "unknown:7", "unknown:8", "unknown:9", "packet"
54130+ };
54131+
54132+static const char * gr_sockfamilies[AF_MAX+1] = {
54133+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
54134+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
54135+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
54136+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
54137+ };
54138+
54139+const char *
54140+gr_proto_to_name(unsigned char proto)
54141+{
54142+ return gr_protocols[proto];
54143+}
54144+
54145+const char *
54146+gr_socktype_to_name(unsigned char type)
54147+{
54148+ return gr_socktypes[type];
54149+}
54150+
54151+const char *
54152+gr_sockfamily_to_name(unsigned char family)
54153+{
54154+ return gr_sockfamilies[family];
54155+}
54156+
54157+int
54158+gr_search_socket(const int domain, const int type, const int protocol)
54159+{
54160+ struct acl_subject_label *curr;
54161+ const struct cred *cred = current_cred();
54162+
54163+ if (unlikely(!gr_acl_is_enabled()))
54164+ goto exit;
54165+
54166+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
54167+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
54168+ goto exit; // let the kernel handle it
54169+
54170+ curr = current->acl;
54171+
54172+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
54173+ /* the family is allowed, if this is PF_INET allow it only if
54174+ the extra sock type/protocol checks pass */
54175+ if (domain == PF_INET)
54176+ goto inet_check;
54177+ goto exit;
54178+ } else {
54179+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
54180+ __u32 fakeip = 0;
54181+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
54182+ current->role->roletype, cred->uid,
54183+ cred->gid, current->exec_file ?
54184+ gr_to_filename(current->exec_file->f_path.dentry,
54185+ current->exec_file->f_path.mnt) :
54186+ curr->filename, curr->filename,
54187+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
54188+ &current->signal->saved_ip);
54189+ goto exit;
54190+ }
54191+ goto exit_fail;
54192+ }
54193+
54194+inet_check:
54195+ /* the rest of this checking is for IPv4 only */
54196+ if (!curr->ips)
54197+ goto exit;
54198+
54199+ if ((curr->ip_type & (1 << type)) &&
54200+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
54201+ goto exit;
54202+
54203+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
54204+ /* we don't place acls on raw sockets , and sometimes
54205+ dgram/ip sockets are opened for ioctl and not
54206+ bind/connect, so we'll fake a bind learn log */
54207+ if (type == SOCK_RAW || type == SOCK_PACKET) {
54208+ __u32 fakeip = 0;
54209+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
54210+ current->role->roletype, cred->uid,
54211+ cred->gid, current->exec_file ?
54212+ gr_to_filename(current->exec_file->f_path.dentry,
54213+ current->exec_file->f_path.mnt) :
54214+ curr->filename, curr->filename,
54215+ &fakeip, 0, type,
54216+ protocol, GR_CONNECT, &current->signal->saved_ip);
54217+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
54218+ __u32 fakeip = 0;
54219+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
54220+ current->role->roletype, cred->uid,
54221+ cred->gid, current->exec_file ?
54222+ gr_to_filename(current->exec_file->f_path.dentry,
54223+ current->exec_file->f_path.mnt) :
54224+ curr->filename, curr->filename,
54225+ &fakeip, 0, type,
54226+ protocol, GR_BIND, &current->signal->saved_ip);
54227+ }
54228+ /* we'll log when they use connect or bind */
54229+ goto exit;
54230+ }
54231+
54232+exit_fail:
54233+ if (domain == PF_INET)
54234+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
54235+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
54236+ else
54237+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
54238+ gr_socktype_to_name(type), protocol);
54239+
54240+ return 0;
54241+exit:
54242+ return 1;
54243+}
54244+
54245+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
54246+{
54247+ if ((ip->mode & mode) &&
54248+ (ip_port >= ip->low) &&
54249+ (ip_port <= ip->high) &&
54250+ ((ntohl(ip_addr) & our_netmask) ==
54251+ (ntohl(our_addr) & our_netmask))
54252+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
54253+ && (ip->type & (1 << type))) {
54254+ if (ip->mode & GR_INVERT)
54255+ return 2; // specifically denied
54256+ else
54257+ return 1; // allowed
54258+ }
54259+
54260+ return 0; // not specifically allowed, may continue parsing
54261+}
54262+
54263+static int
54264+gr_search_connectbind(const int full_mode, struct sock *sk,
54265+ struct sockaddr_in *addr, const int type)
54266+{
54267+ char iface[IFNAMSIZ] = {0};
54268+ struct acl_subject_label *curr;
54269+ struct acl_ip_label *ip;
54270+ struct inet_sock *isk;
54271+ struct net_device *dev;
54272+ struct in_device *idev;
54273+ unsigned long i;
54274+ int ret;
54275+ int mode = full_mode & (GR_BIND | GR_CONNECT);
54276+ __u32 ip_addr = 0;
54277+ __u32 our_addr;
54278+ __u32 our_netmask;
54279+ char *p;
54280+ __u16 ip_port = 0;
54281+ const struct cred *cred = current_cred();
54282+
54283+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
54284+ return 0;
54285+
54286+ curr = current->acl;
54287+ isk = inet_sk(sk);
54288+
54289+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
54290+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
54291+ addr->sin_addr.s_addr = curr->inaddr_any_override;
54292+ if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
54293+ struct sockaddr_in saddr;
54294+ int err;
54295+
54296+ saddr.sin_family = AF_INET;
54297+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
54298+ saddr.sin_port = isk->sport;
54299+
54300+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
54301+ if (err)
54302+ return err;
54303+
54304+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
54305+ if (err)
54306+ return err;
54307+ }
54308+
54309+ if (!curr->ips)
54310+ return 0;
54311+
54312+ ip_addr = addr->sin_addr.s_addr;
54313+ ip_port = ntohs(addr->sin_port);
54314+
54315+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
54316+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
54317+ current->role->roletype, cred->uid,
54318+ cred->gid, current->exec_file ?
54319+ gr_to_filename(current->exec_file->f_path.dentry,
54320+ current->exec_file->f_path.mnt) :
54321+ curr->filename, curr->filename,
54322+ &ip_addr, ip_port, type,
54323+ sk->sk_protocol, mode, &current->signal->saved_ip);
54324+ return 0;
54325+ }
54326+
54327+ for (i = 0; i < curr->ip_num; i++) {
54328+ ip = *(curr->ips + i);
54329+ if (ip->iface != NULL) {
54330+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
54331+ p = strchr(iface, ':');
54332+ if (p != NULL)
54333+ *p = '\0';
54334+ dev = dev_get_by_name(sock_net(sk), iface);
54335+ if (dev == NULL)
54336+ continue;
54337+ idev = in_dev_get(dev);
54338+ if (idev == NULL) {
54339+ dev_put(dev);
54340+ continue;
54341+ }
54342+ rcu_read_lock();
54343+ for_ifa(idev) {
54344+ if (!strcmp(ip->iface, ifa->ifa_label)) {
54345+ our_addr = ifa->ifa_address;
54346+ our_netmask = 0xffffffff;
54347+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
54348+ if (ret == 1) {
54349+ rcu_read_unlock();
54350+ in_dev_put(idev);
54351+ dev_put(dev);
54352+ return 0;
54353+ } else if (ret == 2) {
54354+ rcu_read_unlock();
54355+ in_dev_put(idev);
54356+ dev_put(dev);
54357+ goto denied;
54358+ }
54359+ }
54360+ } endfor_ifa(idev);
54361+ rcu_read_unlock();
54362+ in_dev_put(idev);
54363+ dev_put(dev);
54364+ } else {
54365+ our_addr = ip->addr;
54366+ our_netmask = ip->netmask;
54367+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
54368+ if (ret == 1)
54369+ return 0;
54370+ else if (ret == 2)
54371+ goto denied;
54372+ }
54373+ }
54374+
54375+denied:
54376+ if (mode == GR_BIND)
54377+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
54378+ else if (mode == GR_CONNECT)
54379+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
54380+
54381+ return -EACCES;
54382+}
54383+
54384+int
54385+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
54386+{
54387+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
54388+}
54389+
54390+int
54391+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
54392+{
54393+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
54394+}
54395+
54396+int gr_search_listen(struct socket *sock)
54397+{
54398+ struct sock *sk = sock->sk;
54399+ struct sockaddr_in addr;
54400+
54401+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
54402+ addr.sin_port = inet_sk(sk)->sport;
54403+
54404+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
54405+}
54406+
54407+int gr_search_accept(struct socket *sock)
54408+{
54409+ struct sock *sk = sock->sk;
54410+ struct sockaddr_in addr;
54411+
54412+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
54413+ addr.sin_port = inet_sk(sk)->sport;
54414+
54415+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
54416+}
54417+
54418+int
54419+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
54420+{
54421+ if (addr)
54422+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
54423+ else {
54424+ struct sockaddr_in sin;
54425+ const struct inet_sock *inet = inet_sk(sk);
54426+
54427+ sin.sin_addr.s_addr = inet->daddr;
54428+ sin.sin_port = inet->dport;
54429+
54430+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
54431+ }
54432+}
54433+
54434+int
54435+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
54436+{
54437+ struct sockaddr_in sin;
54438+
54439+ if (unlikely(skb->len < sizeof (struct udphdr)))
54440+ return 0; // skip this packet
54441+
54442+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
54443+ sin.sin_port = udp_hdr(skb)->source;
54444+
54445+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
54446+}
54447diff -urNp linux-2.6.32.46/grsecurity/gracl_learn.c linux-2.6.32.46/grsecurity/gracl_learn.c
54448--- linux-2.6.32.46/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
54449+++ linux-2.6.32.46/grsecurity/gracl_learn.c 2011-07-14 21:02:03.000000000 -0400
54450@@ -0,0 +1,208 @@
54451+#include <linux/kernel.h>
54452+#include <linux/mm.h>
54453+#include <linux/sched.h>
54454+#include <linux/poll.h>
54455+#include <linux/smp_lock.h>
54456+#include <linux/string.h>
54457+#include <linux/file.h>
54458+#include <linux/types.h>
54459+#include <linux/vmalloc.h>
54460+#include <linux/grinternal.h>
54461+
54462+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
54463+ size_t count, loff_t *ppos);
54464+extern int gr_acl_is_enabled(void);
54465+
54466+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
54467+static int gr_learn_attached;
54468+
54469+/* use a 512k buffer */
54470+#define LEARN_BUFFER_SIZE (512 * 1024)
54471+
54472+static DEFINE_SPINLOCK(gr_learn_lock);
54473+static DEFINE_MUTEX(gr_learn_user_mutex);
54474+
54475+/* we need to maintain two buffers, so that the kernel context of grlearn
54476+ uses a semaphore around the userspace copying, and the other kernel contexts
54477+ use a spinlock when copying into the buffer, since they cannot sleep
54478+*/
54479+static char *learn_buffer;
54480+static char *learn_buffer_user;
54481+static int learn_buffer_len;
54482+static int learn_buffer_user_len;
54483+
54484+static ssize_t
54485+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
54486+{
54487+ DECLARE_WAITQUEUE(wait, current);
54488+ ssize_t retval = 0;
54489+
54490+ add_wait_queue(&learn_wait, &wait);
54491+ set_current_state(TASK_INTERRUPTIBLE);
54492+ do {
54493+ mutex_lock(&gr_learn_user_mutex);
54494+ spin_lock(&gr_learn_lock);
54495+ if (learn_buffer_len)
54496+ break;
54497+ spin_unlock(&gr_learn_lock);
54498+ mutex_unlock(&gr_learn_user_mutex);
54499+ if (file->f_flags & O_NONBLOCK) {
54500+ retval = -EAGAIN;
54501+ goto out;
54502+ }
54503+ if (signal_pending(current)) {
54504+ retval = -ERESTARTSYS;
54505+ goto out;
54506+ }
54507+
54508+ schedule();
54509+ } while (1);
54510+
54511+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
54512+ learn_buffer_user_len = learn_buffer_len;
54513+ retval = learn_buffer_len;
54514+ learn_buffer_len = 0;
54515+
54516+ spin_unlock(&gr_learn_lock);
54517+
54518+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
54519+ retval = -EFAULT;
54520+
54521+ mutex_unlock(&gr_learn_user_mutex);
54522+out:
54523+ set_current_state(TASK_RUNNING);
54524+ remove_wait_queue(&learn_wait, &wait);
54525+ return retval;
54526+}
54527+
54528+static unsigned int
54529+poll_learn(struct file * file, poll_table * wait)
54530+{
54531+ poll_wait(file, &learn_wait, wait);
54532+
54533+ if (learn_buffer_len)
54534+ return (POLLIN | POLLRDNORM);
54535+
54536+ return 0;
54537+}
54538+
54539+void
54540+gr_clear_learn_entries(void)
54541+{
54542+ char *tmp;
54543+
54544+ mutex_lock(&gr_learn_user_mutex);
54545+ spin_lock(&gr_learn_lock);
54546+ tmp = learn_buffer;
54547+ learn_buffer = NULL;
54548+ spin_unlock(&gr_learn_lock);
54549+ if (tmp)
54550+ vfree(tmp);
54551+ if (learn_buffer_user != NULL) {
54552+ vfree(learn_buffer_user);
54553+ learn_buffer_user = NULL;
54554+ }
54555+ learn_buffer_len = 0;
54556+ mutex_unlock(&gr_learn_user_mutex);
54557+
54558+ return;
54559+}
54560+
54561+void
54562+gr_add_learn_entry(const char *fmt, ...)
54563+{
54564+ va_list args;
54565+ unsigned int len;
54566+
54567+ if (!gr_learn_attached)
54568+ return;
54569+
54570+ spin_lock(&gr_learn_lock);
54571+
54572+ /* leave a gap at the end so we know when it's "full" but don't have to
54573+ compute the exact length of the string we're trying to append
54574+ */
54575+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
54576+ spin_unlock(&gr_learn_lock);
54577+ wake_up_interruptible(&learn_wait);
54578+ return;
54579+ }
54580+ if (learn_buffer == NULL) {
54581+ spin_unlock(&gr_learn_lock);
54582+ return;
54583+ }
54584+
54585+ va_start(args, fmt);
54586+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
54587+ va_end(args);
54588+
54589+ learn_buffer_len += len + 1;
54590+
54591+ spin_unlock(&gr_learn_lock);
54592+ wake_up_interruptible(&learn_wait);
54593+
54594+ return;
54595+}
54596+
54597+static int
54598+open_learn(struct inode *inode, struct file *file)
54599+{
54600+ if (file->f_mode & FMODE_READ && gr_learn_attached)
54601+ return -EBUSY;
54602+ if (file->f_mode & FMODE_READ) {
54603+ int retval = 0;
54604+ mutex_lock(&gr_learn_user_mutex);
54605+ if (learn_buffer == NULL)
54606+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
54607+ if (learn_buffer_user == NULL)
54608+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
54609+ if (learn_buffer == NULL) {
54610+ retval = -ENOMEM;
54611+ goto out_error;
54612+ }
54613+ if (learn_buffer_user == NULL) {
54614+ retval = -ENOMEM;
54615+ goto out_error;
54616+ }
54617+ learn_buffer_len = 0;
54618+ learn_buffer_user_len = 0;
54619+ gr_learn_attached = 1;
54620+out_error:
54621+ mutex_unlock(&gr_learn_user_mutex);
54622+ return retval;
54623+ }
54624+ return 0;
54625+}
54626+
54627+static int
54628+close_learn(struct inode *inode, struct file *file)
54629+{
54630+ if (file->f_mode & FMODE_READ) {
54631+ char *tmp = NULL;
54632+ mutex_lock(&gr_learn_user_mutex);
54633+ spin_lock(&gr_learn_lock);
54634+ tmp = learn_buffer;
54635+ learn_buffer = NULL;
54636+ spin_unlock(&gr_learn_lock);
54637+ if (tmp)
54638+ vfree(tmp);
54639+ if (learn_buffer_user != NULL) {
54640+ vfree(learn_buffer_user);
54641+ learn_buffer_user = NULL;
54642+ }
54643+ learn_buffer_len = 0;
54644+ learn_buffer_user_len = 0;
54645+ gr_learn_attached = 0;
54646+ mutex_unlock(&gr_learn_user_mutex);
54647+ }
54648+
54649+ return 0;
54650+}
54651+
54652+const struct file_operations grsec_fops = {
54653+ .read = read_learn,
54654+ .write = write_grsec_handler,
54655+ .open = open_learn,
54656+ .release = close_learn,
54657+ .poll = poll_learn,
54658+};
54659diff -urNp linux-2.6.32.46/grsecurity/gracl_res.c linux-2.6.32.46/grsecurity/gracl_res.c
54660--- linux-2.6.32.46/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
54661+++ linux-2.6.32.46/grsecurity/gracl_res.c 2011-04-17 15:56:46.000000000 -0400
54662@@ -0,0 +1,67 @@
54663+#include <linux/kernel.h>
54664+#include <linux/sched.h>
54665+#include <linux/gracl.h>
54666+#include <linux/grinternal.h>
54667+
54668+static const char *restab_log[] = {
54669+ [RLIMIT_CPU] = "RLIMIT_CPU",
54670+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
54671+ [RLIMIT_DATA] = "RLIMIT_DATA",
54672+ [RLIMIT_STACK] = "RLIMIT_STACK",
54673+ [RLIMIT_CORE] = "RLIMIT_CORE",
54674+ [RLIMIT_RSS] = "RLIMIT_RSS",
54675+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
54676+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
54677+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
54678+ [RLIMIT_AS] = "RLIMIT_AS",
54679+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
54680+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
54681+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
54682+ [RLIMIT_NICE] = "RLIMIT_NICE",
54683+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
54684+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
54685+ [GR_CRASH_RES] = "RLIMIT_CRASH"
54686+};
54687+
54688+void
54689+gr_log_resource(const struct task_struct *task,
54690+ const int res, const unsigned long wanted, const int gt)
54691+{
54692+ const struct cred *cred;
54693+ unsigned long rlim;
54694+
54695+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
54696+ return;
54697+
54698+ // not yet supported resource
54699+ if (unlikely(!restab_log[res]))
54700+ return;
54701+
54702+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
54703+ rlim = task->signal->rlim[res].rlim_max;
54704+ else
54705+ rlim = task->signal->rlim[res].rlim_cur;
54706+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
54707+ return;
54708+
54709+ rcu_read_lock();
54710+ cred = __task_cred(task);
54711+
54712+ if (res == RLIMIT_NPROC &&
54713+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
54714+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
54715+ goto out_rcu_unlock;
54716+ else if (res == RLIMIT_MEMLOCK &&
54717+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
54718+ goto out_rcu_unlock;
54719+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
54720+ goto out_rcu_unlock;
54721+ rcu_read_unlock();
54722+
54723+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
54724+
54725+ return;
54726+out_rcu_unlock:
54727+ rcu_read_unlock();
54728+ return;
54729+}
54730diff -urNp linux-2.6.32.46/grsecurity/gracl_segv.c linux-2.6.32.46/grsecurity/gracl_segv.c
54731--- linux-2.6.32.46/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
54732+++ linux-2.6.32.46/grsecurity/gracl_segv.c 2011-04-17 15:56:46.000000000 -0400
54733@@ -0,0 +1,284 @@
54734+#include <linux/kernel.h>
54735+#include <linux/mm.h>
54736+#include <asm/uaccess.h>
54737+#include <asm/errno.h>
54738+#include <asm/mman.h>
54739+#include <net/sock.h>
54740+#include <linux/file.h>
54741+#include <linux/fs.h>
54742+#include <linux/net.h>
54743+#include <linux/in.h>
54744+#include <linux/smp_lock.h>
54745+#include <linux/slab.h>
54746+#include <linux/types.h>
54747+#include <linux/sched.h>
54748+#include <linux/timer.h>
54749+#include <linux/gracl.h>
54750+#include <linux/grsecurity.h>
54751+#include <linux/grinternal.h>
54752+
54753+static struct crash_uid *uid_set;
54754+static unsigned short uid_used;
54755+static DEFINE_SPINLOCK(gr_uid_lock);
54756+extern rwlock_t gr_inode_lock;
54757+extern struct acl_subject_label *
54758+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
54759+ struct acl_role_label *role);
54760+extern int gr_fake_force_sig(int sig, struct task_struct *t);
54761+
54762+int
54763+gr_init_uidset(void)
54764+{
54765+ uid_set =
54766+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
54767+ uid_used = 0;
54768+
54769+ return uid_set ? 1 : 0;
54770+}
54771+
54772+void
54773+gr_free_uidset(void)
54774+{
54775+ if (uid_set)
54776+ kfree(uid_set);
54777+
54778+ return;
54779+}
54780+
54781+int
54782+gr_find_uid(const uid_t uid)
54783+{
54784+ struct crash_uid *tmp = uid_set;
54785+ uid_t buid;
54786+ int low = 0, high = uid_used - 1, mid;
54787+
54788+ while (high >= low) {
54789+ mid = (low + high) >> 1;
54790+ buid = tmp[mid].uid;
54791+ if (buid == uid)
54792+ return mid;
54793+ if (buid > uid)
54794+ high = mid - 1;
54795+ if (buid < uid)
54796+ low = mid + 1;
54797+ }
54798+
54799+ return -1;
54800+}
54801+
54802+static __inline__ void
54803+gr_insertsort(void)
54804+{
54805+ unsigned short i, j;
54806+ struct crash_uid index;
54807+
54808+ for (i = 1; i < uid_used; i++) {
54809+ index = uid_set[i];
54810+ j = i;
54811+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
54812+ uid_set[j] = uid_set[j - 1];
54813+ j--;
54814+ }
54815+ uid_set[j] = index;
54816+ }
54817+
54818+ return;
54819+}
54820+
54821+static __inline__ void
54822+gr_insert_uid(const uid_t uid, const unsigned long expires)
54823+{
54824+ int loc;
54825+
54826+ if (uid_used == GR_UIDTABLE_MAX)
54827+ return;
54828+
54829+ loc = gr_find_uid(uid);
54830+
54831+ if (loc >= 0) {
54832+ uid_set[loc].expires = expires;
54833+ return;
54834+ }
54835+
54836+ uid_set[uid_used].uid = uid;
54837+ uid_set[uid_used].expires = expires;
54838+ uid_used++;
54839+
54840+ gr_insertsort();
54841+
54842+ return;
54843+}
54844+
54845+void
54846+gr_remove_uid(const unsigned short loc)
54847+{
54848+ unsigned short i;
54849+
54850+ for (i = loc + 1; i < uid_used; i++)
54851+ uid_set[i - 1] = uid_set[i];
54852+
54853+ uid_used--;
54854+
54855+ return;
54856+}
54857+
54858+int
54859+gr_check_crash_uid(const uid_t uid)
54860+{
54861+ int loc;
54862+ int ret = 0;
54863+
54864+ if (unlikely(!gr_acl_is_enabled()))
54865+ return 0;
54866+
54867+ spin_lock(&gr_uid_lock);
54868+ loc = gr_find_uid(uid);
54869+
54870+ if (loc < 0)
54871+ goto out_unlock;
54872+
54873+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
54874+ gr_remove_uid(loc);
54875+ else
54876+ ret = 1;
54877+
54878+out_unlock:
54879+ spin_unlock(&gr_uid_lock);
54880+ return ret;
54881+}
54882+
54883+static __inline__ int
54884+proc_is_setxid(const struct cred *cred)
54885+{
54886+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
54887+ cred->uid != cred->fsuid)
54888+ return 1;
54889+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
54890+ cred->gid != cred->fsgid)
54891+ return 1;
54892+
54893+ return 0;
54894+}
54895+
54896+void
54897+gr_handle_crash(struct task_struct *task, const int sig)
54898+{
54899+ struct acl_subject_label *curr;
54900+ struct acl_subject_label *curr2;
54901+ struct task_struct *tsk, *tsk2;
54902+ const struct cred *cred;
54903+ const struct cred *cred2;
54904+
54905+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
54906+ return;
54907+
54908+ if (unlikely(!gr_acl_is_enabled()))
54909+ return;
54910+
54911+ curr = task->acl;
54912+
54913+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
54914+ return;
54915+
54916+ if (time_before_eq(curr->expires, get_seconds())) {
54917+ curr->expires = 0;
54918+ curr->crashes = 0;
54919+ }
54920+
54921+ curr->crashes++;
54922+
54923+ if (!curr->expires)
54924+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
54925+
54926+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
54927+ time_after(curr->expires, get_seconds())) {
54928+ rcu_read_lock();
54929+ cred = __task_cred(task);
54930+ if (cred->uid && proc_is_setxid(cred)) {
54931+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
54932+ spin_lock(&gr_uid_lock);
54933+ gr_insert_uid(cred->uid, curr->expires);
54934+ spin_unlock(&gr_uid_lock);
54935+ curr->expires = 0;
54936+ curr->crashes = 0;
54937+ read_lock(&tasklist_lock);
54938+ do_each_thread(tsk2, tsk) {
54939+ cred2 = __task_cred(tsk);
54940+ if (tsk != task && cred2->uid == cred->uid)
54941+ gr_fake_force_sig(SIGKILL, tsk);
54942+ } while_each_thread(tsk2, tsk);
54943+ read_unlock(&tasklist_lock);
54944+ } else {
54945+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
54946+ read_lock(&tasklist_lock);
54947+ do_each_thread(tsk2, tsk) {
54948+ if (likely(tsk != task)) {
54949+ curr2 = tsk->acl;
54950+
54951+ if (curr2->device == curr->device &&
54952+ curr2->inode == curr->inode)
54953+ gr_fake_force_sig(SIGKILL, tsk);
54954+ }
54955+ } while_each_thread(tsk2, tsk);
54956+ read_unlock(&tasklist_lock);
54957+ }
54958+ rcu_read_unlock();
54959+ }
54960+
54961+ return;
54962+}
54963+
54964+int
54965+gr_check_crash_exec(const struct file *filp)
54966+{
54967+ struct acl_subject_label *curr;
54968+
54969+ if (unlikely(!gr_acl_is_enabled()))
54970+ return 0;
54971+
54972+ read_lock(&gr_inode_lock);
54973+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
54974+ filp->f_path.dentry->d_inode->i_sb->s_dev,
54975+ current->role);
54976+ read_unlock(&gr_inode_lock);
54977+
54978+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
54979+ (!curr->crashes && !curr->expires))
54980+ return 0;
54981+
54982+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
54983+ time_after(curr->expires, get_seconds()))
54984+ return 1;
54985+ else if (time_before_eq(curr->expires, get_seconds())) {
54986+ curr->crashes = 0;
54987+ curr->expires = 0;
54988+ }
54989+
54990+ return 0;
54991+}
54992+
54993+void
54994+gr_handle_alertkill(struct task_struct *task)
54995+{
54996+ struct acl_subject_label *curracl;
54997+ __u32 curr_ip;
54998+ struct task_struct *p, *p2;
54999+
55000+ if (unlikely(!gr_acl_is_enabled()))
55001+ return;
55002+
55003+ curracl = task->acl;
55004+ curr_ip = task->signal->curr_ip;
55005+
55006+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
55007+ read_lock(&tasklist_lock);
55008+ do_each_thread(p2, p) {
55009+ if (p->signal->curr_ip == curr_ip)
55010+ gr_fake_force_sig(SIGKILL, p);
55011+ } while_each_thread(p2, p);
55012+ read_unlock(&tasklist_lock);
55013+ } else if (curracl->mode & GR_KILLPROC)
55014+ gr_fake_force_sig(SIGKILL, task);
55015+
55016+ return;
55017+}
55018diff -urNp linux-2.6.32.46/grsecurity/gracl_shm.c linux-2.6.32.46/grsecurity/gracl_shm.c
55019--- linux-2.6.32.46/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
55020+++ linux-2.6.32.46/grsecurity/gracl_shm.c 2011-04-17 15:56:46.000000000 -0400
55021@@ -0,0 +1,40 @@
55022+#include <linux/kernel.h>
55023+#include <linux/mm.h>
55024+#include <linux/sched.h>
55025+#include <linux/file.h>
55026+#include <linux/ipc.h>
55027+#include <linux/gracl.h>
55028+#include <linux/grsecurity.h>
55029+#include <linux/grinternal.h>
55030+
55031+int
55032+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
55033+ const time_t shm_createtime, const uid_t cuid, const int shmid)
55034+{
55035+ struct task_struct *task;
55036+
55037+ if (!gr_acl_is_enabled())
55038+ return 1;
55039+
55040+ rcu_read_lock();
55041+ read_lock(&tasklist_lock);
55042+
55043+ task = find_task_by_vpid(shm_cprid);
55044+
55045+ if (unlikely(!task))
55046+ task = find_task_by_vpid(shm_lapid);
55047+
55048+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
55049+ (task->pid == shm_lapid)) &&
55050+ (task->acl->mode & GR_PROTSHM) &&
55051+ (task->acl != current->acl))) {
55052+ read_unlock(&tasklist_lock);
55053+ rcu_read_unlock();
55054+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
55055+ return 0;
55056+ }
55057+ read_unlock(&tasklist_lock);
55058+ rcu_read_unlock();
55059+
55060+ return 1;
55061+}
55062diff -urNp linux-2.6.32.46/grsecurity/grsec_chdir.c linux-2.6.32.46/grsecurity/grsec_chdir.c
55063--- linux-2.6.32.46/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
55064+++ linux-2.6.32.46/grsecurity/grsec_chdir.c 2011-04-17 15:56:46.000000000 -0400
55065@@ -0,0 +1,19 @@
55066+#include <linux/kernel.h>
55067+#include <linux/sched.h>
55068+#include <linux/fs.h>
55069+#include <linux/file.h>
55070+#include <linux/grsecurity.h>
55071+#include <linux/grinternal.h>
55072+
55073+void
55074+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
55075+{
55076+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
55077+ if ((grsec_enable_chdir && grsec_enable_group &&
55078+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
55079+ !grsec_enable_group)) {
55080+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
55081+ }
55082+#endif
55083+ return;
55084+}
55085diff -urNp linux-2.6.32.46/grsecurity/grsec_chroot.c linux-2.6.32.46/grsecurity/grsec_chroot.c
55086--- linux-2.6.32.46/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
55087+++ linux-2.6.32.46/grsecurity/grsec_chroot.c 2011-09-15 06:48:16.000000000 -0400
55088@@ -0,0 +1,386 @@
55089+#include <linux/kernel.h>
55090+#include <linux/module.h>
55091+#include <linux/sched.h>
55092+#include <linux/file.h>
55093+#include <linux/fs.h>
55094+#include <linux/mount.h>
55095+#include <linux/types.h>
55096+#include <linux/pid_namespace.h>
55097+#include <linux/grsecurity.h>
55098+#include <linux/grinternal.h>
55099+
55100+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
55101+{
55102+#ifdef CONFIG_GRKERNSEC
55103+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
55104+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
55105+ task->gr_is_chrooted = 1;
55106+ else
55107+ task->gr_is_chrooted = 0;
55108+
55109+ task->gr_chroot_dentry = path->dentry;
55110+#endif
55111+ return;
55112+}
55113+
55114+void gr_clear_chroot_entries(struct task_struct *task)
55115+{
55116+#ifdef CONFIG_GRKERNSEC
55117+ task->gr_is_chrooted = 0;
55118+ task->gr_chroot_dentry = NULL;
55119+#endif
55120+ return;
55121+}
55122+
55123+int
55124+gr_handle_chroot_unix(const pid_t pid)
55125+{
55126+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
55127+ struct task_struct *p;
55128+
55129+ if (unlikely(!grsec_enable_chroot_unix))
55130+ return 1;
55131+
55132+ if (likely(!proc_is_chrooted(current)))
55133+ return 1;
55134+
55135+ rcu_read_lock();
55136+ read_lock(&tasklist_lock);
55137+
55138+ p = find_task_by_vpid_unrestricted(pid);
55139+ if (unlikely(p && !have_same_root(current, p))) {
55140+ read_unlock(&tasklist_lock);
55141+ rcu_read_unlock();
55142+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
55143+ return 0;
55144+ }
55145+ read_unlock(&tasklist_lock);
55146+ rcu_read_unlock();
55147+#endif
55148+ return 1;
55149+}
55150+
55151+int
55152+gr_handle_chroot_nice(void)
55153+{
55154+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
55155+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
55156+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
55157+ return -EPERM;
55158+ }
55159+#endif
55160+ return 0;
55161+}
55162+
55163+int
55164+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
55165+{
55166+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
55167+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
55168+ && proc_is_chrooted(current)) {
55169+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
55170+ return -EACCES;
55171+ }
55172+#endif
55173+ return 0;
55174+}
55175+
55176+int
55177+gr_handle_chroot_rawio(const struct inode *inode)
55178+{
55179+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
55180+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
55181+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
55182+ return 1;
55183+#endif
55184+ return 0;
55185+}
55186+
55187+int
55188+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
55189+{
55190+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
55191+ struct task_struct *p;
55192+ int ret = 0;
55193+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
55194+ return ret;
55195+
55196+ read_lock(&tasklist_lock);
55197+ do_each_pid_task(pid, type, p) {
55198+ if (!have_same_root(current, p)) {
55199+ ret = 1;
55200+ goto out;
55201+ }
55202+ } while_each_pid_task(pid, type, p);
55203+out:
55204+ read_unlock(&tasklist_lock);
55205+ return ret;
55206+#endif
55207+ return 0;
55208+}
55209+
55210+int
55211+gr_pid_is_chrooted(struct task_struct *p)
55212+{
55213+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
55214+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
55215+ return 0;
55216+
55217+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
55218+ !have_same_root(current, p)) {
55219+ return 1;
55220+ }
55221+#endif
55222+ return 0;
55223+}
55224+
55225+EXPORT_SYMBOL(gr_pid_is_chrooted);
55226+
55227+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
55228+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
55229+{
55230+ struct dentry *dentry = (struct dentry *)u_dentry;
55231+ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
55232+ struct dentry *realroot;
55233+ struct vfsmount *realrootmnt;
55234+ struct dentry *currentroot;
55235+ struct vfsmount *currentmnt;
55236+ struct task_struct *reaper = &init_task;
55237+ int ret = 1;
55238+
55239+ read_lock(&reaper->fs->lock);
55240+ realrootmnt = mntget(reaper->fs->root.mnt);
55241+ realroot = dget(reaper->fs->root.dentry);
55242+ read_unlock(&reaper->fs->lock);
55243+
55244+ read_lock(&current->fs->lock);
55245+ currentmnt = mntget(current->fs->root.mnt);
55246+ currentroot = dget(current->fs->root.dentry);
55247+ read_unlock(&current->fs->lock);
55248+
55249+ spin_lock(&dcache_lock);
55250+ for (;;) {
55251+ if (unlikely((dentry == realroot && mnt == realrootmnt)
55252+ || (dentry == currentroot && mnt == currentmnt)))
55253+ break;
55254+ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
55255+ if (mnt->mnt_parent == mnt)
55256+ break;
55257+ dentry = mnt->mnt_mountpoint;
55258+ mnt = mnt->mnt_parent;
55259+ continue;
55260+ }
55261+ dentry = dentry->d_parent;
55262+ }
55263+ spin_unlock(&dcache_lock);
55264+
55265+ dput(currentroot);
55266+ mntput(currentmnt);
55267+
55268+ /* access is outside of chroot */
55269+ if (dentry == realroot && mnt == realrootmnt)
55270+ ret = 0;
55271+
55272+ dput(realroot);
55273+ mntput(realrootmnt);
55274+ return ret;
55275+}
55276+#endif
55277+
55278+int
55279+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
55280+{
55281+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
55282+ if (!grsec_enable_chroot_fchdir)
55283+ return 1;
55284+
55285+ if (!proc_is_chrooted(current))
55286+ return 1;
55287+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
55288+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
55289+ return 0;
55290+ }
55291+#endif
55292+ return 1;
55293+}
55294+
55295+int
55296+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
55297+ const time_t shm_createtime)
55298+{
55299+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
55300+ struct task_struct *p;
55301+ time_t starttime;
55302+
55303+ if (unlikely(!grsec_enable_chroot_shmat))
55304+ return 1;
55305+
55306+ if (likely(!proc_is_chrooted(current)))
55307+ return 1;
55308+
55309+ rcu_read_lock();
55310+ read_lock(&tasklist_lock);
55311+
55312+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
55313+ starttime = p->start_time.tv_sec;
55314+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
55315+ if (have_same_root(current, p)) {
55316+ goto allow;
55317+ } else {
55318+ read_unlock(&tasklist_lock);
55319+ rcu_read_unlock();
55320+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
55321+ return 0;
55322+ }
55323+ }
55324+ /* creator exited, pid reuse, fall through to next check */
55325+ }
55326+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
55327+ if (unlikely(!have_same_root(current, p))) {
55328+ read_unlock(&tasklist_lock);
55329+ rcu_read_unlock();
55330+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
55331+ return 0;
55332+ }
55333+ }
55334+
55335+allow:
55336+ read_unlock(&tasklist_lock);
55337+ rcu_read_unlock();
55338+#endif
55339+ return 1;
55340+}
55341+
55342+void
55343+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
55344+{
55345+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
55346+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
55347+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
55348+#endif
55349+ return;
55350+}
55351+
55352+int
55353+gr_handle_chroot_mknod(const struct dentry *dentry,
55354+ const struct vfsmount *mnt, const int mode)
55355+{
55356+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
55357+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
55358+ proc_is_chrooted(current)) {
55359+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
55360+ return -EPERM;
55361+ }
55362+#endif
55363+ return 0;
55364+}
55365+
55366+int
55367+gr_handle_chroot_mount(const struct dentry *dentry,
55368+ const struct vfsmount *mnt, const char *dev_name)
55369+{
55370+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
55371+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
55372+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
55373+ return -EPERM;
55374+ }
55375+#endif
55376+ return 0;
55377+}
55378+
55379+int
55380+gr_handle_chroot_pivot(void)
55381+{
55382+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
55383+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
55384+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
55385+ return -EPERM;
55386+ }
55387+#endif
55388+ return 0;
55389+}
55390+
55391+int
55392+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
55393+{
55394+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
55395+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
55396+ !gr_is_outside_chroot(dentry, mnt)) {
55397+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
55398+ return -EPERM;
55399+ }
55400+#endif
55401+ return 0;
55402+}
55403+
55404+extern const char *captab_log[];
55405+extern int captab_log_entries;
55406+
55407+int
55408+gr_chroot_is_capable(const int cap)
55409+{
55410+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
55411+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
55412+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
55413+ if (cap_raised(chroot_caps, cap)) {
55414+ const struct cred *creds = current_cred();
55415+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
55416+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
55417+ }
55418+ return 0;
55419+ }
55420+ }
55421+#endif
55422+ return 1;
55423+}
55424+
55425+int
55426+gr_chroot_is_capable_nolog(const int cap)
55427+{
55428+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
55429+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
55430+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
55431+ if (cap_raised(chroot_caps, cap)) {
55432+ return 0;
55433+ }
55434+ }
55435+#endif
55436+ return 1;
55437+}
55438+
55439+int
55440+gr_handle_chroot_sysctl(const int op)
55441+{
55442+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
55443+ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
55444+ && (op & MAY_WRITE))
55445+ return -EACCES;
55446+#endif
55447+ return 0;
55448+}
55449+
55450+void
55451+gr_handle_chroot_chdir(struct path *path)
55452+{
55453+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
55454+ if (grsec_enable_chroot_chdir)
55455+ set_fs_pwd(current->fs, path);
55456+#endif
55457+ return;
55458+}
55459+
55460+int
55461+gr_handle_chroot_chmod(const struct dentry *dentry,
55462+ const struct vfsmount *mnt, const int mode)
55463+{
55464+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
55465+ /* allow chmod +s on directories, but not on files */
55466+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
55467+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
55468+ proc_is_chrooted(current)) {
55469+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
55470+ return -EPERM;
55471+ }
55472+#endif
55473+ return 0;
55474+}
55475diff -urNp linux-2.6.32.46/grsecurity/grsec_disabled.c linux-2.6.32.46/grsecurity/grsec_disabled.c
55476--- linux-2.6.32.46/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
55477+++ linux-2.6.32.46/grsecurity/grsec_disabled.c 2011-04-17 15:56:46.000000000 -0400
55478@@ -0,0 +1,447 @@
55479+#include <linux/kernel.h>
55480+#include <linux/module.h>
55481+#include <linux/sched.h>
55482+#include <linux/file.h>
55483+#include <linux/fs.h>
55484+#include <linux/kdev_t.h>
55485+#include <linux/net.h>
55486+#include <linux/in.h>
55487+#include <linux/ip.h>
55488+#include <linux/skbuff.h>
55489+#include <linux/sysctl.h>
55490+
55491+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
55492+void
55493+pax_set_initial_flags(struct linux_binprm *bprm)
55494+{
55495+ return;
55496+}
55497+#endif
55498+
55499+#ifdef CONFIG_SYSCTL
55500+__u32
55501+gr_handle_sysctl(const struct ctl_table * table, const int op)
55502+{
55503+ return 0;
55504+}
55505+#endif
55506+
55507+#ifdef CONFIG_TASKSTATS
55508+int gr_is_taskstats_denied(int pid)
55509+{
55510+ return 0;
55511+}
55512+#endif
55513+
55514+int
55515+gr_acl_is_enabled(void)
55516+{
55517+ return 0;
55518+}
55519+
55520+int
55521+gr_handle_rawio(const struct inode *inode)
55522+{
55523+ return 0;
55524+}
55525+
55526+void
55527+gr_acl_handle_psacct(struct task_struct *task, const long code)
55528+{
55529+ return;
55530+}
55531+
55532+int
55533+gr_handle_ptrace(struct task_struct *task, const long request)
55534+{
55535+ return 0;
55536+}
55537+
55538+int
55539+gr_handle_proc_ptrace(struct task_struct *task)
55540+{
55541+ return 0;
55542+}
55543+
55544+void
55545+gr_learn_resource(const struct task_struct *task,
55546+ const int res, const unsigned long wanted, const int gt)
55547+{
55548+ return;
55549+}
55550+
55551+int
55552+gr_set_acls(const int type)
55553+{
55554+ return 0;
55555+}
55556+
55557+int
55558+gr_check_hidden_task(const struct task_struct *tsk)
55559+{
55560+ return 0;
55561+}
55562+
55563+int
55564+gr_check_protected_task(const struct task_struct *task)
55565+{
55566+ return 0;
55567+}
55568+
55569+int
55570+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
55571+{
55572+ return 0;
55573+}
55574+
55575+void
55576+gr_copy_label(struct task_struct *tsk)
55577+{
55578+ return;
55579+}
55580+
55581+void
55582+gr_set_pax_flags(struct task_struct *task)
55583+{
55584+ return;
55585+}
55586+
55587+int
55588+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
55589+ const int unsafe_share)
55590+{
55591+ return 0;
55592+}
55593+
55594+void
55595+gr_handle_delete(const ino_t ino, const dev_t dev)
55596+{
55597+ return;
55598+}
55599+
55600+void
55601+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
55602+{
55603+ return;
55604+}
55605+
55606+void
55607+gr_handle_crash(struct task_struct *task, const int sig)
55608+{
55609+ return;
55610+}
55611+
55612+int
55613+gr_check_crash_exec(const struct file *filp)
55614+{
55615+ return 0;
55616+}
55617+
55618+int
55619+gr_check_crash_uid(const uid_t uid)
55620+{
55621+ return 0;
55622+}
55623+
55624+void
55625+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
55626+ struct dentry *old_dentry,
55627+ struct dentry *new_dentry,
55628+ struct vfsmount *mnt, const __u8 replace)
55629+{
55630+ return;
55631+}
55632+
55633+int
55634+gr_search_socket(const int family, const int type, const int protocol)
55635+{
55636+ return 1;
55637+}
55638+
55639+int
55640+gr_search_connectbind(const int mode, const struct socket *sock,
55641+ const struct sockaddr_in *addr)
55642+{
55643+ return 0;
55644+}
55645+
55646+int
55647+gr_is_capable(const int cap)
55648+{
55649+ return 1;
55650+}
55651+
55652+int
55653+gr_is_capable_nolog(const int cap)
55654+{
55655+ return 1;
55656+}
55657+
55658+void
55659+gr_handle_alertkill(struct task_struct *task)
55660+{
55661+ return;
55662+}
55663+
55664+__u32
55665+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
55666+{
55667+ return 1;
55668+}
55669+
55670+__u32
55671+gr_acl_handle_hidden_file(const struct dentry * dentry,
55672+ const struct vfsmount * mnt)
55673+{
55674+ return 1;
55675+}
55676+
55677+__u32
55678+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55679+ const int fmode)
55680+{
55681+ return 1;
55682+}
55683+
55684+__u32
55685+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55686+{
55687+ return 1;
55688+}
55689+
55690+__u32
55691+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
55692+{
55693+ return 1;
55694+}
55695+
55696+int
55697+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
55698+ unsigned int *vm_flags)
55699+{
55700+ return 1;
55701+}
55702+
55703+__u32
55704+gr_acl_handle_truncate(const struct dentry * dentry,
55705+ const struct vfsmount * mnt)
55706+{
55707+ return 1;
55708+}
55709+
55710+__u32
55711+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
55712+{
55713+ return 1;
55714+}
55715+
55716+__u32
55717+gr_acl_handle_access(const struct dentry * dentry,
55718+ const struct vfsmount * mnt, const int fmode)
55719+{
55720+ return 1;
55721+}
55722+
55723+__u32
55724+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
55725+ mode_t mode)
55726+{
55727+ return 1;
55728+}
55729+
55730+__u32
55731+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
55732+ mode_t mode)
55733+{
55734+ return 1;
55735+}
55736+
55737+__u32
55738+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
55739+{
55740+ return 1;
55741+}
55742+
55743+__u32
55744+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
55745+{
55746+ return 1;
55747+}
55748+
55749+void
55750+grsecurity_init(void)
55751+{
55752+ return;
55753+}
55754+
55755+__u32
55756+gr_acl_handle_mknod(const struct dentry * new_dentry,
55757+ const struct dentry * parent_dentry,
55758+ const struct vfsmount * parent_mnt,
55759+ const int mode)
55760+{
55761+ return 1;
55762+}
55763+
55764+__u32
55765+gr_acl_handle_mkdir(const struct dentry * new_dentry,
55766+ const struct dentry * parent_dentry,
55767+ const struct vfsmount * parent_mnt)
55768+{
55769+ return 1;
55770+}
55771+
55772+__u32
55773+gr_acl_handle_symlink(const struct dentry * new_dentry,
55774+ const struct dentry * parent_dentry,
55775+ const struct vfsmount * parent_mnt, const char *from)
55776+{
55777+ return 1;
55778+}
55779+
55780+__u32
55781+gr_acl_handle_link(const struct dentry * new_dentry,
55782+ const struct dentry * parent_dentry,
55783+ const struct vfsmount * parent_mnt,
55784+ const struct dentry * old_dentry,
55785+ const struct vfsmount * old_mnt, const char *to)
55786+{
55787+ return 1;
55788+}
55789+
55790+int
55791+gr_acl_handle_rename(const struct dentry *new_dentry,
55792+ const struct dentry *parent_dentry,
55793+ const struct vfsmount *parent_mnt,
55794+ const struct dentry *old_dentry,
55795+ const struct inode *old_parent_inode,
55796+ const struct vfsmount *old_mnt, const char *newname)
55797+{
55798+ return 0;
55799+}
55800+
55801+int
55802+gr_acl_handle_filldir(const struct file *file, const char *name,
55803+ const int namelen, const ino_t ino)
55804+{
55805+ return 1;
55806+}
55807+
55808+int
55809+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
55810+ const time_t shm_createtime, const uid_t cuid, const int shmid)
55811+{
55812+ return 1;
55813+}
55814+
55815+int
55816+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
55817+{
55818+ return 0;
55819+}
55820+
55821+int
55822+gr_search_accept(const struct socket *sock)
55823+{
55824+ return 0;
55825+}
55826+
55827+int
55828+gr_search_listen(const struct socket *sock)
55829+{
55830+ return 0;
55831+}
55832+
55833+int
55834+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
55835+{
55836+ return 0;
55837+}
55838+
55839+__u32
55840+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
55841+{
55842+ return 1;
55843+}
55844+
55845+__u32
55846+gr_acl_handle_creat(const struct dentry * dentry,
55847+ const struct dentry * p_dentry,
55848+ const struct vfsmount * p_mnt, const int fmode,
55849+ const int imode)
55850+{
55851+ return 1;
55852+}
55853+
55854+void
55855+gr_acl_handle_exit(void)
55856+{
55857+ return;
55858+}
55859+
55860+int
55861+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55862+{
55863+ return 1;
55864+}
55865+
55866+void
55867+gr_set_role_label(const uid_t uid, const gid_t gid)
55868+{
55869+ return;
55870+}
55871+
55872+int
55873+gr_acl_handle_procpidmem(const struct task_struct *task)
55874+{
55875+ return 0;
55876+}
55877+
55878+int
55879+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
55880+{
55881+ return 0;
55882+}
55883+
55884+int
55885+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
55886+{
55887+ return 0;
55888+}
55889+
55890+void
55891+gr_set_kernel_label(struct task_struct *task)
55892+{
55893+ return;
55894+}
55895+
55896+int
55897+gr_check_user_change(int real, int effective, int fs)
55898+{
55899+ return 0;
55900+}
55901+
55902+int
55903+gr_check_group_change(int real, int effective, int fs)
55904+{
55905+ return 0;
55906+}
55907+
55908+int gr_acl_enable_at_secure(void)
55909+{
55910+ return 0;
55911+}
55912+
55913+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
55914+{
55915+ return dentry->d_inode->i_sb->s_dev;
55916+}
55917+
55918+EXPORT_SYMBOL(gr_is_capable);
55919+EXPORT_SYMBOL(gr_is_capable_nolog);
55920+EXPORT_SYMBOL(gr_learn_resource);
55921+EXPORT_SYMBOL(gr_set_kernel_label);
55922+#ifdef CONFIG_SECURITY
55923+EXPORT_SYMBOL(gr_check_user_change);
55924+EXPORT_SYMBOL(gr_check_group_change);
55925+#endif
55926diff -urNp linux-2.6.32.46/grsecurity/grsec_exec.c linux-2.6.32.46/grsecurity/grsec_exec.c
55927--- linux-2.6.32.46/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
55928+++ linux-2.6.32.46/grsecurity/grsec_exec.c 2011-09-13 22:54:27.000000000 -0400
55929@@ -0,0 +1,204 @@
55930+#include <linux/kernel.h>
55931+#include <linux/sched.h>
55932+#include <linux/file.h>
55933+#include <linux/binfmts.h>
55934+#include <linux/smp_lock.h>
55935+#include <linux/fs.h>
55936+#include <linux/types.h>
55937+#include <linux/grdefs.h>
55938+#include <linux/grinternal.h>
55939+#include <linux/capability.h>
55940+#include <linux/compat.h>
55941+#include <linux/module.h>
55942+
55943+#include <asm/uaccess.h>
55944+
55945+#ifdef CONFIG_GRKERNSEC_EXECLOG
55946+static char gr_exec_arg_buf[132];
55947+static DEFINE_MUTEX(gr_exec_arg_mutex);
55948+#endif
55949+
55950+void
55951+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
55952+{
55953+#ifdef CONFIG_GRKERNSEC_EXECLOG
55954+ char *grarg = gr_exec_arg_buf;
55955+ unsigned int i, x, execlen = 0;
55956+ char c;
55957+
55958+ if (!((grsec_enable_execlog && grsec_enable_group &&
55959+ in_group_p(grsec_audit_gid))
55960+ || (grsec_enable_execlog && !grsec_enable_group)))
55961+ return;
55962+
55963+ mutex_lock(&gr_exec_arg_mutex);
55964+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
55965+
55966+ if (unlikely(argv == NULL))
55967+ goto log;
55968+
55969+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
55970+ const char __user *p;
55971+ unsigned int len;
55972+
55973+ if (copy_from_user(&p, argv + i, sizeof(p)))
55974+ goto log;
55975+ if (!p)
55976+ goto log;
55977+ len = strnlen_user(p, 128 - execlen);
55978+ if (len > 128 - execlen)
55979+ len = 128 - execlen;
55980+ else if (len > 0)
55981+ len--;
55982+ if (copy_from_user(grarg + execlen, p, len))
55983+ goto log;
55984+
55985+ /* rewrite unprintable characters */
55986+ for (x = 0; x < len; x++) {
55987+ c = *(grarg + execlen + x);
55988+ if (c < 32 || c > 126)
55989+ *(grarg + execlen + x) = ' ';
55990+ }
55991+
55992+ execlen += len;
55993+ *(grarg + execlen) = ' ';
55994+ *(grarg + execlen + 1) = '\0';
55995+ execlen++;
55996+ }
55997+
55998+ log:
55999+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
56000+ bprm->file->f_path.mnt, grarg);
56001+ mutex_unlock(&gr_exec_arg_mutex);
56002+#endif
56003+ return;
56004+}
56005+
56006+#ifdef CONFIG_COMPAT
56007+void
56008+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
56009+{
56010+#ifdef CONFIG_GRKERNSEC_EXECLOG
56011+ char *grarg = gr_exec_arg_buf;
56012+ unsigned int i, x, execlen = 0;
56013+ char c;
56014+
56015+ if (!((grsec_enable_execlog && grsec_enable_group &&
56016+ in_group_p(grsec_audit_gid))
56017+ || (grsec_enable_execlog && !grsec_enable_group)))
56018+ return;
56019+
56020+ mutex_lock(&gr_exec_arg_mutex);
56021+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
56022+
56023+ if (unlikely(argv == NULL))
56024+ goto log;
56025+
56026+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
56027+ compat_uptr_t p;
56028+ unsigned int len;
56029+
56030+ if (get_user(p, argv + i))
56031+ goto log;
56032+ len = strnlen_user(compat_ptr(p), 128 - execlen);
56033+ if (len > 128 - execlen)
56034+ len = 128 - execlen;
56035+ else if (len > 0)
56036+ len--;
56037+ else
56038+ goto log;
56039+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
56040+ goto log;
56041+
56042+ /* rewrite unprintable characters */
56043+ for (x = 0; x < len; x++) {
56044+ c = *(grarg + execlen + x);
56045+ if (c < 32 || c > 126)
56046+ *(grarg + execlen + x) = ' ';
56047+ }
56048+
56049+ execlen += len;
56050+ *(grarg + execlen) = ' ';
56051+ *(grarg + execlen + 1) = '\0';
56052+ execlen++;
56053+ }
56054+
56055+ log:
56056+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
56057+ bprm->file->f_path.mnt, grarg);
56058+ mutex_unlock(&gr_exec_arg_mutex);
56059+#endif
56060+ return;
56061+}
56062+#endif
56063+
56064+#ifdef CONFIG_GRKERNSEC
56065+extern int gr_acl_is_capable(const int cap);
56066+extern int gr_acl_is_capable_nolog(const int cap);
56067+extern int gr_chroot_is_capable(const int cap);
56068+extern int gr_chroot_is_capable_nolog(const int cap);
56069+#endif
56070+
56071+const char *captab_log[] = {
56072+ "CAP_CHOWN",
56073+ "CAP_DAC_OVERRIDE",
56074+ "CAP_DAC_READ_SEARCH",
56075+ "CAP_FOWNER",
56076+ "CAP_FSETID",
56077+ "CAP_KILL",
56078+ "CAP_SETGID",
56079+ "CAP_SETUID",
56080+ "CAP_SETPCAP",
56081+ "CAP_LINUX_IMMUTABLE",
56082+ "CAP_NET_BIND_SERVICE",
56083+ "CAP_NET_BROADCAST",
56084+ "CAP_NET_ADMIN",
56085+ "CAP_NET_RAW",
56086+ "CAP_IPC_LOCK",
56087+ "CAP_IPC_OWNER",
56088+ "CAP_SYS_MODULE",
56089+ "CAP_SYS_RAWIO",
56090+ "CAP_SYS_CHROOT",
56091+ "CAP_SYS_PTRACE",
56092+ "CAP_SYS_PACCT",
56093+ "CAP_SYS_ADMIN",
56094+ "CAP_SYS_BOOT",
56095+ "CAP_SYS_NICE",
56096+ "CAP_SYS_RESOURCE",
56097+ "CAP_SYS_TIME",
56098+ "CAP_SYS_TTY_CONFIG",
56099+ "CAP_MKNOD",
56100+ "CAP_LEASE",
56101+ "CAP_AUDIT_WRITE",
56102+ "CAP_AUDIT_CONTROL",
56103+ "CAP_SETFCAP",
56104+ "CAP_MAC_OVERRIDE",
56105+ "CAP_MAC_ADMIN"
56106+};
56107+
56108+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
56109+
56110+int gr_is_capable(const int cap)
56111+{
56112+#ifdef CONFIG_GRKERNSEC
56113+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
56114+ return 1;
56115+ return 0;
56116+#else
56117+ return 1;
56118+#endif
56119+}
56120+
56121+int gr_is_capable_nolog(const int cap)
56122+{
56123+#ifdef CONFIG_GRKERNSEC
56124+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
56125+ return 1;
56126+ return 0;
56127+#else
56128+ return 1;
56129+#endif
56130+}
56131+
56132+EXPORT_SYMBOL(gr_is_capable);
56133+EXPORT_SYMBOL(gr_is_capable_nolog);
56134diff -urNp linux-2.6.32.46/grsecurity/grsec_fifo.c linux-2.6.32.46/grsecurity/grsec_fifo.c
56135--- linux-2.6.32.46/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
56136+++ linux-2.6.32.46/grsecurity/grsec_fifo.c 2011-04-17 15:56:46.000000000 -0400
56137@@ -0,0 +1,24 @@
56138+#include <linux/kernel.h>
56139+#include <linux/sched.h>
56140+#include <linux/fs.h>
56141+#include <linux/file.h>
56142+#include <linux/grinternal.h>
56143+
56144+int
56145+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
56146+ const struct dentry *dir, const int flag, const int acc_mode)
56147+{
56148+#ifdef CONFIG_GRKERNSEC_FIFO
56149+ const struct cred *cred = current_cred();
56150+
56151+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
56152+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
56153+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
56154+ (cred->fsuid != dentry->d_inode->i_uid)) {
56155+ if (!inode_permission(dentry->d_inode, acc_mode))
56156+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
56157+ return -EACCES;
56158+ }
56159+#endif
56160+ return 0;
56161+}
56162diff -urNp linux-2.6.32.46/grsecurity/grsec_fork.c linux-2.6.32.46/grsecurity/grsec_fork.c
56163--- linux-2.6.32.46/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
56164+++ linux-2.6.32.46/grsecurity/grsec_fork.c 2011-04-17 15:56:46.000000000 -0400
56165@@ -0,0 +1,23 @@
56166+#include <linux/kernel.h>
56167+#include <linux/sched.h>
56168+#include <linux/grsecurity.h>
56169+#include <linux/grinternal.h>
56170+#include <linux/errno.h>
56171+
56172+void
56173+gr_log_forkfail(const int retval)
56174+{
56175+#ifdef CONFIG_GRKERNSEC_FORKFAIL
56176+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
56177+ switch (retval) {
56178+ case -EAGAIN:
56179+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
56180+ break;
56181+ case -ENOMEM:
56182+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
56183+ break;
56184+ }
56185+ }
56186+#endif
56187+ return;
56188+}
56189diff -urNp linux-2.6.32.46/grsecurity/grsec_init.c linux-2.6.32.46/grsecurity/grsec_init.c
56190--- linux-2.6.32.46/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
56191+++ linux-2.6.32.46/grsecurity/grsec_init.c 2011-08-11 19:57:42.000000000 -0400
56192@@ -0,0 +1,270 @@
56193+#include <linux/kernel.h>
56194+#include <linux/sched.h>
56195+#include <linux/mm.h>
56196+#include <linux/smp_lock.h>
56197+#include <linux/gracl.h>
56198+#include <linux/slab.h>
56199+#include <linux/vmalloc.h>
56200+#include <linux/percpu.h>
56201+#include <linux/module.h>
56202+
56203+int grsec_enable_brute;
56204+int grsec_enable_link;
56205+int grsec_enable_dmesg;
56206+int grsec_enable_harden_ptrace;
56207+int grsec_enable_fifo;
56208+int grsec_enable_execlog;
56209+int grsec_enable_signal;
56210+int grsec_enable_forkfail;
56211+int grsec_enable_audit_ptrace;
56212+int grsec_enable_time;
56213+int grsec_enable_audit_textrel;
56214+int grsec_enable_group;
56215+int grsec_audit_gid;
56216+int grsec_enable_chdir;
56217+int grsec_enable_mount;
56218+int grsec_enable_rofs;
56219+int grsec_enable_chroot_findtask;
56220+int grsec_enable_chroot_mount;
56221+int grsec_enable_chroot_shmat;
56222+int grsec_enable_chroot_fchdir;
56223+int grsec_enable_chroot_double;
56224+int grsec_enable_chroot_pivot;
56225+int grsec_enable_chroot_chdir;
56226+int grsec_enable_chroot_chmod;
56227+int grsec_enable_chroot_mknod;
56228+int grsec_enable_chroot_nice;
56229+int grsec_enable_chroot_execlog;
56230+int grsec_enable_chroot_caps;
56231+int grsec_enable_chroot_sysctl;
56232+int grsec_enable_chroot_unix;
56233+int grsec_enable_tpe;
56234+int grsec_tpe_gid;
56235+int grsec_enable_blackhole;
56236+#ifdef CONFIG_IPV6_MODULE
56237+EXPORT_SYMBOL(grsec_enable_blackhole);
56238+#endif
56239+int grsec_lastack_retries;
56240+int grsec_enable_tpe_all;
56241+int grsec_enable_tpe_invert;
56242+int grsec_enable_socket_all;
56243+int grsec_socket_all_gid;
56244+int grsec_enable_socket_client;
56245+int grsec_socket_client_gid;
56246+int grsec_enable_socket_server;
56247+int grsec_socket_server_gid;
56248+int grsec_resource_logging;
56249+int grsec_disable_privio;
56250+int grsec_enable_log_rwxmaps;
56251+int grsec_lock;
56252+
56253+DEFINE_SPINLOCK(grsec_alert_lock);
56254+unsigned long grsec_alert_wtime = 0;
56255+unsigned long grsec_alert_fyet = 0;
56256+
56257+DEFINE_SPINLOCK(grsec_audit_lock);
56258+
56259+DEFINE_RWLOCK(grsec_exec_file_lock);
56260+
56261+char *gr_shared_page[4];
56262+
56263+char *gr_alert_log_fmt;
56264+char *gr_audit_log_fmt;
56265+char *gr_alert_log_buf;
56266+char *gr_audit_log_buf;
56267+
56268+extern struct gr_arg *gr_usermode;
56269+extern unsigned char *gr_system_salt;
56270+extern unsigned char *gr_system_sum;
56271+
56272+void __init
56273+grsecurity_init(void)
56274+{
56275+ int j;
56276+ /* create the per-cpu shared pages */
56277+
56278+#ifdef CONFIG_X86
56279+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
56280+#endif
56281+
56282+ for (j = 0; j < 4; j++) {
56283+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
56284+ if (gr_shared_page[j] == NULL) {
56285+ panic("Unable to allocate grsecurity shared page");
56286+ return;
56287+ }
56288+ }
56289+
56290+ /* allocate log buffers */
56291+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
56292+ if (!gr_alert_log_fmt) {
56293+ panic("Unable to allocate grsecurity alert log format buffer");
56294+ return;
56295+ }
56296+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
56297+ if (!gr_audit_log_fmt) {
56298+ panic("Unable to allocate grsecurity audit log format buffer");
56299+ return;
56300+ }
56301+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
56302+ if (!gr_alert_log_buf) {
56303+ panic("Unable to allocate grsecurity alert log buffer");
56304+ return;
56305+ }
56306+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
56307+ if (!gr_audit_log_buf) {
56308+ panic("Unable to allocate grsecurity audit log buffer");
56309+ return;
56310+ }
56311+
56312+ /* allocate memory for authentication structure */
56313+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
56314+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
56315+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
56316+
56317+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
56318+ panic("Unable to allocate grsecurity authentication structure");
56319+ return;
56320+ }
56321+
56322+
56323+#ifdef CONFIG_GRKERNSEC_IO
56324+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
56325+ grsec_disable_privio = 1;
56326+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
56327+ grsec_disable_privio = 1;
56328+#else
56329+ grsec_disable_privio = 0;
56330+#endif
56331+#endif
56332+
56333+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
56334+ /* for backward compatibility, tpe_invert always defaults to on if
56335+ enabled in the kernel
56336+ */
56337+ grsec_enable_tpe_invert = 1;
56338+#endif
56339+
56340+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
56341+#ifndef CONFIG_GRKERNSEC_SYSCTL
56342+ grsec_lock = 1;
56343+#endif
56344+
56345+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
56346+ grsec_enable_audit_textrel = 1;
56347+#endif
56348+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
56349+ grsec_enable_log_rwxmaps = 1;
56350+#endif
56351+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
56352+ grsec_enable_group = 1;
56353+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
56354+#endif
56355+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56356+ grsec_enable_chdir = 1;
56357+#endif
56358+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
56359+ grsec_enable_harden_ptrace = 1;
56360+#endif
56361+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
56362+ grsec_enable_mount = 1;
56363+#endif
56364+#ifdef CONFIG_GRKERNSEC_LINK
56365+ grsec_enable_link = 1;
56366+#endif
56367+#ifdef CONFIG_GRKERNSEC_BRUTE
56368+ grsec_enable_brute = 1;
56369+#endif
56370+#ifdef CONFIG_GRKERNSEC_DMESG
56371+ grsec_enable_dmesg = 1;
56372+#endif
56373+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
56374+ grsec_enable_blackhole = 1;
56375+ grsec_lastack_retries = 4;
56376+#endif
56377+#ifdef CONFIG_GRKERNSEC_FIFO
56378+ grsec_enable_fifo = 1;
56379+#endif
56380+#ifdef CONFIG_GRKERNSEC_EXECLOG
56381+ grsec_enable_execlog = 1;
56382+#endif
56383+#ifdef CONFIG_GRKERNSEC_SIGNAL
56384+ grsec_enable_signal = 1;
56385+#endif
56386+#ifdef CONFIG_GRKERNSEC_FORKFAIL
56387+ grsec_enable_forkfail = 1;
56388+#endif
56389+#ifdef CONFIG_GRKERNSEC_TIME
56390+ grsec_enable_time = 1;
56391+#endif
56392+#ifdef CONFIG_GRKERNSEC_RESLOG
56393+ grsec_resource_logging = 1;
56394+#endif
56395+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56396+ grsec_enable_chroot_findtask = 1;
56397+#endif
56398+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
56399+ grsec_enable_chroot_unix = 1;
56400+#endif
56401+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
56402+ grsec_enable_chroot_mount = 1;
56403+#endif
56404+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
56405+ grsec_enable_chroot_fchdir = 1;
56406+#endif
56407+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
56408+ grsec_enable_chroot_shmat = 1;
56409+#endif
56410+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
56411+ grsec_enable_audit_ptrace = 1;
56412+#endif
56413+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
56414+ grsec_enable_chroot_double = 1;
56415+#endif
56416+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
56417+ grsec_enable_chroot_pivot = 1;
56418+#endif
56419+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
56420+ grsec_enable_chroot_chdir = 1;
56421+#endif
56422+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
56423+ grsec_enable_chroot_chmod = 1;
56424+#endif
56425+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
56426+ grsec_enable_chroot_mknod = 1;
56427+#endif
56428+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56429+ grsec_enable_chroot_nice = 1;
56430+#endif
56431+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
56432+ grsec_enable_chroot_execlog = 1;
56433+#endif
56434+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56435+ grsec_enable_chroot_caps = 1;
56436+#endif
56437+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
56438+ grsec_enable_chroot_sysctl = 1;
56439+#endif
56440+#ifdef CONFIG_GRKERNSEC_TPE
56441+ grsec_enable_tpe = 1;
56442+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
56443+#ifdef CONFIG_GRKERNSEC_TPE_ALL
56444+ grsec_enable_tpe_all = 1;
56445+#endif
56446+#endif
56447+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
56448+ grsec_enable_socket_all = 1;
56449+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
56450+#endif
56451+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
56452+ grsec_enable_socket_client = 1;
56453+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
56454+#endif
56455+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
56456+ grsec_enable_socket_server = 1;
56457+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
56458+#endif
56459+#endif
56460+
56461+ return;
56462+}
56463diff -urNp linux-2.6.32.46/grsecurity/grsec_link.c linux-2.6.32.46/grsecurity/grsec_link.c
56464--- linux-2.6.32.46/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
56465+++ linux-2.6.32.46/grsecurity/grsec_link.c 2011-04-17 15:56:46.000000000 -0400
56466@@ -0,0 +1,43 @@
56467+#include <linux/kernel.h>
56468+#include <linux/sched.h>
56469+#include <linux/fs.h>
56470+#include <linux/file.h>
56471+#include <linux/grinternal.h>
56472+
56473+int
56474+gr_handle_follow_link(const struct inode *parent,
56475+ const struct inode *inode,
56476+ const struct dentry *dentry, const struct vfsmount *mnt)
56477+{
56478+#ifdef CONFIG_GRKERNSEC_LINK
56479+ const struct cred *cred = current_cred();
56480+
56481+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
56482+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
56483+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
56484+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
56485+ return -EACCES;
56486+ }
56487+#endif
56488+ return 0;
56489+}
56490+
56491+int
56492+gr_handle_hardlink(const struct dentry *dentry,
56493+ const struct vfsmount *mnt,
56494+ struct inode *inode, const int mode, const char *to)
56495+{
56496+#ifdef CONFIG_GRKERNSEC_LINK
56497+ const struct cred *cred = current_cred();
56498+
56499+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
56500+ (!S_ISREG(mode) || (mode & S_ISUID) ||
56501+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
56502+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
56503+ !capable(CAP_FOWNER) && cred->uid) {
56504+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
56505+ return -EPERM;
56506+ }
56507+#endif
56508+ return 0;
56509+}
56510diff -urNp linux-2.6.32.46/grsecurity/grsec_log.c linux-2.6.32.46/grsecurity/grsec_log.c
56511--- linux-2.6.32.46/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
56512+++ linux-2.6.32.46/grsecurity/grsec_log.c 2011-09-14 23:16:01.000000000 -0400
56513@@ -0,0 +1,313 @@
56514+#include <linux/kernel.h>
56515+#include <linux/sched.h>
56516+#include <linux/file.h>
56517+#include <linux/tty.h>
56518+#include <linux/fs.h>
56519+#include <linux/grinternal.h>
56520+
56521+#ifdef CONFIG_TREE_PREEMPT_RCU
56522+#define DISABLE_PREEMPT() preempt_disable()
56523+#define ENABLE_PREEMPT() preempt_enable()
56524+#else
56525+#define DISABLE_PREEMPT()
56526+#define ENABLE_PREEMPT()
56527+#endif
56528+
56529+#define BEGIN_LOCKS(x) \
56530+ DISABLE_PREEMPT(); \
56531+ rcu_read_lock(); \
56532+ read_lock(&tasklist_lock); \
56533+ read_lock(&grsec_exec_file_lock); \
56534+ if (x != GR_DO_AUDIT) \
56535+ spin_lock(&grsec_alert_lock); \
56536+ else \
56537+ spin_lock(&grsec_audit_lock)
56538+
56539+#define END_LOCKS(x) \
56540+ if (x != GR_DO_AUDIT) \
56541+ spin_unlock(&grsec_alert_lock); \
56542+ else \
56543+ spin_unlock(&grsec_audit_lock); \
56544+ read_unlock(&grsec_exec_file_lock); \
56545+ read_unlock(&tasklist_lock); \
56546+ rcu_read_unlock(); \
56547+ ENABLE_PREEMPT(); \
56548+ if (x == GR_DONT_AUDIT) \
56549+ gr_handle_alertkill(current)
56550+
56551+enum {
56552+ FLOODING,
56553+ NO_FLOODING
56554+};
56555+
56556+extern char *gr_alert_log_fmt;
56557+extern char *gr_audit_log_fmt;
56558+extern char *gr_alert_log_buf;
56559+extern char *gr_audit_log_buf;
56560+
56561+static int gr_log_start(int audit)
56562+{
56563+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
56564+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
56565+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
56566+ unsigned long curr_secs = get_seconds();
56567+
56568+ if (audit == GR_DO_AUDIT)
56569+ goto set_fmt;
56570+
56571+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
56572+ grsec_alert_wtime = curr_secs;
56573+ grsec_alert_fyet = 0;
56574+ } else if (time_before(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
56575+ if (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST) {
56576+ grsec_alert_fyet++;
56577+ } else if (grsec_alert_fyet && grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
56578+ grsec_alert_wtime = curr_secs;
56579+ grsec_alert_fyet++;
56580+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
56581+ return FLOODING;
56582+ }
56583+ } else return FLOODING;
56584+
56585+set_fmt:
56586+ memset(buf, 0, PAGE_SIZE);
56587+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
56588+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
56589+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
56590+ } else if (current->signal->curr_ip) {
56591+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
56592+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
56593+ } else if (gr_acl_is_enabled()) {
56594+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
56595+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
56596+ } else {
56597+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
56598+ strcpy(buf, fmt);
56599+ }
56600+
56601+ return NO_FLOODING;
56602+}
56603+
56604+static void gr_log_middle(int audit, const char *msg, va_list ap)
56605+ __attribute__ ((format (printf, 2, 0)));
56606+
56607+static void gr_log_middle(int audit, const char *msg, va_list ap)
56608+{
56609+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
56610+ unsigned int len = strlen(buf);
56611+
56612+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
56613+
56614+ return;
56615+}
56616+
56617+static void gr_log_middle_varargs(int audit, const char *msg, ...)
56618+ __attribute__ ((format (printf, 2, 3)));
56619+
56620+static void gr_log_middle_varargs(int audit, const char *msg, ...)
56621+{
56622+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
56623+ unsigned int len = strlen(buf);
56624+ va_list ap;
56625+
56626+ va_start(ap, msg);
56627+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
56628+ va_end(ap);
56629+
56630+ return;
56631+}
56632+
56633+static void gr_log_end(int audit)
56634+{
56635+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
56636+ unsigned int len = strlen(buf);
56637+
56638+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
56639+ printk("%s\n", buf);
56640+
56641+ return;
56642+}
56643+
56644+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
56645+{
56646+ int logtype;
56647+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
56648+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
56649+ void *voidptr = NULL;
56650+ int num1 = 0, num2 = 0;
56651+ unsigned long ulong1 = 0, ulong2 = 0;
56652+ struct dentry *dentry = NULL;
56653+ struct vfsmount *mnt = NULL;
56654+ struct file *file = NULL;
56655+ struct task_struct *task = NULL;
56656+ const struct cred *cred, *pcred;
56657+ va_list ap;
56658+
56659+ BEGIN_LOCKS(audit);
56660+ logtype = gr_log_start(audit);
56661+ if (logtype == FLOODING) {
56662+ END_LOCKS(audit);
56663+ return;
56664+ }
56665+ va_start(ap, argtypes);
56666+ switch (argtypes) {
56667+ case GR_TTYSNIFF:
56668+ task = va_arg(ap, struct task_struct *);
56669+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
56670+ break;
56671+ case GR_SYSCTL_HIDDEN:
56672+ str1 = va_arg(ap, char *);
56673+ gr_log_middle_varargs(audit, msg, result, str1);
56674+ break;
56675+ case GR_RBAC:
56676+ dentry = va_arg(ap, struct dentry *);
56677+ mnt = va_arg(ap, struct vfsmount *);
56678+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
56679+ break;
56680+ case GR_RBAC_STR:
56681+ dentry = va_arg(ap, struct dentry *);
56682+ mnt = va_arg(ap, struct vfsmount *);
56683+ str1 = va_arg(ap, char *);
56684+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
56685+ break;
56686+ case GR_STR_RBAC:
56687+ str1 = va_arg(ap, char *);
56688+ dentry = va_arg(ap, struct dentry *);
56689+ mnt = va_arg(ap, struct vfsmount *);
56690+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
56691+ break;
56692+ case GR_RBAC_MODE2:
56693+ dentry = va_arg(ap, struct dentry *);
56694+ mnt = va_arg(ap, struct vfsmount *);
56695+ str1 = va_arg(ap, char *);
56696+ str2 = va_arg(ap, char *);
56697+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
56698+ break;
56699+ case GR_RBAC_MODE3:
56700+ dentry = va_arg(ap, struct dentry *);
56701+ mnt = va_arg(ap, struct vfsmount *);
56702+ str1 = va_arg(ap, char *);
56703+ str2 = va_arg(ap, char *);
56704+ str3 = va_arg(ap, char *);
56705+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
56706+ break;
56707+ case GR_FILENAME:
56708+ dentry = va_arg(ap, struct dentry *);
56709+ mnt = va_arg(ap, struct vfsmount *);
56710+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
56711+ break;
56712+ case GR_STR_FILENAME:
56713+ str1 = va_arg(ap, char *);
56714+ dentry = va_arg(ap, struct dentry *);
56715+ mnt = va_arg(ap, struct vfsmount *);
56716+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
56717+ break;
56718+ case GR_FILENAME_STR:
56719+ dentry = va_arg(ap, struct dentry *);
56720+ mnt = va_arg(ap, struct vfsmount *);
56721+ str1 = va_arg(ap, char *);
56722+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
56723+ break;
56724+ case GR_FILENAME_TWO_INT:
56725+ dentry = va_arg(ap, struct dentry *);
56726+ mnt = va_arg(ap, struct vfsmount *);
56727+ num1 = va_arg(ap, int);
56728+ num2 = va_arg(ap, int);
56729+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
56730+ break;
56731+ case GR_FILENAME_TWO_INT_STR:
56732+ dentry = va_arg(ap, struct dentry *);
56733+ mnt = va_arg(ap, struct vfsmount *);
56734+ num1 = va_arg(ap, int);
56735+ num2 = va_arg(ap, int);
56736+ str1 = va_arg(ap, char *);
56737+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
56738+ break;
56739+ case GR_TEXTREL:
56740+ file = va_arg(ap, struct file *);
56741+ ulong1 = va_arg(ap, unsigned long);
56742+ ulong2 = va_arg(ap, unsigned long);
56743+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
56744+ break;
56745+ case GR_PTRACE:
56746+ task = va_arg(ap, struct task_struct *);
56747+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
56748+ break;
56749+ case GR_RESOURCE:
56750+ task = va_arg(ap, struct task_struct *);
56751+ cred = __task_cred(task);
56752+ pcred = __task_cred(task->real_parent);
56753+ ulong1 = va_arg(ap, unsigned long);
56754+ str1 = va_arg(ap, char *);
56755+ ulong2 = va_arg(ap, unsigned long);
56756+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
56757+ break;
56758+ case GR_CAP:
56759+ task = va_arg(ap, struct task_struct *);
56760+ cred = __task_cred(task);
56761+ pcred = __task_cred(task->real_parent);
56762+ str1 = va_arg(ap, char *);
56763+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
56764+ break;
56765+ case GR_SIG:
56766+ str1 = va_arg(ap, char *);
56767+ voidptr = va_arg(ap, void *);
56768+ gr_log_middle_varargs(audit, msg, str1, voidptr);
56769+ break;
56770+ case GR_SIG2:
56771+ task = va_arg(ap, struct task_struct *);
56772+ cred = __task_cred(task);
56773+ pcred = __task_cred(task->real_parent);
56774+ num1 = va_arg(ap, int);
56775+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
56776+ break;
56777+ case GR_CRASH1:
56778+ task = va_arg(ap, struct task_struct *);
56779+ cred = __task_cred(task);
56780+ pcred = __task_cred(task->real_parent);
56781+ ulong1 = va_arg(ap, unsigned long);
56782+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
56783+ break;
56784+ case GR_CRASH2:
56785+ task = va_arg(ap, struct task_struct *);
56786+ cred = __task_cred(task);
56787+ pcred = __task_cred(task->real_parent);
56788+ ulong1 = va_arg(ap, unsigned long);
56789+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
56790+ break;
56791+ case GR_RWXMAP:
56792+ file = va_arg(ap, struct file *);
56793+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
56794+ break;
56795+ case GR_PSACCT:
56796+ {
56797+ unsigned int wday, cday;
56798+ __u8 whr, chr;
56799+ __u8 wmin, cmin;
56800+ __u8 wsec, csec;
56801+ char cur_tty[64] = { 0 };
56802+ char parent_tty[64] = { 0 };
56803+
56804+ task = va_arg(ap, struct task_struct *);
56805+ wday = va_arg(ap, unsigned int);
56806+ cday = va_arg(ap, unsigned int);
56807+ whr = va_arg(ap, int);
56808+ chr = va_arg(ap, int);
56809+ wmin = va_arg(ap, int);
56810+ cmin = va_arg(ap, int);
56811+ wsec = va_arg(ap, int);
56812+ csec = va_arg(ap, int);
56813+ ulong1 = va_arg(ap, unsigned long);
56814+ cred = __task_cred(task);
56815+ pcred = __task_cred(task->real_parent);
56816+
56817+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
56818+ }
56819+ break;
56820+ default:
56821+ gr_log_middle(audit, msg, ap);
56822+ }
56823+ va_end(ap);
56824+ gr_log_end(audit);
56825+ END_LOCKS(audit);
56826+}
56827diff -urNp linux-2.6.32.46/grsecurity/grsec_mem.c linux-2.6.32.46/grsecurity/grsec_mem.c
56828--- linux-2.6.32.46/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
56829+++ linux-2.6.32.46/grsecurity/grsec_mem.c 2011-04-17 15:56:46.000000000 -0400
56830@@ -0,0 +1,33 @@
56831+#include <linux/kernel.h>
56832+#include <linux/sched.h>
56833+#include <linux/mm.h>
56834+#include <linux/mman.h>
56835+#include <linux/grinternal.h>
56836+
56837+void
56838+gr_handle_ioperm(void)
56839+{
56840+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
56841+ return;
56842+}
56843+
56844+void
56845+gr_handle_iopl(void)
56846+{
56847+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
56848+ return;
56849+}
56850+
56851+void
56852+gr_handle_mem_readwrite(u64 from, u64 to)
56853+{
56854+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
56855+ return;
56856+}
56857+
56858+void
56859+gr_handle_vm86(void)
56860+{
56861+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
56862+ return;
56863+}
56864diff -urNp linux-2.6.32.46/grsecurity/grsec_mount.c linux-2.6.32.46/grsecurity/grsec_mount.c
56865--- linux-2.6.32.46/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
56866+++ linux-2.6.32.46/grsecurity/grsec_mount.c 2011-06-20 19:47:03.000000000 -0400
56867@@ -0,0 +1,62 @@
56868+#include <linux/kernel.h>
56869+#include <linux/sched.h>
56870+#include <linux/mount.h>
56871+#include <linux/grsecurity.h>
56872+#include <linux/grinternal.h>
56873+
56874+void
56875+gr_log_remount(const char *devname, const int retval)
56876+{
56877+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
56878+ if (grsec_enable_mount && (retval >= 0))
56879+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
56880+#endif
56881+ return;
56882+}
56883+
56884+void
56885+gr_log_unmount(const char *devname, const int retval)
56886+{
56887+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
56888+ if (grsec_enable_mount && (retval >= 0))
56889+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
56890+#endif
56891+ return;
56892+}
56893+
56894+void
56895+gr_log_mount(const char *from, const char *to, const int retval)
56896+{
56897+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
56898+ if (grsec_enable_mount && (retval >= 0))
56899+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
56900+#endif
56901+ return;
56902+}
56903+
56904+int
56905+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
56906+{
56907+#ifdef CONFIG_GRKERNSEC_ROFS
56908+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
56909+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
56910+ return -EPERM;
56911+ } else
56912+ return 0;
56913+#endif
56914+ return 0;
56915+}
56916+
56917+int
56918+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
56919+{
56920+#ifdef CONFIG_GRKERNSEC_ROFS
56921+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
56922+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
56923+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
56924+ return -EPERM;
56925+ } else
56926+ return 0;
56927+#endif
56928+ return 0;
56929+}
56930diff -urNp linux-2.6.32.46/grsecurity/grsec_pax.c linux-2.6.32.46/grsecurity/grsec_pax.c
56931--- linux-2.6.32.46/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
56932+++ linux-2.6.32.46/grsecurity/grsec_pax.c 2011-04-17 15:56:46.000000000 -0400
56933@@ -0,0 +1,36 @@
56934+#include <linux/kernel.h>
56935+#include <linux/sched.h>
56936+#include <linux/mm.h>
56937+#include <linux/file.h>
56938+#include <linux/grinternal.h>
56939+#include <linux/grsecurity.h>
56940+
56941+void
56942+gr_log_textrel(struct vm_area_struct * vma)
56943+{
56944+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
56945+ if (grsec_enable_audit_textrel)
56946+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
56947+#endif
56948+ return;
56949+}
56950+
56951+void
56952+gr_log_rwxmmap(struct file *file)
56953+{
56954+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
56955+ if (grsec_enable_log_rwxmaps)
56956+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
56957+#endif
56958+ return;
56959+}
56960+
56961+void
56962+gr_log_rwxmprotect(struct file *file)
56963+{
56964+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
56965+ if (grsec_enable_log_rwxmaps)
56966+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
56967+#endif
56968+ return;
56969+}
56970diff -urNp linux-2.6.32.46/grsecurity/grsec_ptrace.c linux-2.6.32.46/grsecurity/grsec_ptrace.c
56971--- linux-2.6.32.46/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
56972+++ linux-2.6.32.46/grsecurity/grsec_ptrace.c 2011-04-17 15:56:46.000000000 -0400
56973@@ -0,0 +1,14 @@
56974+#include <linux/kernel.h>
56975+#include <linux/sched.h>
56976+#include <linux/grinternal.h>
56977+#include <linux/grsecurity.h>
56978+
56979+void
56980+gr_audit_ptrace(struct task_struct *task)
56981+{
56982+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
56983+ if (grsec_enable_audit_ptrace)
56984+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
56985+#endif
56986+ return;
56987+}
56988diff -urNp linux-2.6.32.46/grsecurity/grsec_sig.c linux-2.6.32.46/grsecurity/grsec_sig.c
56989--- linux-2.6.32.46/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
56990+++ linux-2.6.32.46/grsecurity/grsec_sig.c 2011-06-29 19:40:31.000000000 -0400
56991@@ -0,0 +1,205 @@
56992+#include <linux/kernel.h>
56993+#include <linux/sched.h>
56994+#include <linux/delay.h>
56995+#include <linux/grsecurity.h>
56996+#include <linux/grinternal.h>
56997+#include <linux/hardirq.h>
56998+
56999+char *signames[] = {
57000+ [SIGSEGV] = "Segmentation fault",
57001+ [SIGILL] = "Illegal instruction",
57002+ [SIGABRT] = "Abort",
57003+ [SIGBUS] = "Invalid alignment/Bus error"
57004+};
57005+
57006+void
57007+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
57008+{
57009+#ifdef CONFIG_GRKERNSEC_SIGNAL
57010+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
57011+ (sig == SIGABRT) || (sig == SIGBUS))) {
57012+ if (t->pid == current->pid) {
57013+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
57014+ } else {
57015+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
57016+ }
57017+ }
57018+#endif
57019+ return;
57020+}
57021+
57022+int
57023+gr_handle_signal(const struct task_struct *p, const int sig)
57024+{
57025+#ifdef CONFIG_GRKERNSEC
57026+ if (current->pid > 1 && gr_check_protected_task(p)) {
57027+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
57028+ return -EPERM;
57029+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
57030+ return -EPERM;
57031+ }
57032+#endif
57033+ return 0;
57034+}
57035+
57036+#ifdef CONFIG_GRKERNSEC
57037+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
57038+
57039+int gr_fake_force_sig(int sig, struct task_struct *t)
57040+{
57041+ unsigned long int flags;
57042+ int ret, blocked, ignored;
57043+ struct k_sigaction *action;
57044+
57045+ spin_lock_irqsave(&t->sighand->siglock, flags);
57046+ action = &t->sighand->action[sig-1];
57047+ ignored = action->sa.sa_handler == SIG_IGN;
57048+ blocked = sigismember(&t->blocked, sig);
57049+ if (blocked || ignored) {
57050+ action->sa.sa_handler = SIG_DFL;
57051+ if (blocked) {
57052+ sigdelset(&t->blocked, sig);
57053+ recalc_sigpending_and_wake(t);
57054+ }
57055+ }
57056+ if (action->sa.sa_handler == SIG_DFL)
57057+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
57058+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
57059+
57060+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
57061+
57062+ return ret;
57063+}
57064+#endif
57065+
57066+#ifdef CONFIG_GRKERNSEC_BRUTE
57067+#define GR_USER_BAN_TIME (15 * 60)
57068+
57069+static int __get_dumpable(unsigned long mm_flags)
57070+{
57071+ int ret;
57072+
57073+ ret = mm_flags & MMF_DUMPABLE_MASK;
57074+ return (ret >= 2) ? 2 : ret;
57075+}
57076+#endif
57077+
57078+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
57079+{
57080+#ifdef CONFIG_GRKERNSEC_BRUTE
57081+ uid_t uid = 0;
57082+
57083+ if (!grsec_enable_brute)
57084+ return;
57085+
57086+ rcu_read_lock();
57087+ read_lock(&tasklist_lock);
57088+ read_lock(&grsec_exec_file_lock);
57089+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
57090+ p->real_parent->brute = 1;
57091+ else {
57092+ const struct cred *cred = __task_cred(p), *cred2;
57093+ struct task_struct *tsk, *tsk2;
57094+
57095+ if (!__get_dumpable(mm_flags) && cred->uid) {
57096+ struct user_struct *user;
57097+
57098+ uid = cred->uid;
57099+
57100+ /* this is put upon execution past expiration */
57101+ user = find_user(uid);
57102+ if (user == NULL)
57103+ goto unlock;
57104+ user->banned = 1;
57105+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
57106+ if (user->ban_expires == ~0UL)
57107+ user->ban_expires--;
57108+
57109+ do_each_thread(tsk2, tsk) {
57110+ cred2 = __task_cred(tsk);
57111+ if (tsk != p && cred2->uid == uid)
57112+ gr_fake_force_sig(SIGKILL, tsk);
57113+ } while_each_thread(tsk2, tsk);
57114+ }
57115+ }
57116+unlock:
57117+ read_unlock(&grsec_exec_file_lock);
57118+ read_unlock(&tasklist_lock);
57119+ rcu_read_unlock();
57120+
57121+ if (uid)
57122+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
57123+#endif
57124+ return;
57125+}
57126+
57127+void gr_handle_brute_check(void)
57128+{
57129+#ifdef CONFIG_GRKERNSEC_BRUTE
57130+ if (current->brute)
57131+ msleep(30 * 1000);
57132+#endif
57133+ return;
57134+}
57135+
57136+void gr_handle_kernel_exploit(void)
57137+{
57138+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
57139+ const struct cred *cred;
57140+ struct task_struct *tsk, *tsk2;
57141+ struct user_struct *user;
57142+ uid_t uid;
57143+
57144+ if (in_irq() || in_serving_softirq() || in_nmi())
57145+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
57146+
57147+ uid = current_uid();
57148+
57149+ if (uid == 0)
57150+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
57151+ else {
57152+ /* kill all the processes of this user, hold a reference
57153+ to their creds struct, and prevent them from creating
57154+ another process until system reset
57155+ */
57156+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
57157+ /* we intentionally leak this ref */
57158+ user = get_uid(current->cred->user);
57159+ if (user) {
57160+ user->banned = 1;
57161+ user->ban_expires = ~0UL;
57162+ }
57163+
57164+ read_lock(&tasklist_lock);
57165+ do_each_thread(tsk2, tsk) {
57166+ cred = __task_cred(tsk);
57167+ if (cred->uid == uid)
57168+ gr_fake_force_sig(SIGKILL, tsk);
57169+ } while_each_thread(tsk2, tsk);
57170+ read_unlock(&tasklist_lock);
57171+ }
57172+#endif
57173+}
57174+
57175+int __gr_process_user_ban(struct user_struct *user)
57176+{
57177+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
57178+ if (unlikely(user->banned)) {
57179+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
57180+ user->banned = 0;
57181+ user->ban_expires = 0;
57182+ free_uid(user);
57183+ } else
57184+ return -EPERM;
57185+ }
57186+#endif
57187+ return 0;
57188+}
57189+
57190+int gr_process_user_ban(void)
57191+{
57192+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
57193+ return __gr_process_user_ban(current->cred->user);
57194+#endif
57195+ return 0;
57196+}
57197diff -urNp linux-2.6.32.46/grsecurity/grsec_sock.c linux-2.6.32.46/grsecurity/grsec_sock.c
57198--- linux-2.6.32.46/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
57199+++ linux-2.6.32.46/grsecurity/grsec_sock.c 2011-04-17 15:56:46.000000000 -0400
57200@@ -0,0 +1,275 @@
57201+#include <linux/kernel.h>
57202+#include <linux/module.h>
57203+#include <linux/sched.h>
57204+#include <linux/file.h>
57205+#include <linux/net.h>
57206+#include <linux/in.h>
57207+#include <linux/ip.h>
57208+#include <net/sock.h>
57209+#include <net/inet_sock.h>
57210+#include <linux/grsecurity.h>
57211+#include <linux/grinternal.h>
57212+#include <linux/gracl.h>
57213+
57214+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
57215+EXPORT_SYMBOL(gr_cap_rtnetlink);
57216+
57217+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
57218+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
57219+
57220+EXPORT_SYMBOL(gr_search_udp_recvmsg);
57221+EXPORT_SYMBOL(gr_search_udp_sendmsg);
57222+
57223+#ifdef CONFIG_UNIX_MODULE
57224+EXPORT_SYMBOL(gr_acl_handle_unix);
57225+EXPORT_SYMBOL(gr_acl_handle_mknod);
57226+EXPORT_SYMBOL(gr_handle_chroot_unix);
57227+EXPORT_SYMBOL(gr_handle_create);
57228+#endif
57229+
57230+#ifdef CONFIG_GRKERNSEC
57231+#define gr_conn_table_size 32749
57232+struct conn_table_entry {
57233+ struct conn_table_entry *next;
57234+ struct signal_struct *sig;
57235+};
57236+
57237+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
57238+DEFINE_SPINLOCK(gr_conn_table_lock);
57239+
57240+extern const char * gr_socktype_to_name(unsigned char type);
57241+extern const char * gr_proto_to_name(unsigned char proto);
57242+extern const char * gr_sockfamily_to_name(unsigned char family);
57243+
57244+static __inline__ int
57245+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
57246+{
57247+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
57248+}
57249+
57250+static __inline__ int
57251+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
57252+ __u16 sport, __u16 dport)
57253+{
57254+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
57255+ sig->gr_sport == sport && sig->gr_dport == dport))
57256+ return 1;
57257+ else
57258+ return 0;
57259+}
57260+
57261+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
57262+{
57263+ struct conn_table_entry **match;
57264+ unsigned int index;
57265+
57266+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
57267+ sig->gr_sport, sig->gr_dport,
57268+ gr_conn_table_size);
57269+
57270+ newent->sig = sig;
57271+
57272+ match = &gr_conn_table[index];
57273+ newent->next = *match;
57274+ *match = newent;
57275+
57276+ return;
57277+}
57278+
57279+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
57280+{
57281+ struct conn_table_entry *match, *last = NULL;
57282+ unsigned int index;
57283+
57284+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
57285+ sig->gr_sport, sig->gr_dport,
57286+ gr_conn_table_size);
57287+
57288+ match = gr_conn_table[index];
57289+ while (match && !conn_match(match->sig,
57290+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
57291+ sig->gr_dport)) {
57292+ last = match;
57293+ match = match->next;
57294+ }
57295+
57296+ if (match) {
57297+ if (last)
57298+ last->next = match->next;
57299+ else
57300+ gr_conn_table[index] = NULL;
57301+ kfree(match);
57302+ }
57303+
57304+ return;
57305+}
57306+
57307+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
57308+ __u16 sport, __u16 dport)
57309+{
57310+ struct conn_table_entry *match;
57311+ unsigned int index;
57312+
57313+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
57314+
57315+ match = gr_conn_table[index];
57316+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
57317+ match = match->next;
57318+
57319+ if (match)
57320+ return match->sig;
57321+ else
57322+ return NULL;
57323+}
57324+
57325+#endif
57326+
57327+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
57328+{
57329+#ifdef CONFIG_GRKERNSEC
57330+ struct signal_struct *sig = task->signal;
57331+ struct conn_table_entry *newent;
57332+
57333+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
57334+ if (newent == NULL)
57335+ return;
57336+ /* no bh lock needed since we are called with bh disabled */
57337+ spin_lock(&gr_conn_table_lock);
57338+ gr_del_task_from_ip_table_nolock(sig);
57339+ sig->gr_saddr = inet->rcv_saddr;
57340+ sig->gr_daddr = inet->daddr;
57341+ sig->gr_sport = inet->sport;
57342+ sig->gr_dport = inet->dport;
57343+ gr_add_to_task_ip_table_nolock(sig, newent);
57344+ spin_unlock(&gr_conn_table_lock);
57345+#endif
57346+ return;
57347+}
57348+
57349+void gr_del_task_from_ip_table(struct task_struct *task)
57350+{
57351+#ifdef CONFIG_GRKERNSEC
57352+ spin_lock_bh(&gr_conn_table_lock);
57353+ gr_del_task_from_ip_table_nolock(task->signal);
57354+ spin_unlock_bh(&gr_conn_table_lock);
57355+#endif
57356+ return;
57357+}
57358+
57359+void
57360+gr_attach_curr_ip(const struct sock *sk)
57361+{
57362+#ifdef CONFIG_GRKERNSEC
57363+ struct signal_struct *p, *set;
57364+ const struct inet_sock *inet = inet_sk(sk);
57365+
57366+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
57367+ return;
57368+
57369+ set = current->signal;
57370+
57371+ spin_lock_bh(&gr_conn_table_lock);
57372+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
57373+ inet->dport, inet->sport);
57374+ if (unlikely(p != NULL)) {
57375+ set->curr_ip = p->curr_ip;
57376+ set->used_accept = 1;
57377+ gr_del_task_from_ip_table_nolock(p);
57378+ spin_unlock_bh(&gr_conn_table_lock);
57379+ return;
57380+ }
57381+ spin_unlock_bh(&gr_conn_table_lock);
57382+
57383+ set->curr_ip = inet->daddr;
57384+ set->used_accept = 1;
57385+#endif
57386+ return;
57387+}
57388+
57389+int
57390+gr_handle_sock_all(const int family, const int type, const int protocol)
57391+{
57392+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57393+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
57394+ (family != AF_UNIX)) {
57395+ if (family == AF_INET)
57396+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
57397+ else
57398+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
57399+ return -EACCES;
57400+ }
57401+#endif
57402+ return 0;
57403+}
57404+
57405+int
57406+gr_handle_sock_server(const struct sockaddr *sck)
57407+{
57408+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57409+ if (grsec_enable_socket_server &&
57410+ in_group_p(grsec_socket_server_gid) &&
57411+ sck && (sck->sa_family != AF_UNIX) &&
57412+ (sck->sa_family != AF_LOCAL)) {
57413+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
57414+ return -EACCES;
57415+ }
57416+#endif
57417+ return 0;
57418+}
57419+
57420+int
57421+gr_handle_sock_server_other(const struct sock *sck)
57422+{
57423+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57424+ if (grsec_enable_socket_server &&
57425+ in_group_p(grsec_socket_server_gid) &&
57426+ sck && (sck->sk_family != AF_UNIX) &&
57427+ (sck->sk_family != AF_LOCAL)) {
57428+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
57429+ return -EACCES;
57430+ }
57431+#endif
57432+ return 0;
57433+}
57434+
57435+int
57436+gr_handle_sock_client(const struct sockaddr *sck)
57437+{
57438+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57439+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
57440+ sck && (sck->sa_family != AF_UNIX) &&
57441+ (sck->sa_family != AF_LOCAL)) {
57442+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
57443+ return -EACCES;
57444+ }
57445+#endif
57446+ return 0;
57447+}
57448+
57449+kernel_cap_t
57450+gr_cap_rtnetlink(struct sock *sock)
57451+{
57452+#ifdef CONFIG_GRKERNSEC
57453+ if (!gr_acl_is_enabled())
57454+ return current_cap();
57455+ else if (sock->sk_protocol == NETLINK_ISCSI &&
57456+ cap_raised(current_cap(), CAP_SYS_ADMIN) &&
57457+ gr_is_capable(CAP_SYS_ADMIN))
57458+ return current_cap();
57459+ else if (sock->sk_protocol == NETLINK_AUDIT &&
57460+ cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
57461+ gr_is_capable(CAP_AUDIT_WRITE) &&
57462+ cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
57463+ gr_is_capable(CAP_AUDIT_CONTROL))
57464+ return current_cap();
57465+ else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
57466+ ((sock->sk_protocol == NETLINK_ROUTE) ?
57467+ gr_is_capable_nolog(CAP_NET_ADMIN) :
57468+ gr_is_capable(CAP_NET_ADMIN)))
57469+ return current_cap();
57470+ else
57471+ return __cap_empty_set;
57472+#else
57473+ return current_cap();
57474+#endif
57475+}
57476diff -urNp linux-2.6.32.46/grsecurity/grsec_sysctl.c linux-2.6.32.46/grsecurity/grsec_sysctl.c
57477--- linux-2.6.32.46/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
57478+++ linux-2.6.32.46/grsecurity/grsec_sysctl.c 2011-08-11 19:57:54.000000000 -0400
57479@@ -0,0 +1,479 @@
57480+#include <linux/kernel.h>
57481+#include <linux/sched.h>
57482+#include <linux/sysctl.h>
57483+#include <linux/grsecurity.h>
57484+#include <linux/grinternal.h>
57485+
57486+int
57487+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
57488+{
57489+#ifdef CONFIG_GRKERNSEC_SYSCTL
57490+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
57491+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
57492+ return -EACCES;
57493+ }
57494+#endif
57495+ return 0;
57496+}
57497+
57498+#ifdef CONFIG_GRKERNSEC_ROFS
57499+static int __maybe_unused one = 1;
57500+#endif
57501+
57502+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
57503+ctl_table grsecurity_table[] = {
57504+#ifdef CONFIG_GRKERNSEC_SYSCTL
57505+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
57506+#ifdef CONFIG_GRKERNSEC_IO
57507+ {
57508+ .ctl_name = CTL_UNNUMBERED,
57509+ .procname = "disable_priv_io",
57510+ .data = &grsec_disable_privio,
57511+ .maxlen = sizeof(int),
57512+ .mode = 0600,
57513+ .proc_handler = &proc_dointvec,
57514+ },
57515+#endif
57516+#endif
57517+#ifdef CONFIG_GRKERNSEC_LINK
57518+ {
57519+ .ctl_name = CTL_UNNUMBERED,
57520+ .procname = "linking_restrictions",
57521+ .data = &grsec_enable_link,
57522+ .maxlen = sizeof(int),
57523+ .mode = 0600,
57524+ .proc_handler = &proc_dointvec,
57525+ },
57526+#endif
57527+#ifdef CONFIG_GRKERNSEC_BRUTE
57528+ {
57529+ .ctl_name = CTL_UNNUMBERED,
57530+ .procname = "deter_bruteforce",
57531+ .data = &grsec_enable_brute,
57532+ .maxlen = sizeof(int),
57533+ .mode = 0600,
57534+ .proc_handler = &proc_dointvec,
57535+ },
57536+#endif
57537+#ifdef CONFIG_GRKERNSEC_FIFO
57538+ {
57539+ .ctl_name = CTL_UNNUMBERED,
57540+ .procname = "fifo_restrictions",
57541+ .data = &grsec_enable_fifo,
57542+ .maxlen = sizeof(int),
57543+ .mode = 0600,
57544+ .proc_handler = &proc_dointvec,
57545+ },
57546+#endif
57547+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
57548+ {
57549+ .ctl_name = CTL_UNNUMBERED,
57550+ .procname = "ip_blackhole",
57551+ .data = &grsec_enable_blackhole,
57552+ .maxlen = sizeof(int),
57553+ .mode = 0600,
57554+ .proc_handler = &proc_dointvec,
57555+ },
57556+ {
57557+ .ctl_name = CTL_UNNUMBERED,
57558+ .procname = "lastack_retries",
57559+ .data = &grsec_lastack_retries,
57560+ .maxlen = sizeof(int),
57561+ .mode = 0600,
57562+ .proc_handler = &proc_dointvec,
57563+ },
57564+#endif
57565+#ifdef CONFIG_GRKERNSEC_EXECLOG
57566+ {
57567+ .ctl_name = CTL_UNNUMBERED,
57568+ .procname = "exec_logging",
57569+ .data = &grsec_enable_execlog,
57570+ .maxlen = sizeof(int),
57571+ .mode = 0600,
57572+ .proc_handler = &proc_dointvec,
57573+ },
57574+#endif
57575+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57576+ {
57577+ .ctl_name = CTL_UNNUMBERED,
57578+ .procname = "rwxmap_logging",
57579+ .data = &grsec_enable_log_rwxmaps,
57580+ .maxlen = sizeof(int),
57581+ .mode = 0600,
57582+ .proc_handler = &proc_dointvec,
57583+ },
57584+#endif
57585+#ifdef CONFIG_GRKERNSEC_SIGNAL
57586+ {
57587+ .ctl_name = CTL_UNNUMBERED,
57588+ .procname = "signal_logging",
57589+ .data = &grsec_enable_signal,
57590+ .maxlen = sizeof(int),
57591+ .mode = 0600,
57592+ .proc_handler = &proc_dointvec,
57593+ },
57594+#endif
57595+#ifdef CONFIG_GRKERNSEC_FORKFAIL
57596+ {
57597+ .ctl_name = CTL_UNNUMBERED,
57598+ .procname = "forkfail_logging",
57599+ .data = &grsec_enable_forkfail,
57600+ .maxlen = sizeof(int),
57601+ .mode = 0600,
57602+ .proc_handler = &proc_dointvec,
57603+ },
57604+#endif
57605+#ifdef CONFIG_GRKERNSEC_TIME
57606+ {
57607+ .ctl_name = CTL_UNNUMBERED,
57608+ .procname = "timechange_logging",
57609+ .data = &grsec_enable_time,
57610+ .maxlen = sizeof(int),
57611+ .mode = 0600,
57612+ .proc_handler = &proc_dointvec,
57613+ },
57614+#endif
57615+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57616+ {
57617+ .ctl_name = CTL_UNNUMBERED,
57618+ .procname = "chroot_deny_shmat",
57619+ .data = &grsec_enable_chroot_shmat,
57620+ .maxlen = sizeof(int),
57621+ .mode = 0600,
57622+ .proc_handler = &proc_dointvec,
57623+ },
57624+#endif
57625+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57626+ {
57627+ .ctl_name = CTL_UNNUMBERED,
57628+ .procname = "chroot_deny_unix",
57629+ .data = &grsec_enable_chroot_unix,
57630+ .maxlen = sizeof(int),
57631+ .mode = 0600,
57632+ .proc_handler = &proc_dointvec,
57633+ },
57634+#endif
57635+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57636+ {
57637+ .ctl_name = CTL_UNNUMBERED,
57638+ .procname = "chroot_deny_mount",
57639+ .data = &grsec_enable_chroot_mount,
57640+ .maxlen = sizeof(int),
57641+ .mode = 0600,
57642+ .proc_handler = &proc_dointvec,
57643+ },
57644+#endif
57645+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57646+ {
57647+ .ctl_name = CTL_UNNUMBERED,
57648+ .procname = "chroot_deny_fchdir",
57649+ .data = &grsec_enable_chroot_fchdir,
57650+ .maxlen = sizeof(int),
57651+ .mode = 0600,
57652+ .proc_handler = &proc_dointvec,
57653+ },
57654+#endif
57655+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57656+ {
57657+ .ctl_name = CTL_UNNUMBERED,
57658+ .procname = "chroot_deny_chroot",
57659+ .data = &grsec_enable_chroot_double,
57660+ .maxlen = sizeof(int),
57661+ .mode = 0600,
57662+ .proc_handler = &proc_dointvec,
57663+ },
57664+#endif
57665+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57666+ {
57667+ .ctl_name = CTL_UNNUMBERED,
57668+ .procname = "chroot_deny_pivot",
57669+ .data = &grsec_enable_chroot_pivot,
57670+ .maxlen = sizeof(int),
57671+ .mode = 0600,
57672+ .proc_handler = &proc_dointvec,
57673+ },
57674+#endif
57675+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57676+ {
57677+ .ctl_name = CTL_UNNUMBERED,
57678+ .procname = "chroot_enforce_chdir",
57679+ .data = &grsec_enable_chroot_chdir,
57680+ .maxlen = sizeof(int),
57681+ .mode = 0600,
57682+ .proc_handler = &proc_dointvec,
57683+ },
57684+#endif
57685+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57686+ {
57687+ .ctl_name = CTL_UNNUMBERED,
57688+ .procname = "chroot_deny_chmod",
57689+ .data = &grsec_enable_chroot_chmod,
57690+ .maxlen = sizeof(int),
57691+ .mode = 0600,
57692+ .proc_handler = &proc_dointvec,
57693+ },
57694+#endif
57695+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57696+ {
57697+ .ctl_name = CTL_UNNUMBERED,
57698+ .procname = "chroot_deny_mknod",
57699+ .data = &grsec_enable_chroot_mknod,
57700+ .maxlen = sizeof(int),
57701+ .mode = 0600,
57702+ .proc_handler = &proc_dointvec,
57703+ },
57704+#endif
57705+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57706+ {
57707+ .ctl_name = CTL_UNNUMBERED,
57708+ .procname = "chroot_restrict_nice",
57709+ .data = &grsec_enable_chroot_nice,
57710+ .maxlen = sizeof(int),
57711+ .mode = 0600,
57712+ .proc_handler = &proc_dointvec,
57713+ },
57714+#endif
57715+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57716+ {
57717+ .ctl_name = CTL_UNNUMBERED,
57718+ .procname = "chroot_execlog",
57719+ .data = &grsec_enable_chroot_execlog,
57720+ .maxlen = sizeof(int),
57721+ .mode = 0600,
57722+ .proc_handler = &proc_dointvec,
57723+ },
57724+#endif
57725+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57726+ {
57727+ .ctl_name = CTL_UNNUMBERED,
57728+ .procname = "chroot_caps",
57729+ .data = &grsec_enable_chroot_caps,
57730+ .maxlen = sizeof(int),
57731+ .mode = 0600,
57732+ .proc_handler = &proc_dointvec,
57733+ },
57734+#endif
57735+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57736+ {
57737+ .ctl_name = CTL_UNNUMBERED,
57738+ .procname = "chroot_deny_sysctl",
57739+ .data = &grsec_enable_chroot_sysctl,
57740+ .maxlen = sizeof(int),
57741+ .mode = 0600,
57742+ .proc_handler = &proc_dointvec,
57743+ },
57744+#endif
57745+#ifdef CONFIG_GRKERNSEC_TPE
57746+ {
57747+ .ctl_name = CTL_UNNUMBERED,
57748+ .procname = "tpe",
57749+ .data = &grsec_enable_tpe,
57750+ .maxlen = sizeof(int),
57751+ .mode = 0600,
57752+ .proc_handler = &proc_dointvec,
57753+ },
57754+ {
57755+ .ctl_name = CTL_UNNUMBERED,
57756+ .procname = "tpe_gid",
57757+ .data = &grsec_tpe_gid,
57758+ .maxlen = sizeof(int),
57759+ .mode = 0600,
57760+ .proc_handler = &proc_dointvec,
57761+ },
57762+#endif
57763+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
57764+ {
57765+ .ctl_name = CTL_UNNUMBERED,
57766+ .procname = "tpe_invert",
57767+ .data = &grsec_enable_tpe_invert,
57768+ .maxlen = sizeof(int),
57769+ .mode = 0600,
57770+ .proc_handler = &proc_dointvec,
57771+ },
57772+#endif
57773+#ifdef CONFIG_GRKERNSEC_TPE_ALL
57774+ {
57775+ .ctl_name = CTL_UNNUMBERED,
57776+ .procname = "tpe_restrict_all",
57777+ .data = &grsec_enable_tpe_all,
57778+ .maxlen = sizeof(int),
57779+ .mode = 0600,
57780+ .proc_handler = &proc_dointvec,
57781+ },
57782+#endif
57783+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57784+ {
57785+ .ctl_name = CTL_UNNUMBERED,
57786+ .procname = "socket_all",
57787+ .data = &grsec_enable_socket_all,
57788+ .maxlen = sizeof(int),
57789+ .mode = 0600,
57790+ .proc_handler = &proc_dointvec,
57791+ },
57792+ {
57793+ .ctl_name = CTL_UNNUMBERED,
57794+ .procname = "socket_all_gid",
57795+ .data = &grsec_socket_all_gid,
57796+ .maxlen = sizeof(int),
57797+ .mode = 0600,
57798+ .proc_handler = &proc_dointvec,
57799+ },
57800+#endif
57801+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57802+ {
57803+ .ctl_name = CTL_UNNUMBERED,
57804+ .procname = "socket_client",
57805+ .data = &grsec_enable_socket_client,
57806+ .maxlen = sizeof(int),
57807+ .mode = 0600,
57808+ .proc_handler = &proc_dointvec,
57809+ },
57810+ {
57811+ .ctl_name = CTL_UNNUMBERED,
57812+ .procname = "socket_client_gid",
57813+ .data = &grsec_socket_client_gid,
57814+ .maxlen = sizeof(int),
57815+ .mode = 0600,
57816+ .proc_handler = &proc_dointvec,
57817+ },
57818+#endif
57819+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57820+ {
57821+ .ctl_name = CTL_UNNUMBERED,
57822+ .procname = "socket_server",
57823+ .data = &grsec_enable_socket_server,
57824+ .maxlen = sizeof(int),
57825+ .mode = 0600,
57826+ .proc_handler = &proc_dointvec,
57827+ },
57828+ {
57829+ .ctl_name = CTL_UNNUMBERED,
57830+ .procname = "socket_server_gid",
57831+ .data = &grsec_socket_server_gid,
57832+ .maxlen = sizeof(int),
57833+ .mode = 0600,
57834+ .proc_handler = &proc_dointvec,
57835+ },
57836+#endif
57837+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
57838+ {
57839+ .ctl_name = CTL_UNNUMBERED,
57840+ .procname = "audit_group",
57841+ .data = &grsec_enable_group,
57842+ .maxlen = sizeof(int),
57843+ .mode = 0600,
57844+ .proc_handler = &proc_dointvec,
57845+ },
57846+ {
57847+ .ctl_name = CTL_UNNUMBERED,
57848+ .procname = "audit_gid",
57849+ .data = &grsec_audit_gid,
57850+ .maxlen = sizeof(int),
57851+ .mode = 0600,
57852+ .proc_handler = &proc_dointvec,
57853+ },
57854+#endif
57855+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57856+ {
57857+ .ctl_name = CTL_UNNUMBERED,
57858+ .procname = "audit_chdir",
57859+ .data = &grsec_enable_chdir,
57860+ .maxlen = sizeof(int),
57861+ .mode = 0600,
57862+ .proc_handler = &proc_dointvec,
57863+ },
57864+#endif
57865+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
57866+ {
57867+ .ctl_name = CTL_UNNUMBERED,
57868+ .procname = "audit_mount",
57869+ .data = &grsec_enable_mount,
57870+ .maxlen = sizeof(int),
57871+ .mode = 0600,
57872+ .proc_handler = &proc_dointvec,
57873+ },
57874+#endif
57875+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
57876+ {
57877+ .ctl_name = CTL_UNNUMBERED,
57878+ .procname = "audit_textrel",
57879+ .data = &grsec_enable_audit_textrel,
57880+ .maxlen = sizeof(int),
57881+ .mode = 0600,
57882+ .proc_handler = &proc_dointvec,
57883+ },
57884+#endif
57885+#ifdef CONFIG_GRKERNSEC_DMESG
57886+ {
57887+ .ctl_name = CTL_UNNUMBERED,
57888+ .procname = "dmesg",
57889+ .data = &grsec_enable_dmesg,
57890+ .maxlen = sizeof(int),
57891+ .mode = 0600,
57892+ .proc_handler = &proc_dointvec,
57893+ },
57894+#endif
57895+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57896+ {
57897+ .ctl_name = CTL_UNNUMBERED,
57898+ .procname = "chroot_findtask",
57899+ .data = &grsec_enable_chroot_findtask,
57900+ .maxlen = sizeof(int),
57901+ .mode = 0600,
57902+ .proc_handler = &proc_dointvec,
57903+ },
57904+#endif
57905+#ifdef CONFIG_GRKERNSEC_RESLOG
57906+ {
57907+ .ctl_name = CTL_UNNUMBERED,
57908+ .procname = "resource_logging",
57909+ .data = &grsec_resource_logging,
57910+ .maxlen = sizeof(int),
57911+ .mode = 0600,
57912+ .proc_handler = &proc_dointvec,
57913+ },
57914+#endif
57915+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
57916+ {
57917+ .ctl_name = CTL_UNNUMBERED,
57918+ .procname = "audit_ptrace",
57919+ .data = &grsec_enable_audit_ptrace,
57920+ .maxlen = sizeof(int),
57921+ .mode = 0600,
57922+ .proc_handler = &proc_dointvec,
57923+ },
57924+#endif
57925+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
57926+ {
57927+ .ctl_name = CTL_UNNUMBERED,
57928+ .procname = "harden_ptrace",
57929+ .data = &grsec_enable_harden_ptrace,
57930+ .maxlen = sizeof(int),
57931+ .mode = 0600,
57932+ .proc_handler = &proc_dointvec,
57933+ },
57934+#endif
57935+ {
57936+ .ctl_name = CTL_UNNUMBERED,
57937+ .procname = "grsec_lock",
57938+ .data = &grsec_lock,
57939+ .maxlen = sizeof(int),
57940+ .mode = 0600,
57941+ .proc_handler = &proc_dointvec,
57942+ },
57943+#endif
57944+#ifdef CONFIG_GRKERNSEC_ROFS
57945+ {
57946+ .ctl_name = CTL_UNNUMBERED,
57947+ .procname = "romount_protect",
57948+ .data = &grsec_enable_rofs,
57949+ .maxlen = sizeof(int),
57950+ .mode = 0600,
57951+ .proc_handler = &proc_dointvec_minmax,
57952+ .extra1 = &one,
57953+ .extra2 = &one,
57954+ },
57955+#endif
57956+ { .ctl_name = 0 }
57957+};
57958+#endif
57959diff -urNp linux-2.6.32.46/grsecurity/grsec_time.c linux-2.6.32.46/grsecurity/grsec_time.c
57960--- linux-2.6.32.46/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
57961+++ linux-2.6.32.46/grsecurity/grsec_time.c 2011-04-17 15:56:46.000000000 -0400
57962@@ -0,0 +1,16 @@
57963+#include <linux/kernel.h>
57964+#include <linux/sched.h>
57965+#include <linux/grinternal.h>
57966+#include <linux/module.h>
57967+
57968+void
57969+gr_log_timechange(void)
57970+{
57971+#ifdef CONFIG_GRKERNSEC_TIME
57972+ if (grsec_enable_time)
57973+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
57974+#endif
57975+ return;
57976+}
57977+
57978+EXPORT_SYMBOL(gr_log_timechange);
57979diff -urNp linux-2.6.32.46/grsecurity/grsec_tpe.c linux-2.6.32.46/grsecurity/grsec_tpe.c
57980--- linux-2.6.32.46/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
57981+++ linux-2.6.32.46/grsecurity/grsec_tpe.c 2011-04-17 15:56:46.000000000 -0400
57982@@ -0,0 +1,39 @@
57983+#include <linux/kernel.h>
57984+#include <linux/sched.h>
57985+#include <linux/file.h>
57986+#include <linux/fs.h>
57987+#include <linux/grinternal.h>
57988+
57989+extern int gr_acl_tpe_check(void);
57990+
57991+int
57992+gr_tpe_allow(const struct file *file)
57993+{
57994+#ifdef CONFIG_GRKERNSEC
57995+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
57996+ const struct cred *cred = current_cred();
57997+
57998+ if (cred->uid && ((grsec_enable_tpe &&
57999+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58000+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
58001+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
58002+#else
58003+ in_group_p(grsec_tpe_gid)
58004+#endif
58005+ ) || gr_acl_tpe_check()) &&
58006+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
58007+ (inode->i_mode & S_IWOTH))))) {
58008+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
58009+ return 0;
58010+ }
58011+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58012+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
58013+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
58014+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
58015+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
58016+ return 0;
58017+ }
58018+#endif
58019+#endif
58020+ return 1;
58021+}
58022diff -urNp linux-2.6.32.46/grsecurity/grsum.c linux-2.6.32.46/grsecurity/grsum.c
58023--- linux-2.6.32.46/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
58024+++ linux-2.6.32.46/grsecurity/grsum.c 2011-04-17 15:56:46.000000000 -0400
58025@@ -0,0 +1,61 @@
58026+#include <linux/err.h>
58027+#include <linux/kernel.h>
58028+#include <linux/sched.h>
58029+#include <linux/mm.h>
58030+#include <linux/scatterlist.h>
58031+#include <linux/crypto.h>
58032+#include <linux/gracl.h>
58033+
58034+
58035+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
58036+#error "crypto and sha256 must be built into the kernel"
58037+#endif
58038+
58039+int
58040+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
58041+{
58042+ char *p;
58043+ struct crypto_hash *tfm;
58044+ struct hash_desc desc;
58045+ struct scatterlist sg;
58046+ unsigned char temp_sum[GR_SHA_LEN];
58047+ volatile int retval = 0;
58048+ volatile int dummy = 0;
58049+ unsigned int i;
58050+
58051+ sg_init_table(&sg, 1);
58052+
58053+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
58054+ if (IS_ERR(tfm)) {
58055+ /* should never happen, since sha256 should be built in */
58056+ return 1;
58057+ }
58058+
58059+ desc.tfm = tfm;
58060+ desc.flags = 0;
58061+
58062+ crypto_hash_init(&desc);
58063+
58064+ p = salt;
58065+ sg_set_buf(&sg, p, GR_SALT_LEN);
58066+ crypto_hash_update(&desc, &sg, sg.length);
58067+
58068+ p = entry->pw;
58069+ sg_set_buf(&sg, p, strlen(p));
58070+
58071+ crypto_hash_update(&desc, &sg, sg.length);
58072+
58073+ crypto_hash_final(&desc, temp_sum);
58074+
58075+ memset(entry->pw, 0, GR_PW_LEN);
58076+
58077+ for (i = 0; i < GR_SHA_LEN; i++)
58078+ if (sum[i] != temp_sum[i])
58079+ retval = 1;
58080+ else
58081+ dummy = 1; // waste a cycle
58082+
58083+ crypto_free_hash(tfm);
58084+
58085+ return retval;
58086+}
58087diff -urNp linux-2.6.32.46/grsecurity/Kconfig linux-2.6.32.46/grsecurity/Kconfig
58088--- linux-2.6.32.46/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
58089+++ linux-2.6.32.46/grsecurity/Kconfig 2011-09-15 00:00:38.000000000 -0400
58090@@ -0,0 +1,1037 @@
58091+#
58092+# grecurity configuration
58093+#
58094+
58095+menu "Grsecurity"
58096+
58097+config GRKERNSEC
58098+ bool "Grsecurity"
58099+ select CRYPTO
58100+ select CRYPTO_SHA256
58101+ help
58102+ If you say Y here, you will be able to configure many features
58103+ that will enhance the security of your system. It is highly
58104+ recommended that you say Y here and read through the help
58105+ for each option so that you fully understand the features and
58106+ can evaluate their usefulness for your machine.
58107+
58108+choice
58109+ prompt "Security Level"
58110+ depends on GRKERNSEC
58111+ default GRKERNSEC_CUSTOM
58112+
58113+config GRKERNSEC_LOW
58114+ bool "Low"
58115+ select GRKERNSEC_LINK
58116+ select GRKERNSEC_FIFO
58117+ select GRKERNSEC_RANDNET
58118+ select GRKERNSEC_DMESG
58119+ select GRKERNSEC_CHROOT
58120+ select GRKERNSEC_CHROOT_CHDIR
58121+
58122+ help
58123+ If you choose this option, several of the grsecurity options will
58124+ be enabled that will give you greater protection against a number
58125+ of attacks, while assuring that none of your software will have any
58126+ conflicts with the additional security measures. If you run a lot
58127+ of unusual software, or you are having problems with the higher
58128+ security levels, you should say Y here. With this option, the
58129+ following features are enabled:
58130+
58131+ - Linking restrictions
58132+ - FIFO restrictions
58133+ - Restricted dmesg
58134+ - Enforced chdir("/") on chroot
58135+ - Runtime module disabling
58136+
58137+config GRKERNSEC_MEDIUM
58138+ bool "Medium"
58139+ select PAX
58140+ select PAX_EI_PAX
58141+ select PAX_PT_PAX_FLAGS
58142+ select PAX_HAVE_ACL_FLAGS
58143+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
58144+ select GRKERNSEC_CHROOT
58145+ select GRKERNSEC_CHROOT_SYSCTL
58146+ select GRKERNSEC_LINK
58147+ select GRKERNSEC_FIFO
58148+ select GRKERNSEC_DMESG
58149+ select GRKERNSEC_RANDNET
58150+ select GRKERNSEC_FORKFAIL
58151+ select GRKERNSEC_TIME
58152+ select GRKERNSEC_SIGNAL
58153+ select GRKERNSEC_CHROOT
58154+ select GRKERNSEC_CHROOT_UNIX
58155+ select GRKERNSEC_CHROOT_MOUNT
58156+ select GRKERNSEC_CHROOT_PIVOT
58157+ select GRKERNSEC_CHROOT_DOUBLE
58158+ select GRKERNSEC_CHROOT_CHDIR
58159+ select GRKERNSEC_CHROOT_MKNOD
58160+ select GRKERNSEC_PROC
58161+ select GRKERNSEC_PROC_USERGROUP
58162+ select PAX_RANDUSTACK
58163+ select PAX_ASLR
58164+ select PAX_RANDMMAP
58165+ select PAX_REFCOUNT if (X86 || SPARC64)
58166+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
58167+
58168+ help
58169+ If you say Y here, several features in addition to those included
58170+ in the low additional security level will be enabled. These
58171+ features provide even more security to your system, though in rare
58172+ cases they may be incompatible with very old or poorly written
58173+ software. If you enable this option, make sure that your auth
58174+ service (identd) is running as gid 1001. With this option,
58175+ the following features (in addition to those provided in the
58176+ low additional security level) will be enabled:
58177+
58178+ - Failed fork logging
58179+ - Time change logging
58180+ - Signal logging
58181+ - Deny mounts in chroot
58182+ - Deny double chrooting
58183+ - Deny sysctl writes in chroot
58184+ - Deny mknod in chroot
58185+ - Deny access to abstract AF_UNIX sockets out of chroot
58186+ - Deny pivot_root in chroot
58187+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
58188+ - /proc restrictions with special GID set to 10 (usually wheel)
58189+ - Address Space Layout Randomization (ASLR)
58190+ - Prevent exploitation of most refcount overflows
58191+ - Bounds checking of copying between the kernel and userland
58192+
58193+config GRKERNSEC_HIGH
58194+ bool "High"
58195+ select GRKERNSEC_LINK
58196+ select GRKERNSEC_FIFO
58197+ select GRKERNSEC_DMESG
58198+ select GRKERNSEC_FORKFAIL
58199+ select GRKERNSEC_TIME
58200+ select GRKERNSEC_SIGNAL
58201+ select GRKERNSEC_CHROOT
58202+ select GRKERNSEC_CHROOT_SHMAT
58203+ select GRKERNSEC_CHROOT_UNIX
58204+ select GRKERNSEC_CHROOT_MOUNT
58205+ select GRKERNSEC_CHROOT_FCHDIR
58206+ select GRKERNSEC_CHROOT_PIVOT
58207+ select GRKERNSEC_CHROOT_DOUBLE
58208+ select GRKERNSEC_CHROOT_CHDIR
58209+ select GRKERNSEC_CHROOT_MKNOD
58210+ select GRKERNSEC_CHROOT_CAPS
58211+ select GRKERNSEC_CHROOT_SYSCTL
58212+ select GRKERNSEC_CHROOT_FINDTASK
58213+ select GRKERNSEC_SYSFS_RESTRICT
58214+ select GRKERNSEC_PROC
58215+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
58216+ select GRKERNSEC_HIDESYM
58217+ select GRKERNSEC_BRUTE
58218+ select GRKERNSEC_PROC_USERGROUP
58219+ select GRKERNSEC_KMEM
58220+ select GRKERNSEC_RESLOG
58221+ select GRKERNSEC_RANDNET
58222+ select GRKERNSEC_PROC_ADD
58223+ select GRKERNSEC_CHROOT_CHMOD
58224+ select GRKERNSEC_CHROOT_NICE
58225+ select GRKERNSEC_AUDIT_MOUNT
58226+ select GRKERNSEC_MODHARDEN if (MODULES)
58227+ select GRKERNSEC_HARDEN_PTRACE
58228+ select GRKERNSEC_VM86 if (X86_32)
58229+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
58230+ select PAX
58231+ select PAX_RANDUSTACK
58232+ select PAX_ASLR
58233+ select PAX_RANDMMAP
58234+ select PAX_NOEXEC
58235+ select PAX_MPROTECT
58236+ select PAX_EI_PAX
58237+ select PAX_PT_PAX_FLAGS
58238+ select PAX_HAVE_ACL_FLAGS
58239+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
58240+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
58241+ select PAX_RANDKSTACK if (X86_TSC && X86)
58242+ select PAX_SEGMEXEC if (X86_32)
58243+ select PAX_PAGEEXEC
58244+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
58245+ select PAX_EMUTRAMP if (PARISC)
58246+ select PAX_EMUSIGRT if (PARISC)
58247+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
58248+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
58249+ select PAX_REFCOUNT if (X86 || SPARC64)
58250+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
58251+ help
58252+ If you say Y here, many of the features of grsecurity will be
58253+ enabled, which will protect you against many kinds of attacks
58254+ against your system. The heightened security comes at a cost
58255+ of an increased chance of incompatibilities with rare software
58256+ on your machine. Since this security level enables PaX, you should
58257+ view <http://pax.grsecurity.net> and read about the PaX
58258+ project. While you are there, download chpax and run it on
58259+ binaries that cause problems with PaX. Also remember that
58260+ since the /proc restrictions are enabled, you must run your
58261+ identd as gid 1001. This security level enables the following
58262+ features in addition to those listed in the low and medium
58263+ security levels:
58264+
58265+ - Additional /proc restrictions
58266+ - Chmod restrictions in chroot
58267+ - No signals, ptrace, or viewing of processes outside of chroot
58268+ - Capability restrictions in chroot
58269+ - Deny fchdir out of chroot
58270+ - Priority restrictions in chroot
58271+ - Segmentation-based implementation of PaX
58272+ - Mprotect restrictions
58273+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
58274+ - Kernel stack randomization
58275+ - Mount/unmount/remount logging
58276+ - Kernel symbol hiding
58277+ - Prevention of memory exhaustion-based exploits
58278+ - Hardening of module auto-loading
58279+ - Ptrace restrictions
58280+ - Restricted vm86 mode
58281+ - Restricted sysfs/debugfs
58282+ - Active kernel exploit response
58283+
58284+config GRKERNSEC_CUSTOM
58285+ bool "Custom"
58286+ help
58287+ If you say Y here, you will be able to configure every grsecurity
58288+ option, which allows you to enable many more features that aren't
58289+ covered in the basic security levels. These additional features
58290+ include TPE, socket restrictions, and the sysctl system for
58291+ grsecurity. It is advised that you read through the help for
58292+ each option to determine its usefulness in your situation.
58293+
58294+endchoice
58295+
58296+menu "Address Space Protection"
58297+depends on GRKERNSEC
58298+
58299+config GRKERNSEC_KMEM
58300+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
58301+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
58302+ help
58303+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
58304+ be written to via mmap or otherwise to modify the running kernel.
58305+ /dev/port will also not be allowed to be opened. If you have module
58306+ support disabled, enabling this will close up four ways that are
58307+ currently used to insert malicious code into the running kernel.
58308+ Even with all these features enabled, we still highly recommend that
58309+ you use the RBAC system, as it is still possible for an attacker to
58310+ modify the running kernel through privileged I/O granted by ioperm/iopl.
58311+ If you are not using XFree86, you may be able to stop this additional
58312+ case by enabling the 'Disable privileged I/O' option. Though nothing
58313+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
58314+ but only to video memory, which is the only writing we allow in this
58315+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
58316+ not be allowed to mprotect it with PROT_WRITE later.
58317+ It is highly recommended that you say Y here if you meet all the
58318+ conditions above.
58319+
58320+config GRKERNSEC_VM86
58321+ bool "Restrict VM86 mode"
58322+ depends on X86_32
58323+
58324+ help
58325+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
58326+ make use of a special execution mode on 32bit x86 processors called
58327+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
58328+ video cards and will still work with this option enabled. The purpose
58329+ of the option is to prevent exploitation of emulation errors in
58330+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
58331+ Nearly all users should be able to enable this option.
58332+
58333+config GRKERNSEC_IO
58334+ bool "Disable privileged I/O"
58335+ depends on X86
58336+ select RTC_CLASS
58337+ select RTC_INTF_DEV
58338+ select RTC_DRV_CMOS
58339+
58340+ help
58341+ If you say Y here, all ioperm and iopl calls will return an error.
58342+ Ioperm and iopl can be used to modify the running kernel.
58343+ Unfortunately, some programs need this access to operate properly,
58344+ the most notable of which are XFree86 and hwclock. hwclock can be
58345+ remedied by having RTC support in the kernel, so real-time
58346+ clock support is enabled if this option is enabled, to ensure
58347+ that hwclock operates correctly. XFree86 still will not
58348+ operate correctly with this option enabled, so DO NOT CHOOSE Y
58349+ IF YOU USE XFree86. If you use XFree86 and you still want to
58350+ protect your kernel against modification, use the RBAC system.
58351+
58352+config GRKERNSEC_PROC_MEMMAP
58353+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
58354+ default y if (PAX_NOEXEC || PAX_ASLR)
58355+ depends on PAX_NOEXEC || PAX_ASLR
58356+ help
58357+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
58358+ give no information about the addresses of its mappings if
58359+ PaX features that rely on random addresses are enabled on the task.
58360+ If you use PaX it is greatly recommended that you say Y here as it
58361+ closes up a hole that makes the full ASLR useless for suid
58362+ binaries.
58363+
58364+config GRKERNSEC_BRUTE
58365+ bool "Deter exploit bruteforcing"
58366+ help
58367+ If you say Y here, attempts to bruteforce exploits against forking
58368+ daemons such as apache or sshd, as well as against suid/sgid binaries
58369+ will be deterred. When a child of a forking daemon is killed by PaX
58370+ or crashes due to an illegal instruction or other suspicious signal,
58371+ the parent process will be delayed 30 seconds upon every subsequent
58372+ fork until the administrator is able to assess the situation and
58373+ restart the daemon.
58374+ In the suid/sgid case, the attempt is logged, the user has all their
58375+ processes terminated, and they are prevented from executing any further
58376+ processes for 15 minutes.
58377+ It is recommended that you also enable signal logging in the auditing
58378+ section so that logs are generated when a process triggers a suspicious
58379+ signal.
58380+ If the sysctl option is enabled, a sysctl option with name
58381+ "deter_bruteforce" is created.
58382+
58383+config GRKERNSEC_MODHARDEN
58384+ bool "Harden module auto-loading"
58385+ depends on MODULES
58386+ help
58387+ If you say Y here, module auto-loading in response to use of some
58388+ feature implemented by an unloaded module will be restricted to
58389+ root users. Enabling this option helps defend against attacks
58390+ by unprivileged users who abuse the auto-loading behavior to
58391+ cause a vulnerable module to load that is then exploited.
58392+
58393+ If this option prevents a legitimate use of auto-loading for a
58394+ non-root user, the administrator can execute modprobe manually
58395+ with the exact name of the module mentioned in the alert log.
58396+ Alternatively, the administrator can add the module to the list
58397+ of modules loaded at boot by modifying init scripts.
58398+
58399+ Modification of init scripts will most likely be needed on
58400+ Ubuntu servers with encrypted home directory support enabled,
58401+ as the first non-root user logging in will cause the ecb(aes),
58402+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
58403+
58404+config GRKERNSEC_HIDESYM
58405+ bool "Hide kernel symbols"
58406+ help
58407+ If you say Y here, getting information on loaded modules, and
58408+ displaying all kernel symbols through a syscall will be restricted
58409+ to users with CAP_SYS_MODULE. For software compatibility reasons,
58410+ /proc/kallsyms will be restricted to the root user. The RBAC
58411+ system can hide that entry even from root.
58412+
58413+ This option also prevents leaking of kernel addresses through
58414+ several /proc entries.
58415+
58416+ Note that this option is only effective provided the following
58417+ conditions are met:
58418+ 1) The kernel using grsecurity is not precompiled by some distribution
58419+ 2) You have also enabled GRKERNSEC_DMESG
58420+ 3) You are using the RBAC system and hiding other files such as your
58421+ kernel image and System.map. Alternatively, enabling this option
58422+ causes the permissions on /boot, /lib/modules, and the kernel
58423+ source directory to change at compile time to prevent
58424+ reading by non-root users.
58425+ If the above conditions are met, this option will aid in providing a
58426+ useful protection against local kernel exploitation of overflows
58427+ and arbitrary read/write vulnerabilities.
58428+
58429+config GRKERNSEC_KERN_LOCKOUT
58430+ bool "Active kernel exploit response"
58431+ depends on X86 || ARM || PPC || SPARC
58432+ help
58433+ If you say Y here, when a PaX alert is triggered due to suspicious
58434+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
58435+ or an OOPs occurs due to bad memory accesses, instead of just
58436+ terminating the offending process (and potentially allowing
58437+ a subsequent exploit from the same user), we will take one of two
58438+ actions:
58439+ If the user was root, we will panic the system
58440+ If the user was non-root, we will log the attempt, terminate
58441+ all processes owned by the user, then prevent them from creating
58442+ any new processes until the system is restarted
58443+ This deters repeated kernel exploitation/bruteforcing attempts
58444+ and is useful for later forensics.
58445+
58446+endmenu
58447+menu "Role Based Access Control Options"
58448+depends on GRKERNSEC
58449+
58450+config GRKERNSEC_RBAC_DEBUG
58451+ bool
58452+
58453+config GRKERNSEC_NO_RBAC
58454+ bool "Disable RBAC system"
58455+ help
58456+ If you say Y here, the /dev/grsec device will be removed from the kernel,
58457+ preventing the RBAC system from being enabled. You should only say Y
58458+ here if you have no intention of using the RBAC system, so as to prevent
58459+ an attacker with root access from misusing the RBAC system to hide files
58460+ and processes when loadable module support and /dev/[k]mem have been
58461+ locked down.
58462+
58463+config GRKERNSEC_ACL_HIDEKERN
58464+ bool "Hide kernel processes"
58465+ help
58466+ If you say Y here, all kernel threads will be hidden to all
58467+ processes but those whose subject has the "view hidden processes"
58468+ flag.
58469+
58470+config GRKERNSEC_ACL_MAXTRIES
58471+ int "Maximum tries before password lockout"
58472+ default 3
58473+ help
58474+ This option enforces the maximum number of times a user can attempt
58475+ to authorize themselves with the grsecurity RBAC system before being
58476+ denied the ability to attempt authorization again for a specified time.
58477+ The lower the number, the harder it will be to brute-force a password.
58478+
58479+config GRKERNSEC_ACL_TIMEOUT
58480+ int "Time to wait after max password tries, in seconds"
58481+ default 30
58482+ help
58483+ This option specifies the time the user must wait after attempting to
58484+ authorize to the RBAC system with the maximum number of invalid
58485+ passwords. The higher the number, the harder it will be to brute-force
58486+ a password.
58487+
58488+endmenu
58489+menu "Filesystem Protections"
58490+depends on GRKERNSEC
58491+
58492+config GRKERNSEC_PROC
58493+ bool "Proc restrictions"
58494+ help
58495+ If you say Y here, the permissions of the /proc filesystem
58496+ will be altered to enhance system security and privacy. You MUST
58497+ choose either a user only restriction or a user and group restriction.
58498+ Depending upon the option you choose, you can either restrict users to
58499+ see only the processes they themselves run, or choose a group that can
58500+ view all processes and files normally restricted to root if you choose
58501+ the "restrict to user only" option. NOTE: If you're running identd as
58502+ a non-root user, you will have to run it as the group you specify here.
58503+
58504+config GRKERNSEC_PROC_USER
58505+ bool "Restrict /proc to user only"
58506+ depends on GRKERNSEC_PROC
58507+ help
58508+ If you say Y here, non-root users will only be able to view their own
58509+ processes, and restricts them from viewing network-related information,
58510+ and viewing kernel symbol and module information.
58511+
58512+config GRKERNSEC_PROC_USERGROUP
58513+ bool "Allow special group"
58514+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
58515+ help
58516+ If you say Y here, you will be able to select a group that will be
58517+ able to view all processes and network-related information. If you've
58518+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
58519+ remain hidden. This option is useful if you want to run identd as
58520+ a non-root user.
58521+
58522+config GRKERNSEC_PROC_GID
58523+ int "GID for special group"
58524+ depends on GRKERNSEC_PROC_USERGROUP
58525+ default 1001
58526+
58527+config GRKERNSEC_PROC_ADD
58528+ bool "Additional restrictions"
58529+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
58530+ help
58531+ If you say Y here, additional restrictions will be placed on
58532+ /proc that keep normal users from viewing device information and
58533+ slabinfo information that could be useful for exploits.
58534+
58535+config GRKERNSEC_LINK
58536+ bool "Linking restrictions"
58537+ help
58538+ If you say Y here, /tmp race exploits will be prevented, since users
58539+ will no longer be able to follow symlinks owned by other users in
58540+ world-writable +t directories (e.g. /tmp), unless the owner of the
58541+ symlink is the owner of the directory. users will also not be
58542+ able to hardlink to files they do not own. If the sysctl option is
58543+ enabled, a sysctl option with name "linking_restrictions" is created.
58544+
58545+config GRKERNSEC_FIFO
58546+ bool "FIFO restrictions"
58547+ help
58548+ If you say Y here, users will not be able to write to FIFOs they don't
58549+ own in world-writable +t directories (e.g. /tmp), unless the owner of
58550+ the FIFO is the same owner of the directory it's held in. If the sysctl
58551+ option is enabled, a sysctl option with name "fifo_restrictions" is
58552+ created.
58553+
58554+config GRKERNSEC_SYSFS_RESTRICT
58555+ bool "Sysfs/debugfs restriction"
58556+ depends on SYSFS
58557+ help
58558+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
58559+ any filesystem normally mounted under it (e.g. debugfs) will only
58560+ be accessible by root. These filesystems generally provide access
58561+ to hardware and debug information that isn't appropriate for unprivileged
58562+ users of the system. Sysfs and debugfs have also become a large source
58563+ of new vulnerabilities, ranging from infoleaks to local compromise.
58564+ There has been very little oversight with an eye toward security involved
58565+ in adding new exporters of information to these filesystems, so their
58566+ use is discouraged.
58567+ This option is equivalent to a chmod 0700 of the mount paths.
58568+
58569+config GRKERNSEC_ROFS
58570+ bool "Runtime read-only mount protection"
58571+ help
58572+ If you say Y here, a sysctl option with name "romount_protect" will
58573+ be created. By setting this option to 1 at runtime, filesystems
58574+ will be protected in the following ways:
58575+ * No new writable mounts will be allowed
58576+ * Existing read-only mounts won't be able to be remounted read/write
58577+ * Write operations will be denied on all block devices
58578+ This option acts independently of grsec_lock: once it is set to 1,
58579+ it cannot be turned off. Therefore, please be mindful of the resulting
58580+ behavior if this option is enabled in an init script on a read-only
58581+ filesystem. This feature is mainly intended for secure embedded systems.
58582+
58583+config GRKERNSEC_CHROOT
58584+ bool "Chroot jail restrictions"
58585+ help
58586+ If you say Y here, you will be able to choose several options that will
58587+ make breaking out of a chrooted jail much more difficult. If you
58588+ encounter no software incompatibilities with the following options, it
58589+ is recommended that you enable each one.
58590+
58591+config GRKERNSEC_CHROOT_MOUNT
58592+ bool "Deny mounts"
58593+ depends on GRKERNSEC_CHROOT
58594+ help
58595+ If you say Y here, processes inside a chroot will not be able to
58596+ mount or remount filesystems. If the sysctl option is enabled, a
58597+ sysctl option with name "chroot_deny_mount" is created.
58598+
58599+config GRKERNSEC_CHROOT_DOUBLE
58600+ bool "Deny double-chroots"
58601+ depends on GRKERNSEC_CHROOT
58602+ help
58603+ If you say Y here, processes inside a chroot will not be able to chroot
58604+ again outside the chroot. This is a widely used method of breaking
58605+ out of a chroot jail and should not be allowed. If the sysctl
58606+ option is enabled, a sysctl option with name
58607+ "chroot_deny_chroot" is created.
58608+
58609+config GRKERNSEC_CHROOT_PIVOT
58610+ bool "Deny pivot_root in chroot"
58611+ depends on GRKERNSEC_CHROOT
58612+ help
58613+ If you say Y here, processes inside a chroot will not be able to use
58614+ a function called pivot_root() that was introduced in Linux 2.3.41. It
58615+ works similar to chroot in that it changes the root filesystem. This
58616+ function could be misused in a chrooted process to attempt to break out
58617+ of the chroot, and therefore should not be allowed. If the sysctl
58618+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
58619+ created.
58620+
58621+config GRKERNSEC_CHROOT_CHDIR
58622+ bool "Enforce chdir(\"/\") on all chroots"
58623+ depends on GRKERNSEC_CHROOT
58624+ help
58625+ If you say Y here, the current working directory of all newly-chrooted
58626+ applications will be set to the the root directory of the chroot.
58627+ The man page on chroot(2) states:
58628+ Note that this call does not change the current working
58629+ directory, so that `.' can be outside the tree rooted at
58630+ `/'. In particular, the super-user can escape from a
58631+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
58632+
58633+ It is recommended that you say Y here, since it's not known to break
58634+ any software. If the sysctl option is enabled, a sysctl option with
58635+ name "chroot_enforce_chdir" is created.
58636+
58637+config GRKERNSEC_CHROOT_CHMOD
58638+ bool "Deny (f)chmod +s"
58639+ depends on GRKERNSEC_CHROOT
58640+ help
58641+ If you say Y here, processes inside a chroot will not be able to chmod
58642+ or fchmod files to make them have suid or sgid bits. This protects
58643+ against another published method of breaking a chroot. If the sysctl
58644+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
58645+ created.
58646+
58647+config GRKERNSEC_CHROOT_FCHDIR
58648+ bool "Deny fchdir out of chroot"
58649+ depends on GRKERNSEC_CHROOT
58650+ help
58651+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
58652+ to a file descriptor of the chrooting process that points to a directory
58653+ outside the filesystem will be stopped. If the sysctl option
58654+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
58655+
58656+config GRKERNSEC_CHROOT_MKNOD
58657+ bool "Deny mknod"
58658+ depends on GRKERNSEC_CHROOT
58659+ help
58660+ If you say Y here, processes inside a chroot will not be allowed to
58661+ mknod. The problem with using mknod inside a chroot is that it
58662+ would allow an attacker to create a device entry that is the same
58663+ as one on the physical root of your system, which could range from
58664+ anything from the console device to a device for your harddrive (which
58665+ they could then use to wipe the drive or steal data). It is recommended
58666+ that you say Y here, unless you run into software incompatibilities.
58667+ If the sysctl option is enabled, a sysctl option with name
58668+ "chroot_deny_mknod" is created.
58669+
58670+config GRKERNSEC_CHROOT_SHMAT
58671+ bool "Deny shmat() out of chroot"
58672+ depends on GRKERNSEC_CHROOT
58673+ help
58674+ If you say Y here, processes inside a chroot will not be able to attach
58675+ to shared memory segments that were created outside of the chroot jail.
58676+ It is recommended that you say Y here. If the sysctl option is enabled,
58677+ a sysctl option with name "chroot_deny_shmat" is created.
58678+
58679+config GRKERNSEC_CHROOT_UNIX
58680+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
58681+ depends on GRKERNSEC_CHROOT
58682+ help
58683+ If you say Y here, processes inside a chroot will not be able to
58684+ connect to abstract (meaning not belonging to a filesystem) Unix
58685+ domain sockets that were bound outside of a chroot. It is recommended
58686+ that you say Y here. If the sysctl option is enabled, a sysctl option
58687+ with name "chroot_deny_unix" is created.
58688+
58689+config GRKERNSEC_CHROOT_FINDTASK
58690+ bool "Protect outside processes"
58691+ depends on GRKERNSEC_CHROOT
58692+ help
58693+ If you say Y here, processes inside a chroot will not be able to
58694+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
58695+ getsid, or view any process outside of the chroot. If the sysctl
58696+ option is enabled, a sysctl option with name "chroot_findtask" is
58697+ created.
58698+
58699+config GRKERNSEC_CHROOT_NICE
58700+ bool "Restrict priority changes"
58701+ depends on GRKERNSEC_CHROOT
58702+ help
58703+ If you say Y here, processes inside a chroot will not be able to raise
58704+ the priority of processes in the chroot, or alter the priority of
58705+ processes outside the chroot. This provides more security than simply
58706+ removing CAP_SYS_NICE from the process' capability set. If the
58707+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
58708+ is created.
58709+
58710+config GRKERNSEC_CHROOT_SYSCTL
58711+ bool "Deny sysctl writes"
58712+ depends on GRKERNSEC_CHROOT
58713+ help
58714+ If you say Y here, an attacker in a chroot will not be able to
58715+ write to sysctl entries, either by sysctl(2) or through a /proc
58716+ interface. It is strongly recommended that you say Y here. If the
58717+ sysctl option is enabled, a sysctl option with name
58718+ "chroot_deny_sysctl" is created.
58719+
58720+config GRKERNSEC_CHROOT_CAPS
58721+ bool "Capability restrictions"
58722+ depends on GRKERNSEC_CHROOT
58723+ help
58724+ If you say Y here, the capabilities on all processes within a
58725+ chroot jail will be lowered to stop module insertion, raw i/o,
58726+ system and net admin tasks, rebooting the system, modifying immutable
58727+ files, modifying IPC owned by another, and changing the system time.
58728+ This is left an option because it can break some apps. Disable this
58729+ if your chrooted apps are having problems performing those kinds of
58730+ tasks. If the sysctl option is enabled, a sysctl option with
58731+ name "chroot_caps" is created.
58732+
58733+endmenu
58734+menu "Kernel Auditing"
58735+depends on GRKERNSEC
58736+
58737+config GRKERNSEC_AUDIT_GROUP
58738+ bool "Single group for auditing"
58739+ help
58740+ If you say Y here, the exec, chdir, and (un)mount logging features
58741+ will only operate on a group you specify. This option is recommended
58742+ if you only want to watch certain users instead of having a large
58743+ amount of logs from the entire system. If the sysctl option is enabled,
58744+ a sysctl option with name "audit_group" is created.
58745+
58746+config GRKERNSEC_AUDIT_GID
58747+ int "GID for auditing"
58748+ depends on GRKERNSEC_AUDIT_GROUP
58749+ default 1007
58750+
58751+config GRKERNSEC_EXECLOG
58752+ bool "Exec logging"
58753+ help
58754+ If you say Y here, all execve() calls will be logged (since the
58755+ other exec*() calls are frontends to execve(), all execution
58756+ will be logged). Useful for shell-servers that like to keep track
58757+ of their users. If the sysctl option is enabled, a sysctl option with
58758+ name "exec_logging" is created.
58759+ WARNING: This option when enabled will produce a LOT of logs, especially
58760+ on an active system.
58761+
58762+config GRKERNSEC_RESLOG
58763+ bool "Resource logging"
58764+ help
58765+ If you say Y here, all attempts to overstep resource limits will
58766+ be logged with the resource name, the requested size, and the current
58767+ limit. It is highly recommended that you say Y here. If the sysctl
58768+ option is enabled, a sysctl option with name "resource_logging" is
58769+ created. If the RBAC system is enabled, the sysctl value is ignored.
58770+
58771+config GRKERNSEC_CHROOT_EXECLOG
58772+ bool "Log execs within chroot"
58773+ help
58774+ If you say Y here, all executions inside a chroot jail will be logged
58775+ to syslog. This can cause a large amount of logs if certain
58776+ applications (eg. djb's daemontools) are installed on the system, and
58777+ is therefore left as an option. If the sysctl option is enabled, a
58778+ sysctl option with name "chroot_execlog" is created.
58779+
58780+config GRKERNSEC_AUDIT_PTRACE
58781+ bool "Ptrace logging"
58782+ help
58783+ If you say Y here, all attempts to attach to a process via ptrace
58784+ will be logged. If the sysctl option is enabled, a sysctl option
58785+ with name "audit_ptrace" is created.
58786+
58787+config GRKERNSEC_AUDIT_CHDIR
58788+ bool "Chdir logging"
58789+ help
58790+ If you say Y here, all chdir() calls will be logged. If the sysctl
58791+ option is enabled, a sysctl option with name "audit_chdir" is created.
58792+
58793+config GRKERNSEC_AUDIT_MOUNT
58794+ bool "(Un)Mount logging"
58795+ help
58796+ If you say Y here, all mounts and unmounts will be logged. If the
58797+ sysctl option is enabled, a sysctl option with name "audit_mount" is
58798+ created.
58799+
58800+config GRKERNSEC_SIGNAL
58801+ bool "Signal logging"
58802+ help
58803+ If you say Y here, certain important signals will be logged, such as
58804+ SIGSEGV, which will as a result inform you of when a error in a program
58805+ occurred, which in some cases could mean a possible exploit attempt.
58806+ If the sysctl option is enabled, a sysctl option with name
58807+ "signal_logging" is created.
58808+
58809+config GRKERNSEC_FORKFAIL
58810+ bool "Fork failure logging"
58811+ help
58812+ If you say Y here, all failed fork() attempts will be logged.
58813+ This could suggest a fork bomb, or someone attempting to overstep
58814+ their process limit. If the sysctl option is enabled, a sysctl option
58815+ with name "forkfail_logging" is created.
58816+
58817+config GRKERNSEC_TIME
58818+ bool "Time change logging"
58819+ help
58820+ If you say Y here, any changes of the system clock will be logged.
58821+ If the sysctl option is enabled, a sysctl option with name
58822+ "timechange_logging" is created.
58823+
58824+config GRKERNSEC_PROC_IPADDR
58825+ bool "/proc/<pid>/ipaddr support"
58826+ help
58827+ If you say Y here, a new entry will be added to each /proc/<pid>
58828+ directory that contains the IP address of the person using the task.
58829+ The IP is carried across local TCP and AF_UNIX stream sockets.
58830+ This information can be useful for IDS/IPSes to perform remote response
58831+ to a local attack. The entry is readable by only the owner of the
58832+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
58833+ the RBAC system), and thus does not create privacy concerns.
58834+
58835+config GRKERNSEC_RWXMAP_LOG
58836+ bool 'Denied RWX mmap/mprotect logging'
58837+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
58838+ help
58839+ If you say Y here, calls to mmap() and mprotect() with explicit
58840+ usage of PROT_WRITE and PROT_EXEC together will be logged when
58841+ denied by the PAX_MPROTECT feature. If the sysctl option is
58842+ enabled, a sysctl option with name "rwxmap_logging" is created.
58843+
58844+config GRKERNSEC_AUDIT_TEXTREL
58845+ bool 'ELF text relocations logging (READ HELP)'
58846+ depends on PAX_MPROTECT
58847+ help
58848+ If you say Y here, text relocations will be logged with the filename
58849+ of the offending library or binary. The purpose of the feature is
58850+ to help Linux distribution developers get rid of libraries and
58851+ binaries that need text relocations which hinder the future progress
58852+ of PaX. Only Linux distribution developers should say Y here, and
58853+ never on a production machine, as this option creates an information
58854+ leak that could aid an attacker in defeating the randomization of
58855+ a single memory region. If the sysctl option is enabled, a sysctl
58856+ option with name "audit_textrel" is created.
58857+
58858+endmenu
58859+
58860+menu "Executable Protections"
58861+depends on GRKERNSEC
58862+
58863+config GRKERNSEC_DMESG
58864+ bool "Dmesg(8) restriction"
58865+ help
58866+ If you say Y here, non-root users will not be able to use dmesg(8)
58867+ to view up to the last 4kb of messages in the kernel's log buffer.
58868+ The kernel's log buffer often contains kernel addresses and other
58869+ identifying information useful to an attacker in fingerprinting a
58870+ system for a targeted exploit.
58871+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
58872+ created.
58873+
58874+config GRKERNSEC_HARDEN_PTRACE
58875+ bool "Deter ptrace-based process snooping"
58876+ help
58877+ If you say Y here, TTY sniffers and other malicious monitoring
58878+ programs implemented through ptrace will be defeated. If you
58879+ have been using the RBAC system, this option has already been
58880+ enabled for several years for all users, with the ability to make
58881+ fine-grained exceptions.
58882+
58883+ This option only affects the ability of non-root users to ptrace
58884+ processes that are not a descendent of the ptracing process.
58885+ This means that strace ./binary and gdb ./binary will still work,
58886+ but attaching to arbitrary processes will not. If the sysctl
58887+ option is enabled, a sysctl option with name "harden_ptrace" is
58888+ created.
58889+
58890+config GRKERNSEC_TPE
58891+ bool "Trusted Path Execution (TPE)"
58892+ help
58893+ If you say Y here, you will be able to choose a gid to add to the
58894+ supplementary groups of users you want to mark as "untrusted."
58895+ These users will not be able to execute any files that are not in
58896+ root-owned directories writable only by root. If the sysctl option
58897+ is enabled, a sysctl option with name "tpe" is created.
58898+
58899+config GRKERNSEC_TPE_ALL
58900+ bool "Partially restrict all non-root users"
58901+ depends on GRKERNSEC_TPE
58902+ help
58903+ If you say Y here, all non-root users will be covered under
58904+ a weaker TPE restriction. This is separate from, and in addition to,
58905+ the main TPE options that you have selected elsewhere. Thus, if a
58906+ "trusted" GID is chosen, this restriction applies to even that GID.
58907+ Under this restriction, all non-root users will only be allowed to
58908+ execute files in directories they own that are not group or
58909+ world-writable, or in directories owned by root and writable only by
58910+ root. If the sysctl option is enabled, a sysctl option with name
58911+ "tpe_restrict_all" is created.
58912+
58913+config GRKERNSEC_TPE_INVERT
58914+ bool "Invert GID option"
58915+ depends on GRKERNSEC_TPE
58916+ help
58917+ If you say Y here, the group you specify in the TPE configuration will
58918+ decide what group TPE restrictions will be *disabled* for. This
58919+ option is useful if you want TPE restrictions to be applied to most
58920+ users on the system. If the sysctl option is enabled, a sysctl option
58921+ with name "tpe_invert" is created. Unlike other sysctl options, this
58922+ entry will default to on for backward-compatibility.
58923+
58924+config GRKERNSEC_TPE_GID
58925+ int "GID for untrusted users"
58926+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
58927+ default 1005
58928+ help
58929+ Setting this GID determines what group TPE restrictions will be
58930+ *enabled* for. If the sysctl option is enabled, a sysctl option
58931+ with name "tpe_gid" is created.
58932+
58933+config GRKERNSEC_TPE_GID
58934+ int "GID for trusted users"
58935+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
58936+ default 1005
58937+ help
58938+ Setting this GID determines what group TPE restrictions will be
58939+ *disabled* for. If the sysctl option is enabled, a sysctl option
58940+ with name "tpe_gid" is created.
58941+
58942+endmenu
58943+menu "Network Protections"
58944+depends on GRKERNSEC
58945+
58946+config GRKERNSEC_RANDNET
58947+ bool "Larger entropy pools"
58948+ help
58949+ If you say Y here, the entropy pools used for many features of Linux
58950+ and grsecurity will be doubled in size. Since several grsecurity
58951+ features use additional randomness, it is recommended that you say Y
58952+ here. Saying Y here has a similar effect as modifying
58953+ /proc/sys/kernel/random/poolsize.
58954+
58955+config GRKERNSEC_BLACKHOLE
58956+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
58957+ depends on NET
58958+ help
58959+ If you say Y here, neither TCP resets nor ICMP
58960+ destination-unreachable packets will be sent in response to packets
58961+ sent to ports for which no associated listening process exists.
58962+ This feature supports both IPV4 and IPV6 and exempts the
58963+ loopback interface from blackholing. Enabling this feature
58964+ makes a host more resilient to DoS attacks and reduces network
58965+ visibility against scanners.
58966+
58967+ The blackhole feature as-implemented is equivalent to the FreeBSD
58968+ blackhole feature, as it prevents RST responses to all packets, not
58969+ just SYNs. Under most application behavior this causes no
58970+ problems, but applications (like haproxy) may not close certain
58971+ connections in a way that cleanly terminates them on the remote
58972+ end, leaving the remote host in LAST_ACK state. Because of this
58973+ side-effect and to prevent intentional LAST_ACK DoSes, this
58974+ feature also adds automatic mitigation against such attacks.
58975+ The mitigation drastically reduces the amount of time a socket
58976+ can spend in LAST_ACK state. If you're using haproxy and not
58977+ all servers it connects to have this option enabled, consider
58978+ disabling this feature on the haproxy host.
58979+
58980+ If the sysctl option is enabled, two sysctl options with names
58981+ "ip_blackhole" and "lastack_retries" will be created.
58982+ While "ip_blackhole" takes the standard zero/non-zero on/off
58983+ toggle, "lastack_retries" uses the same kinds of values as
58984+ "tcp_retries1" and "tcp_retries2". The default value of 4
58985+ prevents a socket from lasting more than 45 seconds in LAST_ACK
58986+ state.
58987+
58988+config GRKERNSEC_SOCKET
58989+ bool "Socket restrictions"
58990+ depends on NET
58991+ help
58992+ If you say Y here, you will be able to choose from several options.
58993+ If you assign a GID on your system and add it to the supplementary
58994+ groups of users you want to restrict socket access to, this patch
58995+ will perform up to three things, based on the option(s) you choose.
58996+
58997+config GRKERNSEC_SOCKET_ALL
58998+ bool "Deny any sockets to group"
58999+ depends on GRKERNSEC_SOCKET
59000+ help
59001+ If you say Y here, you will be able to choose a GID of whose users will
59002+ be unable to connect to other hosts from your machine or run server
59003+ applications from your machine. If the sysctl option is enabled, a
59004+ sysctl option with name "socket_all" is created.
59005+
59006+config GRKERNSEC_SOCKET_ALL_GID
59007+ int "GID to deny all sockets for"
59008+ depends on GRKERNSEC_SOCKET_ALL
59009+ default 1004
59010+ help
59011+ Here you can choose the GID to disable socket access for. Remember to
59012+ add the users you want socket access disabled for to the GID
59013+ specified here. If the sysctl option is enabled, a sysctl option
59014+ with name "socket_all_gid" is created.
59015+
59016+config GRKERNSEC_SOCKET_CLIENT
59017+ bool "Deny client sockets to group"
59018+ depends on GRKERNSEC_SOCKET
59019+ help
59020+ If you say Y here, you will be able to choose a GID of whose users will
59021+ be unable to connect to other hosts from your machine, but will be
59022+ able to run servers. If this option is enabled, all users in the group
59023+ you specify will have to use passive mode when initiating ftp transfers
59024+ from the shell on your machine. If the sysctl option is enabled, a
59025+ sysctl option with name "socket_client" is created.
59026+
59027+config GRKERNSEC_SOCKET_CLIENT_GID
59028+ int "GID to deny client sockets for"
59029+ depends on GRKERNSEC_SOCKET_CLIENT
59030+ default 1003
59031+ help
59032+ Here you can choose the GID to disable client socket access for.
59033+ Remember to add the users you want client socket access disabled for to
59034+ the GID specified here. If the sysctl option is enabled, a sysctl
59035+ option with name "socket_client_gid" is created.
59036+
59037+config GRKERNSEC_SOCKET_SERVER
59038+ bool "Deny server sockets to group"
59039+ depends on GRKERNSEC_SOCKET
59040+ help
59041+ If you say Y here, you will be able to choose a GID of whose users will
59042+ be unable to run server applications from your machine. If the sysctl
59043+ option is enabled, a sysctl option with name "socket_server" is created.
59044+
59045+config GRKERNSEC_SOCKET_SERVER_GID
59046+ int "GID to deny server sockets for"
59047+ depends on GRKERNSEC_SOCKET_SERVER
59048+ default 1002
59049+ help
59050+ Here you can choose the GID to disable server socket access for.
59051+ Remember to add the users you want server socket access disabled for to
59052+ the GID specified here. If the sysctl option is enabled, a sysctl
59053+ option with name "socket_server_gid" is created.
59054+
59055+endmenu
59056+menu "Sysctl support"
59057+depends on GRKERNSEC && SYSCTL
59058+
59059+config GRKERNSEC_SYSCTL
59060+ bool "Sysctl support"
59061+ help
59062+ If you say Y here, you will be able to change the options that
59063+ grsecurity runs with at bootup, without having to recompile your
59064+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
59065+ to enable (1) or disable (0) various features. All the sysctl entries
59066+ are mutable until the "grsec_lock" entry is set to a non-zero value.
59067+ All features enabled in the kernel configuration are disabled at boot
59068+ if you do not say Y to the "Turn on features by default" option.
59069+ All options should be set at startup, and the grsec_lock entry should
59070+ be set to a non-zero value after all the options are set.
59071+ *THIS IS EXTREMELY IMPORTANT*
59072+
59073+config GRKERNSEC_SYSCTL_DISTRO
59074+ bool "Extra sysctl support for distro makers (READ HELP)"
59075+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
59076+ help
59077+ If you say Y here, additional sysctl options will be created
59078+ for features that affect processes running as root. Therefore,
59079+ it is critical when using this option that the grsec_lock entry be
59080+ enabled after boot. Only distros with prebuilt kernel packages
59081+ with this option enabled that can ensure grsec_lock is enabled
59082+ after boot should use this option.
59083+ *Failure to set grsec_lock after boot makes all grsec features
59084+ this option covers useless*
59085+
59086+ Currently this option creates the following sysctl entries:
59087+ "Disable Privileged I/O": "disable_priv_io"
59088+
59089+config GRKERNSEC_SYSCTL_ON
59090+ bool "Turn on features by default"
59091+ depends on GRKERNSEC_SYSCTL
59092+ help
59093+ If you say Y here, instead of having all features enabled in the
59094+ kernel configuration disabled at boot time, the features will be
59095+ enabled at boot time. It is recommended you say Y here unless
59096+ there is some reason you would want all sysctl-tunable features to
59097+ be disabled by default. As mentioned elsewhere, it is important
59098+ to enable the grsec_lock entry once you have finished modifying
59099+ the sysctl entries.
59100+
59101+endmenu
59102+menu "Logging Options"
59103+depends on GRKERNSEC
59104+
59105+config GRKERNSEC_FLOODTIME
59106+ int "Seconds in between log messages (minimum)"
59107+ default 10
59108+ help
59109+ This option allows you to enforce the number of seconds between
59110+ grsecurity log messages. The default should be suitable for most
59111+ people, however, if you choose to change it, choose a value small enough
59112+ to allow informative logs to be produced, but large enough to
59113+ prevent flooding.
59114+
59115+config GRKERNSEC_FLOODBURST
59116+ int "Number of messages in a burst (maximum)"
59117+ default 6
59118+ help
59119+ This option allows you to choose the maximum number of messages allowed
59120+ within the flood time interval you chose in a separate option. The
59121+ default should be suitable for most people, however if you find that
59122+ many of your logs are being interpreted as flooding, you may want to
59123+ raise this value.
59124+
59125+endmenu
59126+
59127+endmenu
59128diff -urNp linux-2.6.32.46/grsecurity/Makefile linux-2.6.32.46/grsecurity/Makefile
59129--- linux-2.6.32.46/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
59130+++ linux-2.6.32.46/grsecurity/Makefile 2011-09-14 23:29:39.000000000 -0400
59131@@ -0,0 +1,35 @@
59132+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
59133+# during 2001-2009 it has been completely redesigned by Brad Spengler
59134+# into an RBAC system
59135+#
59136+# All code in this directory and various hooks inserted throughout the kernel
59137+# are copyright Brad Spengler - Open Source Security, Inc., and released
59138+# under the GPL v2 or higher
59139+
59140+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
59141+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
59142+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
59143+
59144+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
59145+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
59146+ gracl_learn.o grsec_log.o
59147+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
59148+
59149+ifdef CONFIG_NET
59150+obj-y += grsec_sock.o
59151+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
59152+endif
59153+
59154+ifndef CONFIG_GRKERNSEC
59155+obj-y += grsec_disabled.o
59156+endif
59157+
59158+ifdef CONFIG_GRKERNSEC_HIDESYM
59159+extra-y := grsec_hidesym.o
59160+$(obj)/grsec_hidesym.o:
59161+ @-chmod -f 500 /boot
59162+ @-chmod -f 500 /lib/modules
59163+ @-chmod -f 500 /lib64/modules
59164+ @-chmod -f 700 .
59165+ @echo ' grsec: protected kernel image paths'
59166+endif
59167diff -urNp linux-2.6.32.46/include/acpi/acpi_bus.h linux-2.6.32.46/include/acpi/acpi_bus.h
59168--- linux-2.6.32.46/include/acpi/acpi_bus.h 2011-03-27 14:31:47.000000000 -0400
59169+++ linux-2.6.32.46/include/acpi/acpi_bus.h 2011-08-05 20:33:55.000000000 -0400
59170@@ -107,7 +107,7 @@ struct acpi_device_ops {
59171 acpi_op_bind bind;
59172 acpi_op_unbind unbind;
59173 acpi_op_notify notify;
59174-};
59175+} __no_const;
59176
59177 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
59178
59179diff -urNp linux-2.6.32.46/include/acpi/acpi_drivers.h linux-2.6.32.46/include/acpi/acpi_drivers.h
59180--- linux-2.6.32.46/include/acpi/acpi_drivers.h 2011-03-27 14:31:47.000000000 -0400
59181+++ linux-2.6.32.46/include/acpi/acpi_drivers.h 2011-04-17 15:56:46.000000000 -0400
59182@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
59183 Dock Station
59184 -------------------------------------------------------------------------- */
59185 struct acpi_dock_ops {
59186- acpi_notify_handler handler;
59187- acpi_notify_handler uevent;
59188+ const acpi_notify_handler handler;
59189+ const acpi_notify_handler uevent;
59190 };
59191
59192 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
59193@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
59194 extern int register_dock_notifier(struct notifier_block *nb);
59195 extern void unregister_dock_notifier(struct notifier_block *nb);
59196 extern int register_hotplug_dock_device(acpi_handle handle,
59197- struct acpi_dock_ops *ops,
59198+ const struct acpi_dock_ops *ops,
59199 void *context);
59200 extern void unregister_hotplug_dock_device(acpi_handle handle);
59201 #else
59202@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
59203 {
59204 }
59205 static inline int register_hotplug_dock_device(acpi_handle handle,
59206- struct acpi_dock_ops *ops,
59207+ const struct acpi_dock_ops *ops,
59208 void *context)
59209 {
59210 return -ENODEV;
59211diff -urNp linux-2.6.32.46/include/asm-generic/atomic-long.h linux-2.6.32.46/include/asm-generic/atomic-long.h
59212--- linux-2.6.32.46/include/asm-generic/atomic-long.h 2011-03-27 14:31:47.000000000 -0400
59213+++ linux-2.6.32.46/include/asm-generic/atomic-long.h 2011-07-13 22:21:25.000000000 -0400
59214@@ -22,6 +22,12 @@
59215
59216 typedef atomic64_t atomic_long_t;
59217
59218+#ifdef CONFIG_PAX_REFCOUNT
59219+typedef atomic64_unchecked_t atomic_long_unchecked_t;
59220+#else
59221+typedef atomic64_t atomic_long_unchecked_t;
59222+#endif
59223+
59224 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
59225
59226 static inline long atomic_long_read(atomic_long_t *l)
59227@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
59228 return (long)atomic64_read(v);
59229 }
59230
59231+#ifdef CONFIG_PAX_REFCOUNT
59232+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59233+{
59234+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59235+
59236+ return (long)atomic64_read_unchecked(v);
59237+}
59238+#endif
59239+
59240 static inline void atomic_long_set(atomic_long_t *l, long i)
59241 {
59242 atomic64_t *v = (atomic64_t *)l;
59243@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
59244 atomic64_set(v, i);
59245 }
59246
59247+#ifdef CONFIG_PAX_REFCOUNT
59248+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59249+{
59250+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59251+
59252+ atomic64_set_unchecked(v, i);
59253+}
59254+#endif
59255+
59256 static inline void atomic_long_inc(atomic_long_t *l)
59257 {
59258 atomic64_t *v = (atomic64_t *)l;
59259@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
59260 atomic64_inc(v);
59261 }
59262
59263+#ifdef CONFIG_PAX_REFCOUNT
59264+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59265+{
59266+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59267+
59268+ atomic64_inc_unchecked(v);
59269+}
59270+#endif
59271+
59272 static inline void atomic_long_dec(atomic_long_t *l)
59273 {
59274 atomic64_t *v = (atomic64_t *)l;
59275@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
59276 atomic64_dec(v);
59277 }
59278
59279+#ifdef CONFIG_PAX_REFCOUNT
59280+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59281+{
59282+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59283+
59284+ atomic64_dec_unchecked(v);
59285+}
59286+#endif
59287+
59288 static inline void atomic_long_add(long i, atomic_long_t *l)
59289 {
59290 atomic64_t *v = (atomic64_t *)l;
59291@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
59292 atomic64_add(i, v);
59293 }
59294
59295+#ifdef CONFIG_PAX_REFCOUNT
59296+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59297+{
59298+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59299+
59300+ atomic64_add_unchecked(i, v);
59301+}
59302+#endif
59303+
59304 static inline void atomic_long_sub(long i, atomic_long_t *l)
59305 {
59306 atomic64_t *v = (atomic64_t *)l;
59307@@ -115,6 +166,15 @@ static inline long atomic_long_inc_retur
59308 return (long)atomic64_inc_return(v);
59309 }
59310
59311+#ifdef CONFIG_PAX_REFCOUNT
59312+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59313+{
59314+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
59315+
59316+ return (long)atomic64_inc_return_unchecked(v);
59317+}
59318+#endif
59319+
59320 static inline long atomic_long_dec_return(atomic_long_t *l)
59321 {
59322 atomic64_t *v = (atomic64_t *)l;
59323@@ -140,6 +200,12 @@ static inline long atomic_long_add_unles
59324
59325 typedef atomic_t atomic_long_t;
59326
59327+#ifdef CONFIG_PAX_REFCOUNT
59328+typedef atomic_unchecked_t atomic_long_unchecked_t;
59329+#else
59330+typedef atomic_t atomic_long_unchecked_t;
59331+#endif
59332+
59333 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
59334 static inline long atomic_long_read(atomic_long_t *l)
59335 {
59336@@ -148,6 +214,15 @@ static inline long atomic_long_read(atom
59337 return (long)atomic_read(v);
59338 }
59339
59340+#ifdef CONFIG_PAX_REFCOUNT
59341+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
59342+{
59343+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59344+
59345+ return (long)atomic_read_unchecked(v);
59346+}
59347+#endif
59348+
59349 static inline void atomic_long_set(atomic_long_t *l, long i)
59350 {
59351 atomic_t *v = (atomic_t *)l;
59352@@ -155,6 +230,15 @@ static inline void atomic_long_set(atomi
59353 atomic_set(v, i);
59354 }
59355
59356+#ifdef CONFIG_PAX_REFCOUNT
59357+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
59358+{
59359+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59360+
59361+ atomic_set_unchecked(v, i);
59362+}
59363+#endif
59364+
59365 static inline void atomic_long_inc(atomic_long_t *l)
59366 {
59367 atomic_t *v = (atomic_t *)l;
59368@@ -162,6 +246,15 @@ static inline void atomic_long_inc(atomi
59369 atomic_inc(v);
59370 }
59371
59372+#ifdef CONFIG_PAX_REFCOUNT
59373+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
59374+{
59375+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59376+
59377+ atomic_inc_unchecked(v);
59378+}
59379+#endif
59380+
59381 static inline void atomic_long_dec(atomic_long_t *l)
59382 {
59383 atomic_t *v = (atomic_t *)l;
59384@@ -169,6 +262,15 @@ static inline void atomic_long_dec(atomi
59385 atomic_dec(v);
59386 }
59387
59388+#ifdef CONFIG_PAX_REFCOUNT
59389+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
59390+{
59391+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59392+
59393+ atomic_dec_unchecked(v);
59394+}
59395+#endif
59396+
59397 static inline void atomic_long_add(long i, atomic_long_t *l)
59398 {
59399 atomic_t *v = (atomic_t *)l;
59400@@ -176,6 +278,15 @@ static inline void atomic_long_add(long
59401 atomic_add(i, v);
59402 }
59403
59404+#ifdef CONFIG_PAX_REFCOUNT
59405+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
59406+{
59407+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59408+
59409+ atomic_add_unchecked(i, v);
59410+}
59411+#endif
59412+
59413 static inline void atomic_long_sub(long i, atomic_long_t *l)
59414 {
59415 atomic_t *v = (atomic_t *)l;
59416@@ -232,6 +343,15 @@ static inline long atomic_long_inc_retur
59417 return (long)atomic_inc_return(v);
59418 }
59419
59420+#ifdef CONFIG_PAX_REFCOUNT
59421+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
59422+{
59423+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
59424+
59425+ return (long)atomic_inc_return_unchecked(v);
59426+}
59427+#endif
59428+
59429 static inline long atomic_long_dec_return(atomic_long_t *l)
59430 {
59431 atomic_t *v = (atomic_t *)l;
59432@@ -255,4 +375,47 @@ static inline long atomic_long_add_unles
59433
59434 #endif /* BITS_PER_LONG == 64 */
59435
59436+#ifdef CONFIG_PAX_REFCOUNT
59437+static inline void pax_refcount_needs_these_functions(void)
59438+{
59439+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
59440+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
59441+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
59442+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
59443+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
59444+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
59445+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
59446+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
59447+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
59448+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
59449+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
59450+
59451+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
59452+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
59453+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
59454+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
59455+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
59456+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
59457+}
59458+#else
59459+#define atomic_read_unchecked(v) atomic_read(v)
59460+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
59461+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
59462+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
59463+#define atomic_inc_unchecked(v) atomic_inc(v)
59464+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
59465+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
59466+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
59467+#define atomic_dec_unchecked(v) atomic_dec(v)
59468+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
59469+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
59470+
59471+#define atomic_long_read_unchecked(v) atomic_long_read(v)
59472+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
59473+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
59474+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
59475+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
59476+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
59477+#endif
59478+
59479 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
59480diff -urNp linux-2.6.32.46/include/asm-generic/bug.h linux-2.6.32.46/include/asm-generic/bug.h
59481--- linux-2.6.32.46/include/asm-generic/bug.h 2011-07-13 17:23:04.000000000 -0400
59482+++ linux-2.6.32.46/include/asm-generic/bug.h 2011-08-21 17:56:07.000000000 -0400
59483@@ -105,11 +105,11 @@ extern void warn_slowpath_null(const cha
59484
59485 #else /* !CONFIG_BUG */
59486 #ifndef HAVE_ARCH_BUG
59487-#define BUG() do {} while(0)
59488+#define BUG() do { for (;;) ; } while(0)
59489 #endif
59490
59491 #ifndef HAVE_ARCH_BUG_ON
59492-#define BUG_ON(condition) do { if (condition) ; } while(0)
59493+#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
59494 #endif
59495
59496 #ifndef HAVE_ARCH_WARN_ON
59497diff -urNp linux-2.6.32.46/include/asm-generic/cache.h linux-2.6.32.46/include/asm-generic/cache.h
59498--- linux-2.6.32.46/include/asm-generic/cache.h 2011-03-27 14:31:47.000000000 -0400
59499+++ linux-2.6.32.46/include/asm-generic/cache.h 2011-07-06 19:53:33.000000000 -0400
59500@@ -6,7 +6,7 @@
59501 * cache lines need to provide their own cache.h.
59502 */
59503
59504-#define L1_CACHE_SHIFT 5
59505-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
59506+#define L1_CACHE_SHIFT 5UL
59507+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
59508
59509 #endif /* __ASM_GENERIC_CACHE_H */
59510diff -urNp linux-2.6.32.46/include/asm-generic/dma-mapping-common.h linux-2.6.32.46/include/asm-generic/dma-mapping-common.h
59511--- linux-2.6.32.46/include/asm-generic/dma-mapping-common.h 2011-03-27 14:31:47.000000000 -0400
59512+++ linux-2.6.32.46/include/asm-generic/dma-mapping-common.h 2011-04-17 15:56:46.000000000 -0400
59513@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
59514 enum dma_data_direction dir,
59515 struct dma_attrs *attrs)
59516 {
59517- struct dma_map_ops *ops = get_dma_ops(dev);
59518+ const struct dma_map_ops *ops = get_dma_ops(dev);
59519 dma_addr_t addr;
59520
59521 kmemcheck_mark_initialized(ptr, size);
59522@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
59523 enum dma_data_direction dir,
59524 struct dma_attrs *attrs)
59525 {
59526- struct dma_map_ops *ops = get_dma_ops(dev);
59527+ const struct dma_map_ops *ops = get_dma_ops(dev);
59528
59529 BUG_ON(!valid_dma_direction(dir));
59530 if (ops->unmap_page)
59531@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
59532 int nents, enum dma_data_direction dir,
59533 struct dma_attrs *attrs)
59534 {
59535- struct dma_map_ops *ops = get_dma_ops(dev);
59536+ const struct dma_map_ops *ops = get_dma_ops(dev);
59537 int i, ents;
59538 struct scatterlist *s;
59539
59540@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
59541 int nents, enum dma_data_direction dir,
59542 struct dma_attrs *attrs)
59543 {
59544- struct dma_map_ops *ops = get_dma_ops(dev);
59545+ const struct dma_map_ops *ops = get_dma_ops(dev);
59546
59547 BUG_ON(!valid_dma_direction(dir));
59548 debug_dma_unmap_sg(dev, sg, nents, dir);
59549@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
59550 size_t offset, size_t size,
59551 enum dma_data_direction dir)
59552 {
59553- struct dma_map_ops *ops = get_dma_ops(dev);
59554+ const struct dma_map_ops *ops = get_dma_ops(dev);
59555 dma_addr_t addr;
59556
59557 kmemcheck_mark_initialized(page_address(page) + offset, size);
59558@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
59559 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
59560 size_t size, enum dma_data_direction dir)
59561 {
59562- struct dma_map_ops *ops = get_dma_ops(dev);
59563+ const struct dma_map_ops *ops = get_dma_ops(dev);
59564
59565 BUG_ON(!valid_dma_direction(dir));
59566 if (ops->unmap_page)
59567@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
59568 size_t size,
59569 enum dma_data_direction dir)
59570 {
59571- struct dma_map_ops *ops = get_dma_ops(dev);
59572+ const struct dma_map_ops *ops = get_dma_ops(dev);
59573
59574 BUG_ON(!valid_dma_direction(dir));
59575 if (ops->sync_single_for_cpu)
59576@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
59577 dma_addr_t addr, size_t size,
59578 enum dma_data_direction dir)
59579 {
59580- struct dma_map_ops *ops = get_dma_ops(dev);
59581+ const struct dma_map_ops *ops = get_dma_ops(dev);
59582
59583 BUG_ON(!valid_dma_direction(dir));
59584 if (ops->sync_single_for_device)
59585@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
59586 size_t size,
59587 enum dma_data_direction dir)
59588 {
59589- struct dma_map_ops *ops = get_dma_ops(dev);
59590+ const struct dma_map_ops *ops = get_dma_ops(dev);
59591
59592 BUG_ON(!valid_dma_direction(dir));
59593 if (ops->sync_single_range_for_cpu) {
59594@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
59595 size_t size,
59596 enum dma_data_direction dir)
59597 {
59598- struct dma_map_ops *ops = get_dma_ops(dev);
59599+ const struct dma_map_ops *ops = get_dma_ops(dev);
59600
59601 BUG_ON(!valid_dma_direction(dir));
59602 if (ops->sync_single_range_for_device) {
59603@@ -155,7 +155,7 @@ static inline void
59604 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
59605 int nelems, enum dma_data_direction dir)
59606 {
59607- struct dma_map_ops *ops = get_dma_ops(dev);
59608+ const struct dma_map_ops *ops = get_dma_ops(dev);
59609
59610 BUG_ON(!valid_dma_direction(dir));
59611 if (ops->sync_sg_for_cpu)
59612@@ -167,7 +167,7 @@ static inline void
59613 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
59614 int nelems, enum dma_data_direction dir)
59615 {
59616- struct dma_map_ops *ops = get_dma_ops(dev);
59617+ const struct dma_map_ops *ops = get_dma_ops(dev);
59618
59619 BUG_ON(!valid_dma_direction(dir));
59620 if (ops->sync_sg_for_device)
59621diff -urNp linux-2.6.32.46/include/asm-generic/emergency-restart.h linux-2.6.32.46/include/asm-generic/emergency-restart.h
59622--- linux-2.6.32.46/include/asm-generic/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
59623+++ linux-2.6.32.46/include/asm-generic/emergency-restart.h 2011-08-21 19:17:17.000000000 -0400
59624@@ -1,7 +1,7 @@
59625 #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
59626 #define _ASM_GENERIC_EMERGENCY_RESTART_H
59627
59628-static inline void machine_emergency_restart(void)
59629+static inline __noreturn void machine_emergency_restart(void)
59630 {
59631 machine_restart(NULL);
59632 }
59633diff -urNp linux-2.6.32.46/include/asm-generic/futex.h linux-2.6.32.46/include/asm-generic/futex.h
59634--- linux-2.6.32.46/include/asm-generic/futex.h 2011-03-27 14:31:47.000000000 -0400
59635+++ linux-2.6.32.46/include/asm-generic/futex.h 2011-04-17 15:56:46.000000000 -0400
59636@@ -6,7 +6,7 @@
59637 #include <asm/errno.h>
59638
59639 static inline int
59640-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
59641+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
59642 {
59643 int op = (encoded_op >> 28) & 7;
59644 int cmp = (encoded_op >> 24) & 15;
59645@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op,
59646 }
59647
59648 static inline int
59649-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
59650+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
59651 {
59652 return -ENOSYS;
59653 }
59654diff -urNp linux-2.6.32.46/include/asm-generic/int-l64.h linux-2.6.32.46/include/asm-generic/int-l64.h
59655--- linux-2.6.32.46/include/asm-generic/int-l64.h 2011-03-27 14:31:47.000000000 -0400
59656+++ linux-2.6.32.46/include/asm-generic/int-l64.h 2011-04-17 15:56:46.000000000 -0400
59657@@ -46,6 +46,8 @@ typedef unsigned int u32;
59658 typedef signed long s64;
59659 typedef unsigned long u64;
59660
59661+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
59662+
59663 #define S8_C(x) x
59664 #define U8_C(x) x ## U
59665 #define S16_C(x) x
59666diff -urNp linux-2.6.32.46/include/asm-generic/int-ll64.h linux-2.6.32.46/include/asm-generic/int-ll64.h
59667--- linux-2.6.32.46/include/asm-generic/int-ll64.h 2011-03-27 14:31:47.000000000 -0400
59668+++ linux-2.6.32.46/include/asm-generic/int-ll64.h 2011-04-17 15:56:46.000000000 -0400
59669@@ -51,6 +51,8 @@ typedef unsigned int u32;
59670 typedef signed long long s64;
59671 typedef unsigned long long u64;
59672
59673+typedef unsigned long long intoverflow_t;
59674+
59675 #define S8_C(x) x
59676 #define U8_C(x) x ## U
59677 #define S16_C(x) x
59678diff -urNp linux-2.6.32.46/include/asm-generic/kmap_types.h linux-2.6.32.46/include/asm-generic/kmap_types.h
59679--- linux-2.6.32.46/include/asm-generic/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
59680+++ linux-2.6.32.46/include/asm-generic/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
59681@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
59682 KMAP_D(16) KM_IRQ_PTE,
59683 KMAP_D(17) KM_NMI,
59684 KMAP_D(18) KM_NMI_PTE,
59685-KMAP_D(19) KM_TYPE_NR
59686+KMAP_D(19) KM_CLEARPAGE,
59687+KMAP_D(20) KM_TYPE_NR
59688 };
59689
59690 #undef KMAP_D
59691diff -urNp linux-2.6.32.46/include/asm-generic/pgtable.h linux-2.6.32.46/include/asm-generic/pgtable.h
59692--- linux-2.6.32.46/include/asm-generic/pgtable.h 2011-03-27 14:31:47.000000000 -0400
59693+++ linux-2.6.32.46/include/asm-generic/pgtable.h 2011-04-17 15:56:46.000000000 -0400
59694@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
59695 unsigned long size);
59696 #endif
59697
59698+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
59699+static inline unsigned long pax_open_kernel(void) { return 0; }
59700+#endif
59701+
59702+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
59703+static inline unsigned long pax_close_kernel(void) { return 0; }
59704+#endif
59705+
59706 #endif /* !__ASSEMBLY__ */
59707
59708 #endif /* _ASM_GENERIC_PGTABLE_H */
59709diff -urNp linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h
59710--- linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h 2011-03-27 14:31:47.000000000 -0400
59711+++ linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h 2011-04-17 15:56:46.000000000 -0400
59712@@ -1,14 +1,19 @@
59713 #ifndef _PGTABLE_NOPMD_H
59714 #define _PGTABLE_NOPMD_H
59715
59716-#ifndef __ASSEMBLY__
59717-
59718 #include <asm-generic/pgtable-nopud.h>
59719
59720-struct mm_struct;
59721-
59722 #define __PAGETABLE_PMD_FOLDED
59723
59724+#define PMD_SHIFT PUD_SHIFT
59725+#define PTRS_PER_PMD 1
59726+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
59727+#define PMD_MASK (~(PMD_SIZE-1))
59728+
59729+#ifndef __ASSEMBLY__
59730+
59731+struct mm_struct;
59732+
59733 /*
59734 * Having the pmd type consist of a pud gets the size right, and allows
59735 * us to conceptually access the pud entry that this pmd is folded into
59736@@ -16,11 +21,6 @@ struct mm_struct;
59737 */
59738 typedef struct { pud_t pud; } pmd_t;
59739
59740-#define PMD_SHIFT PUD_SHIFT
59741-#define PTRS_PER_PMD 1
59742-#define PMD_SIZE (1UL << PMD_SHIFT)
59743-#define PMD_MASK (~(PMD_SIZE-1))
59744-
59745 /*
59746 * The "pud_xxx()" functions here are trivial for a folded two-level
59747 * setup: the pmd is never bad, and a pmd always exists (as it's folded
59748diff -urNp linux-2.6.32.46/include/asm-generic/pgtable-nopud.h linux-2.6.32.46/include/asm-generic/pgtable-nopud.h
59749--- linux-2.6.32.46/include/asm-generic/pgtable-nopud.h 2011-03-27 14:31:47.000000000 -0400
59750+++ linux-2.6.32.46/include/asm-generic/pgtable-nopud.h 2011-04-17 15:56:46.000000000 -0400
59751@@ -1,10 +1,15 @@
59752 #ifndef _PGTABLE_NOPUD_H
59753 #define _PGTABLE_NOPUD_H
59754
59755-#ifndef __ASSEMBLY__
59756-
59757 #define __PAGETABLE_PUD_FOLDED
59758
59759+#define PUD_SHIFT PGDIR_SHIFT
59760+#define PTRS_PER_PUD 1
59761+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
59762+#define PUD_MASK (~(PUD_SIZE-1))
59763+
59764+#ifndef __ASSEMBLY__
59765+
59766 /*
59767 * Having the pud type consist of a pgd gets the size right, and allows
59768 * us to conceptually access the pgd entry that this pud is folded into
59769@@ -12,11 +17,6 @@
59770 */
59771 typedef struct { pgd_t pgd; } pud_t;
59772
59773-#define PUD_SHIFT PGDIR_SHIFT
59774-#define PTRS_PER_PUD 1
59775-#define PUD_SIZE (1UL << PUD_SHIFT)
59776-#define PUD_MASK (~(PUD_SIZE-1))
59777-
59778 /*
59779 * The "pgd_xxx()" functions here are trivial for a folded two-level
59780 * setup: the pud is never bad, and a pud always exists (as it's folded
59781diff -urNp linux-2.6.32.46/include/asm-generic/vmlinux.lds.h linux-2.6.32.46/include/asm-generic/vmlinux.lds.h
59782--- linux-2.6.32.46/include/asm-generic/vmlinux.lds.h 2011-03-27 14:31:47.000000000 -0400
59783+++ linux-2.6.32.46/include/asm-generic/vmlinux.lds.h 2011-04-17 15:56:46.000000000 -0400
59784@@ -199,6 +199,7 @@
59785 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
59786 VMLINUX_SYMBOL(__start_rodata) = .; \
59787 *(.rodata) *(.rodata.*) \
59788+ *(.data.read_only) \
59789 *(__vermagic) /* Kernel version magic */ \
59790 *(__markers_strings) /* Markers: strings */ \
59791 *(__tracepoints_strings)/* Tracepoints: strings */ \
59792@@ -656,22 +657,24 @@
59793 * section in the linker script will go there too. @phdr should have
59794 * a leading colon.
59795 *
59796- * Note that this macros defines __per_cpu_load as an absolute symbol.
59797+ * Note that this macros defines per_cpu_load as an absolute symbol.
59798 * If there is no need to put the percpu section at a predetermined
59799 * address, use PERCPU().
59800 */
59801 #define PERCPU_VADDR(vaddr, phdr) \
59802- VMLINUX_SYMBOL(__per_cpu_load) = .; \
59803- .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
59804+ per_cpu_load = .; \
59805+ .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
59806 - LOAD_OFFSET) { \
59807+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
59808 VMLINUX_SYMBOL(__per_cpu_start) = .; \
59809 *(.data.percpu.first) \
59810- *(.data.percpu.page_aligned) \
59811 *(.data.percpu) \
59812+ . = ALIGN(PAGE_SIZE); \
59813+ *(.data.percpu.page_aligned) \
59814 *(.data.percpu.shared_aligned) \
59815 VMLINUX_SYMBOL(__per_cpu_end) = .; \
59816 } phdr \
59817- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
59818+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
59819
59820 /**
59821 * PERCPU - define output section for percpu area, simple version
59822diff -urNp linux-2.6.32.46/include/drm/drm_crtc_helper.h linux-2.6.32.46/include/drm/drm_crtc_helper.h
59823--- linux-2.6.32.46/include/drm/drm_crtc_helper.h 2011-03-27 14:31:47.000000000 -0400
59824+++ linux-2.6.32.46/include/drm/drm_crtc_helper.h 2011-08-05 20:33:55.000000000 -0400
59825@@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
59826
59827 /* reload the current crtc LUT */
59828 void (*load_lut)(struct drm_crtc *crtc);
59829-};
59830+} __no_const;
59831
59832 struct drm_encoder_helper_funcs {
59833 void (*dpms)(struct drm_encoder *encoder, int mode);
59834@@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
59835 struct drm_connector *connector);
59836 /* disable encoder when not in use - more explicit than dpms off */
59837 void (*disable)(struct drm_encoder *encoder);
59838-};
59839+} __no_const;
59840
59841 struct drm_connector_helper_funcs {
59842 int (*get_modes)(struct drm_connector *connector);
59843diff -urNp linux-2.6.32.46/include/drm/drmP.h linux-2.6.32.46/include/drm/drmP.h
59844--- linux-2.6.32.46/include/drm/drmP.h 2011-03-27 14:31:47.000000000 -0400
59845+++ linux-2.6.32.46/include/drm/drmP.h 2011-04-17 15:56:46.000000000 -0400
59846@@ -71,6 +71,7 @@
59847 #include <linux/workqueue.h>
59848 #include <linux/poll.h>
59849 #include <asm/pgalloc.h>
59850+#include <asm/local.h>
59851 #include "drm.h"
59852
59853 #include <linux/idr.h>
59854@@ -814,7 +815,7 @@ struct drm_driver {
59855 void (*vgaarb_irq)(struct drm_device *dev, bool state);
59856
59857 /* Driver private ops for this object */
59858- struct vm_operations_struct *gem_vm_ops;
59859+ const struct vm_operations_struct *gem_vm_ops;
59860
59861 int major;
59862 int minor;
59863@@ -917,7 +918,7 @@ struct drm_device {
59864
59865 /** \name Usage Counters */
59866 /*@{ */
59867- int open_count; /**< Outstanding files open */
59868+ local_t open_count; /**< Outstanding files open */
59869 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
59870 atomic_t vma_count; /**< Outstanding vma areas open */
59871 int buf_use; /**< Buffers in use -- cannot alloc */
59872@@ -928,7 +929,7 @@ struct drm_device {
59873 /*@{ */
59874 unsigned long counters;
59875 enum drm_stat_type types[15];
59876- atomic_t counts[15];
59877+ atomic_unchecked_t counts[15];
59878 /*@} */
59879
59880 struct list_head filelist;
59881@@ -1016,7 +1017,7 @@ struct drm_device {
59882 struct pci_controller *hose;
59883 #endif
59884 struct drm_sg_mem *sg; /**< Scatter gather memory */
59885- unsigned int num_crtcs; /**< Number of CRTCs on this device */
59886+ unsigned int num_crtcs; /**< Number of CRTCs on this device */
59887 void *dev_private; /**< device private data */
59888 void *mm_private;
59889 struct address_space *dev_mapping;
59890@@ -1042,11 +1043,11 @@ struct drm_device {
59891 spinlock_t object_name_lock;
59892 struct idr object_name_idr;
59893 atomic_t object_count;
59894- atomic_t object_memory;
59895+ atomic_unchecked_t object_memory;
59896 atomic_t pin_count;
59897- atomic_t pin_memory;
59898+ atomic_unchecked_t pin_memory;
59899 atomic_t gtt_count;
59900- atomic_t gtt_memory;
59901+ atomic_unchecked_t gtt_memory;
59902 uint32_t gtt_total;
59903 uint32_t invalidate_domains; /* domains pending invalidation */
59904 uint32_t flush_domains; /* domains pending flush */
59905diff -urNp linux-2.6.32.46/include/drm/ttm/ttm_memory.h linux-2.6.32.46/include/drm/ttm/ttm_memory.h
59906--- linux-2.6.32.46/include/drm/ttm/ttm_memory.h 2011-03-27 14:31:47.000000000 -0400
59907+++ linux-2.6.32.46/include/drm/ttm/ttm_memory.h 2011-08-05 20:33:55.000000000 -0400
59908@@ -47,7 +47,7 @@
59909
59910 struct ttm_mem_shrink {
59911 int (*do_shrink) (struct ttm_mem_shrink *);
59912-};
59913+} __no_const;
59914
59915 /**
59916 * struct ttm_mem_global - Global memory accounting structure.
59917diff -urNp linux-2.6.32.46/include/linux/a.out.h linux-2.6.32.46/include/linux/a.out.h
59918--- linux-2.6.32.46/include/linux/a.out.h 2011-03-27 14:31:47.000000000 -0400
59919+++ linux-2.6.32.46/include/linux/a.out.h 2011-04-17 15:56:46.000000000 -0400
59920@@ -39,6 +39,14 @@ enum machine_type {
59921 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
59922 };
59923
59924+/* Constants for the N_FLAGS field */
59925+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
59926+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
59927+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
59928+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
59929+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
59930+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
59931+
59932 #if !defined (N_MAGIC)
59933 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
59934 #endif
59935diff -urNp linux-2.6.32.46/include/linux/atmdev.h linux-2.6.32.46/include/linux/atmdev.h
59936--- linux-2.6.32.46/include/linux/atmdev.h 2011-03-27 14:31:47.000000000 -0400
59937+++ linux-2.6.32.46/include/linux/atmdev.h 2011-04-17 15:56:46.000000000 -0400
59938@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
59939 #endif
59940
59941 struct k_atm_aal_stats {
59942-#define __HANDLE_ITEM(i) atomic_t i
59943+#define __HANDLE_ITEM(i) atomic_unchecked_t i
59944 __AAL_STAT_ITEMS
59945 #undef __HANDLE_ITEM
59946 };
59947diff -urNp linux-2.6.32.46/include/linux/backlight.h linux-2.6.32.46/include/linux/backlight.h
59948--- linux-2.6.32.46/include/linux/backlight.h 2011-03-27 14:31:47.000000000 -0400
59949+++ linux-2.6.32.46/include/linux/backlight.h 2011-04-17 15:56:46.000000000 -0400
59950@@ -36,18 +36,18 @@ struct backlight_device;
59951 struct fb_info;
59952
59953 struct backlight_ops {
59954- unsigned int options;
59955+ const unsigned int options;
59956
59957 #define BL_CORE_SUSPENDRESUME (1 << 0)
59958
59959 /* Notify the backlight driver some property has changed */
59960- int (*update_status)(struct backlight_device *);
59961+ int (* const update_status)(struct backlight_device *);
59962 /* Return the current backlight brightness (accounting for power,
59963 fb_blank etc.) */
59964- int (*get_brightness)(struct backlight_device *);
59965+ int (* const get_brightness)(struct backlight_device *);
59966 /* Check if given framebuffer device is the one bound to this backlight;
59967 return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
59968- int (*check_fb)(struct fb_info *);
59969+ int (* const check_fb)(struct fb_info *);
59970 };
59971
59972 /* This structure defines all the properties of a backlight */
59973@@ -86,7 +86,7 @@ struct backlight_device {
59974 registered this device has been unloaded, and if class_get_devdata()
59975 points to something in the body of that driver, it is also invalid. */
59976 struct mutex ops_lock;
59977- struct backlight_ops *ops;
59978+ const struct backlight_ops *ops;
59979
59980 /* The framebuffer notifier block */
59981 struct notifier_block fb_notif;
59982@@ -103,7 +103,7 @@ static inline void backlight_update_stat
59983 }
59984
59985 extern struct backlight_device *backlight_device_register(const char *name,
59986- struct device *dev, void *devdata, struct backlight_ops *ops);
59987+ struct device *dev, void *devdata, const struct backlight_ops *ops);
59988 extern void backlight_device_unregister(struct backlight_device *bd);
59989 extern void backlight_force_update(struct backlight_device *bd,
59990 enum backlight_update_reason reason);
59991diff -urNp linux-2.6.32.46/include/linux/binfmts.h linux-2.6.32.46/include/linux/binfmts.h
59992--- linux-2.6.32.46/include/linux/binfmts.h 2011-04-17 17:00:52.000000000 -0400
59993+++ linux-2.6.32.46/include/linux/binfmts.h 2011-04-17 15:56:46.000000000 -0400
59994@@ -83,6 +83,7 @@ struct linux_binfmt {
59995 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
59996 int (*load_shlib)(struct file *);
59997 int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
59998+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
59999 unsigned long min_coredump; /* minimal dump size */
60000 int hasvdso;
60001 };
60002diff -urNp linux-2.6.32.46/include/linux/blkdev.h linux-2.6.32.46/include/linux/blkdev.h
60003--- linux-2.6.32.46/include/linux/blkdev.h 2011-03-27 14:31:47.000000000 -0400
60004+++ linux-2.6.32.46/include/linux/blkdev.h 2011-08-26 20:27:21.000000000 -0400
60005@@ -1278,7 +1278,7 @@ struct block_device_operations {
60006 int (*revalidate_disk) (struct gendisk *);
60007 int (*getgeo)(struct block_device *, struct hd_geometry *);
60008 struct module *owner;
60009-};
60010+} __do_const;
60011
60012 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60013 unsigned long);
60014diff -urNp linux-2.6.32.46/include/linux/blktrace_api.h linux-2.6.32.46/include/linux/blktrace_api.h
60015--- linux-2.6.32.46/include/linux/blktrace_api.h 2011-03-27 14:31:47.000000000 -0400
60016+++ linux-2.6.32.46/include/linux/blktrace_api.h 2011-05-04 17:56:28.000000000 -0400
60017@@ -160,7 +160,7 @@ struct blk_trace {
60018 struct dentry *dir;
60019 struct dentry *dropped_file;
60020 struct dentry *msg_file;
60021- atomic_t dropped;
60022+ atomic_unchecked_t dropped;
60023 };
60024
60025 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60026diff -urNp linux-2.6.32.46/include/linux/byteorder/little_endian.h linux-2.6.32.46/include/linux/byteorder/little_endian.h
60027--- linux-2.6.32.46/include/linux/byteorder/little_endian.h 2011-03-27 14:31:47.000000000 -0400
60028+++ linux-2.6.32.46/include/linux/byteorder/little_endian.h 2011-04-17 15:56:46.000000000 -0400
60029@@ -42,51 +42,51 @@
60030
60031 static inline __le64 __cpu_to_le64p(const __u64 *p)
60032 {
60033- return (__force __le64)*p;
60034+ return (__force const __le64)*p;
60035 }
60036 static inline __u64 __le64_to_cpup(const __le64 *p)
60037 {
60038- return (__force __u64)*p;
60039+ return (__force const __u64)*p;
60040 }
60041 static inline __le32 __cpu_to_le32p(const __u32 *p)
60042 {
60043- return (__force __le32)*p;
60044+ return (__force const __le32)*p;
60045 }
60046 static inline __u32 __le32_to_cpup(const __le32 *p)
60047 {
60048- return (__force __u32)*p;
60049+ return (__force const __u32)*p;
60050 }
60051 static inline __le16 __cpu_to_le16p(const __u16 *p)
60052 {
60053- return (__force __le16)*p;
60054+ return (__force const __le16)*p;
60055 }
60056 static inline __u16 __le16_to_cpup(const __le16 *p)
60057 {
60058- return (__force __u16)*p;
60059+ return (__force const __u16)*p;
60060 }
60061 static inline __be64 __cpu_to_be64p(const __u64 *p)
60062 {
60063- return (__force __be64)__swab64p(p);
60064+ return (__force const __be64)__swab64p(p);
60065 }
60066 static inline __u64 __be64_to_cpup(const __be64 *p)
60067 {
60068- return __swab64p((__u64 *)p);
60069+ return __swab64p((const __u64 *)p);
60070 }
60071 static inline __be32 __cpu_to_be32p(const __u32 *p)
60072 {
60073- return (__force __be32)__swab32p(p);
60074+ return (__force const __be32)__swab32p(p);
60075 }
60076 static inline __u32 __be32_to_cpup(const __be32 *p)
60077 {
60078- return __swab32p((__u32 *)p);
60079+ return __swab32p((const __u32 *)p);
60080 }
60081 static inline __be16 __cpu_to_be16p(const __u16 *p)
60082 {
60083- return (__force __be16)__swab16p(p);
60084+ return (__force const __be16)__swab16p(p);
60085 }
60086 static inline __u16 __be16_to_cpup(const __be16 *p)
60087 {
60088- return __swab16p((__u16 *)p);
60089+ return __swab16p((const __u16 *)p);
60090 }
60091 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60092 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60093diff -urNp linux-2.6.32.46/include/linux/cache.h linux-2.6.32.46/include/linux/cache.h
60094--- linux-2.6.32.46/include/linux/cache.h 2011-03-27 14:31:47.000000000 -0400
60095+++ linux-2.6.32.46/include/linux/cache.h 2011-04-17 15:56:46.000000000 -0400
60096@@ -16,6 +16,10 @@
60097 #define __read_mostly
60098 #endif
60099
60100+#ifndef __read_only
60101+#define __read_only __read_mostly
60102+#endif
60103+
60104 #ifndef ____cacheline_aligned
60105 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60106 #endif
60107diff -urNp linux-2.6.32.46/include/linux/capability.h linux-2.6.32.46/include/linux/capability.h
60108--- linux-2.6.32.46/include/linux/capability.h 2011-03-27 14:31:47.000000000 -0400
60109+++ linux-2.6.32.46/include/linux/capability.h 2011-04-17 15:56:46.000000000 -0400
60110@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
60111 (security_real_capable_noaudit((t), (cap)) == 0)
60112
60113 extern int capable(int cap);
60114+int capable_nolog(int cap);
60115
60116 /* audit system wants to get cap info from files as well */
60117 struct dentry;
60118diff -urNp linux-2.6.32.46/include/linux/compiler-gcc4.h linux-2.6.32.46/include/linux/compiler-gcc4.h
60119--- linux-2.6.32.46/include/linux/compiler-gcc4.h 2011-03-27 14:31:47.000000000 -0400
60120+++ linux-2.6.32.46/include/linux/compiler-gcc4.h 2011-08-26 20:19:09.000000000 -0400
60121@@ -36,4 +36,16 @@
60122 the kernel context */
60123 #define __cold __attribute__((__cold__))
60124
60125+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60126+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60127+#define __bos0(ptr) __bos((ptr), 0)
60128+#define __bos1(ptr) __bos((ptr), 1)
60129+
60130+#if __GNUC_MINOR__ >= 5
60131+#ifdef CONSTIFY_PLUGIN
60132+#define __no_const __attribute__((no_const))
60133+#define __do_const __attribute__((do_const))
60134+#endif
60135+#endif
60136+
60137 #endif
60138diff -urNp linux-2.6.32.46/include/linux/compiler.h linux-2.6.32.46/include/linux/compiler.h
60139--- linux-2.6.32.46/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400
60140+++ linux-2.6.32.46/include/linux/compiler.h 2011-08-26 20:19:09.000000000 -0400
60141@@ -247,6 +247,14 @@ void ftrace_likely_update(struct ftrace_
60142 # define __attribute_const__ /* unimplemented */
60143 #endif
60144
60145+#ifndef __no_const
60146+# define __no_const
60147+#endif
60148+
60149+#ifndef __do_const
60150+# define __do_const
60151+#endif
60152+
60153 /*
60154 * Tell gcc if a function is cold. The compiler will assume any path
60155 * directly leading to the call is unlikely.
60156@@ -256,6 +264,22 @@ void ftrace_likely_update(struct ftrace_
60157 #define __cold
60158 #endif
60159
60160+#ifndef __alloc_size
60161+#define __alloc_size(...)
60162+#endif
60163+
60164+#ifndef __bos
60165+#define __bos(ptr, arg)
60166+#endif
60167+
60168+#ifndef __bos0
60169+#define __bos0(ptr)
60170+#endif
60171+
60172+#ifndef __bos1
60173+#define __bos1(ptr)
60174+#endif
60175+
60176 /* Simple shorthand for a section definition */
60177 #ifndef __section
60178 # define __section(S) __attribute__ ((__section__(#S)))
60179@@ -278,6 +302,7 @@ void ftrace_likely_update(struct ftrace_
60180 * use is to mediate communication between process-level code and irq/NMI
60181 * handlers, all running on the same CPU.
60182 */
60183-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
60184+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
60185+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
60186
60187 #endif /* __LINUX_COMPILER_H */
60188diff -urNp linux-2.6.32.46/include/linux/crypto.h linux-2.6.32.46/include/linux/crypto.h
60189--- linux-2.6.32.46/include/linux/crypto.h 2011-03-27 14:31:47.000000000 -0400
60190+++ linux-2.6.32.46/include/linux/crypto.h 2011-08-05 20:33:55.000000000 -0400
60191@@ -394,7 +394,7 @@ struct cipher_tfm {
60192 const u8 *key, unsigned int keylen);
60193 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60194 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
60195-};
60196+} __no_const;
60197
60198 struct hash_tfm {
60199 int (*init)(struct hash_desc *desc);
60200@@ -415,13 +415,13 @@ struct compress_tfm {
60201 int (*cot_decompress)(struct crypto_tfm *tfm,
60202 const u8 *src, unsigned int slen,
60203 u8 *dst, unsigned int *dlen);
60204-};
60205+} __no_const;
60206
60207 struct rng_tfm {
60208 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
60209 unsigned int dlen);
60210 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
60211-};
60212+} __no_const;
60213
60214 #define crt_ablkcipher crt_u.ablkcipher
60215 #define crt_aead crt_u.aead
60216diff -urNp linux-2.6.32.46/include/linux/dcache.h linux-2.6.32.46/include/linux/dcache.h
60217--- linux-2.6.32.46/include/linux/dcache.h 2011-03-27 14:31:47.000000000 -0400
60218+++ linux-2.6.32.46/include/linux/dcache.h 2011-04-23 13:34:46.000000000 -0400
60219@@ -119,6 +119,8 @@ struct dentry {
60220 unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
60221 };
60222
60223+#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
60224+
60225 /*
60226 * dentry->d_lock spinlock nesting subclasses:
60227 *
60228diff -urNp linux-2.6.32.46/include/linux/decompress/mm.h linux-2.6.32.46/include/linux/decompress/mm.h
60229--- linux-2.6.32.46/include/linux/decompress/mm.h 2011-03-27 14:31:47.000000000 -0400
60230+++ linux-2.6.32.46/include/linux/decompress/mm.h 2011-04-17 15:56:46.000000000 -0400
60231@@ -78,7 +78,7 @@ static void free(void *where)
60232 * warnings when not needed (indeed large_malloc / large_free are not
60233 * needed by inflate */
60234
60235-#define malloc(a) kmalloc(a, GFP_KERNEL)
60236+#define malloc(a) kmalloc((a), GFP_KERNEL)
60237 #define free(a) kfree(a)
60238
60239 #define large_malloc(a) vmalloc(a)
60240diff -urNp linux-2.6.32.46/include/linux/dma-mapping.h linux-2.6.32.46/include/linux/dma-mapping.h
60241--- linux-2.6.32.46/include/linux/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
60242+++ linux-2.6.32.46/include/linux/dma-mapping.h 2011-08-26 20:19:09.000000000 -0400
60243@@ -16,51 +16,51 @@ enum dma_data_direction {
60244 };
60245
60246 struct dma_map_ops {
60247- void* (*alloc_coherent)(struct device *dev, size_t size,
60248+ void* (* const alloc_coherent)(struct device *dev, size_t size,
60249 dma_addr_t *dma_handle, gfp_t gfp);
60250- void (*free_coherent)(struct device *dev, size_t size,
60251+ void (* const free_coherent)(struct device *dev, size_t size,
60252 void *vaddr, dma_addr_t dma_handle);
60253- dma_addr_t (*map_page)(struct device *dev, struct page *page,
60254+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
60255 unsigned long offset, size_t size,
60256 enum dma_data_direction dir,
60257 struct dma_attrs *attrs);
60258- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
60259+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
60260 size_t size, enum dma_data_direction dir,
60261 struct dma_attrs *attrs);
60262- int (*map_sg)(struct device *dev, struct scatterlist *sg,
60263+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
60264 int nents, enum dma_data_direction dir,
60265 struct dma_attrs *attrs);
60266- void (*unmap_sg)(struct device *dev,
60267+ void (* const unmap_sg)(struct device *dev,
60268 struct scatterlist *sg, int nents,
60269 enum dma_data_direction dir,
60270 struct dma_attrs *attrs);
60271- void (*sync_single_for_cpu)(struct device *dev,
60272+ void (* const sync_single_for_cpu)(struct device *dev,
60273 dma_addr_t dma_handle, size_t size,
60274 enum dma_data_direction dir);
60275- void (*sync_single_for_device)(struct device *dev,
60276+ void (* const sync_single_for_device)(struct device *dev,
60277 dma_addr_t dma_handle, size_t size,
60278 enum dma_data_direction dir);
60279- void (*sync_single_range_for_cpu)(struct device *dev,
60280+ void (* const sync_single_range_for_cpu)(struct device *dev,
60281 dma_addr_t dma_handle,
60282 unsigned long offset,
60283 size_t size,
60284 enum dma_data_direction dir);
60285- void (*sync_single_range_for_device)(struct device *dev,
60286+ void (* const sync_single_range_for_device)(struct device *dev,
60287 dma_addr_t dma_handle,
60288 unsigned long offset,
60289 size_t size,
60290 enum dma_data_direction dir);
60291- void (*sync_sg_for_cpu)(struct device *dev,
60292+ void (* const sync_sg_for_cpu)(struct device *dev,
60293 struct scatterlist *sg, int nents,
60294 enum dma_data_direction dir);
60295- void (*sync_sg_for_device)(struct device *dev,
60296+ void (* const sync_sg_for_device)(struct device *dev,
60297 struct scatterlist *sg, int nents,
60298 enum dma_data_direction dir);
60299- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
60300- int (*dma_supported)(struct device *dev, u64 mask);
60301+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
60302+ int (* const dma_supported)(struct device *dev, u64 mask);
60303 int (*set_dma_mask)(struct device *dev, u64 mask);
60304 int is_phys;
60305-};
60306+} __do_const;
60307
60308 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
60309
60310diff -urNp linux-2.6.32.46/include/linux/dst.h linux-2.6.32.46/include/linux/dst.h
60311--- linux-2.6.32.46/include/linux/dst.h 2011-03-27 14:31:47.000000000 -0400
60312+++ linux-2.6.32.46/include/linux/dst.h 2011-04-17 15:56:46.000000000 -0400
60313@@ -380,7 +380,7 @@ struct dst_node
60314 struct thread_pool *pool;
60315
60316 /* Transaction IDs live here */
60317- atomic_long_t gen;
60318+ atomic_long_unchecked_t gen;
60319
60320 /*
60321 * How frequently and how many times transaction
60322diff -urNp linux-2.6.32.46/include/linux/elf.h linux-2.6.32.46/include/linux/elf.h
60323--- linux-2.6.32.46/include/linux/elf.h 2011-03-27 14:31:47.000000000 -0400
60324+++ linux-2.6.32.46/include/linux/elf.h 2011-04-17 15:56:46.000000000 -0400
60325@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
60326 #define PT_GNU_EH_FRAME 0x6474e550
60327
60328 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
60329+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
60330+
60331+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
60332+
60333+/* Constants for the e_flags field */
60334+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60335+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
60336+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
60337+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
60338+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60339+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60340
60341 /* These constants define the different elf file types */
60342 #define ET_NONE 0
60343@@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
60344 #define DT_DEBUG 21
60345 #define DT_TEXTREL 22
60346 #define DT_JMPREL 23
60347+#define DT_FLAGS 30
60348+ #define DF_TEXTREL 0x00000004
60349 #define DT_ENCODING 32
60350 #define OLD_DT_LOOS 0x60000000
60351 #define DT_LOOS 0x6000000d
60352@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
60353 #define PF_W 0x2
60354 #define PF_X 0x1
60355
60356+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
60357+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
60358+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
60359+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
60360+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
60361+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
60362+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
60363+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
60364+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
60365+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
60366+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
60367+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
60368+
60369 typedef struct elf32_phdr{
60370 Elf32_Word p_type;
60371 Elf32_Off p_offset;
60372@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
60373 #define EI_OSABI 7
60374 #define EI_PAD 8
60375
60376+#define EI_PAX 14
60377+
60378 #define ELFMAG0 0x7f /* EI_MAG */
60379 #define ELFMAG1 'E'
60380 #define ELFMAG2 'L'
60381@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
60382 #define elf_phdr elf32_phdr
60383 #define elf_note elf32_note
60384 #define elf_addr_t Elf32_Off
60385+#define elf_dyn Elf32_Dyn
60386
60387 #else
60388
60389@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
60390 #define elf_phdr elf64_phdr
60391 #define elf_note elf64_note
60392 #define elf_addr_t Elf64_Off
60393+#define elf_dyn Elf64_Dyn
60394
60395 #endif
60396
60397diff -urNp linux-2.6.32.46/include/linux/fscache-cache.h linux-2.6.32.46/include/linux/fscache-cache.h
60398--- linux-2.6.32.46/include/linux/fscache-cache.h 2011-03-27 14:31:47.000000000 -0400
60399+++ linux-2.6.32.46/include/linux/fscache-cache.h 2011-05-04 17:56:28.000000000 -0400
60400@@ -116,7 +116,7 @@ struct fscache_operation {
60401 #endif
60402 };
60403
60404-extern atomic_t fscache_op_debug_id;
60405+extern atomic_unchecked_t fscache_op_debug_id;
60406 extern const struct slow_work_ops fscache_op_slow_work_ops;
60407
60408 extern void fscache_enqueue_operation(struct fscache_operation *);
60409@@ -134,7 +134,7 @@ static inline void fscache_operation_ini
60410 fscache_operation_release_t release)
60411 {
60412 atomic_set(&op->usage, 1);
60413- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
60414+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
60415 op->release = release;
60416 INIT_LIST_HEAD(&op->pend_link);
60417 fscache_set_op_state(op, "Init");
60418diff -urNp linux-2.6.32.46/include/linux/fs.h linux-2.6.32.46/include/linux/fs.h
60419--- linux-2.6.32.46/include/linux/fs.h 2011-07-13 17:23:04.000000000 -0400
60420+++ linux-2.6.32.46/include/linux/fs.h 2011-08-26 20:19:09.000000000 -0400
60421@@ -90,6 +90,11 @@ struct inodes_stat_t {
60422 /* Expect random access pattern */
60423 #define FMODE_RANDOM ((__force fmode_t)4096)
60424
60425+/* Hack for grsec so as not to require read permission simply to execute
60426+ * a binary
60427+ */
60428+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
60429+
60430 /*
60431 * The below are the various read and write types that we support. Some of
60432 * them include behavioral modifiers that send information down to the
60433@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
60434 unsigned long, unsigned long);
60435
60436 struct address_space_operations {
60437- int (*writepage)(struct page *page, struct writeback_control *wbc);
60438- int (*readpage)(struct file *, struct page *);
60439- void (*sync_page)(struct page *);
60440+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
60441+ int (* const readpage)(struct file *, struct page *);
60442+ void (* const sync_page)(struct page *);
60443
60444 /* Write back some dirty pages from this mapping. */
60445- int (*writepages)(struct address_space *, struct writeback_control *);
60446+ int (* const writepages)(struct address_space *, struct writeback_control *);
60447
60448 /* Set a page dirty. Return true if this dirtied it */
60449- int (*set_page_dirty)(struct page *page);
60450+ int (* const set_page_dirty)(struct page *page);
60451
60452- int (*readpages)(struct file *filp, struct address_space *mapping,
60453+ int (* const readpages)(struct file *filp, struct address_space *mapping,
60454 struct list_head *pages, unsigned nr_pages);
60455
60456- int (*write_begin)(struct file *, struct address_space *mapping,
60457+ int (* const write_begin)(struct file *, struct address_space *mapping,
60458 loff_t pos, unsigned len, unsigned flags,
60459 struct page **pagep, void **fsdata);
60460- int (*write_end)(struct file *, struct address_space *mapping,
60461+ int (* const write_end)(struct file *, struct address_space *mapping,
60462 loff_t pos, unsigned len, unsigned copied,
60463 struct page *page, void *fsdata);
60464
60465 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
60466- sector_t (*bmap)(struct address_space *, sector_t);
60467- void (*invalidatepage) (struct page *, unsigned long);
60468- int (*releasepage) (struct page *, gfp_t);
60469- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
60470+ sector_t (* const bmap)(struct address_space *, sector_t);
60471+ void (* const invalidatepage) (struct page *, unsigned long);
60472+ int (* const releasepage) (struct page *, gfp_t);
60473+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
60474 loff_t offset, unsigned long nr_segs);
60475- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
60476+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
60477 void **, unsigned long *);
60478 /* migrate the contents of a page to the specified target */
60479- int (*migratepage) (struct address_space *,
60480+ int (* const migratepage) (struct address_space *,
60481 struct page *, struct page *);
60482- int (*launder_page) (struct page *);
60483- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
60484+ int (* const launder_page) (struct page *);
60485+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
60486 unsigned long);
60487- int (*error_remove_page)(struct address_space *, struct page *);
60488+ int (* const error_remove_page)(struct address_space *, struct page *);
60489 };
60490
60491 /*
60492@@ -1031,19 +1036,19 @@ static inline int file_check_writeable(s
60493 typedef struct files_struct *fl_owner_t;
60494
60495 struct file_lock_operations {
60496- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
60497- void (*fl_release_private)(struct file_lock *);
60498+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
60499+ void (* const fl_release_private)(struct file_lock *);
60500 };
60501
60502 struct lock_manager_operations {
60503- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
60504- void (*fl_notify)(struct file_lock *); /* unblock callback */
60505- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
60506- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
60507- void (*fl_release_private)(struct file_lock *);
60508- void (*fl_break)(struct file_lock *);
60509- int (*fl_mylease)(struct file_lock *, struct file_lock *);
60510- int (*fl_change)(struct file_lock **, int);
60511+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
60512+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
60513+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
60514+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
60515+ void (* const fl_release_private)(struct file_lock *);
60516+ void (* const fl_break)(struct file_lock *);
60517+ int (* const fl_mylease)(struct file_lock *, struct file_lock *);
60518+ int (* const fl_change)(struct file_lock **, int);
60519 };
60520
60521 struct lock_manager {
60522@@ -1442,7 +1447,7 @@ struct fiemap_extent_info {
60523 unsigned int fi_flags; /* Flags as passed from user */
60524 unsigned int fi_extents_mapped; /* Number of mapped extents */
60525 unsigned int fi_extents_max; /* Size of fiemap_extent array */
60526- struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
60527+ struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
60528 * array */
60529 };
60530 int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
60531@@ -1512,7 +1517,8 @@ struct file_operations {
60532 ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
60533 ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
60534 int (*setlease)(struct file *, long, struct file_lock **);
60535-};
60536+} __do_const;
60537+typedef struct file_operations __no_const file_operations_no_const;
60538
60539 struct inode_operations {
60540 int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
60541@@ -1559,30 +1565,30 @@ extern ssize_t vfs_writev(struct file *,
60542 unsigned long, loff_t *);
60543
60544 struct super_operations {
60545- struct inode *(*alloc_inode)(struct super_block *sb);
60546- void (*destroy_inode)(struct inode *);
60547+ struct inode *(* const alloc_inode)(struct super_block *sb);
60548+ void (* const destroy_inode)(struct inode *);
60549
60550- void (*dirty_inode) (struct inode *);
60551- int (*write_inode) (struct inode *, int);
60552- void (*drop_inode) (struct inode *);
60553- void (*delete_inode) (struct inode *);
60554- void (*put_super) (struct super_block *);
60555- void (*write_super) (struct super_block *);
60556- int (*sync_fs)(struct super_block *sb, int wait);
60557- int (*freeze_fs) (struct super_block *);
60558- int (*unfreeze_fs) (struct super_block *);
60559- int (*statfs) (struct dentry *, struct kstatfs *);
60560- int (*remount_fs) (struct super_block *, int *, char *);
60561- void (*clear_inode) (struct inode *);
60562- void (*umount_begin) (struct super_block *);
60563+ void (* const dirty_inode) (struct inode *);
60564+ int (* const write_inode) (struct inode *, int);
60565+ void (* const drop_inode) (struct inode *);
60566+ void (* const delete_inode) (struct inode *);
60567+ void (* const put_super) (struct super_block *);
60568+ void (* const write_super) (struct super_block *);
60569+ int (* const sync_fs)(struct super_block *sb, int wait);
60570+ int (* const freeze_fs) (struct super_block *);
60571+ int (* const unfreeze_fs) (struct super_block *);
60572+ int (* const statfs) (struct dentry *, struct kstatfs *);
60573+ int (* const remount_fs) (struct super_block *, int *, char *);
60574+ void (* const clear_inode) (struct inode *);
60575+ void (* const umount_begin) (struct super_block *);
60576
60577- int (*show_options)(struct seq_file *, struct vfsmount *);
60578- int (*show_stats)(struct seq_file *, struct vfsmount *);
60579+ int (* const show_options)(struct seq_file *, struct vfsmount *);
60580+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
60581 #ifdef CONFIG_QUOTA
60582- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
60583- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
60584+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
60585+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
60586 #endif
60587- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
60588+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
60589 };
60590
60591 /*
60592diff -urNp linux-2.6.32.46/include/linux/fs_struct.h linux-2.6.32.46/include/linux/fs_struct.h
60593--- linux-2.6.32.46/include/linux/fs_struct.h 2011-03-27 14:31:47.000000000 -0400
60594+++ linux-2.6.32.46/include/linux/fs_struct.h 2011-04-17 15:56:46.000000000 -0400
60595@@ -4,7 +4,7 @@
60596 #include <linux/path.h>
60597
60598 struct fs_struct {
60599- int users;
60600+ atomic_t users;
60601 rwlock_t lock;
60602 int umask;
60603 int in_exec;
60604diff -urNp linux-2.6.32.46/include/linux/ftrace_event.h linux-2.6.32.46/include/linux/ftrace_event.h
60605--- linux-2.6.32.46/include/linux/ftrace_event.h 2011-03-27 14:31:47.000000000 -0400
60606+++ linux-2.6.32.46/include/linux/ftrace_event.h 2011-05-04 17:56:28.000000000 -0400
60607@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftr
60608 int filter_type);
60609 extern int trace_define_common_fields(struct ftrace_event_call *call);
60610
60611-#define is_signed_type(type) (((type)(-1)) < 0)
60612+#define is_signed_type(type) (((type)(-1)) < (type)1)
60613
60614 int trace_set_clr_event(const char *system, const char *event, int set);
60615
60616diff -urNp linux-2.6.32.46/include/linux/genhd.h linux-2.6.32.46/include/linux/genhd.h
60617--- linux-2.6.32.46/include/linux/genhd.h 2011-03-27 14:31:47.000000000 -0400
60618+++ linux-2.6.32.46/include/linux/genhd.h 2011-04-17 15:56:46.000000000 -0400
60619@@ -161,7 +161,7 @@ struct gendisk {
60620
60621 struct timer_rand_state *random;
60622
60623- atomic_t sync_io; /* RAID */
60624+ atomic_unchecked_t sync_io; /* RAID */
60625 struct work_struct async_notify;
60626 #ifdef CONFIG_BLK_DEV_INTEGRITY
60627 struct blk_integrity *integrity;
60628diff -urNp linux-2.6.32.46/include/linux/gracl.h linux-2.6.32.46/include/linux/gracl.h
60629--- linux-2.6.32.46/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
60630+++ linux-2.6.32.46/include/linux/gracl.h 2011-04-17 15:56:46.000000000 -0400
60631@@ -0,0 +1,317 @@
60632+#ifndef GR_ACL_H
60633+#define GR_ACL_H
60634+
60635+#include <linux/grdefs.h>
60636+#include <linux/resource.h>
60637+#include <linux/capability.h>
60638+#include <linux/dcache.h>
60639+#include <asm/resource.h>
60640+
60641+/* Major status information */
60642+
60643+#define GR_VERSION "grsecurity 2.2.2"
60644+#define GRSECURITY_VERSION 0x2202
60645+
60646+enum {
60647+ GR_SHUTDOWN = 0,
60648+ GR_ENABLE = 1,
60649+ GR_SPROLE = 2,
60650+ GR_RELOAD = 3,
60651+ GR_SEGVMOD = 4,
60652+ GR_STATUS = 5,
60653+ GR_UNSPROLE = 6,
60654+ GR_PASSSET = 7,
60655+ GR_SPROLEPAM = 8,
60656+};
60657+
60658+/* Password setup definitions
60659+ * kernel/grhash.c */
60660+enum {
60661+ GR_PW_LEN = 128,
60662+ GR_SALT_LEN = 16,
60663+ GR_SHA_LEN = 32,
60664+};
60665+
60666+enum {
60667+ GR_SPROLE_LEN = 64,
60668+};
60669+
60670+enum {
60671+ GR_NO_GLOB = 0,
60672+ GR_REG_GLOB,
60673+ GR_CREATE_GLOB
60674+};
60675+
60676+#define GR_NLIMITS 32
60677+
60678+/* Begin Data Structures */
60679+
60680+struct sprole_pw {
60681+ unsigned char *rolename;
60682+ unsigned char salt[GR_SALT_LEN];
60683+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
60684+};
60685+
60686+struct name_entry {
60687+ __u32 key;
60688+ ino_t inode;
60689+ dev_t device;
60690+ char *name;
60691+ __u16 len;
60692+ __u8 deleted;
60693+ struct name_entry *prev;
60694+ struct name_entry *next;
60695+};
60696+
60697+struct inodev_entry {
60698+ struct name_entry *nentry;
60699+ struct inodev_entry *prev;
60700+ struct inodev_entry *next;
60701+};
60702+
60703+struct acl_role_db {
60704+ struct acl_role_label **r_hash;
60705+ __u32 r_size;
60706+};
60707+
60708+struct inodev_db {
60709+ struct inodev_entry **i_hash;
60710+ __u32 i_size;
60711+};
60712+
60713+struct name_db {
60714+ struct name_entry **n_hash;
60715+ __u32 n_size;
60716+};
60717+
60718+struct crash_uid {
60719+ uid_t uid;
60720+ unsigned long expires;
60721+};
60722+
60723+struct gr_hash_struct {
60724+ void **table;
60725+ void **nametable;
60726+ void *first;
60727+ __u32 table_size;
60728+ __u32 used_size;
60729+ int type;
60730+};
60731+
60732+/* Userspace Grsecurity ACL data structures */
60733+
60734+struct acl_subject_label {
60735+ char *filename;
60736+ ino_t inode;
60737+ dev_t device;
60738+ __u32 mode;
60739+ kernel_cap_t cap_mask;
60740+ kernel_cap_t cap_lower;
60741+ kernel_cap_t cap_invert_audit;
60742+
60743+ struct rlimit res[GR_NLIMITS];
60744+ __u32 resmask;
60745+
60746+ __u8 user_trans_type;
60747+ __u8 group_trans_type;
60748+ uid_t *user_transitions;
60749+ gid_t *group_transitions;
60750+ __u16 user_trans_num;
60751+ __u16 group_trans_num;
60752+
60753+ __u32 sock_families[2];
60754+ __u32 ip_proto[8];
60755+ __u32 ip_type;
60756+ struct acl_ip_label **ips;
60757+ __u32 ip_num;
60758+ __u32 inaddr_any_override;
60759+
60760+ __u32 crashes;
60761+ unsigned long expires;
60762+
60763+ struct acl_subject_label *parent_subject;
60764+ struct gr_hash_struct *hash;
60765+ struct acl_subject_label *prev;
60766+ struct acl_subject_label *next;
60767+
60768+ struct acl_object_label **obj_hash;
60769+ __u32 obj_hash_size;
60770+ __u16 pax_flags;
60771+};
60772+
60773+struct role_allowed_ip {
60774+ __u32 addr;
60775+ __u32 netmask;
60776+
60777+ struct role_allowed_ip *prev;
60778+ struct role_allowed_ip *next;
60779+};
60780+
60781+struct role_transition {
60782+ char *rolename;
60783+
60784+ struct role_transition *prev;
60785+ struct role_transition *next;
60786+};
60787+
60788+struct acl_role_label {
60789+ char *rolename;
60790+ uid_t uidgid;
60791+ __u16 roletype;
60792+
60793+ __u16 auth_attempts;
60794+ unsigned long expires;
60795+
60796+ struct acl_subject_label *root_label;
60797+ struct gr_hash_struct *hash;
60798+
60799+ struct acl_role_label *prev;
60800+ struct acl_role_label *next;
60801+
60802+ struct role_transition *transitions;
60803+ struct role_allowed_ip *allowed_ips;
60804+ uid_t *domain_children;
60805+ __u16 domain_child_num;
60806+
60807+ struct acl_subject_label **subj_hash;
60808+ __u32 subj_hash_size;
60809+};
60810+
60811+struct user_acl_role_db {
60812+ struct acl_role_label **r_table;
60813+ __u32 num_pointers; /* Number of allocations to track */
60814+ __u32 num_roles; /* Number of roles */
60815+ __u32 num_domain_children; /* Number of domain children */
60816+ __u32 num_subjects; /* Number of subjects */
60817+ __u32 num_objects; /* Number of objects */
60818+};
60819+
60820+struct acl_object_label {
60821+ char *filename;
60822+ ino_t inode;
60823+ dev_t device;
60824+ __u32 mode;
60825+
60826+ struct acl_subject_label *nested;
60827+ struct acl_object_label *globbed;
60828+
60829+ /* next two structures not used */
60830+
60831+ struct acl_object_label *prev;
60832+ struct acl_object_label *next;
60833+};
60834+
60835+struct acl_ip_label {
60836+ char *iface;
60837+ __u32 addr;
60838+ __u32 netmask;
60839+ __u16 low, high;
60840+ __u8 mode;
60841+ __u32 type;
60842+ __u32 proto[8];
60843+
60844+ /* next two structures not used */
60845+
60846+ struct acl_ip_label *prev;
60847+ struct acl_ip_label *next;
60848+};
60849+
60850+struct gr_arg {
60851+ struct user_acl_role_db role_db;
60852+ unsigned char pw[GR_PW_LEN];
60853+ unsigned char salt[GR_SALT_LEN];
60854+ unsigned char sum[GR_SHA_LEN];
60855+ unsigned char sp_role[GR_SPROLE_LEN];
60856+ struct sprole_pw *sprole_pws;
60857+ dev_t segv_device;
60858+ ino_t segv_inode;
60859+ uid_t segv_uid;
60860+ __u16 num_sprole_pws;
60861+ __u16 mode;
60862+};
60863+
60864+struct gr_arg_wrapper {
60865+ struct gr_arg *arg;
60866+ __u32 version;
60867+ __u32 size;
60868+};
60869+
60870+struct subject_map {
60871+ struct acl_subject_label *user;
60872+ struct acl_subject_label *kernel;
60873+ struct subject_map *prev;
60874+ struct subject_map *next;
60875+};
60876+
60877+struct acl_subj_map_db {
60878+ struct subject_map **s_hash;
60879+ __u32 s_size;
60880+};
60881+
60882+/* End Data Structures Section */
60883+
60884+/* Hash functions generated by empirical testing by Brad Spengler
60885+ Makes good use of the low bits of the inode. Generally 0-1 times
60886+ in loop for successful match. 0-3 for unsuccessful match.
60887+ Shift/add algorithm with modulus of table size and an XOR*/
60888+
60889+static __inline__ unsigned int
60890+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
60891+{
60892+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
60893+}
60894+
60895+ static __inline__ unsigned int
60896+shash(const struct acl_subject_label *userp, const unsigned int sz)
60897+{
60898+ return ((const unsigned long)userp % sz);
60899+}
60900+
60901+static __inline__ unsigned int
60902+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
60903+{
60904+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
60905+}
60906+
60907+static __inline__ unsigned int
60908+nhash(const char *name, const __u16 len, const unsigned int sz)
60909+{
60910+ return full_name_hash((const unsigned char *)name, len) % sz;
60911+}
60912+
60913+#define FOR_EACH_ROLE_START(role) \
60914+ role = role_list; \
60915+ while (role) {
60916+
60917+#define FOR_EACH_ROLE_END(role) \
60918+ role = role->prev; \
60919+ }
60920+
60921+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
60922+ subj = NULL; \
60923+ iter = 0; \
60924+ while (iter < role->subj_hash_size) { \
60925+ if (subj == NULL) \
60926+ subj = role->subj_hash[iter]; \
60927+ if (subj == NULL) { \
60928+ iter++; \
60929+ continue; \
60930+ }
60931+
60932+#define FOR_EACH_SUBJECT_END(subj,iter) \
60933+ subj = subj->next; \
60934+ if (subj == NULL) \
60935+ iter++; \
60936+ }
60937+
60938+
60939+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
60940+ subj = role->hash->first; \
60941+ while (subj != NULL) {
60942+
60943+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
60944+ subj = subj->next; \
60945+ }
60946+
60947+#endif
60948+
60949diff -urNp linux-2.6.32.46/include/linux/gralloc.h linux-2.6.32.46/include/linux/gralloc.h
60950--- linux-2.6.32.46/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
60951+++ linux-2.6.32.46/include/linux/gralloc.h 2011-04-17 15:56:46.000000000 -0400
60952@@ -0,0 +1,9 @@
60953+#ifndef __GRALLOC_H
60954+#define __GRALLOC_H
60955+
60956+void acl_free_all(void);
60957+int acl_alloc_stack_init(unsigned long size);
60958+void *acl_alloc(unsigned long len);
60959+void *acl_alloc_num(unsigned long num, unsigned long len);
60960+
60961+#endif
60962diff -urNp linux-2.6.32.46/include/linux/grdefs.h linux-2.6.32.46/include/linux/grdefs.h
60963--- linux-2.6.32.46/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
60964+++ linux-2.6.32.46/include/linux/grdefs.h 2011-06-11 16:20:26.000000000 -0400
60965@@ -0,0 +1,140 @@
60966+#ifndef GRDEFS_H
60967+#define GRDEFS_H
60968+
60969+/* Begin grsecurity status declarations */
60970+
60971+enum {
60972+ GR_READY = 0x01,
60973+ GR_STATUS_INIT = 0x00 // disabled state
60974+};
60975+
60976+/* Begin ACL declarations */
60977+
60978+/* Role flags */
60979+
60980+enum {
60981+ GR_ROLE_USER = 0x0001,
60982+ GR_ROLE_GROUP = 0x0002,
60983+ GR_ROLE_DEFAULT = 0x0004,
60984+ GR_ROLE_SPECIAL = 0x0008,
60985+ GR_ROLE_AUTH = 0x0010,
60986+ GR_ROLE_NOPW = 0x0020,
60987+ GR_ROLE_GOD = 0x0040,
60988+ GR_ROLE_LEARN = 0x0080,
60989+ GR_ROLE_TPE = 0x0100,
60990+ GR_ROLE_DOMAIN = 0x0200,
60991+ GR_ROLE_PAM = 0x0400,
60992+ GR_ROLE_PERSIST = 0x800
60993+};
60994+
60995+/* ACL Subject and Object mode flags */
60996+enum {
60997+ GR_DELETED = 0x80000000
60998+};
60999+
61000+/* ACL Object-only mode flags */
61001+enum {
61002+ GR_READ = 0x00000001,
61003+ GR_APPEND = 0x00000002,
61004+ GR_WRITE = 0x00000004,
61005+ GR_EXEC = 0x00000008,
61006+ GR_FIND = 0x00000010,
61007+ GR_INHERIT = 0x00000020,
61008+ GR_SETID = 0x00000040,
61009+ GR_CREATE = 0x00000080,
61010+ GR_DELETE = 0x00000100,
61011+ GR_LINK = 0x00000200,
61012+ GR_AUDIT_READ = 0x00000400,
61013+ GR_AUDIT_APPEND = 0x00000800,
61014+ GR_AUDIT_WRITE = 0x00001000,
61015+ GR_AUDIT_EXEC = 0x00002000,
61016+ GR_AUDIT_FIND = 0x00004000,
61017+ GR_AUDIT_INHERIT= 0x00008000,
61018+ GR_AUDIT_SETID = 0x00010000,
61019+ GR_AUDIT_CREATE = 0x00020000,
61020+ GR_AUDIT_DELETE = 0x00040000,
61021+ GR_AUDIT_LINK = 0x00080000,
61022+ GR_PTRACERD = 0x00100000,
61023+ GR_NOPTRACE = 0x00200000,
61024+ GR_SUPPRESS = 0x00400000,
61025+ GR_NOLEARN = 0x00800000,
61026+ GR_INIT_TRANSFER= 0x01000000
61027+};
61028+
61029+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61030+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61031+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61032+
61033+/* ACL subject-only mode flags */
61034+enum {
61035+ GR_KILL = 0x00000001,
61036+ GR_VIEW = 0x00000002,
61037+ GR_PROTECTED = 0x00000004,
61038+ GR_LEARN = 0x00000008,
61039+ GR_OVERRIDE = 0x00000010,
61040+ /* just a placeholder, this mode is only used in userspace */
61041+ GR_DUMMY = 0x00000020,
61042+ GR_PROTSHM = 0x00000040,
61043+ GR_KILLPROC = 0x00000080,
61044+ GR_KILLIPPROC = 0x00000100,
61045+ /* just a placeholder, this mode is only used in userspace */
61046+ GR_NOTROJAN = 0x00000200,
61047+ GR_PROTPROCFD = 0x00000400,
61048+ GR_PROCACCT = 0x00000800,
61049+ GR_RELAXPTRACE = 0x00001000,
61050+ GR_NESTED = 0x00002000,
61051+ GR_INHERITLEARN = 0x00004000,
61052+ GR_PROCFIND = 0x00008000,
61053+ GR_POVERRIDE = 0x00010000,
61054+ GR_KERNELAUTH = 0x00020000,
61055+ GR_ATSECURE = 0x00040000,
61056+ GR_SHMEXEC = 0x00080000
61057+};
61058+
61059+enum {
61060+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61061+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61062+ GR_PAX_ENABLE_MPROTECT = 0x0004,
61063+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
61064+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61065+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61066+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61067+ GR_PAX_DISABLE_MPROTECT = 0x0400,
61068+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
61069+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61070+};
61071+
61072+enum {
61073+ GR_ID_USER = 0x01,
61074+ GR_ID_GROUP = 0x02,
61075+};
61076+
61077+enum {
61078+ GR_ID_ALLOW = 0x01,
61079+ GR_ID_DENY = 0x02,
61080+};
61081+
61082+#define GR_CRASH_RES 31
61083+#define GR_UIDTABLE_MAX 500
61084+
61085+/* begin resource learning section */
61086+enum {
61087+ GR_RLIM_CPU_BUMP = 60,
61088+ GR_RLIM_FSIZE_BUMP = 50000,
61089+ GR_RLIM_DATA_BUMP = 10000,
61090+ GR_RLIM_STACK_BUMP = 1000,
61091+ GR_RLIM_CORE_BUMP = 10000,
61092+ GR_RLIM_RSS_BUMP = 500000,
61093+ GR_RLIM_NPROC_BUMP = 1,
61094+ GR_RLIM_NOFILE_BUMP = 5,
61095+ GR_RLIM_MEMLOCK_BUMP = 50000,
61096+ GR_RLIM_AS_BUMP = 500000,
61097+ GR_RLIM_LOCKS_BUMP = 2,
61098+ GR_RLIM_SIGPENDING_BUMP = 5,
61099+ GR_RLIM_MSGQUEUE_BUMP = 10000,
61100+ GR_RLIM_NICE_BUMP = 1,
61101+ GR_RLIM_RTPRIO_BUMP = 1,
61102+ GR_RLIM_RTTIME_BUMP = 1000000
61103+};
61104+
61105+#endif
61106diff -urNp linux-2.6.32.46/include/linux/grinternal.h linux-2.6.32.46/include/linux/grinternal.h
61107--- linux-2.6.32.46/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
61108+++ linux-2.6.32.46/include/linux/grinternal.h 2011-08-11 19:58:37.000000000 -0400
61109@@ -0,0 +1,217 @@
61110+#ifndef __GRINTERNAL_H
61111+#define __GRINTERNAL_H
61112+
61113+#ifdef CONFIG_GRKERNSEC
61114+
61115+#include <linux/fs.h>
61116+#include <linux/mnt_namespace.h>
61117+#include <linux/nsproxy.h>
61118+#include <linux/gracl.h>
61119+#include <linux/grdefs.h>
61120+#include <linux/grmsg.h>
61121+
61122+void gr_add_learn_entry(const char *fmt, ...)
61123+ __attribute__ ((format (printf, 1, 2)));
61124+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61125+ const struct vfsmount *mnt);
61126+__u32 gr_check_create(const struct dentry *new_dentry,
61127+ const struct dentry *parent,
61128+ const struct vfsmount *mnt, const __u32 mode);
61129+int gr_check_protected_task(const struct task_struct *task);
61130+__u32 to_gr_audit(const __u32 reqmode);
61131+int gr_set_acls(const int type);
61132+int gr_apply_subject_to_task(struct task_struct *task);
61133+int gr_acl_is_enabled(void);
61134+char gr_roletype_to_char(void);
61135+
61136+void gr_handle_alertkill(struct task_struct *task);
61137+char *gr_to_filename(const struct dentry *dentry,
61138+ const struct vfsmount *mnt);
61139+char *gr_to_filename1(const struct dentry *dentry,
61140+ const struct vfsmount *mnt);
61141+char *gr_to_filename2(const struct dentry *dentry,
61142+ const struct vfsmount *mnt);
61143+char *gr_to_filename3(const struct dentry *dentry,
61144+ const struct vfsmount *mnt);
61145+
61146+extern int grsec_enable_harden_ptrace;
61147+extern int grsec_enable_link;
61148+extern int grsec_enable_fifo;
61149+extern int grsec_enable_shm;
61150+extern int grsec_enable_execlog;
61151+extern int grsec_enable_signal;
61152+extern int grsec_enable_audit_ptrace;
61153+extern int grsec_enable_forkfail;
61154+extern int grsec_enable_time;
61155+extern int grsec_enable_rofs;
61156+extern int grsec_enable_chroot_shmat;
61157+extern int grsec_enable_chroot_mount;
61158+extern int grsec_enable_chroot_double;
61159+extern int grsec_enable_chroot_pivot;
61160+extern int grsec_enable_chroot_chdir;
61161+extern int grsec_enable_chroot_chmod;
61162+extern int grsec_enable_chroot_mknod;
61163+extern int grsec_enable_chroot_fchdir;
61164+extern int grsec_enable_chroot_nice;
61165+extern int grsec_enable_chroot_execlog;
61166+extern int grsec_enable_chroot_caps;
61167+extern int grsec_enable_chroot_sysctl;
61168+extern int grsec_enable_chroot_unix;
61169+extern int grsec_enable_tpe;
61170+extern int grsec_tpe_gid;
61171+extern int grsec_enable_tpe_all;
61172+extern int grsec_enable_tpe_invert;
61173+extern int grsec_enable_socket_all;
61174+extern int grsec_socket_all_gid;
61175+extern int grsec_enable_socket_client;
61176+extern int grsec_socket_client_gid;
61177+extern int grsec_enable_socket_server;
61178+extern int grsec_socket_server_gid;
61179+extern int grsec_audit_gid;
61180+extern int grsec_enable_group;
61181+extern int grsec_enable_audit_textrel;
61182+extern int grsec_enable_log_rwxmaps;
61183+extern int grsec_enable_mount;
61184+extern int grsec_enable_chdir;
61185+extern int grsec_resource_logging;
61186+extern int grsec_enable_blackhole;
61187+extern int grsec_lastack_retries;
61188+extern int grsec_enable_brute;
61189+extern int grsec_lock;
61190+
61191+extern spinlock_t grsec_alert_lock;
61192+extern unsigned long grsec_alert_wtime;
61193+extern unsigned long grsec_alert_fyet;
61194+
61195+extern spinlock_t grsec_audit_lock;
61196+
61197+extern rwlock_t grsec_exec_file_lock;
61198+
61199+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
61200+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
61201+ (tsk)->exec_file->f_vfsmnt) : "/")
61202+
61203+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
61204+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
61205+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61206+
61207+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
61208+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
61209+ (tsk)->exec_file->f_vfsmnt) : "/")
61210+
61211+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
61212+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
61213+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
61214+
61215+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
61216+
61217+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
61218+
61219+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
61220+ (task)->pid, (cred)->uid, \
61221+ (cred)->euid, (cred)->gid, (cred)->egid, \
61222+ gr_parent_task_fullpath(task), \
61223+ (task)->real_parent->comm, (task)->real_parent->pid, \
61224+ (pcred)->uid, (pcred)->euid, \
61225+ (pcred)->gid, (pcred)->egid
61226+
61227+#define GR_CHROOT_CAPS {{ \
61228+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
61229+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
61230+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
61231+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
61232+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
61233+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
61234+
61235+#define security_learn(normal_msg,args...) \
61236+({ \
61237+ read_lock(&grsec_exec_file_lock); \
61238+ gr_add_learn_entry(normal_msg "\n", ## args); \
61239+ read_unlock(&grsec_exec_file_lock); \
61240+})
61241+
61242+enum {
61243+ GR_DO_AUDIT,
61244+ GR_DONT_AUDIT,
61245+ GR_DONT_AUDIT_GOOD
61246+};
61247+
61248+enum {
61249+ GR_TTYSNIFF,
61250+ GR_RBAC,
61251+ GR_RBAC_STR,
61252+ GR_STR_RBAC,
61253+ GR_RBAC_MODE2,
61254+ GR_RBAC_MODE3,
61255+ GR_FILENAME,
61256+ GR_SYSCTL_HIDDEN,
61257+ GR_NOARGS,
61258+ GR_ONE_INT,
61259+ GR_ONE_INT_TWO_STR,
61260+ GR_ONE_STR,
61261+ GR_STR_INT,
61262+ GR_TWO_STR_INT,
61263+ GR_TWO_INT,
61264+ GR_TWO_U64,
61265+ GR_THREE_INT,
61266+ GR_FIVE_INT_TWO_STR,
61267+ GR_TWO_STR,
61268+ GR_THREE_STR,
61269+ GR_FOUR_STR,
61270+ GR_STR_FILENAME,
61271+ GR_FILENAME_STR,
61272+ GR_FILENAME_TWO_INT,
61273+ GR_FILENAME_TWO_INT_STR,
61274+ GR_TEXTREL,
61275+ GR_PTRACE,
61276+ GR_RESOURCE,
61277+ GR_CAP,
61278+ GR_SIG,
61279+ GR_SIG2,
61280+ GR_CRASH1,
61281+ GR_CRASH2,
61282+ GR_PSACCT,
61283+ GR_RWXMAP
61284+};
61285+
61286+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
61287+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
61288+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
61289+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
61290+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
61291+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
61292+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
61293+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
61294+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
61295+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
61296+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
61297+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
61298+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
61299+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
61300+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
61301+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
61302+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
61303+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
61304+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
61305+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
61306+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
61307+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
61308+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
61309+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
61310+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
61311+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
61312+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
61313+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
61314+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
61315+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
61316+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
61317+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
61318+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
61319+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
61320+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
61321+
61322+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
61323+
61324+#endif
61325+
61326+#endif
61327diff -urNp linux-2.6.32.46/include/linux/grmsg.h linux-2.6.32.46/include/linux/grmsg.h
61328--- linux-2.6.32.46/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
61329+++ linux-2.6.32.46/include/linux/grmsg.h 2011-09-13 15:44:53.000000000 -0400
61330@@ -0,0 +1,108 @@
61331+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
61332+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
61333+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
61334+#define GR_STOPMOD_MSG "denied modification of module state by "
61335+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
61336+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
61337+#define GR_IOPERM_MSG "denied use of ioperm() by "
61338+#define GR_IOPL_MSG "denied use of iopl() by "
61339+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
61340+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
61341+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
61342+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
61343+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
61344+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
61345+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
61346+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
61347+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
61348+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
61349+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
61350+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
61351+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
61352+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
61353+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
61354+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
61355+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
61356+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
61357+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
61358+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
61359+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
61360+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
61361+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
61362+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
61363+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
61364+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
61365+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
61366+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
61367+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
61368+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
61369+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
61370+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
61371+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
61372+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
61373+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
61374+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
61375+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
61376+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
61377+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
61378+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
61379+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
61380+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
61381+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
61382+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
61383+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
61384+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
61385+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
61386+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
61387+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
61388+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
61389+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
61390+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
61391+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
61392+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
61393+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
61394+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
61395+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
61396+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
61397+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
61398+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
61399+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
61400+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
61401+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
61402+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
61403+#define GR_FAILFORK_MSG "failed fork with errno %s by "
61404+#define GR_NICE_CHROOT_MSG "denied priority change by "
61405+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
61406+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
61407+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
61408+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
61409+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
61410+#define GR_TIME_MSG "time set by "
61411+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
61412+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
61413+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
61414+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
61415+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
61416+#define GR_BIND_MSG "denied bind() by "
61417+#define GR_CONNECT_MSG "denied connect() by "
61418+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
61419+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
61420+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
61421+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
61422+#define GR_CAP_ACL_MSG "use of %s denied for "
61423+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
61424+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
61425+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
61426+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
61427+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
61428+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
61429+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
61430+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
61431+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
61432+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
61433+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
61434+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
61435+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
61436+#define GR_VM86_MSG "denied use of vm86 by "
61437+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
61438+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
61439diff -urNp linux-2.6.32.46/include/linux/grsecurity.h linux-2.6.32.46/include/linux/grsecurity.h
61440--- linux-2.6.32.46/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
61441+++ linux-2.6.32.46/include/linux/grsecurity.h 2011-09-13 16:03:42.000000000 -0400
61442@@ -0,0 +1,216 @@
61443+#ifndef GR_SECURITY_H
61444+#define GR_SECURITY_H
61445+#include <linux/fs.h>
61446+#include <linux/fs_struct.h>
61447+#include <linux/binfmts.h>
61448+#include <linux/gracl.h>
61449+#include <linux/compat.h>
61450+
61451+/* notify of brain-dead configs */
61452+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
61453+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
61454+#endif
61455+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
61456+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
61457+#endif
61458+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61459+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61460+#endif
61461+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
61462+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
61463+#endif
61464+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
61465+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
61466+#endif
61467+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
61468+#error "CONFIG_PAX enabled, but no PaX options are enabled."
61469+#endif
61470+
61471+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
61472+void gr_handle_brute_check(void);
61473+void gr_handle_kernel_exploit(void);
61474+int gr_process_user_ban(void);
61475+
61476+char gr_roletype_to_char(void);
61477+
61478+int gr_acl_enable_at_secure(void);
61479+
61480+int gr_check_user_change(int real, int effective, int fs);
61481+int gr_check_group_change(int real, int effective, int fs);
61482+
61483+void gr_del_task_from_ip_table(struct task_struct *p);
61484+
61485+int gr_pid_is_chrooted(struct task_struct *p);
61486+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
61487+int gr_handle_chroot_nice(void);
61488+int gr_handle_chroot_sysctl(const int op);
61489+int gr_handle_chroot_setpriority(struct task_struct *p,
61490+ const int niceval);
61491+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
61492+int gr_handle_chroot_chroot(const struct dentry *dentry,
61493+ const struct vfsmount *mnt);
61494+void gr_handle_chroot_chdir(struct path *path);
61495+int gr_handle_chroot_chmod(const struct dentry *dentry,
61496+ const struct vfsmount *mnt, const int mode);
61497+int gr_handle_chroot_mknod(const struct dentry *dentry,
61498+ const struct vfsmount *mnt, const int mode);
61499+int gr_handle_chroot_mount(const struct dentry *dentry,
61500+ const struct vfsmount *mnt,
61501+ const char *dev_name);
61502+int gr_handle_chroot_pivot(void);
61503+int gr_handle_chroot_unix(const pid_t pid);
61504+
61505+int gr_handle_rawio(const struct inode *inode);
61506+
61507+void gr_handle_ioperm(void);
61508+void gr_handle_iopl(void);
61509+
61510+int gr_tpe_allow(const struct file *file);
61511+
61512+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
61513+void gr_clear_chroot_entries(struct task_struct *task);
61514+
61515+void gr_log_forkfail(const int retval);
61516+void gr_log_timechange(void);
61517+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
61518+void gr_log_chdir(const struct dentry *dentry,
61519+ const struct vfsmount *mnt);
61520+void gr_log_chroot_exec(const struct dentry *dentry,
61521+ const struct vfsmount *mnt);
61522+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
61523+#ifdef CONFIG_COMPAT
61524+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
61525+#endif
61526+void gr_log_remount(const char *devname, const int retval);
61527+void gr_log_unmount(const char *devname, const int retval);
61528+void gr_log_mount(const char *from, const char *to, const int retval);
61529+void gr_log_textrel(struct vm_area_struct *vma);
61530+void gr_log_rwxmmap(struct file *file);
61531+void gr_log_rwxmprotect(struct file *file);
61532+
61533+int gr_handle_follow_link(const struct inode *parent,
61534+ const struct inode *inode,
61535+ const struct dentry *dentry,
61536+ const struct vfsmount *mnt);
61537+int gr_handle_fifo(const struct dentry *dentry,
61538+ const struct vfsmount *mnt,
61539+ const struct dentry *dir, const int flag,
61540+ const int acc_mode);
61541+int gr_handle_hardlink(const struct dentry *dentry,
61542+ const struct vfsmount *mnt,
61543+ struct inode *inode,
61544+ const int mode, const char *to);
61545+
61546+int gr_is_capable(const int cap);
61547+int gr_is_capable_nolog(const int cap);
61548+void gr_learn_resource(const struct task_struct *task, const int limit,
61549+ const unsigned long wanted, const int gt);
61550+void gr_copy_label(struct task_struct *tsk);
61551+void gr_handle_crash(struct task_struct *task, const int sig);
61552+int gr_handle_signal(const struct task_struct *p, const int sig);
61553+int gr_check_crash_uid(const uid_t uid);
61554+int gr_check_protected_task(const struct task_struct *task);
61555+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
61556+int gr_acl_handle_mmap(const struct file *file,
61557+ const unsigned long prot);
61558+int gr_acl_handle_mprotect(const struct file *file,
61559+ const unsigned long prot);
61560+int gr_check_hidden_task(const struct task_struct *tsk);
61561+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
61562+ const struct vfsmount *mnt);
61563+__u32 gr_acl_handle_utime(const struct dentry *dentry,
61564+ const struct vfsmount *mnt);
61565+__u32 gr_acl_handle_access(const struct dentry *dentry,
61566+ const struct vfsmount *mnt, const int fmode);
61567+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
61568+ const struct vfsmount *mnt, mode_t mode);
61569+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
61570+ const struct vfsmount *mnt, mode_t mode);
61571+__u32 gr_acl_handle_chown(const struct dentry *dentry,
61572+ const struct vfsmount *mnt);
61573+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
61574+ const struct vfsmount *mnt);
61575+int gr_handle_ptrace(struct task_struct *task, const long request);
61576+int gr_handle_proc_ptrace(struct task_struct *task);
61577+__u32 gr_acl_handle_execve(const struct dentry *dentry,
61578+ const struct vfsmount *mnt);
61579+int gr_check_crash_exec(const struct file *filp);
61580+int gr_acl_is_enabled(void);
61581+void gr_set_kernel_label(struct task_struct *task);
61582+void gr_set_role_label(struct task_struct *task, const uid_t uid,
61583+ const gid_t gid);
61584+int gr_set_proc_label(const struct dentry *dentry,
61585+ const struct vfsmount *mnt,
61586+ const int unsafe_share);
61587+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
61588+ const struct vfsmount *mnt);
61589+__u32 gr_acl_handle_open(const struct dentry *dentry,
61590+ const struct vfsmount *mnt, const int fmode);
61591+__u32 gr_acl_handle_creat(const struct dentry *dentry,
61592+ const struct dentry *p_dentry,
61593+ const struct vfsmount *p_mnt, const int fmode,
61594+ const int imode);
61595+void gr_handle_create(const struct dentry *dentry,
61596+ const struct vfsmount *mnt);
61597+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
61598+ const struct dentry *parent_dentry,
61599+ const struct vfsmount *parent_mnt,
61600+ const int mode);
61601+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
61602+ const struct dentry *parent_dentry,
61603+ const struct vfsmount *parent_mnt);
61604+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
61605+ const struct vfsmount *mnt);
61606+void gr_handle_delete(const ino_t ino, const dev_t dev);
61607+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
61608+ const struct vfsmount *mnt);
61609+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
61610+ const struct dentry *parent_dentry,
61611+ const struct vfsmount *parent_mnt,
61612+ const char *from);
61613+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
61614+ const struct dentry *parent_dentry,
61615+ const struct vfsmount *parent_mnt,
61616+ const struct dentry *old_dentry,
61617+ const struct vfsmount *old_mnt, const char *to);
61618+int gr_acl_handle_rename(struct dentry *new_dentry,
61619+ struct dentry *parent_dentry,
61620+ const struct vfsmount *parent_mnt,
61621+ struct dentry *old_dentry,
61622+ struct inode *old_parent_inode,
61623+ struct vfsmount *old_mnt, const char *newname);
61624+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
61625+ struct dentry *old_dentry,
61626+ struct dentry *new_dentry,
61627+ struct vfsmount *mnt, const __u8 replace);
61628+__u32 gr_check_link(const struct dentry *new_dentry,
61629+ const struct dentry *parent_dentry,
61630+ const struct vfsmount *parent_mnt,
61631+ const struct dentry *old_dentry,
61632+ const struct vfsmount *old_mnt);
61633+int gr_acl_handle_filldir(const struct file *file, const char *name,
61634+ const unsigned int namelen, const ino_t ino);
61635+
61636+__u32 gr_acl_handle_unix(const struct dentry *dentry,
61637+ const struct vfsmount *mnt);
61638+void gr_acl_handle_exit(void);
61639+void gr_acl_handle_psacct(struct task_struct *task, const long code);
61640+int gr_acl_handle_procpidmem(const struct task_struct *task);
61641+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
61642+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
61643+void gr_audit_ptrace(struct task_struct *task);
61644+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
61645+
61646+#ifdef CONFIG_GRKERNSEC
61647+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
61648+void gr_handle_vm86(void);
61649+void gr_handle_mem_readwrite(u64 from, u64 to);
61650+
61651+extern int grsec_enable_dmesg;
61652+extern int grsec_disable_privio;
61653+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
61654+extern int grsec_enable_chroot_findtask;
61655+#endif
61656+#endif
61657+
61658+#endif
61659diff -urNp linux-2.6.32.46/include/linux/hdpu_features.h linux-2.6.32.46/include/linux/hdpu_features.h
61660--- linux-2.6.32.46/include/linux/hdpu_features.h 2011-03-27 14:31:47.000000000 -0400
61661+++ linux-2.6.32.46/include/linux/hdpu_features.h 2011-04-17 15:56:46.000000000 -0400
61662@@ -3,7 +3,7 @@
61663 struct cpustate_t {
61664 spinlock_t lock;
61665 int excl;
61666- int open_count;
61667+ atomic_t open_count;
61668 unsigned char cached_val;
61669 int inited;
61670 unsigned long *set_addr;
61671diff -urNp linux-2.6.32.46/include/linux/highmem.h linux-2.6.32.46/include/linux/highmem.h
61672--- linux-2.6.32.46/include/linux/highmem.h 2011-03-27 14:31:47.000000000 -0400
61673+++ linux-2.6.32.46/include/linux/highmem.h 2011-04-17 15:56:46.000000000 -0400
61674@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
61675 kunmap_atomic(kaddr, KM_USER0);
61676 }
61677
61678+static inline void sanitize_highpage(struct page *page)
61679+{
61680+ void *kaddr;
61681+ unsigned long flags;
61682+
61683+ local_irq_save(flags);
61684+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
61685+ clear_page(kaddr);
61686+ kunmap_atomic(kaddr, KM_CLEARPAGE);
61687+ local_irq_restore(flags);
61688+}
61689+
61690 static inline void zero_user_segments(struct page *page,
61691 unsigned start1, unsigned end1,
61692 unsigned start2, unsigned end2)
61693diff -urNp linux-2.6.32.46/include/linux/i2c.h linux-2.6.32.46/include/linux/i2c.h
61694--- linux-2.6.32.46/include/linux/i2c.h 2011-03-27 14:31:47.000000000 -0400
61695+++ linux-2.6.32.46/include/linux/i2c.h 2011-08-23 21:22:38.000000000 -0400
61696@@ -325,6 +325,7 @@ struct i2c_algorithm {
61697 /* To determine what the adapter supports */
61698 u32 (*functionality) (struct i2c_adapter *);
61699 };
61700+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
61701
61702 /*
61703 * i2c_adapter is the structure used to identify a physical i2c bus along
61704diff -urNp linux-2.6.32.46/include/linux/i2o.h linux-2.6.32.46/include/linux/i2o.h
61705--- linux-2.6.32.46/include/linux/i2o.h 2011-03-27 14:31:47.000000000 -0400
61706+++ linux-2.6.32.46/include/linux/i2o.h 2011-05-04 17:56:28.000000000 -0400
61707@@ -564,7 +564,7 @@ struct i2o_controller {
61708 struct i2o_device *exec; /* Executive */
61709 #if BITS_PER_LONG == 64
61710 spinlock_t context_list_lock; /* lock for context_list */
61711- atomic_t context_list_counter; /* needed for unique contexts */
61712+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
61713 struct list_head context_list; /* list of context id's
61714 and pointers */
61715 #endif
61716diff -urNp linux-2.6.32.46/include/linux/init_task.h linux-2.6.32.46/include/linux/init_task.h
61717--- linux-2.6.32.46/include/linux/init_task.h 2011-03-27 14:31:47.000000000 -0400
61718+++ linux-2.6.32.46/include/linux/init_task.h 2011-05-18 20:44:59.000000000 -0400
61719@@ -83,6 +83,12 @@ extern struct group_info init_groups;
61720 #define INIT_IDS
61721 #endif
61722
61723+#ifdef CONFIG_X86
61724+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
61725+#else
61726+#define INIT_TASK_THREAD_INFO
61727+#endif
61728+
61729 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
61730 /*
61731 * Because of the reduced scope of CAP_SETPCAP when filesystem
61732@@ -156,6 +162,7 @@ extern struct cred init_cred;
61733 __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
61734 .comm = "swapper", \
61735 .thread = INIT_THREAD, \
61736+ INIT_TASK_THREAD_INFO \
61737 .fs = &init_fs, \
61738 .files = &init_files, \
61739 .signal = &init_signals, \
61740diff -urNp linux-2.6.32.46/include/linux/intel-iommu.h linux-2.6.32.46/include/linux/intel-iommu.h
61741--- linux-2.6.32.46/include/linux/intel-iommu.h 2011-03-27 14:31:47.000000000 -0400
61742+++ linux-2.6.32.46/include/linux/intel-iommu.h 2011-08-05 20:33:55.000000000 -0400
61743@@ -296,7 +296,7 @@ struct iommu_flush {
61744 u8 fm, u64 type);
61745 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
61746 unsigned int size_order, u64 type);
61747-};
61748+} __no_const;
61749
61750 enum {
61751 SR_DMAR_FECTL_REG,
61752diff -urNp linux-2.6.32.46/include/linux/interrupt.h linux-2.6.32.46/include/linux/interrupt.h
61753--- linux-2.6.32.46/include/linux/interrupt.h 2011-06-25 12:55:35.000000000 -0400
61754+++ linux-2.6.32.46/include/linux/interrupt.h 2011-06-25 12:56:37.000000000 -0400
61755@@ -363,7 +363,7 @@ enum
61756 /* map softirq index to softirq name. update 'softirq_to_name' in
61757 * kernel/softirq.c when adding a new softirq.
61758 */
61759-extern char *softirq_to_name[NR_SOFTIRQS];
61760+extern const char * const softirq_to_name[NR_SOFTIRQS];
61761
61762 /* softirq mask and active fields moved to irq_cpustat_t in
61763 * asm/hardirq.h to get better cache usage. KAO
61764@@ -371,12 +371,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
61765
61766 struct softirq_action
61767 {
61768- void (*action)(struct softirq_action *);
61769+ void (*action)(void);
61770 };
61771
61772 asmlinkage void do_softirq(void);
61773 asmlinkage void __do_softirq(void);
61774-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
61775+extern void open_softirq(int nr, void (*action)(void));
61776 extern void softirq_init(void);
61777 #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
61778 extern void raise_softirq_irqoff(unsigned int nr);
61779diff -urNp linux-2.6.32.46/include/linux/irq.h linux-2.6.32.46/include/linux/irq.h
61780--- linux-2.6.32.46/include/linux/irq.h 2011-03-27 14:31:47.000000000 -0400
61781+++ linux-2.6.32.46/include/linux/irq.h 2011-04-17 15:56:46.000000000 -0400
61782@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
61783 static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
61784 bool boot)
61785 {
61786+#ifdef CONFIG_CPUMASK_OFFSTACK
61787 gfp_t gfp = GFP_ATOMIC;
61788
61789 if (boot)
61790 gfp = GFP_NOWAIT;
61791
61792-#ifdef CONFIG_CPUMASK_OFFSTACK
61793 if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
61794 return false;
61795
61796diff -urNp linux-2.6.32.46/include/linux/kallsyms.h linux-2.6.32.46/include/linux/kallsyms.h
61797--- linux-2.6.32.46/include/linux/kallsyms.h 2011-03-27 14:31:47.000000000 -0400
61798+++ linux-2.6.32.46/include/linux/kallsyms.h 2011-04-17 15:56:46.000000000 -0400
61799@@ -15,7 +15,8 @@
61800
61801 struct module;
61802
61803-#ifdef CONFIG_KALLSYMS
61804+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
61805+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
61806 /* Lookup the address for a symbol. Returns 0 if not found. */
61807 unsigned long kallsyms_lookup_name(const char *name);
61808
61809@@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(un
61810 /* Stupid that this does nothing, but I didn't create this mess. */
61811 #define __print_symbol(fmt, addr)
61812 #endif /*CONFIG_KALLSYMS*/
61813+#else /* when included by kallsyms.c, vsnprintf.c, or
61814+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
61815+extern void __print_symbol(const char *fmt, unsigned long address);
61816+extern int sprint_symbol(char *buffer, unsigned long address);
61817+const char *kallsyms_lookup(unsigned long addr,
61818+ unsigned long *symbolsize,
61819+ unsigned long *offset,
61820+ char **modname, char *namebuf);
61821+#endif
61822
61823 /* This macro allows us to keep printk typechecking */
61824 static void __check_printsym_format(const char *fmt, ...)
61825diff -urNp linux-2.6.32.46/include/linux/kgdb.h linux-2.6.32.46/include/linux/kgdb.h
61826--- linux-2.6.32.46/include/linux/kgdb.h 2011-03-27 14:31:47.000000000 -0400
61827+++ linux-2.6.32.46/include/linux/kgdb.h 2011-08-26 20:25:20.000000000 -0400
61828@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
61829
61830 extern int kgdb_connected;
61831
61832-extern atomic_t kgdb_setting_breakpoint;
61833-extern atomic_t kgdb_cpu_doing_single_step;
61834+extern atomic_unchecked_t kgdb_setting_breakpoint;
61835+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
61836
61837 extern struct task_struct *kgdb_usethread;
61838 extern struct task_struct *kgdb_contthread;
61839@@ -235,7 +235,7 @@ struct kgdb_arch {
61840 int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
61841 void (*remove_all_hw_break)(void);
61842 void (*correct_hw_break)(void);
61843-};
61844+} __do_const;
61845
61846 /**
61847 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
61848@@ -257,14 +257,14 @@ struct kgdb_io {
61849 int (*init) (void);
61850 void (*pre_exception) (void);
61851 void (*post_exception) (void);
61852-};
61853+} __do_const;
61854
61855-extern struct kgdb_arch arch_kgdb_ops;
61856+extern const struct kgdb_arch arch_kgdb_ops;
61857
61858 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
61859
61860-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
61861-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
61862+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
61863+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
61864
61865 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
61866 extern int kgdb_mem2hex(char *mem, char *buf, int count);
61867diff -urNp linux-2.6.32.46/include/linux/kmod.h linux-2.6.32.46/include/linux/kmod.h
61868--- linux-2.6.32.46/include/linux/kmod.h 2011-03-27 14:31:47.000000000 -0400
61869+++ linux-2.6.32.46/include/linux/kmod.h 2011-04-17 15:56:46.000000000 -0400
61870@@ -31,6 +31,8 @@
61871 * usually useless though. */
61872 extern int __request_module(bool wait, const char *name, ...) \
61873 __attribute__((format(printf, 2, 3)));
61874+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
61875+ __attribute__((format(printf, 3, 4)));
61876 #define request_module(mod...) __request_module(true, mod)
61877 #define request_module_nowait(mod...) __request_module(false, mod)
61878 #define try_then_request_module(x, mod...) \
61879diff -urNp linux-2.6.32.46/include/linux/kobject.h linux-2.6.32.46/include/linux/kobject.h
61880--- linux-2.6.32.46/include/linux/kobject.h 2011-03-27 14:31:47.000000000 -0400
61881+++ linux-2.6.32.46/include/linux/kobject.h 2011-04-17 15:56:46.000000000 -0400
61882@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
61883
61884 struct kobj_type {
61885 void (*release)(struct kobject *kobj);
61886- struct sysfs_ops *sysfs_ops;
61887+ const struct sysfs_ops *sysfs_ops;
61888 struct attribute **default_attrs;
61889 };
61890
61891@@ -118,9 +118,9 @@ struct kobj_uevent_env {
61892 };
61893
61894 struct kset_uevent_ops {
61895- int (*filter)(struct kset *kset, struct kobject *kobj);
61896- const char *(*name)(struct kset *kset, struct kobject *kobj);
61897- int (*uevent)(struct kset *kset, struct kobject *kobj,
61898+ int (* const filter)(struct kset *kset, struct kobject *kobj);
61899+ const char *(* const name)(struct kset *kset, struct kobject *kobj);
61900+ int (* const uevent)(struct kset *kset, struct kobject *kobj,
61901 struct kobj_uevent_env *env);
61902 };
61903
61904@@ -132,7 +132,7 @@ struct kobj_attribute {
61905 const char *buf, size_t count);
61906 };
61907
61908-extern struct sysfs_ops kobj_sysfs_ops;
61909+extern const struct sysfs_ops kobj_sysfs_ops;
61910
61911 /**
61912 * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
61913@@ -155,14 +155,14 @@ struct kset {
61914 struct list_head list;
61915 spinlock_t list_lock;
61916 struct kobject kobj;
61917- struct kset_uevent_ops *uevent_ops;
61918+ const struct kset_uevent_ops *uevent_ops;
61919 };
61920
61921 extern void kset_init(struct kset *kset);
61922 extern int __must_check kset_register(struct kset *kset);
61923 extern void kset_unregister(struct kset *kset);
61924 extern struct kset * __must_check kset_create_and_add(const char *name,
61925- struct kset_uevent_ops *u,
61926+ const struct kset_uevent_ops *u,
61927 struct kobject *parent_kobj);
61928
61929 static inline struct kset *to_kset(struct kobject *kobj)
61930diff -urNp linux-2.6.32.46/include/linux/kvm_host.h linux-2.6.32.46/include/linux/kvm_host.h
61931--- linux-2.6.32.46/include/linux/kvm_host.h 2011-03-27 14:31:47.000000000 -0400
61932+++ linux-2.6.32.46/include/linux/kvm_host.h 2011-04-17 15:56:46.000000000 -0400
61933@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
61934 void vcpu_load(struct kvm_vcpu *vcpu);
61935 void vcpu_put(struct kvm_vcpu *vcpu);
61936
61937-int kvm_init(void *opaque, unsigned int vcpu_size,
61938+int kvm_init(const void *opaque, unsigned int vcpu_size,
61939 struct module *module);
61940 void kvm_exit(void);
61941
61942@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
61943 struct kvm_guest_debug *dbg);
61944 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
61945
61946-int kvm_arch_init(void *opaque);
61947+int kvm_arch_init(const void *opaque);
61948 void kvm_arch_exit(void);
61949
61950 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
61951diff -urNp linux-2.6.32.46/include/linux/libata.h linux-2.6.32.46/include/linux/libata.h
61952--- linux-2.6.32.46/include/linux/libata.h 2011-03-27 14:31:47.000000000 -0400
61953+++ linux-2.6.32.46/include/linux/libata.h 2011-08-26 20:19:09.000000000 -0400
61954@@ -525,11 +525,11 @@ struct ata_ioports {
61955
61956 struct ata_host {
61957 spinlock_t lock;
61958- struct device *dev;
61959+ struct device *dev;
61960 void __iomem * const *iomap;
61961 unsigned int n_ports;
61962 void *private_data;
61963- struct ata_port_operations *ops;
61964+ const struct ata_port_operations *ops;
61965 unsigned long flags;
61966 #ifdef CONFIG_ATA_ACPI
61967 acpi_handle acpi_handle;
61968@@ -710,7 +710,7 @@ struct ata_link {
61969
61970 struct ata_port {
61971 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
61972- struct ata_port_operations *ops;
61973+ const struct ata_port_operations *ops;
61974 spinlock_t *lock;
61975 /* Flags owned by the EH context. Only EH should touch these once the
61976 port is active */
61977@@ -884,7 +884,7 @@ struct ata_port_operations {
61978 * fields must be pointers.
61979 */
61980 const struct ata_port_operations *inherits;
61981-};
61982+} __do_const;
61983
61984 struct ata_port_info {
61985 unsigned long flags;
61986@@ -892,7 +892,7 @@ struct ata_port_info {
61987 unsigned long pio_mask;
61988 unsigned long mwdma_mask;
61989 unsigned long udma_mask;
61990- struct ata_port_operations *port_ops;
61991+ const struct ata_port_operations *port_ops;
61992 void *private_data;
61993 };
61994
61995@@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timi
61996 extern const unsigned long sata_deb_timing_hotplug[];
61997 extern const unsigned long sata_deb_timing_long[];
61998
61999-extern struct ata_port_operations ata_dummy_port_ops;
62000+extern const struct ata_port_operations ata_dummy_port_ops;
62001 extern const struct ata_port_info ata_dummy_port_info;
62002
62003 static inline const unsigned long *
62004@@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_
62005 struct scsi_host_template *sht);
62006 extern void ata_host_detach(struct ata_host *host);
62007 extern void ata_host_init(struct ata_host *, struct device *,
62008- unsigned long, struct ata_port_operations *);
62009+ unsigned long, const struct ata_port_operations *);
62010 extern int ata_scsi_detect(struct scsi_host_template *sht);
62011 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
62012 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
62013diff -urNp linux-2.6.32.46/include/linux/lockd/bind.h linux-2.6.32.46/include/linux/lockd/bind.h
62014--- linux-2.6.32.46/include/linux/lockd/bind.h 2011-03-27 14:31:47.000000000 -0400
62015+++ linux-2.6.32.46/include/linux/lockd/bind.h 2011-04-17 15:56:46.000000000 -0400
62016@@ -23,13 +23,13 @@ struct svc_rqst;
62017 * This is the set of functions for lockd->nfsd communication
62018 */
62019 struct nlmsvc_binding {
62020- __be32 (*fopen)(struct svc_rqst *,
62021+ __be32 (* const fopen)(struct svc_rqst *,
62022 struct nfs_fh *,
62023 struct file **);
62024- void (*fclose)(struct file *);
62025+ void (* const fclose)(struct file *);
62026 };
62027
62028-extern struct nlmsvc_binding * nlmsvc_ops;
62029+extern const struct nlmsvc_binding * nlmsvc_ops;
62030
62031 /*
62032 * Similar to nfs_client_initdata, but without the NFS-specific
62033diff -urNp linux-2.6.32.46/include/linux/mca.h linux-2.6.32.46/include/linux/mca.h
62034--- linux-2.6.32.46/include/linux/mca.h 2011-03-27 14:31:47.000000000 -0400
62035+++ linux-2.6.32.46/include/linux/mca.h 2011-08-05 20:33:55.000000000 -0400
62036@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
62037 int region);
62038 void * (*mca_transform_memory)(struct mca_device *,
62039 void *memory);
62040-};
62041+} __no_const;
62042
62043 struct mca_bus {
62044 u64 default_dma_mask;
62045diff -urNp linux-2.6.32.46/include/linux/memory.h linux-2.6.32.46/include/linux/memory.h
62046--- linux-2.6.32.46/include/linux/memory.h 2011-03-27 14:31:47.000000000 -0400
62047+++ linux-2.6.32.46/include/linux/memory.h 2011-08-05 20:33:55.000000000 -0400
62048@@ -108,7 +108,7 @@ struct memory_accessor {
62049 size_t count);
62050 ssize_t (*write)(struct memory_accessor *, const char *buf,
62051 off_t offset, size_t count);
62052-};
62053+} __no_const;
62054
62055 /*
62056 * Kernel text modification mutex, used for code patching. Users of this lock
62057diff -urNp linux-2.6.32.46/include/linux/mm.h linux-2.6.32.46/include/linux/mm.h
62058--- linux-2.6.32.46/include/linux/mm.h 2011-03-27 14:31:47.000000000 -0400
62059+++ linux-2.6.32.46/include/linux/mm.h 2011-04-17 15:56:46.000000000 -0400
62060@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void
62061
62062 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
62063 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
62064+
62065+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
62066+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62067+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62068+#else
62069 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62070+#endif
62071+
62072 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62073 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62074
62075@@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
62076 int set_page_dirty_lock(struct page *page);
62077 int clear_page_dirty_for_io(struct page *page);
62078
62079-/* Is the vma a continuation of the stack vma above it? */
62080-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
62081-{
62082- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62083-}
62084-
62085 extern unsigned long move_page_tables(struct vm_area_struct *vma,
62086 unsigned long old_addr, struct vm_area_struct *new_vma,
62087 unsigned long new_addr, unsigned long len);
62088@@ -890,6 +891,8 @@ struct shrinker {
62089 extern void register_shrinker(struct shrinker *);
62090 extern void unregister_shrinker(struct shrinker *);
62091
62092+pgprot_t vm_get_page_prot(unsigned long vm_flags);
62093+
62094 int vma_wants_writenotify(struct vm_area_struct *vma);
62095
62096 extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
62097@@ -1162,6 +1165,7 @@ out:
62098 }
62099
62100 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62101+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62102
62103 extern unsigned long do_brk(unsigned long, unsigned long);
62104
62105@@ -1218,6 +1222,10 @@ extern struct vm_area_struct * find_vma(
62106 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
62107 struct vm_area_struct **pprev);
62108
62109+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
62110+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
62111+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
62112+
62113 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
62114 NULL if none. Assume start_addr < end_addr. */
62115 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
62116@@ -1234,7 +1242,6 @@ static inline unsigned long vma_pages(st
62117 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
62118 }
62119
62120-pgprot_t vm_get_page_prot(unsigned long vm_flags);
62121 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
62122 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
62123 unsigned long pfn, unsigned long size, pgprot_t);
62124@@ -1332,7 +1339,13 @@ extern void memory_failure(unsigned long
62125 extern int __memory_failure(unsigned long pfn, int trapno, int ref);
62126 extern int sysctl_memory_failure_early_kill;
62127 extern int sysctl_memory_failure_recovery;
62128-extern atomic_long_t mce_bad_pages;
62129+extern atomic_long_unchecked_t mce_bad_pages;
62130+
62131+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
62132+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
62133+#else
62134+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
62135+#endif
62136
62137 #endif /* __KERNEL__ */
62138 #endif /* _LINUX_MM_H */
62139diff -urNp linux-2.6.32.46/include/linux/mm_types.h linux-2.6.32.46/include/linux/mm_types.h
62140--- linux-2.6.32.46/include/linux/mm_types.h 2011-03-27 14:31:47.000000000 -0400
62141+++ linux-2.6.32.46/include/linux/mm_types.h 2011-04-17 15:56:46.000000000 -0400
62142@@ -186,6 +186,8 @@ struct vm_area_struct {
62143 #ifdef CONFIG_NUMA
62144 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
62145 #endif
62146+
62147+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
62148 };
62149
62150 struct core_thread {
62151@@ -287,6 +289,24 @@ struct mm_struct {
62152 #ifdef CONFIG_MMU_NOTIFIER
62153 struct mmu_notifier_mm *mmu_notifier_mm;
62154 #endif
62155+
62156+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62157+ unsigned long pax_flags;
62158+#endif
62159+
62160+#ifdef CONFIG_PAX_DLRESOLVE
62161+ unsigned long call_dl_resolve;
62162+#endif
62163+
62164+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
62165+ unsigned long call_syscall;
62166+#endif
62167+
62168+#ifdef CONFIG_PAX_ASLR
62169+ unsigned long delta_mmap; /* randomized offset */
62170+ unsigned long delta_stack; /* randomized offset */
62171+#endif
62172+
62173 };
62174
62175 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
62176diff -urNp linux-2.6.32.46/include/linux/mmu_notifier.h linux-2.6.32.46/include/linux/mmu_notifier.h
62177--- linux-2.6.32.46/include/linux/mmu_notifier.h 2011-03-27 14:31:47.000000000 -0400
62178+++ linux-2.6.32.46/include/linux/mmu_notifier.h 2011-04-17 15:56:46.000000000 -0400
62179@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
62180 */
62181 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
62182 ({ \
62183- pte_t __pte; \
62184+ pte_t ___pte; \
62185 struct vm_area_struct *___vma = __vma; \
62186 unsigned long ___address = __address; \
62187- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
62188+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
62189 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
62190- __pte; \
62191+ ___pte; \
62192 })
62193
62194 #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
62195diff -urNp linux-2.6.32.46/include/linux/mmzone.h linux-2.6.32.46/include/linux/mmzone.h
62196--- linux-2.6.32.46/include/linux/mmzone.h 2011-03-27 14:31:47.000000000 -0400
62197+++ linux-2.6.32.46/include/linux/mmzone.h 2011-04-17 15:56:46.000000000 -0400
62198@@ -350,7 +350,7 @@ struct zone {
62199 unsigned long flags; /* zone flags, see below */
62200
62201 /* Zone statistics */
62202- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62203+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
62204
62205 /*
62206 * prev_priority holds the scanning priority for this zone. It is
62207diff -urNp linux-2.6.32.46/include/linux/mod_devicetable.h linux-2.6.32.46/include/linux/mod_devicetable.h
62208--- linux-2.6.32.46/include/linux/mod_devicetable.h 2011-03-27 14:31:47.000000000 -0400
62209+++ linux-2.6.32.46/include/linux/mod_devicetable.h 2011-04-17 15:56:46.000000000 -0400
62210@@ -12,7 +12,7 @@
62211 typedef unsigned long kernel_ulong_t;
62212 #endif
62213
62214-#define PCI_ANY_ID (~0)
62215+#define PCI_ANY_ID ((__u16)~0)
62216
62217 struct pci_device_id {
62218 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
62219@@ -131,7 +131,7 @@ struct usb_device_id {
62220 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
62221 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
62222
62223-#define HID_ANY_ID (~0)
62224+#define HID_ANY_ID (~0U)
62225
62226 struct hid_device_id {
62227 __u16 bus;
62228diff -urNp linux-2.6.32.46/include/linux/module.h linux-2.6.32.46/include/linux/module.h
62229--- linux-2.6.32.46/include/linux/module.h 2011-03-27 14:31:47.000000000 -0400
62230+++ linux-2.6.32.46/include/linux/module.h 2011-08-05 20:33:55.000000000 -0400
62231@@ -16,6 +16,7 @@
62232 #include <linux/kobject.h>
62233 #include <linux/moduleparam.h>
62234 #include <linux/tracepoint.h>
62235+#include <linux/fs.h>
62236
62237 #include <asm/local.h>
62238 #include <asm/module.h>
62239@@ -287,16 +288,16 @@ struct module
62240 int (*init)(void);
62241
62242 /* If this is non-NULL, vfree after init() returns */
62243- void *module_init;
62244+ void *module_init_rx, *module_init_rw;
62245
62246 /* Here is the actual code + data, vfree'd on unload. */
62247- void *module_core;
62248+ void *module_core_rx, *module_core_rw;
62249
62250 /* Here are the sizes of the init and core sections */
62251- unsigned int init_size, core_size;
62252+ unsigned int init_size_rw, core_size_rw;
62253
62254 /* The size of the executable code in each section. */
62255- unsigned int init_text_size, core_text_size;
62256+ unsigned int init_size_rx, core_size_rx;
62257
62258 /* Arch-specific module values */
62259 struct mod_arch_specific arch;
62260@@ -345,6 +346,10 @@ struct module
62261 #ifdef CONFIG_EVENT_TRACING
62262 struct ftrace_event_call *trace_events;
62263 unsigned int num_trace_events;
62264+ struct file_operations trace_id;
62265+ struct file_operations trace_enable;
62266+ struct file_operations trace_format;
62267+ struct file_operations trace_filter;
62268 #endif
62269 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
62270 unsigned long *ftrace_callsites;
62271@@ -393,16 +398,46 @@ struct module *__module_address(unsigned
62272 bool is_module_address(unsigned long addr);
62273 bool is_module_text_address(unsigned long addr);
62274
62275+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
62276+{
62277+
62278+#ifdef CONFIG_PAX_KERNEXEC
62279+ if (ktla_ktva(addr) >= (unsigned long)start &&
62280+ ktla_ktva(addr) < (unsigned long)start + size)
62281+ return 1;
62282+#endif
62283+
62284+ return ((void *)addr >= start && (void *)addr < start + size);
62285+}
62286+
62287+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
62288+{
62289+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
62290+}
62291+
62292+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
62293+{
62294+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
62295+}
62296+
62297+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
62298+{
62299+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
62300+}
62301+
62302+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
62303+{
62304+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
62305+}
62306+
62307 static inline int within_module_core(unsigned long addr, struct module *mod)
62308 {
62309- return (unsigned long)mod->module_core <= addr &&
62310- addr < (unsigned long)mod->module_core + mod->core_size;
62311+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
62312 }
62313
62314 static inline int within_module_init(unsigned long addr, struct module *mod)
62315 {
62316- return (unsigned long)mod->module_init <= addr &&
62317- addr < (unsigned long)mod->module_init + mod->init_size;
62318+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
62319 }
62320
62321 /* Search for module by name: must hold module_mutex. */
62322diff -urNp linux-2.6.32.46/include/linux/moduleloader.h linux-2.6.32.46/include/linux/moduleloader.h
62323--- linux-2.6.32.46/include/linux/moduleloader.h 2011-03-27 14:31:47.000000000 -0400
62324+++ linux-2.6.32.46/include/linux/moduleloader.h 2011-04-17 15:56:46.000000000 -0400
62325@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
62326 sections. Returns NULL on failure. */
62327 void *module_alloc(unsigned long size);
62328
62329+#ifdef CONFIG_PAX_KERNEXEC
62330+void *module_alloc_exec(unsigned long size);
62331+#else
62332+#define module_alloc_exec(x) module_alloc(x)
62333+#endif
62334+
62335 /* Free memory returned from module_alloc. */
62336 void module_free(struct module *mod, void *module_region);
62337
62338+#ifdef CONFIG_PAX_KERNEXEC
62339+void module_free_exec(struct module *mod, void *module_region);
62340+#else
62341+#define module_free_exec(x, y) module_free((x), (y))
62342+#endif
62343+
62344 /* Apply the given relocation to the (simplified) ELF. Return -error
62345 or 0. */
62346 int apply_relocate(Elf_Shdr *sechdrs,
62347diff -urNp linux-2.6.32.46/include/linux/moduleparam.h linux-2.6.32.46/include/linux/moduleparam.h
62348--- linux-2.6.32.46/include/linux/moduleparam.h 2011-03-27 14:31:47.000000000 -0400
62349+++ linux-2.6.32.46/include/linux/moduleparam.h 2011-04-17 15:56:46.000000000 -0400
62350@@ -132,7 +132,7 @@ struct kparam_array
62351
62352 /* Actually copy string: maxlen param is usually sizeof(string). */
62353 #define module_param_string(name, string, len, perm) \
62354- static const struct kparam_string __param_string_##name \
62355+ static const struct kparam_string __param_string_##name __used \
62356 = { len, string }; \
62357 __module_param_call(MODULE_PARAM_PREFIX, name, \
62358 param_set_copystring, param_get_string, \
62359@@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffe
62360
62361 /* Comma-separated array: *nump is set to number they actually specified. */
62362 #define module_param_array_named(name, array, type, nump, perm) \
62363- static const struct kparam_array __param_arr_##name \
62364+ static const struct kparam_array __param_arr_##name __used \
62365 = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
62366 sizeof(array[0]), array }; \
62367 __module_param_call(MODULE_PARAM_PREFIX, name, \
62368diff -urNp linux-2.6.32.46/include/linux/mutex.h linux-2.6.32.46/include/linux/mutex.h
62369--- linux-2.6.32.46/include/linux/mutex.h 2011-03-27 14:31:47.000000000 -0400
62370+++ linux-2.6.32.46/include/linux/mutex.h 2011-04-17 15:56:46.000000000 -0400
62371@@ -51,7 +51,7 @@ struct mutex {
62372 spinlock_t wait_lock;
62373 struct list_head wait_list;
62374 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
62375- struct thread_info *owner;
62376+ struct task_struct *owner;
62377 #endif
62378 #ifdef CONFIG_DEBUG_MUTEXES
62379 const char *name;
62380diff -urNp linux-2.6.32.46/include/linux/namei.h linux-2.6.32.46/include/linux/namei.h
62381--- linux-2.6.32.46/include/linux/namei.h 2011-03-27 14:31:47.000000000 -0400
62382+++ linux-2.6.32.46/include/linux/namei.h 2011-04-17 15:56:46.000000000 -0400
62383@@ -22,7 +22,7 @@ struct nameidata {
62384 unsigned int flags;
62385 int last_type;
62386 unsigned depth;
62387- char *saved_names[MAX_NESTED_LINKS + 1];
62388+ const char *saved_names[MAX_NESTED_LINKS + 1];
62389
62390 /* Intent data */
62391 union {
62392@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
62393 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
62394 extern void unlock_rename(struct dentry *, struct dentry *);
62395
62396-static inline void nd_set_link(struct nameidata *nd, char *path)
62397+static inline void nd_set_link(struct nameidata *nd, const char *path)
62398 {
62399 nd->saved_names[nd->depth] = path;
62400 }
62401
62402-static inline char *nd_get_link(struct nameidata *nd)
62403+static inline const char *nd_get_link(const struct nameidata *nd)
62404 {
62405 return nd->saved_names[nd->depth];
62406 }
62407diff -urNp linux-2.6.32.46/include/linux/netdevice.h linux-2.6.32.46/include/linux/netdevice.h
62408--- linux-2.6.32.46/include/linux/netdevice.h 2011-08-09 18:35:30.000000000 -0400
62409+++ linux-2.6.32.46/include/linux/netdevice.h 2011-08-23 21:22:38.000000000 -0400
62410@@ -637,6 +637,7 @@ struct net_device_ops {
62411 u16 xid);
62412 #endif
62413 };
62414+typedef struct net_device_ops __no_const net_device_ops_no_const;
62415
62416 /*
62417 * The DEVICE structure.
62418diff -urNp linux-2.6.32.46/include/linux/netfilter/xt_gradm.h linux-2.6.32.46/include/linux/netfilter/xt_gradm.h
62419--- linux-2.6.32.46/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
62420+++ linux-2.6.32.46/include/linux/netfilter/xt_gradm.h 2011-04-17 15:56:46.000000000 -0400
62421@@ -0,0 +1,9 @@
62422+#ifndef _LINUX_NETFILTER_XT_GRADM_H
62423+#define _LINUX_NETFILTER_XT_GRADM_H 1
62424+
62425+struct xt_gradm_mtinfo {
62426+ __u16 flags;
62427+ __u16 invflags;
62428+};
62429+
62430+#endif
62431diff -urNp linux-2.6.32.46/include/linux/nodemask.h linux-2.6.32.46/include/linux/nodemask.h
62432--- linux-2.6.32.46/include/linux/nodemask.h 2011-03-27 14:31:47.000000000 -0400
62433+++ linux-2.6.32.46/include/linux/nodemask.h 2011-04-17 15:56:46.000000000 -0400
62434@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
62435
62436 #define any_online_node(mask) \
62437 ({ \
62438- int node; \
62439- for_each_node_mask(node, (mask)) \
62440- if (node_online(node)) \
62441+ int __node; \
62442+ for_each_node_mask(__node, (mask)) \
62443+ if (node_online(__node)) \
62444 break; \
62445- node; \
62446+ __node; \
62447 })
62448
62449 #define num_online_nodes() num_node_state(N_ONLINE)
62450diff -urNp linux-2.6.32.46/include/linux/oprofile.h linux-2.6.32.46/include/linux/oprofile.h
62451--- linux-2.6.32.46/include/linux/oprofile.h 2011-03-27 14:31:47.000000000 -0400
62452+++ linux-2.6.32.46/include/linux/oprofile.h 2011-04-17 15:56:46.000000000 -0400
62453@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
62454 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
62455 char const * name, ulong * val);
62456
62457-/** Create a file for read-only access to an atomic_t. */
62458+/** Create a file for read-only access to an atomic_unchecked_t. */
62459 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
62460- char const * name, atomic_t * val);
62461+ char const * name, atomic_unchecked_t * val);
62462
62463 /** create a directory */
62464 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
62465diff -urNp linux-2.6.32.46/include/linux/pagemap.h linux-2.6.32.46/include/linux/pagemap.h
62466--- linux-2.6.32.46/include/linux/pagemap.h 2011-03-27 14:31:47.000000000 -0400
62467+++ linux-2.6.32.46/include/linux/pagemap.h 2011-08-17 19:36:28.000000000 -0400
62468@@ -425,6 +425,7 @@ static inline int fault_in_pages_readabl
62469 if (((unsigned long)uaddr & PAGE_MASK) !=
62470 ((unsigned long)end & PAGE_MASK))
62471 ret = __get_user(c, end);
62472+ (void)c;
62473 }
62474 return ret;
62475 }
62476diff -urNp linux-2.6.32.46/include/linux/perf_event.h linux-2.6.32.46/include/linux/perf_event.h
62477--- linux-2.6.32.46/include/linux/perf_event.h 2011-03-27 14:31:47.000000000 -0400
62478+++ linux-2.6.32.46/include/linux/perf_event.h 2011-05-04 17:56:28.000000000 -0400
62479@@ -476,7 +476,7 @@ struct hw_perf_event {
62480 struct hrtimer hrtimer;
62481 };
62482 };
62483- atomic64_t prev_count;
62484+ atomic64_unchecked_t prev_count;
62485 u64 sample_period;
62486 u64 last_period;
62487 atomic64_t period_left;
62488@@ -557,7 +557,7 @@ struct perf_event {
62489 const struct pmu *pmu;
62490
62491 enum perf_event_active_state state;
62492- atomic64_t count;
62493+ atomic64_unchecked_t count;
62494
62495 /*
62496 * These are the total time in nanoseconds that the event
62497@@ -595,8 +595,8 @@ struct perf_event {
62498 * These accumulate total time (in nanoseconds) that children
62499 * events have been enabled and running, respectively.
62500 */
62501- atomic64_t child_total_time_enabled;
62502- atomic64_t child_total_time_running;
62503+ atomic64_unchecked_t child_total_time_enabled;
62504+ atomic64_unchecked_t child_total_time_running;
62505
62506 /*
62507 * Protect attach/detach and child_list:
62508diff -urNp linux-2.6.32.46/include/linux/pipe_fs_i.h linux-2.6.32.46/include/linux/pipe_fs_i.h
62509--- linux-2.6.32.46/include/linux/pipe_fs_i.h 2011-03-27 14:31:47.000000000 -0400
62510+++ linux-2.6.32.46/include/linux/pipe_fs_i.h 2011-04-17 15:56:46.000000000 -0400
62511@@ -46,9 +46,9 @@ struct pipe_inode_info {
62512 wait_queue_head_t wait;
62513 unsigned int nrbufs, curbuf;
62514 struct page *tmp_page;
62515- unsigned int readers;
62516- unsigned int writers;
62517- unsigned int waiting_writers;
62518+ atomic_t readers;
62519+ atomic_t writers;
62520+ atomic_t waiting_writers;
62521 unsigned int r_counter;
62522 unsigned int w_counter;
62523 struct fasync_struct *fasync_readers;
62524diff -urNp linux-2.6.32.46/include/linux/poison.h linux-2.6.32.46/include/linux/poison.h
62525--- linux-2.6.32.46/include/linux/poison.h 2011-03-27 14:31:47.000000000 -0400
62526+++ linux-2.6.32.46/include/linux/poison.h 2011-04-17 15:56:46.000000000 -0400
62527@@ -19,8 +19,8 @@
62528 * under normal circumstances, used to verify that nobody uses
62529 * non-initialized list entries.
62530 */
62531-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
62532-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
62533+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
62534+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
62535
62536 /********** include/linux/timer.h **********/
62537 /*
62538diff -urNp linux-2.6.32.46/include/linux/posix-timers.h linux-2.6.32.46/include/linux/posix-timers.h
62539--- linux-2.6.32.46/include/linux/posix-timers.h 2011-03-27 14:31:47.000000000 -0400
62540+++ linux-2.6.32.46/include/linux/posix-timers.h 2011-08-05 20:33:55.000000000 -0400
62541@@ -67,7 +67,7 @@ struct k_itimer {
62542 };
62543
62544 struct k_clock {
62545- int res; /* in nanoseconds */
62546+ const int res; /* in nanoseconds */
62547 int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
62548 int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
62549 int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
62550diff -urNp linux-2.6.32.46/include/linux/preempt.h linux-2.6.32.46/include/linux/preempt.h
62551--- linux-2.6.32.46/include/linux/preempt.h 2011-03-27 14:31:47.000000000 -0400
62552+++ linux-2.6.32.46/include/linux/preempt.h 2011-08-05 20:33:55.000000000 -0400
62553@@ -110,7 +110,7 @@ struct preempt_ops {
62554 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
62555 void (*sched_out)(struct preempt_notifier *notifier,
62556 struct task_struct *next);
62557-};
62558+} __no_const;
62559
62560 /**
62561 * preempt_notifier - key for installing preemption notifiers
62562diff -urNp linux-2.6.32.46/include/linux/proc_fs.h linux-2.6.32.46/include/linux/proc_fs.h
62563--- linux-2.6.32.46/include/linux/proc_fs.h 2011-03-27 14:31:47.000000000 -0400
62564+++ linux-2.6.32.46/include/linux/proc_fs.h 2011-08-05 20:33:55.000000000 -0400
62565@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
62566 return proc_create_data(name, mode, parent, proc_fops, NULL);
62567 }
62568
62569+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
62570+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
62571+{
62572+#ifdef CONFIG_GRKERNSEC_PROC_USER
62573+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
62574+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62575+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
62576+#else
62577+ return proc_create_data(name, mode, parent, proc_fops, NULL);
62578+#endif
62579+}
62580+
62581+
62582 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
62583 mode_t mode, struct proc_dir_entry *base,
62584 read_proc_t *read_proc, void * data)
62585@@ -256,7 +269,7 @@ union proc_op {
62586 int (*proc_show)(struct seq_file *m,
62587 struct pid_namespace *ns, struct pid *pid,
62588 struct task_struct *task);
62589-};
62590+} __no_const;
62591
62592 struct ctl_table_header;
62593 struct ctl_table;
62594diff -urNp linux-2.6.32.46/include/linux/ptrace.h linux-2.6.32.46/include/linux/ptrace.h
62595--- linux-2.6.32.46/include/linux/ptrace.h 2011-03-27 14:31:47.000000000 -0400
62596+++ linux-2.6.32.46/include/linux/ptrace.h 2011-04-17 15:56:46.000000000 -0400
62597@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_
62598 extern void exit_ptrace(struct task_struct *tracer);
62599 #define PTRACE_MODE_READ 1
62600 #define PTRACE_MODE_ATTACH 2
62601-/* Returns 0 on success, -errno on denial. */
62602-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
62603 /* Returns true on success, false on denial. */
62604 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
62605+/* Returns true on success, false on denial. */
62606+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
62607
62608 static inline int ptrace_reparented(struct task_struct *child)
62609 {
62610diff -urNp linux-2.6.32.46/include/linux/random.h linux-2.6.32.46/include/linux/random.h
62611--- linux-2.6.32.46/include/linux/random.h 2011-08-16 20:37:25.000000000 -0400
62612+++ linux-2.6.32.46/include/linux/random.h 2011-08-07 19:48:09.000000000 -0400
62613@@ -63,6 +63,11 @@ unsigned long randomize_range(unsigned l
62614 u32 random32(void);
62615 void srandom32(u32 seed);
62616
62617+static inline unsigned long pax_get_random_long(void)
62618+{
62619+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
62620+}
62621+
62622 #endif /* __KERNEL___ */
62623
62624 #endif /* _LINUX_RANDOM_H */
62625diff -urNp linux-2.6.32.46/include/linux/reboot.h linux-2.6.32.46/include/linux/reboot.h
62626--- linux-2.6.32.46/include/linux/reboot.h 2011-03-27 14:31:47.000000000 -0400
62627+++ linux-2.6.32.46/include/linux/reboot.h 2011-05-22 23:02:06.000000000 -0400
62628@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
62629 * Architecture-specific implementations of sys_reboot commands.
62630 */
62631
62632-extern void machine_restart(char *cmd);
62633-extern void machine_halt(void);
62634-extern void machine_power_off(void);
62635+extern void machine_restart(char *cmd) __noreturn;
62636+extern void machine_halt(void) __noreturn;
62637+extern void machine_power_off(void) __noreturn;
62638
62639 extern void machine_shutdown(void);
62640 struct pt_regs;
62641@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
62642 */
62643
62644 extern void kernel_restart_prepare(char *cmd);
62645-extern void kernel_restart(char *cmd);
62646-extern void kernel_halt(void);
62647-extern void kernel_power_off(void);
62648+extern void kernel_restart(char *cmd) __noreturn;
62649+extern void kernel_halt(void) __noreturn;
62650+extern void kernel_power_off(void) __noreturn;
62651
62652 void ctrl_alt_del(void);
62653
62654@@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
62655 * Emergency restart, callable from an interrupt handler.
62656 */
62657
62658-extern void emergency_restart(void);
62659+extern void emergency_restart(void) __noreturn;
62660 #include <asm/emergency-restart.h>
62661
62662 #endif
62663diff -urNp linux-2.6.32.46/include/linux/reiserfs_fs.h linux-2.6.32.46/include/linux/reiserfs_fs.h
62664--- linux-2.6.32.46/include/linux/reiserfs_fs.h 2011-03-27 14:31:47.000000000 -0400
62665+++ linux-2.6.32.46/include/linux/reiserfs_fs.h 2011-04-17 15:56:46.000000000 -0400
62666@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
62667 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
62668
62669 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
62670-#define get_generation(s) atomic_read (&fs_generation(s))
62671+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
62672 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
62673 #define __fs_changed(gen,s) (gen != get_generation (s))
62674 #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
62675@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
62676 */
62677
62678 struct item_operations {
62679- int (*bytes_number) (struct item_head * ih, int block_size);
62680- void (*decrement_key) (struct cpu_key *);
62681- int (*is_left_mergeable) (struct reiserfs_key * ih,
62682+ int (* const bytes_number) (struct item_head * ih, int block_size);
62683+ void (* const decrement_key) (struct cpu_key *);
62684+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
62685 unsigned long bsize);
62686- void (*print_item) (struct item_head *, char *item);
62687- void (*check_item) (struct item_head *, char *item);
62688+ void (* const print_item) (struct item_head *, char *item);
62689+ void (* const check_item) (struct item_head *, char *item);
62690
62691- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
62692+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
62693 int is_affected, int insert_size);
62694- int (*check_left) (struct virtual_item * vi, int free,
62695+ int (* const check_left) (struct virtual_item * vi, int free,
62696 int start_skip, int end_skip);
62697- int (*check_right) (struct virtual_item * vi, int free);
62698- int (*part_size) (struct virtual_item * vi, int from, int to);
62699- int (*unit_num) (struct virtual_item * vi);
62700- void (*print_vi) (struct virtual_item * vi);
62701+ int (* const check_right) (struct virtual_item * vi, int free);
62702+ int (* const part_size) (struct virtual_item * vi, int from, int to);
62703+ int (* const unit_num) (struct virtual_item * vi);
62704+ void (* const print_vi) (struct virtual_item * vi);
62705 };
62706
62707-extern struct item_operations *item_ops[TYPE_ANY + 1];
62708+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
62709
62710 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
62711 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
62712diff -urNp linux-2.6.32.46/include/linux/reiserfs_fs_sb.h linux-2.6.32.46/include/linux/reiserfs_fs_sb.h
62713--- linux-2.6.32.46/include/linux/reiserfs_fs_sb.h 2011-03-27 14:31:47.000000000 -0400
62714+++ linux-2.6.32.46/include/linux/reiserfs_fs_sb.h 2011-04-17 15:56:46.000000000 -0400
62715@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
62716 /* Comment? -Hans */
62717 wait_queue_head_t s_wait;
62718 /* To be obsoleted soon by per buffer seals.. -Hans */
62719- atomic_t s_generation_counter; // increased by one every time the
62720+ atomic_unchecked_t s_generation_counter; // increased by one every time the
62721 // tree gets re-balanced
62722 unsigned long s_properties; /* File system properties. Currently holds
62723 on-disk FS format */
62724diff -urNp linux-2.6.32.46/include/linux/relay.h linux-2.6.32.46/include/linux/relay.h
62725--- linux-2.6.32.46/include/linux/relay.h 2011-03-27 14:31:47.000000000 -0400
62726+++ linux-2.6.32.46/include/linux/relay.h 2011-08-05 20:33:55.000000000 -0400
62727@@ -159,7 +159,7 @@ struct rchan_callbacks
62728 * The callback should return 0 if successful, negative if not.
62729 */
62730 int (*remove_buf_file)(struct dentry *dentry);
62731-};
62732+} __no_const;
62733
62734 /*
62735 * CONFIG_RELAY kernel API, kernel/relay.c
62736diff -urNp linux-2.6.32.46/include/linux/rfkill.h linux-2.6.32.46/include/linux/rfkill.h
62737--- linux-2.6.32.46/include/linux/rfkill.h 2011-03-27 14:31:47.000000000 -0400
62738+++ linux-2.6.32.46/include/linux/rfkill.h 2011-08-23 21:22:38.000000000 -0400
62739@@ -144,6 +144,7 @@ struct rfkill_ops {
62740 void (*query)(struct rfkill *rfkill, void *data);
62741 int (*set_block)(void *data, bool blocked);
62742 };
62743+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
62744
62745 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
62746 /**
62747diff -urNp linux-2.6.32.46/include/linux/sched.h linux-2.6.32.46/include/linux/sched.h
62748--- linux-2.6.32.46/include/linux/sched.h 2011-03-27 14:31:47.000000000 -0400
62749+++ linux-2.6.32.46/include/linux/sched.h 2011-08-11 19:48:55.000000000 -0400
62750@@ -101,6 +101,7 @@ struct bio;
62751 struct fs_struct;
62752 struct bts_context;
62753 struct perf_event_context;
62754+struct linux_binprm;
62755
62756 /*
62757 * List of flags we want to share for kernel threads,
62758@@ -350,7 +351,7 @@ extern signed long schedule_timeout_kill
62759 extern signed long schedule_timeout_uninterruptible(signed long timeout);
62760 asmlinkage void __schedule(void);
62761 asmlinkage void schedule(void);
62762-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
62763+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
62764
62765 struct nsproxy;
62766 struct user_namespace;
62767@@ -371,9 +372,12 @@ struct user_namespace;
62768 #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
62769
62770 extern int sysctl_max_map_count;
62771+extern unsigned long sysctl_heap_stack_gap;
62772
62773 #include <linux/aio.h>
62774
62775+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
62776+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
62777 extern unsigned long
62778 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
62779 unsigned long, unsigned long);
62780@@ -666,6 +670,16 @@ struct signal_struct {
62781 struct tty_audit_buf *tty_audit_buf;
62782 #endif
62783
62784+#ifdef CONFIG_GRKERNSEC
62785+ u32 curr_ip;
62786+ u32 saved_ip;
62787+ u32 gr_saddr;
62788+ u32 gr_daddr;
62789+ u16 gr_sport;
62790+ u16 gr_dport;
62791+ u8 used_accept:1;
62792+#endif
62793+
62794 int oom_adj; /* OOM kill score adjustment (bit shift) */
62795 };
62796
62797@@ -723,6 +737,11 @@ struct user_struct {
62798 struct key *session_keyring; /* UID's default session keyring */
62799 #endif
62800
62801+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
62802+ unsigned int banned;
62803+ unsigned long ban_expires;
62804+#endif
62805+
62806 /* Hash table maintenance information */
62807 struct hlist_node uidhash_node;
62808 uid_t uid;
62809@@ -1328,8 +1347,8 @@ struct task_struct {
62810 struct list_head thread_group;
62811
62812 struct completion *vfork_done; /* for vfork() */
62813- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
62814- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62815+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
62816+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
62817
62818 cputime_t utime, stime, utimescaled, stimescaled;
62819 cputime_t gtime;
62820@@ -1343,16 +1362,6 @@ struct task_struct {
62821 struct task_cputime cputime_expires;
62822 struct list_head cpu_timers[3];
62823
62824-/* process credentials */
62825- const struct cred *real_cred; /* objective and real subjective task
62826- * credentials (COW) */
62827- const struct cred *cred; /* effective (overridable) subjective task
62828- * credentials (COW) */
62829- struct mutex cred_guard_mutex; /* guard against foreign influences on
62830- * credential calculations
62831- * (notably. ptrace) */
62832- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62833-
62834 char comm[TASK_COMM_LEN]; /* executable name excluding path
62835 - access with [gs]et_task_comm (which lock
62836 it with task_lock())
62837@@ -1369,6 +1378,10 @@ struct task_struct {
62838 #endif
62839 /* CPU-specific state of this task */
62840 struct thread_struct thread;
62841+/* thread_info moved to task_struct */
62842+#ifdef CONFIG_X86
62843+ struct thread_info tinfo;
62844+#endif
62845 /* filesystem information */
62846 struct fs_struct *fs;
62847 /* open file information */
62848@@ -1436,6 +1449,15 @@ struct task_struct {
62849 int hardirq_context;
62850 int softirq_context;
62851 #endif
62852+
62853+/* process credentials */
62854+ const struct cred *real_cred; /* objective and real subjective task
62855+ * credentials (COW) */
62856+ struct mutex cred_guard_mutex; /* guard against foreign influences on
62857+ * credential calculations
62858+ * (notably. ptrace) */
62859+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
62860+
62861 #ifdef CONFIG_LOCKDEP
62862 # define MAX_LOCK_DEPTH 48UL
62863 u64 curr_chain_key;
62864@@ -1456,6 +1478,9 @@ struct task_struct {
62865
62866 struct backing_dev_info *backing_dev_info;
62867
62868+ const struct cred *cred; /* effective (overridable) subjective task
62869+ * credentials (COW) */
62870+
62871 struct io_context *io_context;
62872
62873 unsigned long ptrace_message;
62874@@ -1519,6 +1544,21 @@ struct task_struct {
62875 unsigned long default_timer_slack_ns;
62876
62877 struct list_head *scm_work_list;
62878+
62879+#ifdef CONFIG_GRKERNSEC
62880+ /* grsecurity */
62881+ struct dentry *gr_chroot_dentry;
62882+ struct acl_subject_label *acl;
62883+ struct acl_role_label *role;
62884+ struct file *exec_file;
62885+ u16 acl_role_id;
62886+ /* is this the task that authenticated to the special role */
62887+ u8 acl_sp_role;
62888+ u8 is_writable;
62889+ u8 brute;
62890+ u8 gr_is_chrooted;
62891+#endif
62892+
62893 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
62894 /* Index of current stored adress in ret_stack */
62895 int curr_ret_stack;
62896@@ -1542,6 +1582,57 @@ struct task_struct {
62897 #endif /* CONFIG_TRACING */
62898 };
62899
62900+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
62901+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
62902+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
62903+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
62904+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
62905+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
62906+
62907+#ifdef CONFIG_PAX_SOFTMODE
62908+extern int pax_softmode;
62909+#endif
62910+
62911+extern int pax_check_flags(unsigned long *);
62912+
62913+/* if tsk != current then task_lock must be held on it */
62914+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
62915+static inline unsigned long pax_get_flags(struct task_struct *tsk)
62916+{
62917+ if (likely(tsk->mm))
62918+ return tsk->mm->pax_flags;
62919+ else
62920+ return 0UL;
62921+}
62922+
62923+/* if tsk != current then task_lock must be held on it */
62924+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
62925+{
62926+ if (likely(tsk->mm)) {
62927+ tsk->mm->pax_flags = flags;
62928+ return 0;
62929+ }
62930+ return -EINVAL;
62931+}
62932+#endif
62933+
62934+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
62935+extern void pax_set_initial_flags(struct linux_binprm *bprm);
62936+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
62937+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
62938+#endif
62939+
62940+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
62941+extern void pax_report_insns(void *pc, void *sp);
62942+extern void pax_report_refcount_overflow(struct pt_regs *regs);
62943+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
62944+
62945+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
62946+extern void pax_track_stack(void);
62947+#else
62948+static inline void pax_track_stack(void) {}
62949+#endif
62950+
62951 /* Future-safe accessor for struct task_struct's cpus_allowed. */
62952 #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
62953
62954@@ -1740,7 +1831,7 @@ extern void thread_group_times(struct ta
62955 #define PF_DUMPCORE 0x00000200 /* dumped core */
62956 #define PF_SIGNALED 0x00000400 /* killed by a signal */
62957 #define PF_MEMALLOC 0x00000800 /* Allocating memory */
62958-#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
62959+#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
62960 #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
62961 #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
62962 #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
62963@@ -1978,7 +2069,9 @@ void yield(void);
62964 extern struct exec_domain default_exec_domain;
62965
62966 union thread_union {
62967+#ifndef CONFIG_X86
62968 struct thread_info thread_info;
62969+#endif
62970 unsigned long stack[THREAD_SIZE/sizeof(long)];
62971 };
62972
62973@@ -2011,6 +2104,7 @@ extern struct pid_namespace init_pid_ns;
62974 */
62975
62976 extern struct task_struct *find_task_by_vpid(pid_t nr);
62977+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
62978 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
62979 struct pid_namespace *ns);
62980
62981@@ -2155,7 +2249,7 @@ extern void __cleanup_sighand(struct sig
62982 extern void exit_itimers(struct signal_struct *);
62983 extern void flush_itimer_signals(void);
62984
62985-extern NORET_TYPE void do_group_exit(int);
62986+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
62987
62988 extern void daemonize(const char *, ...);
62989 extern int allow_signal(int);
62990@@ -2284,13 +2378,17 @@ static inline unsigned long *end_of_stac
62991
62992 #endif
62993
62994-static inline int object_is_on_stack(void *obj)
62995+static inline int object_starts_on_stack(void *obj)
62996 {
62997- void *stack = task_stack_page(current);
62998+ const void *stack = task_stack_page(current);
62999
63000 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
63001 }
63002
63003+#ifdef CONFIG_PAX_USERCOPY
63004+extern int object_is_on_stack(const void *obj, unsigned long len);
63005+#endif
63006+
63007 extern void thread_info_cache_init(void);
63008
63009 #ifdef CONFIG_DEBUG_STACK_USAGE
63010diff -urNp linux-2.6.32.46/include/linux/screen_info.h linux-2.6.32.46/include/linux/screen_info.h
63011--- linux-2.6.32.46/include/linux/screen_info.h 2011-03-27 14:31:47.000000000 -0400
63012+++ linux-2.6.32.46/include/linux/screen_info.h 2011-04-17 15:56:46.000000000 -0400
63013@@ -42,7 +42,8 @@ struct screen_info {
63014 __u16 pages; /* 0x32 */
63015 __u16 vesa_attributes; /* 0x34 */
63016 __u32 capabilities; /* 0x36 */
63017- __u8 _reserved[6]; /* 0x3a */
63018+ __u16 vesapm_size; /* 0x3a */
63019+ __u8 _reserved[4]; /* 0x3c */
63020 } __attribute__((packed));
63021
63022 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
63023diff -urNp linux-2.6.32.46/include/linux/security.h linux-2.6.32.46/include/linux/security.h
63024--- linux-2.6.32.46/include/linux/security.h 2011-03-27 14:31:47.000000000 -0400
63025+++ linux-2.6.32.46/include/linux/security.h 2011-04-17 15:56:46.000000000 -0400
63026@@ -34,6 +34,7 @@
63027 #include <linux/key.h>
63028 #include <linux/xfrm.h>
63029 #include <linux/gfp.h>
63030+#include <linux/grsecurity.h>
63031 #include <net/flow.h>
63032
63033 /* Maximum number of letters for an LSM name string */
63034diff -urNp linux-2.6.32.46/include/linux/seq_file.h linux-2.6.32.46/include/linux/seq_file.h
63035--- linux-2.6.32.46/include/linux/seq_file.h 2011-03-27 14:31:47.000000000 -0400
63036+++ linux-2.6.32.46/include/linux/seq_file.h 2011-08-23 21:22:38.000000000 -0400
63037@@ -32,6 +32,7 @@ struct seq_operations {
63038 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
63039 int (*show) (struct seq_file *m, void *v);
63040 };
63041+typedef struct seq_operations __no_const seq_operations_no_const;
63042
63043 #define SEQ_SKIP 1
63044
63045diff -urNp linux-2.6.32.46/include/linux/shm.h linux-2.6.32.46/include/linux/shm.h
63046--- linux-2.6.32.46/include/linux/shm.h 2011-03-27 14:31:47.000000000 -0400
63047+++ linux-2.6.32.46/include/linux/shm.h 2011-04-17 15:56:46.000000000 -0400
63048@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
63049 pid_t shm_cprid;
63050 pid_t shm_lprid;
63051 struct user_struct *mlock_user;
63052+#ifdef CONFIG_GRKERNSEC
63053+ time_t shm_createtime;
63054+ pid_t shm_lapid;
63055+#endif
63056 };
63057
63058 /* shm_mode upper byte flags */
63059diff -urNp linux-2.6.32.46/include/linux/skbuff.h linux-2.6.32.46/include/linux/skbuff.h
63060--- linux-2.6.32.46/include/linux/skbuff.h 2011-03-27 14:31:47.000000000 -0400
63061+++ linux-2.6.32.46/include/linux/skbuff.h 2011-08-21 15:27:56.000000000 -0400
63062@@ -14,6 +14,7 @@
63063 #ifndef _LINUX_SKBUFF_H
63064 #define _LINUX_SKBUFF_H
63065
63066+#include <linux/const.h>
63067 #include <linux/kernel.h>
63068 #include <linux/kmemcheck.h>
63069 #include <linux/compiler.h>
63070@@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_t
63071 */
63072 static inline int skb_queue_empty(const struct sk_buff_head *list)
63073 {
63074- return list->next == (struct sk_buff *)list;
63075+ return list->next == (const struct sk_buff *)list;
63076 }
63077
63078 /**
63079@@ -557,7 +558,7 @@ static inline int skb_queue_empty(const
63080 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63081 const struct sk_buff *skb)
63082 {
63083- return (skb->next == (struct sk_buff *) list);
63084+ return (skb->next == (const struct sk_buff *) list);
63085 }
63086
63087 /**
63088@@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(con
63089 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
63090 const struct sk_buff *skb)
63091 {
63092- return (skb->prev == (struct sk_buff *) list);
63093+ return (skb->prev == (const struct sk_buff *) list);
63094 }
63095
63096 /**
63097@@ -1367,7 +1368,7 @@ static inline int skb_network_offset(con
63098 * headroom, you should not reduce this.
63099 */
63100 #ifndef NET_SKB_PAD
63101-#define NET_SKB_PAD 32
63102+#define NET_SKB_PAD (_AC(32,UL))
63103 #endif
63104
63105 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
63106diff -urNp linux-2.6.32.46/include/linux/slab_def.h linux-2.6.32.46/include/linux/slab_def.h
63107--- linux-2.6.32.46/include/linux/slab_def.h 2011-03-27 14:31:47.000000000 -0400
63108+++ linux-2.6.32.46/include/linux/slab_def.h 2011-05-04 17:56:28.000000000 -0400
63109@@ -69,10 +69,10 @@ struct kmem_cache {
63110 unsigned long node_allocs;
63111 unsigned long node_frees;
63112 unsigned long node_overflow;
63113- atomic_t allochit;
63114- atomic_t allocmiss;
63115- atomic_t freehit;
63116- atomic_t freemiss;
63117+ atomic_unchecked_t allochit;
63118+ atomic_unchecked_t allocmiss;
63119+ atomic_unchecked_t freehit;
63120+ atomic_unchecked_t freemiss;
63121
63122 /*
63123 * If debugging is enabled, then the allocator can add additional
63124diff -urNp linux-2.6.32.46/include/linux/slab.h linux-2.6.32.46/include/linux/slab.h
63125--- linux-2.6.32.46/include/linux/slab.h 2011-03-27 14:31:47.000000000 -0400
63126+++ linux-2.6.32.46/include/linux/slab.h 2011-04-17 15:56:46.000000000 -0400
63127@@ -11,12 +11,20 @@
63128
63129 #include <linux/gfp.h>
63130 #include <linux/types.h>
63131+#include <linux/err.h>
63132
63133 /*
63134 * Flags to pass to kmem_cache_create().
63135 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
63136 */
63137 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
63138+
63139+#ifdef CONFIG_PAX_USERCOPY
63140+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
63141+#else
63142+#define SLAB_USERCOPY 0x00000000UL
63143+#endif
63144+
63145 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
63146 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
63147 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
63148@@ -82,10 +90,13 @@
63149 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
63150 * Both make kfree a no-op.
63151 */
63152-#define ZERO_SIZE_PTR ((void *)16)
63153+#define ZERO_SIZE_PTR \
63154+({ \
63155+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
63156+ (void *)(-MAX_ERRNO-1L); \
63157+})
63158
63159-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
63160- (unsigned long)ZERO_SIZE_PTR)
63161+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
63162
63163 /*
63164 * struct kmem_cache related prototypes
63165@@ -138,6 +149,7 @@ void * __must_check krealloc(const void
63166 void kfree(const void *);
63167 void kzfree(const void *);
63168 size_t ksize(const void *);
63169+void check_object_size(const void *ptr, unsigned long n, bool to);
63170
63171 /*
63172 * Allocator specific definitions. These are mainly used to establish optimized
63173@@ -328,4 +340,37 @@ static inline void *kzalloc_node(size_t
63174
63175 void __init kmem_cache_init_late(void);
63176
63177+#define kmalloc(x, y) \
63178+({ \
63179+ void *___retval; \
63180+ intoverflow_t ___x = (intoverflow_t)x; \
63181+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
63182+ ___retval = NULL; \
63183+ else \
63184+ ___retval = kmalloc((size_t)___x, (y)); \
63185+ ___retval; \
63186+})
63187+
63188+#define kmalloc_node(x, y, z) \
63189+({ \
63190+ void *___retval; \
63191+ intoverflow_t ___x = (intoverflow_t)x; \
63192+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
63193+ ___retval = NULL; \
63194+ else \
63195+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
63196+ ___retval; \
63197+})
63198+
63199+#define kzalloc(x, y) \
63200+({ \
63201+ void *___retval; \
63202+ intoverflow_t ___x = (intoverflow_t)x; \
63203+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
63204+ ___retval = NULL; \
63205+ else \
63206+ ___retval = kzalloc((size_t)___x, (y)); \
63207+ ___retval; \
63208+})
63209+
63210 #endif /* _LINUX_SLAB_H */
63211diff -urNp linux-2.6.32.46/include/linux/slub_def.h linux-2.6.32.46/include/linux/slub_def.h
63212--- linux-2.6.32.46/include/linux/slub_def.h 2011-03-27 14:31:47.000000000 -0400
63213+++ linux-2.6.32.46/include/linux/slub_def.h 2011-08-05 20:33:55.000000000 -0400
63214@@ -86,7 +86,7 @@ struct kmem_cache {
63215 struct kmem_cache_order_objects max;
63216 struct kmem_cache_order_objects min;
63217 gfp_t allocflags; /* gfp flags to use on each alloc */
63218- int refcount; /* Refcount for slab cache destroy */
63219+ atomic_t refcount; /* Refcount for slab cache destroy */
63220 void (*ctor)(void *);
63221 int inuse; /* Offset to metadata */
63222 int align; /* Alignment */
63223@@ -215,7 +215,7 @@ static __always_inline struct kmem_cache
63224 #endif
63225
63226 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
63227-void *__kmalloc(size_t size, gfp_t flags);
63228+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
63229
63230 #ifdef CONFIG_KMEMTRACE
63231 extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
63232diff -urNp linux-2.6.32.46/include/linux/sonet.h linux-2.6.32.46/include/linux/sonet.h
63233--- linux-2.6.32.46/include/linux/sonet.h 2011-03-27 14:31:47.000000000 -0400
63234+++ linux-2.6.32.46/include/linux/sonet.h 2011-04-17 15:56:46.000000000 -0400
63235@@ -61,7 +61,7 @@ struct sonet_stats {
63236 #include <asm/atomic.h>
63237
63238 struct k_sonet_stats {
63239-#define __HANDLE_ITEM(i) atomic_t i
63240+#define __HANDLE_ITEM(i) atomic_unchecked_t i
63241 __SONET_ITEMS
63242 #undef __HANDLE_ITEM
63243 };
63244diff -urNp linux-2.6.32.46/include/linux/sunrpc/cache.h linux-2.6.32.46/include/linux/sunrpc/cache.h
63245--- linux-2.6.32.46/include/linux/sunrpc/cache.h 2011-03-27 14:31:47.000000000 -0400
63246+++ linux-2.6.32.46/include/linux/sunrpc/cache.h 2011-08-05 20:33:55.000000000 -0400
63247@@ -125,7 +125,7 @@ struct cache_detail {
63248 */
63249 struct cache_req {
63250 struct cache_deferred_req *(*defer)(struct cache_req *req);
63251-};
63252+} __no_const;
63253 /* this must be embedded in a deferred_request that is being
63254 * delayed awaiting cache-fill
63255 */
63256diff -urNp linux-2.6.32.46/include/linux/sunrpc/clnt.h linux-2.6.32.46/include/linux/sunrpc/clnt.h
63257--- linux-2.6.32.46/include/linux/sunrpc/clnt.h 2011-03-27 14:31:47.000000000 -0400
63258+++ linux-2.6.32.46/include/linux/sunrpc/clnt.h 2011-04-17 15:56:46.000000000 -0400
63259@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_por
63260 {
63261 switch (sap->sa_family) {
63262 case AF_INET:
63263- return ntohs(((struct sockaddr_in *)sap)->sin_port);
63264+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
63265 case AF_INET6:
63266- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
63267+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
63268 }
63269 return 0;
63270 }
63271@@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const
63272 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
63273 const struct sockaddr *src)
63274 {
63275- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
63276+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
63277 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
63278
63279 dsin->sin_family = ssin->sin_family;
63280@@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const
63281 if (sa->sa_family != AF_INET6)
63282 return 0;
63283
63284- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
63285+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
63286 }
63287
63288 #endif /* __KERNEL__ */
63289diff -urNp linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h
63290--- linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h 2011-03-27 14:31:47.000000000 -0400
63291+++ linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h 2011-05-04 17:56:28.000000000 -0400
63292@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
63293 extern unsigned int svcrdma_max_requests;
63294 extern unsigned int svcrdma_max_req_size;
63295
63296-extern atomic_t rdma_stat_recv;
63297-extern atomic_t rdma_stat_read;
63298-extern atomic_t rdma_stat_write;
63299-extern atomic_t rdma_stat_sq_starve;
63300-extern atomic_t rdma_stat_rq_starve;
63301-extern atomic_t rdma_stat_rq_poll;
63302-extern atomic_t rdma_stat_rq_prod;
63303-extern atomic_t rdma_stat_sq_poll;
63304-extern atomic_t rdma_stat_sq_prod;
63305+extern atomic_unchecked_t rdma_stat_recv;
63306+extern atomic_unchecked_t rdma_stat_read;
63307+extern atomic_unchecked_t rdma_stat_write;
63308+extern atomic_unchecked_t rdma_stat_sq_starve;
63309+extern atomic_unchecked_t rdma_stat_rq_starve;
63310+extern atomic_unchecked_t rdma_stat_rq_poll;
63311+extern atomic_unchecked_t rdma_stat_rq_prod;
63312+extern atomic_unchecked_t rdma_stat_sq_poll;
63313+extern atomic_unchecked_t rdma_stat_sq_prod;
63314
63315 #define RPCRDMA_VERSION 1
63316
63317diff -urNp linux-2.6.32.46/include/linux/suspend.h linux-2.6.32.46/include/linux/suspend.h
63318--- linux-2.6.32.46/include/linux/suspend.h 2011-03-27 14:31:47.000000000 -0400
63319+++ linux-2.6.32.46/include/linux/suspend.h 2011-04-17 15:56:46.000000000 -0400
63320@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
63321 * which require special recovery actions in that situation.
63322 */
63323 struct platform_suspend_ops {
63324- int (*valid)(suspend_state_t state);
63325- int (*begin)(suspend_state_t state);
63326- int (*prepare)(void);
63327- int (*prepare_late)(void);
63328- int (*enter)(suspend_state_t state);
63329- void (*wake)(void);
63330- void (*finish)(void);
63331- void (*end)(void);
63332- void (*recover)(void);
63333+ int (* const valid)(suspend_state_t state);
63334+ int (* const begin)(suspend_state_t state);
63335+ int (* const prepare)(void);
63336+ int (* const prepare_late)(void);
63337+ int (* const enter)(suspend_state_t state);
63338+ void (* const wake)(void);
63339+ void (* const finish)(void);
63340+ void (* const end)(void);
63341+ void (* const recover)(void);
63342 };
63343
63344 #ifdef CONFIG_SUSPEND
63345@@ -120,7 +120,7 @@ struct platform_suspend_ops {
63346 * suspend_set_ops - set platform dependent suspend operations
63347 * @ops: The new suspend operations to set.
63348 */
63349-extern void suspend_set_ops(struct platform_suspend_ops *ops);
63350+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
63351 extern int suspend_valid_only_mem(suspend_state_t state);
63352
63353 /**
63354@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
63355 #else /* !CONFIG_SUSPEND */
63356 #define suspend_valid_only_mem NULL
63357
63358-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
63359+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
63360 static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
63361 #endif /* !CONFIG_SUSPEND */
63362
63363@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone
63364 * platforms which require special recovery actions in that situation.
63365 */
63366 struct platform_hibernation_ops {
63367- int (*begin)(void);
63368- void (*end)(void);
63369- int (*pre_snapshot)(void);
63370- void (*finish)(void);
63371- int (*prepare)(void);
63372- int (*enter)(void);
63373- void (*leave)(void);
63374- int (*pre_restore)(void);
63375- void (*restore_cleanup)(void);
63376- void (*recover)(void);
63377+ int (* const begin)(void);
63378+ void (* const end)(void);
63379+ int (* const pre_snapshot)(void);
63380+ void (* const finish)(void);
63381+ int (* const prepare)(void);
63382+ int (* const enter)(void);
63383+ void (* const leave)(void);
63384+ int (* const pre_restore)(void);
63385+ void (* const restore_cleanup)(void);
63386+ void (* const recover)(void);
63387 };
63388
63389 #ifdef CONFIG_HIBERNATION
63390@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct
63391 extern void swsusp_unset_page_free(struct page *);
63392 extern unsigned long get_safe_page(gfp_t gfp_mask);
63393
63394-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
63395+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
63396 extern int hibernate(void);
63397 extern bool system_entering_hibernation(void);
63398 #else /* CONFIG_HIBERNATION */
63399@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
63400 static inline void swsusp_set_page_free(struct page *p) {}
63401 static inline void swsusp_unset_page_free(struct page *p) {}
63402
63403-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
63404+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
63405 static inline int hibernate(void) { return -ENOSYS; }
63406 static inline bool system_entering_hibernation(void) { return false; }
63407 #endif /* CONFIG_HIBERNATION */
63408diff -urNp linux-2.6.32.46/include/linux/sysctl.h linux-2.6.32.46/include/linux/sysctl.h
63409--- linux-2.6.32.46/include/linux/sysctl.h 2011-03-27 14:31:47.000000000 -0400
63410+++ linux-2.6.32.46/include/linux/sysctl.h 2011-04-17 15:56:46.000000000 -0400
63411@@ -164,7 +164,11 @@ enum
63412 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
63413 };
63414
63415-
63416+#ifdef CONFIG_PAX_SOFTMODE
63417+enum {
63418+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
63419+};
63420+#endif
63421
63422 /* CTL_VM names: */
63423 enum
63424@@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_tab
63425
63426 extern int proc_dostring(struct ctl_table *, int,
63427 void __user *, size_t *, loff_t *);
63428+extern int proc_dostring_modpriv(struct ctl_table *, int,
63429+ void __user *, size_t *, loff_t *);
63430 extern int proc_dointvec(struct ctl_table *, int,
63431 void __user *, size_t *, loff_t *);
63432 extern int proc_dointvec_minmax(struct ctl_table *, int,
63433@@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name,
63434
63435 extern ctl_handler sysctl_data;
63436 extern ctl_handler sysctl_string;
63437+extern ctl_handler sysctl_string_modpriv;
63438 extern ctl_handler sysctl_intvec;
63439 extern ctl_handler sysctl_jiffies;
63440 extern ctl_handler sysctl_ms_jiffies;
63441diff -urNp linux-2.6.32.46/include/linux/sysfs.h linux-2.6.32.46/include/linux/sysfs.h
63442--- linux-2.6.32.46/include/linux/sysfs.h 2011-03-27 14:31:47.000000000 -0400
63443+++ linux-2.6.32.46/include/linux/sysfs.h 2011-04-17 15:56:46.000000000 -0400
63444@@ -75,8 +75,8 @@ struct bin_attribute {
63445 };
63446
63447 struct sysfs_ops {
63448- ssize_t (*show)(struct kobject *, struct attribute *,char *);
63449- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
63450+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
63451+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
63452 };
63453
63454 struct sysfs_dirent;
63455diff -urNp linux-2.6.32.46/include/linux/thread_info.h linux-2.6.32.46/include/linux/thread_info.h
63456--- linux-2.6.32.46/include/linux/thread_info.h 2011-03-27 14:31:47.000000000 -0400
63457+++ linux-2.6.32.46/include/linux/thread_info.h 2011-04-17 15:56:46.000000000 -0400
63458@@ -23,7 +23,7 @@ struct restart_block {
63459 };
63460 /* For futex_wait and futex_wait_requeue_pi */
63461 struct {
63462- u32 *uaddr;
63463+ u32 __user *uaddr;
63464 u32 val;
63465 u32 flags;
63466 u32 bitset;
63467diff -urNp linux-2.6.32.46/include/linux/tty.h linux-2.6.32.46/include/linux/tty.h
63468--- linux-2.6.32.46/include/linux/tty.h 2011-03-27 14:31:47.000000000 -0400
63469+++ linux-2.6.32.46/include/linux/tty.h 2011-08-05 20:33:55.000000000 -0400
63470@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
63471 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
63472 extern void tty_ldisc_enable(struct tty_struct *tty);
63473
63474-
63475 /* n_tty.c */
63476 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
63477
63478diff -urNp linux-2.6.32.46/include/linux/tty_ldisc.h linux-2.6.32.46/include/linux/tty_ldisc.h
63479--- linux-2.6.32.46/include/linux/tty_ldisc.h 2011-03-27 14:31:47.000000000 -0400
63480+++ linux-2.6.32.46/include/linux/tty_ldisc.h 2011-04-17 15:56:46.000000000 -0400
63481@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
63482
63483 struct module *owner;
63484
63485- int refcount;
63486+ atomic_t refcount;
63487 };
63488
63489 struct tty_ldisc {
63490diff -urNp linux-2.6.32.46/include/linux/types.h linux-2.6.32.46/include/linux/types.h
63491--- linux-2.6.32.46/include/linux/types.h 2011-03-27 14:31:47.000000000 -0400
63492+++ linux-2.6.32.46/include/linux/types.h 2011-04-17 15:56:46.000000000 -0400
63493@@ -191,10 +191,26 @@ typedef struct {
63494 volatile int counter;
63495 } atomic_t;
63496
63497+#ifdef CONFIG_PAX_REFCOUNT
63498+typedef struct {
63499+ volatile int counter;
63500+} atomic_unchecked_t;
63501+#else
63502+typedef atomic_t atomic_unchecked_t;
63503+#endif
63504+
63505 #ifdef CONFIG_64BIT
63506 typedef struct {
63507 volatile long counter;
63508 } atomic64_t;
63509+
63510+#ifdef CONFIG_PAX_REFCOUNT
63511+typedef struct {
63512+ volatile long counter;
63513+} atomic64_unchecked_t;
63514+#else
63515+typedef atomic64_t atomic64_unchecked_t;
63516+#endif
63517 #endif
63518
63519 struct ustat {
63520diff -urNp linux-2.6.32.46/include/linux/uaccess.h linux-2.6.32.46/include/linux/uaccess.h
63521--- linux-2.6.32.46/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400
63522+++ linux-2.6.32.46/include/linux/uaccess.h 2011-04-17 15:56:46.000000000 -0400
63523@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
63524 long ret; \
63525 mm_segment_t old_fs = get_fs(); \
63526 \
63527- set_fs(KERNEL_DS); \
63528 pagefault_disable(); \
63529+ set_fs(KERNEL_DS); \
63530 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
63531- pagefault_enable(); \
63532 set_fs(old_fs); \
63533+ pagefault_enable(); \
63534 ret; \
63535 })
63536
63537@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
63538 * Safely read from address @src to the buffer at @dst. If a kernel fault
63539 * happens, handle that and return -EFAULT.
63540 */
63541-extern long probe_kernel_read(void *dst, void *src, size_t size);
63542+extern long probe_kernel_read(void *dst, const void *src, size_t size);
63543
63544 /*
63545 * probe_kernel_write(): safely attempt to write to a location
63546@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
63547 * Safely write to address @dst from the buffer at @src. If a kernel fault
63548 * happens, handle that and return -EFAULT.
63549 */
63550-extern long probe_kernel_write(void *dst, void *src, size_t size);
63551+extern long probe_kernel_write(void *dst, const void *src, size_t size);
63552
63553 #endif /* __LINUX_UACCESS_H__ */
63554diff -urNp linux-2.6.32.46/include/linux/unaligned/access_ok.h linux-2.6.32.46/include/linux/unaligned/access_ok.h
63555--- linux-2.6.32.46/include/linux/unaligned/access_ok.h 2011-03-27 14:31:47.000000000 -0400
63556+++ linux-2.6.32.46/include/linux/unaligned/access_ok.h 2011-04-17 15:56:46.000000000 -0400
63557@@ -6,32 +6,32 @@
63558
63559 static inline u16 get_unaligned_le16(const void *p)
63560 {
63561- return le16_to_cpup((__le16 *)p);
63562+ return le16_to_cpup((const __le16 *)p);
63563 }
63564
63565 static inline u32 get_unaligned_le32(const void *p)
63566 {
63567- return le32_to_cpup((__le32 *)p);
63568+ return le32_to_cpup((const __le32 *)p);
63569 }
63570
63571 static inline u64 get_unaligned_le64(const void *p)
63572 {
63573- return le64_to_cpup((__le64 *)p);
63574+ return le64_to_cpup((const __le64 *)p);
63575 }
63576
63577 static inline u16 get_unaligned_be16(const void *p)
63578 {
63579- return be16_to_cpup((__be16 *)p);
63580+ return be16_to_cpup((const __be16 *)p);
63581 }
63582
63583 static inline u32 get_unaligned_be32(const void *p)
63584 {
63585- return be32_to_cpup((__be32 *)p);
63586+ return be32_to_cpup((const __be32 *)p);
63587 }
63588
63589 static inline u64 get_unaligned_be64(const void *p)
63590 {
63591- return be64_to_cpup((__be64 *)p);
63592+ return be64_to_cpup((const __be64 *)p);
63593 }
63594
63595 static inline void put_unaligned_le16(u16 val, void *p)
63596diff -urNp linux-2.6.32.46/include/linux/vmalloc.h linux-2.6.32.46/include/linux/vmalloc.h
63597--- linux-2.6.32.46/include/linux/vmalloc.h 2011-03-27 14:31:47.000000000 -0400
63598+++ linux-2.6.32.46/include/linux/vmalloc.h 2011-04-17 15:56:46.000000000 -0400
63599@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
63600 #define VM_MAP 0x00000004 /* vmap()ed pages */
63601 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
63602 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
63603+
63604+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
63605+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
63606+#endif
63607+
63608 /* bits [20..32] reserved for arch specific ioremap internals */
63609
63610 /*
63611@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
63612
63613 void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
63614
63615+#define vmalloc(x) \
63616+({ \
63617+ void *___retval; \
63618+ intoverflow_t ___x = (intoverflow_t)x; \
63619+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
63620+ ___retval = NULL; \
63621+ else \
63622+ ___retval = vmalloc((unsigned long)___x); \
63623+ ___retval; \
63624+})
63625+
63626+#define __vmalloc(x, y, z) \
63627+({ \
63628+ void *___retval; \
63629+ intoverflow_t ___x = (intoverflow_t)x; \
63630+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
63631+ ___retval = NULL; \
63632+ else \
63633+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
63634+ ___retval; \
63635+})
63636+
63637+#define vmalloc_user(x) \
63638+({ \
63639+ void *___retval; \
63640+ intoverflow_t ___x = (intoverflow_t)x; \
63641+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
63642+ ___retval = NULL; \
63643+ else \
63644+ ___retval = vmalloc_user((unsigned long)___x); \
63645+ ___retval; \
63646+})
63647+
63648+#define vmalloc_exec(x) \
63649+({ \
63650+ void *___retval; \
63651+ intoverflow_t ___x = (intoverflow_t)x; \
63652+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
63653+ ___retval = NULL; \
63654+ else \
63655+ ___retval = vmalloc_exec((unsigned long)___x); \
63656+ ___retval; \
63657+})
63658+
63659+#define vmalloc_node(x, y) \
63660+({ \
63661+ void *___retval; \
63662+ intoverflow_t ___x = (intoverflow_t)x; \
63663+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
63664+ ___retval = NULL; \
63665+ else \
63666+ ___retval = vmalloc_node((unsigned long)___x, (y));\
63667+ ___retval; \
63668+})
63669+
63670+#define vmalloc_32(x) \
63671+({ \
63672+ void *___retval; \
63673+ intoverflow_t ___x = (intoverflow_t)x; \
63674+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
63675+ ___retval = NULL; \
63676+ else \
63677+ ___retval = vmalloc_32((unsigned long)___x); \
63678+ ___retval; \
63679+})
63680+
63681+#define vmalloc_32_user(x) \
63682+({ \
63683+ void *___retval; \
63684+ intoverflow_t ___x = (intoverflow_t)x; \
63685+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
63686+ ___retval = NULL; \
63687+ else \
63688+ ___retval = vmalloc_32_user((unsigned long)___x);\
63689+ ___retval; \
63690+})
63691+
63692 #endif /* _LINUX_VMALLOC_H */
63693diff -urNp linux-2.6.32.46/include/linux/vmstat.h linux-2.6.32.46/include/linux/vmstat.h
63694--- linux-2.6.32.46/include/linux/vmstat.h 2011-03-27 14:31:47.000000000 -0400
63695+++ linux-2.6.32.46/include/linux/vmstat.h 2011-04-17 15:56:46.000000000 -0400
63696@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
63697 /*
63698 * Zone based page accounting with per cpu differentials.
63699 */
63700-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63701+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63702
63703 static inline void zone_page_state_add(long x, struct zone *zone,
63704 enum zone_stat_item item)
63705 {
63706- atomic_long_add(x, &zone->vm_stat[item]);
63707- atomic_long_add(x, &vm_stat[item]);
63708+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
63709+ atomic_long_add_unchecked(x, &vm_stat[item]);
63710 }
63711
63712 static inline unsigned long global_page_state(enum zone_stat_item item)
63713 {
63714- long x = atomic_long_read(&vm_stat[item]);
63715+ long x = atomic_long_read_unchecked(&vm_stat[item]);
63716 #ifdef CONFIG_SMP
63717 if (x < 0)
63718 x = 0;
63719@@ -158,7 +158,7 @@ static inline unsigned long global_page_
63720 static inline unsigned long zone_page_state(struct zone *zone,
63721 enum zone_stat_item item)
63722 {
63723- long x = atomic_long_read(&zone->vm_stat[item]);
63724+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63725 #ifdef CONFIG_SMP
63726 if (x < 0)
63727 x = 0;
63728@@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
63729 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
63730 enum zone_stat_item item)
63731 {
63732- long x = atomic_long_read(&zone->vm_stat[item]);
63733+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
63734
63735 #ifdef CONFIG_SMP
63736 int cpu;
63737@@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
63738
63739 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
63740 {
63741- atomic_long_inc(&zone->vm_stat[item]);
63742- atomic_long_inc(&vm_stat[item]);
63743+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
63744+ atomic_long_inc_unchecked(&vm_stat[item]);
63745 }
63746
63747 static inline void __inc_zone_page_state(struct page *page,
63748@@ -276,8 +276,8 @@ static inline void __inc_zone_page_state
63749
63750 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
63751 {
63752- atomic_long_dec(&zone->vm_stat[item]);
63753- atomic_long_dec(&vm_stat[item]);
63754+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
63755+ atomic_long_dec_unchecked(&vm_stat[item]);
63756 }
63757
63758 static inline void __dec_zone_page_state(struct page *page,
63759diff -urNp linux-2.6.32.46/include/media/saa7146_vv.h linux-2.6.32.46/include/media/saa7146_vv.h
63760--- linux-2.6.32.46/include/media/saa7146_vv.h 2011-03-27 14:31:47.000000000 -0400
63761+++ linux-2.6.32.46/include/media/saa7146_vv.h 2011-08-23 21:22:38.000000000 -0400
63762@@ -167,7 +167,7 @@ struct saa7146_ext_vv
63763 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
63764
63765 /* the extension can override this */
63766- struct v4l2_ioctl_ops ops;
63767+ v4l2_ioctl_ops_no_const ops;
63768 /* pointer to the saa7146 core ops */
63769 const struct v4l2_ioctl_ops *core_ops;
63770
63771diff -urNp linux-2.6.32.46/include/media/v4l2-dev.h linux-2.6.32.46/include/media/v4l2-dev.h
63772--- linux-2.6.32.46/include/media/v4l2-dev.h 2011-03-27 14:31:47.000000000 -0400
63773+++ linux-2.6.32.46/include/media/v4l2-dev.h 2011-08-05 20:33:55.000000000 -0400
63774@@ -34,7 +34,7 @@ struct v4l2_device;
63775 #define V4L2_FL_UNREGISTERED (0)
63776
63777 struct v4l2_file_operations {
63778- struct module *owner;
63779+ struct module * const owner;
63780 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
63781 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
63782 unsigned int (*poll) (struct file *, struct poll_table_struct *);
63783diff -urNp linux-2.6.32.46/include/media/v4l2-device.h linux-2.6.32.46/include/media/v4l2-device.h
63784--- linux-2.6.32.46/include/media/v4l2-device.h 2011-03-27 14:31:47.000000000 -0400
63785+++ linux-2.6.32.46/include/media/v4l2-device.h 2011-05-04 17:56:28.000000000 -0400
63786@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(st
63787 this function returns 0. If the name ends with a digit (e.g. cx18),
63788 then the name will be set to cx18-0 since cx180 looks really odd. */
63789 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
63790- atomic_t *instance);
63791+ atomic_unchecked_t *instance);
63792
63793 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
63794 Since the parent disappears this ensures that v4l2_dev doesn't have an
63795diff -urNp linux-2.6.32.46/include/media/v4l2-ioctl.h linux-2.6.32.46/include/media/v4l2-ioctl.h
63796--- linux-2.6.32.46/include/media/v4l2-ioctl.h 2011-03-27 14:31:47.000000000 -0400
63797+++ linux-2.6.32.46/include/media/v4l2-ioctl.h 2011-08-23 21:22:38.000000000 -0400
63798@@ -243,6 +243,7 @@ struct v4l2_ioctl_ops {
63799 long (*vidioc_default) (struct file *file, void *fh,
63800 int cmd, void *arg);
63801 };
63802+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
63803
63804
63805 /* v4l debugging and diagnostics */
63806diff -urNp linux-2.6.32.46/include/net/flow.h linux-2.6.32.46/include/net/flow.h
63807--- linux-2.6.32.46/include/net/flow.h 2011-03-27 14:31:47.000000000 -0400
63808+++ linux-2.6.32.46/include/net/flow.h 2011-05-04 17:56:28.000000000 -0400
63809@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net
63810 extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
63811 u8 dir, flow_resolve_t resolver);
63812 extern void flow_cache_flush(void);
63813-extern atomic_t flow_cache_genid;
63814+extern atomic_unchecked_t flow_cache_genid;
63815
63816 static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
63817 {
63818diff -urNp linux-2.6.32.46/include/net/inetpeer.h linux-2.6.32.46/include/net/inetpeer.h
63819--- linux-2.6.32.46/include/net/inetpeer.h 2011-03-27 14:31:47.000000000 -0400
63820+++ linux-2.6.32.46/include/net/inetpeer.h 2011-04-17 15:56:46.000000000 -0400
63821@@ -24,7 +24,7 @@ struct inet_peer
63822 __u32 dtime; /* the time of last use of not
63823 * referenced entries */
63824 atomic_t refcnt;
63825- atomic_t rid; /* Frag reception counter */
63826+ atomic_unchecked_t rid; /* Frag reception counter */
63827 __u32 tcp_ts;
63828 unsigned long tcp_ts_stamp;
63829 };
63830diff -urNp linux-2.6.32.46/include/net/ip_vs.h linux-2.6.32.46/include/net/ip_vs.h
63831--- linux-2.6.32.46/include/net/ip_vs.h 2011-03-27 14:31:47.000000000 -0400
63832+++ linux-2.6.32.46/include/net/ip_vs.h 2011-05-04 17:56:28.000000000 -0400
63833@@ -365,7 +365,7 @@ struct ip_vs_conn {
63834 struct ip_vs_conn *control; /* Master control connection */
63835 atomic_t n_control; /* Number of controlled ones */
63836 struct ip_vs_dest *dest; /* real server */
63837- atomic_t in_pkts; /* incoming packet counter */
63838+ atomic_unchecked_t in_pkts; /* incoming packet counter */
63839
63840 /* packet transmitter for different forwarding methods. If it
63841 mangles the packet, it must return NF_DROP or better NF_STOLEN,
63842@@ -466,7 +466,7 @@ struct ip_vs_dest {
63843 union nf_inet_addr addr; /* IP address of the server */
63844 __be16 port; /* port number of the server */
63845 volatile unsigned flags; /* dest status flags */
63846- atomic_t conn_flags; /* flags to copy to conn */
63847+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
63848 atomic_t weight; /* server weight */
63849
63850 atomic_t refcnt; /* reference counter */
63851diff -urNp linux-2.6.32.46/include/net/irda/ircomm_core.h linux-2.6.32.46/include/net/irda/ircomm_core.h
63852--- linux-2.6.32.46/include/net/irda/ircomm_core.h 2011-03-27 14:31:47.000000000 -0400
63853+++ linux-2.6.32.46/include/net/irda/ircomm_core.h 2011-08-05 20:33:55.000000000 -0400
63854@@ -51,7 +51,7 @@ typedef struct {
63855 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
63856 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
63857 struct ircomm_info *);
63858-} call_t;
63859+} __no_const call_t;
63860
63861 struct ircomm_cb {
63862 irda_queue_t queue;
63863diff -urNp linux-2.6.32.46/include/net/irda/ircomm_tty.h linux-2.6.32.46/include/net/irda/ircomm_tty.h
63864--- linux-2.6.32.46/include/net/irda/ircomm_tty.h 2011-03-27 14:31:47.000000000 -0400
63865+++ linux-2.6.32.46/include/net/irda/ircomm_tty.h 2011-04-17 15:56:46.000000000 -0400
63866@@ -35,6 +35,7 @@
63867 #include <linux/termios.h>
63868 #include <linux/timer.h>
63869 #include <linux/tty.h> /* struct tty_struct */
63870+#include <asm/local.h>
63871
63872 #include <net/irda/irias_object.h>
63873 #include <net/irda/ircomm_core.h>
63874@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
63875 unsigned short close_delay;
63876 unsigned short closing_wait; /* time to wait before closing */
63877
63878- int open_count;
63879- int blocked_open; /* # of blocked opens */
63880+ local_t open_count;
63881+ local_t blocked_open; /* # of blocked opens */
63882
63883 /* Protect concurent access to :
63884 * o self->open_count
63885diff -urNp linux-2.6.32.46/include/net/iucv/af_iucv.h linux-2.6.32.46/include/net/iucv/af_iucv.h
63886--- linux-2.6.32.46/include/net/iucv/af_iucv.h 2011-03-27 14:31:47.000000000 -0400
63887+++ linux-2.6.32.46/include/net/iucv/af_iucv.h 2011-05-04 17:56:28.000000000 -0400
63888@@ -87,7 +87,7 @@ struct iucv_sock {
63889 struct iucv_sock_list {
63890 struct hlist_head head;
63891 rwlock_t lock;
63892- atomic_t autobind_name;
63893+ atomic_unchecked_t autobind_name;
63894 };
63895
63896 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
63897diff -urNp linux-2.6.32.46/include/net/lapb.h linux-2.6.32.46/include/net/lapb.h
63898--- linux-2.6.32.46/include/net/lapb.h 2011-03-27 14:31:47.000000000 -0400
63899+++ linux-2.6.32.46/include/net/lapb.h 2011-08-05 20:33:55.000000000 -0400
63900@@ -95,7 +95,7 @@ struct lapb_cb {
63901 struct sk_buff_head write_queue;
63902 struct sk_buff_head ack_queue;
63903 unsigned char window;
63904- struct lapb_register_struct callbacks;
63905+ struct lapb_register_struct *callbacks;
63906
63907 /* FRMR control information */
63908 struct lapb_frame frmr_data;
63909diff -urNp linux-2.6.32.46/include/net/neighbour.h linux-2.6.32.46/include/net/neighbour.h
63910--- linux-2.6.32.46/include/net/neighbour.h 2011-03-27 14:31:47.000000000 -0400
63911+++ linux-2.6.32.46/include/net/neighbour.h 2011-08-26 20:29:08.000000000 -0400
63912@@ -131,7 +131,7 @@ struct neigh_ops
63913 int (*connected_output)(struct sk_buff*);
63914 int (*hh_output)(struct sk_buff*);
63915 int (*queue_xmit)(struct sk_buff*);
63916-};
63917+} __do_const;
63918
63919 struct pneigh_entry
63920 {
63921diff -urNp linux-2.6.32.46/include/net/netlink.h linux-2.6.32.46/include/net/netlink.h
63922--- linux-2.6.32.46/include/net/netlink.h 2011-07-13 17:23:04.000000000 -0400
63923+++ linux-2.6.32.46/include/net/netlink.h 2011-08-21 18:08:11.000000000 -0400
63924@@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct
63925 {
63926 return (remaining >= (int) sizeof(struct nlmsghdr) &&
63927 nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
63928- nlh->nlmsg_len <= remaining);
63929+ nlh->nlmsg_len <= (unsigned int)remaining);
63930 }
63931
63932 /**
63933@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct
63934 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
63935 {
63936 if (mark)
63937- skb_trim(skb, (unsigned char *) mark - skb->data);
63938+ skb_trim(skb, (const unsigned char *) mark - skb->data);
63939 }
63940
63941 /**
63942diff -urNp linux-2.6.32.46/include/net/netns/ipv4.h linux-2.6.32.46/include/net/netns/ipv4.h
63943--- linux-2.6.32.46/include/net/netns/ipv4.h 2011-03-27 14:31:47.000000000 -0400
63944+++ linux-2.6.32.46/include/net/netns/ipv4.h 2011-05-04 17:56:28.000000000 -0400
63945@@ -54,7 +54,7 @@ struct netns_ipv4 {
63946 int current_rt_cache_rebuild_count;
63947
63948 struct timer_list rt_secret_timer;
63949- atomic_t rt_genid;
63950+ atomic_unchecked_t rt_genid;
63951
63952 #ifdef CONFIG_IP_MROUTE
63953 struct sock *mroute_sk;
63954diff -urNp linux-2.6.32.46/include/net/sctp/sctp.h linux-2.6.32.46/include/net/sctp/sctp.h
63955--- linux-2.6.32.46/include/net/sctp/sctp.h 2011-03-27 14:31:47.000000000 -0400
63956+++ linux-2.6.32.46/include/net/sctp/sctp.h 2011-04-17 15:56:46.000000000 -0400
63957@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
63958
63959 #else /* SCTP_DEBUG */
63960
63961-#define SCTP_DEBUG_PRINTK(whatever...)
63962-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
63963+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
63964+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
63965 #define SCTP_ENABLE_DEBUG
63966 #define SCTP_DISABLE_DEBUG
63967 #define SCTP_ASSERT(expr, str, func)
63968diff -urNp linux-2.6.32.46/include/net/secure_seq.h linux-2.6.32.46/include/net/secure_seq.h
63969--- linux-2.6.32.46/include/net/secure_seq.h 2011-08-16 20:37:25.000000000 -0400
63970+++ linux-2.6.32.46/include/net/secure_seq.h 2011-08-07 19:48:09.000000000 -0400
63971@@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
63972 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
63973 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
63974 extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
63975- __be16 dport);
63976+ __be16 dport);
63977 extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
63978 __be16 sport, __be16 dport);
63979 extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
63980- __be16 sport, __be16 dport);
63981+ __be16 sport, __be16 dport);
63982 extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
63983- __be16 sport, __be16 dport);
63984+ __be16 sport, __be16 dport);
63985 extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
63986- __be16 sport, __be16 dport);
63987+ __be16 sport, __be16 dport);
63988
63989 #endif /* _NET_SECURE_SEQ */
63990diff -urNp linux-2.6.32.46/include/net/sock.h linux-2.6.32.46/include/net/sock.h
63991--- linux-2.6.32.46/include/net/sock.h 2011-03-27 14:31:47.000000000 -0400
63992+++ linux-2.6.32.46/include/net/sock.h 2011-08-21 17:24:37.000000000 -0400
63993@@ -272,7 +272,7 @@ struct sock {
63994 rwlock_t sk_callback_lock;
63995 int sk_err,
63996 sk_err_soft;
63997- atomic_t sk_drops;
63998+ atomic_unchecked_t sk_drops;
63999 unsigned short sk_ack_backlog;
64000 unsigned short sk_max_ack_backlog;
64001 __u32 sk_priority;
64002@@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_relea
64003 extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
64004 extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
64005 #else
64006-static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
64007+static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
64008 int inc)
64009 {
64010 }
64011diff -urNp linux-2.6.32.46/include/net/tcp.h linux-2.6.32.46/include/net/tcp.h
64012--- linux-2.6.32.46/include/net/tcp.h 2011-03-27 14:31:47.000000000 -0400
64013+++ linux-2.6.32.46/include/net/tcp.h 2011-08-23 21:29:10.000000000 -0400
64014@@ -1444,8 +1444,8 @@ enum tcp_seq_states {
64015 struct tcp_seq_afinfo {
64016 char *name;
64017 sa_family_t family;
64018- struct file_operations seq_fops;
64019- struct seq_operations seq_ops;
64020+ file_operations_no_const seq_fops;
64021+ seq_operations_no_const seq_ops;
64022 };
64023
64024 struct tcp_iter_state {
64025diff -urNp linux-2.6.32.46/include/net/udp.h linux-2.6.32.46/include/net/udp.h
64026--- linux-2.6.32.46/include/net/udp.h 2011-03-27 14:31:47.000000000 -0400
64027+++ linux-2.6.32.46/include/net/udp.h 2011-08-23 21:29:34.000000000 -0400
64028@@ -187,8 +187,8 @@ struct udp_seq_afinfo {
64029 char *name;
64030 sa_family_t family;
64031 struct udp_table *udp_table;
64032- struct file_operations seq_fops;
64033- struct seq_operations seq_ops;
64034+ file_operations_no_const seq_fops;
64035+ seq_operations_no_const seq_ops;
64036 };
64037
64038 struct udp_iter_state {
64039diff -urNp linux-2.6.32.46/include/rdma/iw_cm.h linux-2.6.32.46/include/rdma/iw_cm.h
64040--- linux-2.6.32.46/include/rdma/iw_cm.h 2011-03-27 14:31:47.000000000 -0400
64041+++ linux-2.6.32.46/include/rdma/iw_cm.h 2011-08-05 20:33:55.000000000 -0400
64042@@ -129,7 +129,7 @@ struct iw_cm_verbs {
64043 int backlog);
64044
64045 int (*destroy_listen)(struct iw_cm_id *cm_id);
64046-};
64047+} __no_const;
64048
64049 /**
64050 * iw_create_cm_id - Create an IW CM identifier.
64051diff -urNp linux-2.6.32.46/include/scsi/libfc.h linux-2.6.32.46/include/scsi/libfc.h
64052--- linux-2.6.32.46/include/scsi/libfc.h 2011-03-27 14:31:47.000000000 -0400
64053+++ linux-2.6.32.46/include/scsi/libfc.h 2011-08-23 21:22:38.000000000 -0400
64054@@ -675,6 +675,7 @@ struct libfc_function_template {
64055 */
64056 void (*disc_stop_final) (struct fc_lport *);
64057 };
64058+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
64059
64060 /* information used by the discovery layer */
64061 struct fc_disc {
64062@@ -707,7 +708,7 @@ struct fc_lport {
64063 struct fc_disc disc;
64064
64065 /* Operational Information */
64066- struct libfc_function_template tt;
64067+ libfc_function_template_no_const tt;
64068 u8 link_up;
64069 u8 qfull;
64070 enum fc_lport_state state;
64071diff -urNp linux-2.6.32.46/include/scsi/scsi_device.h linux-2.6.32.46/include/scsi/scsi_device.h
64072--- linux-2.6.32.46/include/scsi/scsi_device.h 2011-04-17 17:00:52.000000000 -0400
64073+++ linux-2.6.32.46/include/scsi/scsi_device.h 2011-05-04 17:56:28.000000000 -0400
64074@@ -156,9 +156,9 @@ struct scsi_device {
64075 unsigned int max_device_blocked; /* what device_blocked counts down from */
64076 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
64077
64078- atomic_t iorequest_cnt;
64079- atomic_t iodone_cnt;
64080- atomic_t ioerr_cnt;
64081+ atomic_unchecked_t iorequest_cnt;
64082+ atomic_unchecked_t iodone_cnt;
64083+ atomic_unchecked_t ioerr_cnt;
64084
64085 struct device sdev_gendev,
64086 sdev_dev;
64087diff -urNp linux-2.6.32.46/include/scsi/scsi_transport_fc.h linux-2.6.32.46/include/scsi/scsi_transport_fc.h
64088--- linux-2.6.32.46/include/scsi/scsi_transport_fc.h 2011-03-27 14:31:47.000000000 -0400
64089+++ linux-2.6.32.46/include/scsi/scsi_transport_fc.h 2011-08-26 20:19:09.000000000 -0400
64090@@ -708,7 +708,7 @@ struct fc_function_template {
64091 unsigned long show_host_system_hostname:1;
64092
64093 unsigned long disable_target_scan:1;
64094-};
64095+} __do_const;
64096
64097
64098 /**
64099diff -urNp linux-2.6.32.46/include/sound/ac97_codec.h linux-2.6.32.46/include/sound/ac97_codec.h
64100--- linux-2.6.32.46/include/sound/ac97_codec.h 2011-03-27 14:31:47.000000000 -0400
64101+++ linux-2.6.32.46/include/sound/ac97_codec.h 2011-04-17 15:56:46.000000000 -0400
64102@@ -419,15 +419,15 @@
64103 struct snd_ac97;
64104
64105 struct snd_ac97_build_ops {
64106- int (*build_3d) (struct snd_ac97 *ac97);
64107- int (*build_specific) (struct snd_ac97 *ac97);
64108- int (*build_spdif) (struct snd_ac97 *ac97);
64109- int (*build_post_spdif) (struct snd_ac97 *ac97);
64110+ int (* const build_3d) (struct snd_ac97 *ac97);
64111+ int (* const build_specific) (struct snd_ac97 *ac97);
64112+ int (* const build_spdif) (struct snd_ac97 *ac97);
64113+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
64114 #ifdef CONFIG_PM
64115- void (*suspend) (struct snd_ac97 *ac97);
64116- void (*resume) (struct snd_ac97 *ac97);
64117+ void (* const suspend) (struct snd_ac97 *ac97);
64118+ void (* const resume) (struct snd_ac97 *ac97);
64119 #endif
64120- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
64121+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
64122 };
64123
64124 struct snd_ac97_bus_ops {
64125@@ -477,7 +477,7 @@ struct snd_ac97_template {
64126
64127 struct snd_ac97 {
64128 /* -- lowlevel (hardware) driver specific -- */
64129- struct snd_ac97_build_ops * build_ops;
64130+ const struct snd_ac97_build_ops * build_ops;
64131 void *private_data;
64132 void (*private_free) (struct snd_ac97 *ac97);
64133 /* --- */
64134diff -urNp linux-2.6.32.46/include/sound/ak4xxx-adda.h linux-2.6.32.46/include/sound/ak4xxx-adda.h
64135--- linux-2.6.32.46/include/sound/ak4xxx-adda.h 2011-03-27 14:31:47.000000000 -0400
64136+++ linux-2.6.32.46/include/sound/ak4xxx-adda.h 2011-08-05 20:33:55.000000000 -0400
64137@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
64138 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
64139 unsigned char val);
64140 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
64141-};
64142+} __no_const;
64143
64144 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
64145
64146diff -urNp linux-2.6.32.46/include/sound/hwdep.h linux-2.6.32.46/include/sound/hwdep.h
64147--- linux-2.6.32.46/include/sound/hwdep.h 2011-03-27 14:31:47.000000000 -0400
64148+++ linux-2.6.32.46/include/sound/hwdep.h 2011-08-05 20:33:55.000000000 -0400
64149@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
64150 struct snd_hwdep_dsp_status *status);
64151 int (*dsp_load)(struct snd_hwdep *hw,
64152 struct snd_hwdep_dsp_image *image);
64153-};
64154+} __no_const;
64155
64156 struct snd_hwdep {
64157 struct snd_card *card;
64158diff -urNp linux-2.6.32.46/include/sound/info.h linux-2.6.32.46/include/sound/info.h
64159--- linux-2.6.32.46/include/sound/info.h 2011-03-27 14:31:47.000000000 -0400
64160+++ linux-2.6.32.46/include/sound/info.h 2011-08-05 20:33:55.000000000 -0400
64161@@ -44,7 +44,7 @@ struct snd_info_entry_text {
64162 struct snd_info_buffer *buffer);
64163 void (*write)(struct snd_info_entry *entry,
64164 struct snd_info_buffer *buffer);
64165-};
64166+} __no_const;
64167
64168 struct snd_info_entry_ops {
64169 int (*open)(struct snd_info_entry *entry,
64170diff -urNp linux-2.6.32.46/include/sound/pcm.h linux-2.6.32.46/include/sound/pcm.h
64171--- linux-2.6.32.46/include/sound/pcm.h 2011-03-27 14:31:47.000000000 -0400
64172+++ linux-2.6.32.46/include/sound/pcm.h 2011-08-23 21:22:38.000000000 -0400
64173@@ -80,6 +80,7 @@ struct snd_pcm_ops {
64174 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
64175 int (*ack)(struct snd_pcm_substream *substream);
64176 };
64177+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
64178
64179 /*
64180 *
64181diff -urNp linux-2.6.32.46/include/sound/sb16_csp.h linux-2.6.32.46/include/sound/sb16_csp.h
64182--- linux-2.6.32.46/include/sound/sb16_csp.h 2011-03-27 14:31:47.000000000 -0400
64183+++ linux-2.6.32.46/include/sound/sb16_csp.h 2011-08-05 20:33:55.000000000 -0400
64184@@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
64185 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
64186 int (*csp_stop) (struct snd_sb_csp * p);
64187 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
64188-};
64189+} __no_const;
64190
64191 /*
64192 * CSP private data
64193diff -urNp linux-2.6.32.46/include/sound/ymfpci.h linux-2.6.32.46/include/sound/ymfpci.h
64194--- linux-2.6.32.46/include/sound/ymfpci.h 2011-03-27 14:31:47.000000000 -0400
64195+++ linux-2.6.32.46/include/sound/ymfpci.h 2011-05-04 17:56:28.000000000 -0400
64196@@ -358,7 +358,7 @@ struct snd_ymfpci {
64197 spinlock_t reg_lock;
64198 spinlock_t voice_lock;
64199 wait_queue_head_t interrupt_sleep;
64200- atomic_t interrupt_sleep_count;
64201+ atomic_unchecked_t interrupt_sleep_count;
64202 struct snd_info_entry *proc_entry;
64203 const struct firmware *dsp_microcode;
64204 const struct firmware *controller_microcode;
64205diff -urNp linux-2.6.32.46/include/trace/events/irq.h linux-2.6.32.46/include/trace/events/irq.h
64206--- linux-2.6.32.46/include/trace/events/irq.h 2011-03-27 14:31:47.000000000 -0400
64207+++ linux-2.6.32.46/include/trace/events/irq.h 2011-04-17 15:56:46.000000000 -0400
64208@@ -34,7 +34,7 @@
64209 */
64210 TRACE_EVENT(irq_handler_entry,
64211
64212- TP_PROTO(int irq, struct irqaction *action),
64213+ TP_PROTO(int irq, const struct irqaction *action),
64214
64215 TP_ARGS(irq, action),
64216
64217@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
64218 */
64219 TRACE_EVENT(irq_handler_exit,
64220
64221- TP_PROTO(int irq, struct irqaction *action, int ret),
64222+ TP_PROTO(int irq, const struct irqaction *action, int ret),
64223
64224 TP_ARGS(irq, action, ret),
64225
64226@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
64227 */
64228 TRACE_EVENT(softirq_entry,
64229
64230- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
64231+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
64232
64233 TP_ARGS(h, vec),
64234
64235@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
64236 */
64237 TRACE_EVENT(softirq_exit,
64238
64239- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
64240+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
64241
64242 TP_ARGS(h, vec),
64243
64244diff -urNp linux-2.6.32.46/include/video/uvesafb.h linux-2.6.32.46/include/video/uvesafb.h
64245--- linux-2.6.32.46/include/video/uvesafb.h 2011-03-27 14:31:47.000000000 -0400
64246+++ linux-2.6.32.46/include/video/uvesafb.h 2011-04-17 15:56:46.000000000 -0400
64247@@ -177,6 +177,7 @@ struct uvesafb_par {
64248 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
64249 u8 pmi_setpal; /* PMI for palette changes */
64250 u16 *pmi_base; /* protected mode interface location */
64251+ u8 *pmi_code; /* protected mode code location */
64252 void *pmi_start;
64253 void *pmi_pal;
64254 u8 *vbe_state_orig; /*
64255diff -urNp linux-2.6.32.46/init/do_mounts.c linux-2.6.32.46/init/do_mounts.c
64256--- linux-2.6.32.46/init/do_mounts.c 2011-03-27 14:31:47.000000000 -0400
64257+++ linux-2.6.32.46/init/do_mounts.c 2011-04-17 15:56:46.000000000 -0400
64258@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
64259
64260 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
64261 {
64262- int err = sys_mount(name, "/root", fs, flags, data);
64263+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
64264 if (err)
64265 return err;
64266
64267- sys_chdir("/root");
64268+ sys_chdir((__force const char __user *)"/root");
64269 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
64270 printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
64271 current->fs->pwd.mnt->mnt_sb->s_type->name,
64272@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
64273 va_start(args, fmt);
64274 vsprintf(buf, fmt, args);
64275 va_end(args);
64276- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
64277+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
64278 if (fd >= 0) {
64279 sys_ioctl(fd, FDEJECT, 0);
64280 sys_close(fd);
64281 }
64282 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
64283- fd = sys_open("/dev/console", O_RDWR, 0);
64284+ fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
64285 if (fd >= 0) {
64286 sys_ioctl(fd, TCGETS, (long)&termios);
64287 termios.c_lflag &= ~ICANON;
64288 sys_ioctl(fd, TCSETSF, (long)&termios);
64289- sys_read(fd, &c, 1);
64290+ sys_read(fd, (char __user *)&c, 1);
64291 termios.c_lflag |= ICANON;
64292 sys_ioctl(fd, TCSETSF, (long)&termios);
64293 sys_close(fd);
64294@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
64295 mount_root();
64296 out:
64297 devtmpfs_mount("dev");
64298- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64299- sys_chroot(".");
64300+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
64301+ sys_chroot((__force char __user *)".");
64302 }
64303diff -urNp linux-2.6.32.46/init/do_mounts.h linux-2.6.32.46/init/do_mounts.h
64304--- linux-2.6.32.46/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400
64305+++ linux-2.6.32.46/init/do_mounts.h 2011-04-17 15:56:46.000000000 -0400
64306@@ -15,15 +15,15 @@ extern int root_mountflags;
64307
64308 static inline int create_dev(char *name, dev_t dev)
64309 {
64310- sys_unlink(name);
64311- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
64312+ sys_unlink((__force char __user *)name);
64313+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
64314 }
64315
64316 #if BITS_PER_LONG == 32
64317 static inline u32 bstat(char *name)
64318 {
64319 struct stat64 stat;
64320- if (sys_stat64(name, &stat) != 0)
64321+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
64322 return 0;
64323 if (!S_ISBLK(stat.st_mode))
64324 return 0;
64325diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mounts_initrd.c
64326--- linux-2.6.32.46/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400
64327+++ linux-2.6.32.46/init/do_mounts_initrd.c 2011-04-17 15:56:46.000000000 -0400
64328@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
64329 sys_close(old_fd);sys_close(root_fd);
64330 sys_close(0);sys_close(1);sys_close(2);
64331 sys_setsid();
64332- (void) sys_open("/dev/console",O_RDWR,0);
64333+ (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
64334 (void) sys_dup(0);
64335 (void) sys_dup(0);
64336 return kernel_execve(shell, argv, envp_init);
64337@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
64338 create_dev("/dev/root.old", Root_RAM0);
64339 /* mount initrd on rootfs' /root */
64340 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
64341- sys_mkdir("/old", 0700);
64342- root_fd = sys_open("/", 0, 0);
64343- old_fd = sys_open("/old", 0, 0);
64344+ sys_mkdir((__force const char __user *)"/old", 0700);
64345+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
64346+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
64347 /* move initrd over / and chdir/chroot in initrd root */
64348- sys_chdir("/root");
64349- sys_mount(".", "/", NULL, MS_MOVE, NULL);
64350- sys_chroot(".");
64351+ sys_chdir((__force const char __user *)"/root");
64352+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
64353+ sys_chroot((__force const char __user *)".");
64354
64355 /*
64356 * In case that a resume from disk is carried out by linuxrc or one of
64357@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
64358
64359 /* move initrd to rootfs' /old */
64360 sys_fchdir(old_fd);
64361- sys_mount("/", ".", NULL, MS_MOVE, NULL);
64362+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
64363 /* switch root and cwd back to / of rootfs */
64364 sys_fchdir(root_fd);
64365- sys_chroot(".");
64366+ sys_chroot((__force const char __user *)".");
64367 sys_close(old_fd);
64368 sys_close(root_fd);
64369
64370 if (new_decode_dev(real_root_dev) == Root_RAM0) {
64371- sys_chdir("/old");
64372+ sys_chdir((__force const char __user *)"/old");
64373 return;
64374 }
64375
64376@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
64377 mount_root();
64378
64379 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
64380- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
64381+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
64382 if (!error)
64383 printk("okay\n");
64384 else {
64385- int fd = sys_open("/dev/root.old", O_RDWR, 0);
64386+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
64387 if (error == -ENOENT)
64388 printk("/initrd does not exist. Ignored.\n");
64389 else
64390 printk("failed\n");
64391 printk(KERN_NOTICE "Unmounting old root\n");
64392- sys_umount("/old", MNT_DETACH);
64393+ sys_umount((__force char __user *)"/old", MNT_DETACH);
64394 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
64395 if (fd < 0) {
64396 error = fd;
64397@@ -119,11 +119,11 @@ int __init initrd_load(void)
64398 * mounted in the normal path.
64399 */
64400 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
64401- sys_unlink("/initrd.image");
64402+ sys_unlink((__force const char __user *)"/initrd.image");
64403 handle_initrd();
64404 return 1;
64405 }
64406 }
64407- sys_unlink("/initrd.image");
64408+ sys_unlink((__force const char __user *)"/initrd.image");
64409 return 0;
64410 }
64411diff -urNp linux-2.6.32.46/init/do_mounts_md.c linux-2.6.32.46/init/do_mounts_md.c
64412--- linux-2.6.32.46/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400
64413+++ linux-2.6.32.46/init/do_mounts_md.c 2011-04-17 15:56:46.000000000 -0400
64414@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
64415 partitioned ? "_d" : "", minor,
64416 md_setup_args[ent].device_names);
64417
64418- fd = sys_open(name, 0, 0);
64419+ fd = sys_open((__force char __user *)name, 0, 0);
64420 if (fd < 0) {
64421 printk(KERN_ERR "md: open failed - cannot start "
64422 "array %s\n", name);
64423@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
64424 * array without it
64425 */
64426 sys_close(fd);
64427- fd = sys_open(name, 0, 0);
64428+ fd = sys_open((__force char __user *)name, 0, 0);
64429 sys_ioctl(fd, BLKRRPART, 0);
64430 }
64431 sys_close(fd);
64432@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
64433
64434 wait_for_device_probe();
64435
64436- fd = sys_open("/dev/md0", 0, 0);
64437+ fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
64438 if (fd >= 0) {
64439 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
64440 sys_close(fd);
64441diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c
64442--- linux-2.6.32.46/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400
64443+++ linux-2.6.32.46/init/initramfs.c 2011-04-17 15:56:46.000000000 -0400
64444@@ -74,7 +74,7 @@ static void __init free_hash(void)
64445 }
64446 }
64447
64448-static long __init do_utime(char __user *filename, time_t mtime)
64449+static long __init do_utime(__force char __user *filename, time_t mtime)
64450 {
64451 struct timespec t[2];
64452
64453@@ -109,7 +109,7 @@ static void __init dir_utime(void)
64454 struct dir_entry *de, *tmp;
64455 list_for_each_entry_safe(de, tmp, &dir_list, list) {
64456 list_del(&de->list);
64457- do_utime(de->name, de->mtime);
64458+ do_utime((__force char __user *)de->name, de->mtime);
64459 kfree(de->name);
64460 kfree(de);
64461 }
64462@@ -271,7 +271,7 @@ static int __init maybe_link(void)
64463 if (nlink >= 2) {
64464 char *old = find_link(major, minor, ino, mode, collected);
64465 if (old)
64466- return (sys_link(old, collected) < 0) ? -1 : 1;
64467+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
64468 }
64469 return 0;
64470 }
64471@@ -280,11 +280,11 @@ static void __init clean_path(char *path
64472 {
64473 struct stat st;
64474
64475- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
64476+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
64477 if (S_ISDIR(st.st_mode))
64478- sys_rmdir(path);
64479+ sys_rmdir((__force char __user *)path);
64480 else
64481- sys_unlink(path);
64482+ sys_unlink((__force char __user *)path);
64483 }
64484 }
64485
64486@@ -305,7 +305,7 @@ static int __init do_name(void)
64487 int openflags = O_WRONLY|O_CREAT;
64488 if (ml != 1)
64489 openflags |= O_TRUNC;
64490- wfd = sys_open(collected, openflags, mode);
64491+ wfd = sys_open((__force char __user *)collected, openflags, mode);
64492
64493 if (wfd >= 0) {
64494 sys_fchown(wfd, uid, gid);
64495@@ -317,17 +317,17 @@ static int __init do_name(void)
64496 }
64497 }
64498 } else if (S_ISDIR(mode)) {
64499- sys_mkdir(collected, mode);
64500- sys_chown(collected, uid, gid);
64501- sys_chmod(collected, mode);
64502+ sys_mkdir((__force char __user *)collected, mode);
64503+ sys_chown((__force char __user *)collected, uid, gid);
64504+ sys_chmod((__force char __user *)collected, mode);
64505 dir_add(collected, mtime);
64506 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
64507 S_ISFIFO(mode) || S_ISSOCK(mode)) {
64508 if (maybe_link() == 0) {
64509- sys_mknod(collected, mode, rdev);
64510- sys_chown(collected, uid, gid);
64511- sys_chmod(collected, mode);
64512- do_utime(collected, mtime);
64513+ sys_mknod((__force char __user *)collected, mode, rdev);
64514+ sys_chown((__force char __user *)collected, uid, gid);
64515+ sys_chmod((__force char __user *)collected, mode);
64516+ do_utime((__force char __user *)collected, mtime);
64517 }
64518 }
64519 return 0;
64520@@ -336,15 +336,15 @@ static int __init do_name(void)
64521 static int __init do_copy(void)
64522 {
64523 if (count >= body_len) {
64524- sys_write(wfd, victim, body_len);
64525+ sys_write(wfd, (__force char __user *)victim, body_len);
64526 sys_close(wfd);
64527- do_utime(vcollected, mtime);
64528+ do_utime((__force char __user *)vcollected, mtime);
64529 kfree(vcollected);
64530 eat(body_len);
64531 state = SkipIt;
64532 return 0;
64533 } else {
64534- sys_write(wfd, victim, count);
64535+ sys_write(wfd, (__force char __user *)victim, count);
64536 body_len -= count;
64537 eat(count);
64538 return 1;
64539@@ -355,9 +355,9 @@ static int __init do_symlink(void)
64540 {
64541 collected[N_ALIGN(name_len) + body_len] = '\0';
64542 clean_path(collected, 0);
64543- sys_symlink(collected + N_ALIGN(name_len), collected);
64544- sys_lchown(collected, uid, gid);
64545- do_utime(collected, mtime);
64546+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
64547+ sys_lchown((__force char __user *)collected, uid, gid);
64548+ do_utime((__force char __user *)collected, mtime);
64549 state = SkipIt;
64550 next_state = Reset;
64551 return 0;
64552diff -urNp linux-2.6.32.46/init/Kconfig linux-2.6.32.46/init/Kconfig
64553--- linux-2.6.32.46/init/Kconfig 2011-05-10 22:12:01.000000000 -0400
64554+++ linux-2.6.32.46/init/Kconfig 2011-05-10 22:12:34.000000000 -0400
64555@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
64556
64557 config COMPAT_BRK
64558 bool "Disable heap randomization"
64559- default y
64560+ default n
64561 help
64562 Randomizing heap placement makes heap exploits harder, but it
64563 also breaks ancient binaries (including anything libc5 based).
64564diff -urNp linux-2.6.32.46/init/main.c linux-2.6.32.46/init/main.c
64565--- linux-2.6.32.46/init/main.c 2011-05-10 22:12:01.000000000 -0400
64566+++ linux-2.6.32.46/init/main.c 2011-08-05 20:33:55.000000000 -0400
64567@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
64568 #ifdef CONFIG_TC
64569 extern void tc_init(void);
64570 #endif
64571+extern void grsecurity_init(void);
64572
64573 enum system_states system_state __read_mostly;
64574 EXPORT_SYMBOL(system_state);
64575@@ -183,6 +184,49 @@ static int __init set_reset_devices(char
64576
64577 __setup("reset_devices", set_reset_devices);
64578
64579+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
64580+extern char pax_enter_kernel_user[];
64581+extern char pax_exit_kernel_user[];
64582+extern pgdval_t clone_pgd_mask;
64583+#endif
64584+
64585+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
64586+static int __init setup_pax_nouderef(char *str)
64587+{
64588+#ifdef CONFIG_X86_32
64589+ unsigned int cpu;
64590+ struct desc_struct *gdt;
64591+
64592+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
64593+ gdt = get_cpu_gdt_table(cpu);
64594+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
64595+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
64596+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
64597+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
64598+ }
64599+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
64600+#else
64601+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
64602+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
64603+ clone_pgd_mask = ~(pgdval_t)0UL;
64604+#endif
64605+
64606+ return 0;
64607+}
64608+early_param("pax_nouderef", setup_pax_nouderef);
64609+#endif
64610+
64611+#ifdef CONFIG_PAX_SOFTMODE
64612+int pax_softmode;
64613+
64614+static int __init setup_pax_softmode(char *str)
64615+{
64616+ get_option(&str, &pax_softmode);
64617+ return 1;
64618+}
64619+__setup("pax_softmode=", setup_pax_softmode);
64620+#endif
64621+
64622 static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
64623 char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
64624 static const char *panic_later, *panic_param;
64625@@ -705,52 +749,53 @@ int initcall_debug;
64626 core_param(initcall_debug, initcall_debug, bool, 0644);
64627
64628 static char msgbuf[64];
64629-static struct boot_trace_call call;
64630-static struct boot_trace_ret ret;
64631+static struct boot_trace_call trace_call;
64632+static struct boot_trace_ret trace_ret;
64633
64634 int do_one_initcall(initcall_t fn)
64635 {
64636 int count = preempt_count();
64637 ktime_t calltime, delta, rettime;
64638+ const char *msg1 = "", *msg2 = "";
64639
64640 if (initcall_debug) {
64641- call.caller = task_pid_nr(current);
64642- printk("calling %pF @ %i\n", fn, call.caller);
64643+ trace_call.caller = task_pid_nr(current);
64644+ printk("calling %pF @ %i\n", fn, trace_call.caller);
64645 calltime = ktime_get();
64646- trace_boot_call(&call, fn);
64647+ trace_boot_call(&trace_call, fn);
64648 enable_boot_trace();
64649 }
64650
64651- ret.result = fn();
64652+ trace_ret.result = fn();
64653
64654 if (initcall_debug) {
64655 disable_boot_trace();
64656 rettime = ktime_get();
64657 delta = ktime_sub(rettime, calltime);
64658- ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
64659- trace_boot_ret(&ret, fn);
64660+ trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
64661+ trace_boot_ret(&trace_ret, fn);
64662 printk("initcall %pF returned %d after %Ld usecs\n", fn,
64663- ret.result, ret.duration);
64664+ trace_ret.result, trace_ret.duration);
64665 }
64666
64667 msgbuf[0] = 0;
64668
64669- if (ret.result && ret.result != -ENODEV && initcall_debug)
64670- sprintf(msgbuf, "error code %d ", ret.result);
64671+ if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
64672+ sprintf(msgbuf, "error code %d ", trace_ret.result);
64673
64674 if (preempt_count() != count) {
64675- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
64676+ msg1 = " preemption imbalance";
64677 preempt_count() = count;
64678 }
64679 if (irqs_disabled()) {
64680- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
64681+ msg2 = " disabled interrupts";
64682 local_irq_enable();
64683 }
64684- if (msgbuf[0]) {
64685- printk("initcall %pF returned with %s\n", fn, msgbuf);
64686+ if (msgbuf[0] || *msg1 || *msg2) {
64687+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
64688 }
64689
64690- return ret.result;
64691+ return trace_ret.result;
64692 }
64693
64694
64695@@ -893,11 +938,13 @@ static int __init kernel_init(void * unu
64696 if (!ramdisk_execute_command)
64697 ramdisk_execute_command = "/init";
64698
64699- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
64700+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
64701 ramdisk_execute_command = NULL;
64702 prepare_namespace();
64703 }
64704
64705+ grsecurity_init();
64706+
64707 /*
64708 * Ok, we have completed the initial bootup, and
64709 * we're essentially up and running. Get rid of the
64710diff -urNp linux-2.6.32.46/init/noinitramfs.c linux-2.6.32.46/init/noinitramfs.c
64711--- linux-2.6.32.46/init/noinitramfs.c 2011-03-27 14:31:47.000000000 -0400
64712+++ linux-2.6.32.46/init/noinitramfs.c 2011-04-17 15:56:46.000000000 -0400
64713@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
64714 {
64715 int err;
64716
64717- err = sys_mkdir("/dev", 0755);
64718+ err = sys_mkdir((const char __user *)"/dev", 0755);
64719 if (err < 0)
64720 goto out;
64721
64722@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
64723 if (err < 0)
64724 goto out;
64725
64726- err = sys_mkdir("/root", 0700);
64727+ err = sys_mkdir((const char __user *)"/root", 0700);
64728 if (err < 0)
64729 goto out;
64730
64731diff -urNp linux-2.6.32.46/ipc/mqueue.c linux-2.6.32.46/ipc/mqueue.c
64732--- linux-2.6.32.46/ipc/mqueue.c 2011-03-27 14:31:47.000000000 -0400
64733+++ linux-2.6.32.46/ipc/mqueue.c 2011-04-17 15:56:46.000000000 -0400
64734@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
64735 mq_bytes = (mq_msg_tblsz +
64736 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
64737
64738+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
64739 spin_lock(&mq_lock);
64740 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
64741 u->mq_bytes + mq_bytes >
64742diff -urNp linux-2.6.32.46/ipc/msg.c linux-2.6.32.46/ipc/msg.c
64743--- linux-2.6.32.46/ipc/msg.c 2011-03-27 14:31:47.000000000 -0400
64744+++ linux-2.6.32.46/ipc/msg.c 2011-08-05 20:33:55.000000000 -0400
64745@@ -310,18 +310,19 @@ static inline int msg_security(struct ke
64746 return security_msg_queue_associate(msq, msgflg);
64747 }
64748
64749+static struct ipc_ops msg_ops = {
64750+ .getnew = newque,
64751+ .associate = msg_security,
64752+ .more_checks = NULL
64753+};
64754+
64755 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
64756 {
64757 struct ipc_namespace *ns;
64758- struct ipc_ops msg_ops;
64759 struct ipc_params msg_params;
64760
64761 ns = current->nsproxy->ipc_ns;
64762
64763- msg_ops.getnew = newque;
64764- msg_ops.associate = msg_security;
64765- msg_ops.more_checks = NULL;
64766-
64767 msg_params.key = key;
64768 msg_params.flg = msgflg;
64769
64770diff -urNp linux-2.6.32.46/ipc/sem.c linux-2.6.32.46/ipc/sem.c
64771--- linux-2.6.32.46/ipc/sem.c 2011-03-27 14:31:47.000000000 -0400
64772+++ linux-2.6.32.46/ipc/sem.c 2011-08-05 20:33:55.000000000 -0400
64773@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct
64774 return 0;
64775 }
64776
64777+static struct ipc_ops sem_ops = {
64778+ .getnew = newary,
64779+ .associate = sem_security,
64780+ .more_checks = sem_more_checks
64781+};
64782+
64783 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
64784 {
64785 struct ipc_namespace *ns;
64786- struct ipc_ops sem_ops;
64787 struct ipc_params sem_params;
64788
64789 ns = current->nsproxy->ipc_ns;
64790@@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
64791 if (nsems < 0 || nsems > ns->sc_semmsl)
64792 return -EINVAL;
64793
64794- sem_ops.getnew = newary;
64795- sem_ops.associate = sem_security;
64796- sem_ops.more_checks = sem_more_checks;
64797-
64798 sem_params.key = key;
64799 sem_params.flg = semflg;
64800 sem_params.u.nsems = nsems;
64801@@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namesp
64802 ushort* sem_io = fast_sem_io;
64803 int nsems;
64804
64805+ pax_track_stack();
64806+
64807 sma = sem_lock_check(ns, semid);
64808 if (IS_ERR(sma))
64809 return PTR_ERR(sma);
64810@@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
64811 unsigned long jiffies_left = 0;
64812 struct ipc_namespace *ns;
64813
64814+ pax_track_stack();
64815+
64816 ns = current->nsproxy->ipc_ns;
64817
64818 if (nsops < 1 || semid < 0)
64819diff -urNp linux-2.6.32.46/ipc/shm.c linux-2.6.32.46/ipc/shm.c
64820--- linux-2.6.32.46/ipc/shm.c 2011-03-27 14:31:47.000000000 -0400
64821+++ linux-2.6.32.46/ipc/shm.c 2011-08-05 20:33:55.000000000 -0400
64822@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
64823 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
64824 #endif
64825
64826+#ifdef CONFIG_GRKERNSEC
64827+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64828+ const time_t shm_createtime, const uid_t cuid,
64829+ const int shmid);
64830+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
64831+ const time_t shm_createtime);
64832+#endif
64833+
64834 void shm_init_ns(struct ipc_namespace *ns)
64835 {
64836 ns->shm_ctlmax = SHMMAX;
64837@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
64838 shp->shm_lprid = 0;
64839 shp->shm_atim = shp->shm_dtim = 0;
64840 shp->shm_ctim = get_seconds();
64841+#ifdef CONFIG_GRKERNSEC
64842+ {
64843+ struct timespec timeval;
64844+ do_posix_clock_monotonic_gettime(&timeval);
64845+
64846+ shp->shm_createtime = timeval.tv_sec;
64847+ }
64848+#endif
64849 shp->shm_segsz = size;
64850 shp->shm_nattch = 0;
64851 shp->shm_file = file;
64852@@ -446,18 +462,19 @@ static inline int shm_more_checks(struct
64853 return 0;
64854 }
64855
64856+static struct ipc_ops shm_ops = {
64857+ .getnew = newseg,
64858+ .associate = shm_security,
64859+ .more_checks = shm_more_checks
64860+};
64861+
64862 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
64863 {
64864 struct ipc_namespace *ns;
64865- struct ipc_ops shm_ops;
64866 struct ipc_params shm_params;
64867
64868 ns = current->nsproxy->ipc_ns;
64869
64870- shm_ops.getnew = newseg;
64871- shm_ops.associate = shm_security;
64872- shm_ops.more_checks = shm_more_checks;
64873-
64874 shm_params.key = key;
64875 shm_params.flg = shmflg;
64876 shm_params.u.size = size;
64877@@ -880,9 +897,21 @@ long do_shmat(int shmid, char __user *sh
64878 if (err)
64879 goto out_unlock;
64880
64881+#ifdef CONFIG_GRKERNSEC
64882+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
64883+ shp->shm_perm.cuid, shmid) ||
64884+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
64885+ err = -EACCES;
64886+ goto out_unlock;
64887+ }
64888+#endif
64889+
64890 path.dentry = dget(shp->shm_file->f_path.dentry);
64891 path.mnt = shp->shm_file->f_path.mnt;
64892 shp->shm_nattch++;
64893+#ifdef CONFIG_GRKERNSEC
64894+ shp->shm_lapid = current->pid;
64895+#endif
64896 size = i_size_read(path.dentry->d_inode);
64897 shm_unlock(shp);
64898
64899diff -urNp linux-2.6.32.46/kernel/acct.c linux-2.6.32.46/kernel/acct.c
64900--- linux-2.6.32.46/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400
64901+++ linux-2.6.32.46/kernel/acct.c 2011-04-17 15:56:46.000000000 -0400
64902@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
64903 */
64904 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
64905 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
64906- file->f_op->write(file, (char *)&ac,
64907+ file->f_op->write(file, (__force char __user *)&ac,
64908 sizeof(acct_t), &file->f_pos);
64909 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
64910 set_fs(fs);
64911diff -urNp linux-2.6.32.46/kernel/audit.c linux-2.6.32.46/kernel/audit.c
64912--- linux-2.6.32.46/kernel/audit.c 2011-03-27 14:31:47.000000000 -0400
64913+++ linux-2.6.32.46/kernel/audit.c 2011-05-04 17:56:28.000000000 -0400
64914@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
64915 3) suppressed due to audit_rate_limit
64916 4) suppressed due to audit_backlog_limit
64917 */
64918-static atomic_t audit_lost = ATOMIC_INIT(0);
64919+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
64920
64921 /* The netlink socket. */
64922 static struct sock *audit_sock;
64923@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
64924 unsigned long now;
64925 int print;
64926
64927- atomic_inc(&audit_lost);
64928+ atomic_inc_unchecked(&audit_lost);
64929
64930 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
64931
64932@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
64933 printk(KERN_WARNING
64934 "audit: audit_lost=%d audit_rate_limit=%d "
64935 "audit_backlog_limit=%d\n",
64936- atomic_read(&audit_lost),
64937+ atomic_read_unchecked(&audit_lost),
64938 audit_rate_limit,
64939 audit_backlog_limit);
64940 audit_panic(message);
64941@@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_b
64942 status_set.pid = audit_pid;
64943 status_set.rate_limit = audit_rate_limit;
64944 status_set.backlog_limit = audit_backlog_limit;
64945- status_set.lost = atomic_read(&audit_lost);
64946+ status_set.lost = atomic_read_unchecked(&audit_lost);
64947 status_set.backlog = skb_queue_len(&audit_skb_queue);
64948 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
64949 &status_set, sizeof(status_set));
64950@@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_b
64951 spin_unlock_irq(&tsk->sighand->siglock);
64952 }
64953 read_unlock(&tasklist_lock);
64954- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
64955- &s, sizeof(s));
64956+
64957+ if (!err)
64958+ audit_send_reply(NETLINK_CB(skb).pid, seq,
64959+ AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
64960 break;
64961 }
64962 case AUDIT_TTY_SET: {
64963diff -urNp linux-2.6.32.46/kernel/auditsc.c linux-2.6.32.46/kernel/auditsc.c
64964--- linux-2.6.32.46/kernel/auditsc.c 2011-03-27 14:31:47.000000000 -0400
64965+++ linux-2.6.32.46/kernel/auditsc.c 2011-05-04 17:56:28.000000000 -0400
64966@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_conte
64967 }
64968
64969 /* global counter which is incremented every time something logs in */
64970-static atomic_t session_id = ATOMIC_INIT(0);
64971+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
64972
64973 /**
64974 * audit_set_loginuid - set a task's audit_context loginuid
64975@@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT
64976 */
64977 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
64978 {
64979- unsigned int sessionid = atomic_inc_return(&session_id);
64980+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
64981 struct audit_context *context = task->audit_context;
64982
64983 if (context && context->in_syscall) {
64984diff -urNp linux-2.6.32.46/kernel/capability.c linux-2.6.32.46/kernel/capability.c
64985--- linux-2.6.32.46/kernel/capability.c 2011-03-27 14:31:47.000000000 -0400
64986+++ linux-2.6.32.46/kernel/capability.c 2011-04-17 15:56:46.000000000 -0400
64987@@ -305,10 +305,26 @@ int capable(int cap)
64988 BUG();
64989 }
64990
64991- if (security_capable(cap) == 0) {
64992+ if (security_capable(cap) == 0 && gr_is_capable(cap)) {
64993 current->flags |= PF_SUPERPRIV;
64994 return 1;
64995 }
64996 return 0;
64997 }
64998+
64999+int capable_nolog(int cap)
65000+{
65001+ if (unlikely(!cap_valid(cap))) {
65002+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
65003+ BUG();
65004+ }
65005+
65006+ if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
65007+ current->flags |= PF_SUPERPRIV;
65008+ return 1;
65009+ }
65010+ return 0;
65011+}
65012+
65013 EXPORT_SYMBOL(capable);
65014+EXPORT_SYMBOL(capable_nolog);
65015diff -urNp linux-2.6.32.46/kernel/cgroup.c linux-2.6.32.46/kernel/cgroup.c
65016--- linux-2.6.32.46/kernel/cgroup.c 2011-03-27 14:31:47.000000000 -0400
65017+++ linux-2.6.32.46/kernel/cgroup.c 2011-05-16 21:46:57.000000000 -0400
65018@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
65019 struct hlist_head *hhead;
65020 struct cg_cgroup_link *link;
65021
65022+ pax_track_stack();
65023+
65024 /* First see if we already have a cgroup group that matches
65025 * the desired set */
65026 read_lock(&css_set_lock);
65027diff -urNp linux-2.6.32.46/kernel/configs.c linux-2.6.32.46/kernel/configs.c
65028--- linux-2.6.32.46/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400
65029+++ linux-2.6.32.46/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400
65030@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
65031 struct proc_dir_entry *entry;
65032
65033 /* create the current config file */
65034+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
65035+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
65036+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
65037+ &ikconfig_file_ops);
65038+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65039+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
65040+ &ikconfig_file_ops);
65041+#endif
65042+#else
65043 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
65044 &ikconfig_file_ops);
65045+#endif
65046+
65047 if (!entry)
65048 return -ENOMEM;
65049
65050diff -urNp linux-2.6.32.46/kernel/cpu.c linux-2.6.32.46/kernel/cpu.c
65051--- linux-2.6.32.46/kernel/cpu.c 2011-03-27 14:31:47.000000000 -0400
65052+++ linux-2.6.32.46/kernel/cpu.c 2011-04-17 15:56:46.000000000 -0400
65053@@ -19,7 +19,7 @@
65054 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
65055 static DEFINE_MUTEX(cpu_add_remove_lock);
65056
65057-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
65058+static RAW_NOTIFIER_HEAD(cpu_chain);
65059
65060 /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
65061 * Should always be manipulated under cpu_add_remove_lock
65062diff -urNp linux-2.6.32.46/kernel/cred.c linux-2.6.32.46/kernel/cred.c
65063--- linux-2.6.32.46/kernel/cred.c 2011-03-27 14:31:47.000000000 -0400
65064+++ linux-2.6.32.46/kernel/cred.c 2011-08-11 19:49:38.000000000 -0400
65065@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head
65066 */
65067 void __put_cred(struct cred *cred)
65068 {
65069+ pax_track_stack();
65070+
65071 kdebug("__put_cred(%p{%d,%d})", cred,
65072 atomic_read(&cred->usage),
65073 read_cred_subscribers(cred));
65074@@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
65075 {
65076 struct cred *cred;
65077
65078+ pax_track_stack();
65079+
65080 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
65081 atomic_read(&tsk->cred->usage),
65082 read_cred_subscribers(tsk->cred));
65083@@ -222,6 +226,8 @@ const struct cred *get_task_cred(struct
65084 {
65085 const struct cred *cred;
65086
65087+ pax_track_stack();
65088+
65089 rcu_read_lock();
65090
65091 do {
65092@@ -241,6 +247,8 @@ struct cred *cred_alloc_blank(void)
65093 {
65094 struct cred *new;
65095
65096+ pax_track_stack();
65097+
65098 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
65099 if (!new)
65100 return NULL;
65101@@ -289,6 +297,8 @@ struct cred *prepare_creds(void)
65102 const struct cred *old;
65103 struct cred *new;
65104
65105+ pax_track_stack();
65106+
65107 validate_process_creds();
65108
65109 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65110@@ -335,6 +345,8 @@ struct cred *prepare_exec_creds(void)
65111 struct thread_group_cred *tgcred = NULL;
65112 struct cred *new;
65113
65114+ pax_track_stack();
65115+
65116 #ifdef CONFIG_KEYS
65117 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
65118 if (!tgcred)
65119@@ -441,6 +453,8 @@ int copy_creds(struct task_struct *p, un
65120 struct cred *new;
65121 int ret;
65122
65123+ pax_track_stack();
65124+
65125 mutex_init(&p->cred_guard_mutex);
65126
65127 if (
65128@@ -528,6 +542,8 @@ int commit_creds(struct cred *new)
65129 struct task_struct *task = current;
65130 const struct cred *old = task->real_cred;
65131
65132+ pax_track_stack();
65133+
65134 kdebug("commit_creds(%p{%d,%d})", new,
65135 atomic_read(&new->usage),
65136 read_cred_subscribers(new));
65137@@ -544,6 +560,8 @@ int commit_creds(struct cred *new)
65138
65139 get_cred(new); /* we will require a ref for the subj creds too */
65140
65141+ gr_set_role_label(task, new->uid, new->gid);
65142+
65143 /* dumpability changes */
65144 if (old->euid != new->euid ||
65145 old->egid != new->egid ||
65146@@ -563,10 +581,8 @@ int commit_creds(struct cred *new)
65147 key_fsgid_changed(task);
65148
65149 /* do it
65150- * - What if a process setreuid()'s and this brings the
65151- * new uid over his NPROC rlimit? We can check this now
65152- * cheaply with the new uid cache, so if it matters
65153- * we should be checking for it. -DaveM
65154+ * RLIMIT_NPROC limits on user->processes have already been checked
65155+ * in set_user().
65156 */
65157 alter_cred_subscribers(new, 2);
65158 if (new->user != old->user)
65159@@ -606,6 +622,8 @@ EXPORT_SYMBOL(commit_creds);
65160 */
65161 void abort_creds(struct cred *new)
65162 {
65163+ pax_track_stack();
65164+
65165 kdebug("abort_creds(%p{%d,%d})", new,
65166 atomic_read(&new->usage),
65167 read_cred_subscribers(new));
65168@@ -629,6 +647,8 @@ const struct cred *override_creds(const
65169 {
65170 const struct cred *old = current->cred;
65171
65172+ pax_track_stack();
65173+
65174 kdebug("override_creds(%p{%d,%d})", new,
65175 atomic_read(&new->usage),
65176 read_cred_subscribers(new));
65177@@ -658,6 +678,8 @@ void revert_creds(const struct cred *old
65178 {
65179 const struct cred *override = current->cred;
65180
65181+ pax_track_stack();
65182+
65183 kdebug("revert_creds(%p{%d,%d})", old,
65184 atomic_read(&old->usage),
65185 read_cred_subscribers(old));
65186@@ -704,6 +726,8 @@ struct cred *prepare_kernel_cred(struct
65187 const struct cred *old;
65188 struct cred *new;
65189
65190+ pax_track_stack();
65191+
65192 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
65193 if (!new)
65194 return NULL;
65195@@ -758,6 +782,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
65196 */
65197 int set_security_override(struct cred *new, u32 secid)
65198 {
65199+ pax_track_stack();
65200+
65201 return security_kernel_act_as(new, secid);
65202 }
65203 EXPORT_SYMBOL(set_security_override);
65204@@ -777,6 +803,8 @@ int set_security_override_from_ctx(struc
65205 u32 secid;
65206 int ret;
65207
65208+ pax_track_stack();
65209+
65210 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
65211 if (ret < 0)
65212 return ret;
65213diff -urNp linux-2.6.32.46/kernel/exit.c linux-2.6.32.46/kernel/exit.c
65214--- linux-2.6.32.46/kernel/exit.c 2011-03-27 14:31:47.000000000 -0400
65215+++ linux-2.6.32.46/kernel/exit.c 2011-08-17 19:19:50.000000000 -0400
65216@@ -55,6 +55,10 @@
65217 #include <asm/pgtable.h>
65218 #include <asm/mmu_context.h>
65219
65220+#ifdef CONFIG_GRKERNSEC
65221+extern rwlock_t grsec_exec_file_lock;
65222+#endif
65223+
65224 static void exit_mm(struct task_struct * tsk);
65225
65226 static void __unhash_process(struct task_struct *p)
65227@@ -174,6 +178,10 @@ void release_task(struct task_struct * p
65228 struct task_struct *leader;
65229 int zap_leader;
65230 repeat:
65231+#ifdef CONFIG_NET
65232+ gr_del_task_from_ip_table(p);
65233+#endif
65234+
65235 tracehook_prepare_release_task(p);
65236 /* don't need to get the RCU readlock here - the process is dead and
65237 * can't be modifying its own credentials */
65238@@ -341,11 +349,22 @@ static void reparent_to_kthreadd(void)
65239 {
65240 write_lock_irq(&tasklist_lock);
65241
65242+#ifdef CONFIG_GRKERNSEC
65243+ write_lock(&grsec_exec_file_lock);
65244+ if (current->exec_file) {
65245+ fput(current->exec_file);
65246+ current->exec_file = NULL;
65247+ }
65248+ write_unlock(&grsec_exec_file_lock);
65249+#endif
65250+
65251 ptrace_unlink(current);
65252 /* Reparent to init */
65253 current->real_parent = current->parent = kthreadd_task;
65254 list_move_tail(&current->sibling, &current->real_parent->children);
65255
65256+ gr_set_kernel_label(current);
65257+
65258 /* Set the exit signal to SIGCHLD so we signal init on exit */
65259 current->exit_signal = SIGCHLD;
65260
65261@@ -397,7 +416,7 @@ int allow_signal(int sig)
65262 * know it'll be handled, so that they don't get converted to
65263 * SIGKILL or just silently dropped.
65264 */
65265- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
65266+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
65267 recalc_sigpending();
65268 spin_unlock_irq(&current->sighand->siglock);
65269 return 0;
65270@@ -433,6 +452,17 @@ void daemonize(const char *name, ...)
65271 vsnprintf(current->comm, sizeof(current->comm), name, args);
65272 va_end(args);
65273
65274+#ifdef CONFIG_GRKERNSEC
65275+ write_lock(&grsec_exec_file_lock);
65276+ if (current->exec_file) {
65277+ fput(current->exec_file);
65278+ current->exec_file = NULL;
65279+ }
65280+ write_unlock(&grsec_exec_file_lock);
65281+#endif
65282+
65283+ gr_set_kernel_label(current);
65284+
65285 /*
65286 * If we were started as result of loading a module, close all of the
65287 * user space pages. We don't need them, and if we didn't close them
65288@@ -897,17 +927,17 @@ NORET_TYPE void do_exit(long code)
65289 struct task_struct *tsk = current;
65290 int group_dead;
65291
65292- profile_task_exit(tsk);
65293-
65294- WARN_ON(atomic_read(&tsk->fs_excl));
65295-
65296+ /*
65297+ * Check this first since set_fs() below depends on
65298+ * current_thread_info(), which we better not access when we're in
65299+ * interrupt context. Other than that, we want to do the set_fs()
65300+ * as early as possible.
65301+ */
65302 if (unlikely(in_interrupt()))
65303 panic("Aiee, killing interrupt handler!");
65304- if (unlikely(!tsk->pid))
65305- panic("Attempted to kill the idle task!");
65306
65307 /*
65308- * If do_exit is called because this processes oopsed, it's possible
65309+ * If do_exit is called because this processes Oops'ed, it's possible
65310 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
65311 * continuing. Amongst other possible reasons, this is to prevent
65312 * mm_release()->clear_child_tid() from writing to a user-controlled
65313@@ -915,6 +945,13 @@ NORET_TYPE void do_exit(long code)
65314 */
65315 set_fs(USER_DS);
65316
65317+ profile_task_exit(tsk);
65318+
65319+ WARN_ON(atomic_read(&tsk->fs_excl));
65320+
65321+ if (unlikely(!tsk->pid))
65322+ panic("Attempted to kill the idle task!");
65323+
65324 tracehook_report_exit(&code);
65325
65326 validate_creds_for_do_exit(tsk);
65327@@ -973,6 +1010,9 @@ NORET_TYPE void do_exit(long code)
65328 tsk->exit_code = code;
65329 taskstats_exit(tsk, group_dead);
65330
65331+ gr_acl_handle_psacct(tsk, code);
65332+ gr_acl_handle_exit();
65333+
65334 exit_mm(tsk);
65335
65336 if (group_dead)
65337@@ -1188,7 +1228,7 @@ static int wait_task_zombie(struct wait_
65338
65339 if (unlikely(wo->wo_flags & WNOWAIT)) {
65340 int exit_code = p->exit_code;
65341- int why, status;
65342+ int why;
65343
65344 get_task_struct(p);
65345 read_unlock(&tasklist_lock);
65346diff -urNp linux-2.6.32.46/kernel/fork.c linux-2.6.32.46/kernel/fork.c
65347--- linux-2.6.32.46/kernel/fork.c 2011-03-27 14:31:47.000000000 -0400
65348+++ linux-2.6.32.46/kernel/fork.c 2011-08-11 19:50:07.000000000 -0400
65349@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
65350 *stackend = STACK_END_MAGIC; /* for overflow detection */
65351
65352 #ifdef CONFIG_CC_STACKPROTECTOR
65353- tsk->stack_canary = get_random_int();
65354+ tsk->stack_canary = pax_get_random_long();
65355 #endif
65356
65357 /* One for us, one for whoever does the "release_task()" (usually parent) */
65358@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
65359 mm->locked_vm = 0;
65360 mm->mmap = NULL;
65361 mm->mmap_cache = NULL;
65362- mm->free_area_cache = oldmm->mmap_base;
65363- mm->cached_hole_size = ~0UL;
65364+ mm->free_area_cache = oldmm->free_area_cache;
65365+ mm->cached_hole_size = oldmm->cached_hole_size;
65366 mm->map_count = 0;
65367 cpumask_clear(mm_cpumask(mm));
65368 mm->mm_rb = RB_ROOT;
65369@@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm
65370 tmp->vm_flags &= ~VM_LOCKED;
65371 tmp->vm_mm = mm;
65372 tmp->vm_next = tmp->vm_prev = NULL;
65373+ tmp->vm_mirror = NULL;
65374 anon_vma_link(tmp);
65375 file = tmp->vm_file;
65376 if (file) {
65377@@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm
65378 if (retval)
65379 goto out;
65380 }
65381+
65382+#ifdef CONFIG_PAX_SEGMEXEC
65383+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
65384+ struct vm_area_struct *mpnt_m;
65385+
65386+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
65387+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
65388+
65389+ if (!mpnt->vm_mirror)
65390+ continue;
65391+
65392+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
65393+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
65394+ mpnt->vm_mirror = mpnt_m;
65395+ } else {
65396+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
65397+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
65398+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
65399+ mpnt->vm_mirror->vm_mirror = mpnt;
65400+ }
65401+ }
65402+ BUG_ON(mpnt_m);
65403+ }
65404+#endif
65405+
65406 /* a new mm has just been created */
65407 arch_dup_mmap(oldmm, mm);
65408 retval = 0;
65409@@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_f
65410 write_unlock(&fs->lock);
65411 return -EAGAIN;
65412 }
65413- fs->users++;
65414+ atomic_inc(&fs->users);
65415 write_unlock(&fs->lock);
65416 return 0;
65417 }
65418 tsk->fs = copy_fs_struct(fs);
65419 if (!tsk->fs)
65420 return -ENOMEM;
65421+ gr_set_chroot_entries(tsk, &tsk->fs->root);
65422 return 0;
65423 }
65424
65425@@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(
65426 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
65427 #endif
65428 retval = -EAGAIN;
65429+
65430+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
65431+
65432 if (atomic_read(&p->real_cred->user->processes) >=
65433 p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
65434- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
65435- p->real_cred->user != INIT_USER)
65436+ if (p->real_cred->user != INIT_USER &&
65437+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
65438 goto bad_fork_free;
65439 }
65440+ current->flags &= ~PF_NPROC_EXCEEDED;
65441
65442 retval = copy_creds(p, clone_flags);
65443 if (retval < 0)
65444@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(
65445 goto bad_fork_free_pid;
65446 }
65447
65448+ gr_copy_label(p);
65449+
65450 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
65451 /*
65452 * Clear TID on mm_release()?
65453@@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
65454 bad_fork_free:
65455 free_task(p);
65456 fork_out:
65457+ gr_log_forkfail(retval);
65458+
65459 return ERR_PTR(retval);
65460 }
65461
65462@@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
65463 if (clone_flags & CLONE_PARENT_SETTID)
65464 put_user(nr, parent_tidptr);
65465
65466+ gr_handle_brute_check();
65467+
65468 if (clone_flags & CLONE_VFORK) {
65469 p->vfork_done = &vfork;
65470 init_completion(&vfork);
65471@@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unsh
65472 return 0;
65473
65474 /* don't need lock here; in the worst case we'll do useless copy */
65475- if (fs->users == 1)
65476+ if (atomic_read(&fs->users) == 1)
65477 return 0;
65478
65479 *new_fsp = copy_fs_struct(fs);
65480@@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
65481 fs = current->fs;
65482 write_lock(&fs->lock);
65483 current->fs = new_fs;
65484- if (--fs->users)
65485+ gr_set_chroot_entries(current, &current->fs->root);
65486+ if (atomic_dec_return(&fs->users))
65487 new_fs = NULL;
65488 else
65489 new_fs = fs;
65490diff -urNp linux-2.6.32.46/kernel/futex.c linux-2.6.32.46/kernel/futex.c
65491--- linux-2.6.32.46/kernel/futex.c 2011-08-29 22:24:44.000000000 -0400
65492+++ linux-2.6.32.46/kernel/futex.c 2011-08-29 22:25:07.000000000 -0400
65493@@ -54,6 +54,7 @@
65494 #include <linux/mount.h>
65495 #include <linux/pagemap.h>
65496 #include <linux/syscalls.h>
65497+#include <linux/ptrace.h>
65498 #include <linux/signal.h>
65499 #include <linux/module.h>
65500 #include <linux/magic.h>
65501@@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fsh
65502 struct page *page;
65503 int err, ro = 0;
65504
65505+#ifdef CONFIG_PAX_SEGMEXEC
65506+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
65507+ return -EFAULT;
65508+#endif
65509+
65510 /*
65511 * The futex address must be "naturally" aligned.
65512 */
65513@@ -1819,6 +1825,8 @@ static int futex_wait(u32 __user *uaddr,
65514 struct futex_q q;
65515 int ret;
65516
65517+ pax_track_stack();
65518+
65519 if (!bitset)
65520 return -EINVAL;
65521
65522@@ -1871,7 +1879,7 @@ retry:
65523
65524 restart = &current_thread_info()->restart_block;
65525 restart->fn = futex_wait_restart;
65526- restart->futex.uaddr = (u32 *)uaddr;
65527+ restart->futex.uaddr = uaddr;
65528 restart->futex.val = val;
65529 restart->futex.time = abs_time->tv64;
65530 restart->futex.bitset = bitset;
65531@@ -2233,6 +2241,8 @@ static int futex_wait_requeue_pi(u32 __u
65532 struct futex_q q;
65533 int res, ret;
65534
65535+ pax_track_stack();
65536+
65537 if (!bitset)
65538 return -EINVAL;
65539
65540@@ -2407,7 +2417,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
65541 {
65542 struct robust_list_head __user *head;
65543 unsigned long ret;
65544+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
65545 const struct cred *cred = current_cred(), *pcred;
65546+#endif
65547
65548 if (!futex_cmpxchg_enabled)
65549 return -ENOSYS;
65550@@ -2423,11 +2435,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
65551 if (!p)
65552 goto err_unlock;
65553 ret = -EPERM;
65554+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
65555+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
65556+ goto err_unlock;
65557+#else
65558 pcred = __task_cred(p);
65559 if (cred->euid != pcred->euid &&
65560 cred->euid != pcred->uid &&
65561 !capable(CAP_SYS_PTRACE))
65562 goto err_unlock;
65563+#endif
65564 head = p->robust_list;
65565 rcu_read_unlock();
65566 }
65567@@ -2489,7 +2506,7 @@ retry:
65568 */
65569 static inline int fetch_robust_entry(struct robust_list __user **entry,
65570 struct robust_list __user * __user *head,
65571- int *pi)
65572+ unsigned int *pi)
65573 {
65574 unsigned long uentry;
65575
65576@@ -2670,6 +2687,7 @@ static int __init futex_init(void)
65577 {
65578 u32 curval;
65579 int i;
65580+ mm_segment_t oldfs;
65581
65582 /*
65583 * This will fail and we want it. Some arch implementations do
65584@@ -2681,7 +2699,10 @@ static int __init futex_init(void)
65585 * implementation, the non functional ones will return
65586 * -ENOSYS.
65587 */
65588+ oldfs = get_fs();
65589+ set_fs(USER_DS);
65590 curval = cmpxchg_futex_value_locked(NULL, 0, 0);
65591+ set_fs(oldfs);
65592 if (curval == -EFAULT)
65593 futex_cmpxchg_enabled = 1;
65594
65595diff -urNp linux-2.6.32.46/kernel/futex_compat.c linux-2.6.32.46/kernel/futex_compat.c
65596--- linux-2.6.32.46/kernel/futex_compat.c 2011-03-27 14:31:47.000000000 -0400
65597+++ linux-2.6.32.46/kernel/futex_compat.c 2011-04-17 15:56:46.000000000 -0400
65598@@ -10,6 +10,7 @@
65599 #include <linux/compat.h>
65600 #include <linux/nsproxy.h>
65601 #include <linux/futex.h>
65602+#include <linux/ptrace.h>
65603
65604 #include <asm/uaccess.h>
65605
65606@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
65607 {
65608 struct compat_robust_list_head __user *head;
65609 unsigned long ret;
65610- const struct cred *cred = current_cred(), *pcred;
65611+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
65612+ const struct cred *cred = current_cred();
65613+ const struct cred *pcred;
65614+#endif
65615
65616 if (!futex_cmpxchg_enabled)
65617 return -ENOSYS;
65618@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
65619 if (!p)
65620 goto err_unlock;
65621 ret = -EPERM;
65622+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
65623+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
65624+ goto err_unlock;
65625+#else
65626 pcred = __task_cred(p);
65627 if (cred->euid != pcred->euid &&
65628 cred->euid != pcred->uid &&
65629 !capable(CAP_SYS_PTRACE))
65630 goto err_unlock;
65631+#endif
65632 head = p->compat_robust_list;
65633 read_unlock(&tasklist_lock);
65634 }
65635diff -urNp linux-2.6.32.46/kernel/gcov/base.c linux-2.6.32.46/kernel/gcov/base.c
65636--- linux-2.6.32.46/kernel/gcov/base.c 2011-03-27 14:31:47.000000000 -0400
65637+++ linux-2.6.32.46/kernel/gcov/base.c 2011-04-17 15:56:46.000000000 -0400
65638@@ -102,11 +102,6 @@ void gcov_enable_events(void)
65639 }
65640
65641 #ifdef CONFIG_MODULES
65642-static inline int within(void *addr, void *start, unsigned long size)
65643-{
65644- return ((addr >= start) && (addr < start + size));
65645-}
65646-
65647 /* Update list and generate events when modules are unloaded. */
65648 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
65649 void *data)
65650@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
65651 prev = NULL;
65652 /* Remove entries located in module from linked list. */
65653 for (info = gcov_info_head; info; info = info->next) {
65654- if (within(info, mod->module_core, mod->core_size)) {
65655+ if (within_module_core_rw((unsigned long)info, mod)) {
65656 if (prev)
65657 prev->next = info->next;
65658 else
65659diff -urNp linux-2.6.32.46/kernel/hrtimer.c linux-2.6.32.46/kernel/hrtimer.c
65660--- linux-2.6.32.46/kernel/hrtimer.c 2011-03-27 14:31:47.000000000 -0400
65661+++ linux-2.6.32.46/kernel/hrtimer.c 2011-04-17 15:56:46.000000000 -0400
65662@@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
65663 local_irq_restore(flags);
65664 }
65665
65666-static void run_hrtimer_softirq(struct softirq_action *h)
65667+static void run_hrtimer_softirq(void)
65668 {
65669 hrtimer_peek_ahead_timers();
65670 }
65671diff -urNp linux-2.6.32.46/kernel/kallsyms.c linux-2.6.32.46/kernel/kallsyms.c
65672--- linux-2.6.32.46/kernel/kallsyms.c 2011-03-27 14:31:47.000000000 -0400
65673+++ linux-2.6.32.46/kernel/kallsyms.c 2011-04-17 15:56:46.000000000 -0400
65674@@ -11,6 +11,9 @@
65675 * Changed the compression method from stem compression to "table lookup"
65676 * compression (see scripts/kallsyms.c for a more complete description)
65677 */
65678+#ifdef CONFIG_GRKERNSEC_HIDESYM
65679+#define __INCLUDED_BY_HIDESYM 1
65680+#endif
65681 #include <linux/kallsyms.h>
65682 #include <linux/module.h>
65683 #include <linux/init.h>
65684@@ -51,12 +54,33 @@ extern const unsigned long kallsyms_mark
65685
65686 static inline int is_kernel_inittext(unsigned long addr)
65687 {
65688+ if (system_state != SYSTEM_BOOTING)
65689+ return 0;
65690+
65691 if (addr >= (unsigned long)_sinittext
65692 && addr <= (unsigned long)_einittext)
65693 return 1;
65694 return 0;
65695 }
65696
65697+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
65698+#ifdef CONFIG_MODULES
65699+static inline int is_module_text(unsigned long addr)
65700+{
65701+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
65702+ return 1;
65703+
65704+ addr = ktla_ktva(addr);
65705+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
65706+}
65707+#else
65708+static inline int is_module_text(unsigned long addr)
65709+{
65710+ return 0;
65711+}
65712+#endif
65713+#endif
65714+
65715 static inline int is_kernel_text(unsigned long addr)
65716 {
65717 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
65718@@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigne
65719
65720 static inline int is_kernel(unsigned long addr)
65721 {
65722+
65723+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
65724+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
65725+ return 1;
65726+
65727+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
65728+#else
65729 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
65730+#endif
65731+
65732 return 1;
65733 return in_gate_area_no_task(addr);
65734 }
65735
65736 static int is_ksym_addr(unsigned long addr)
65737 {
65738+
65739+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
65740+ if (is_module_text(addr))
65741+ return 0;
65742+#endif
65743+
65744 if (all_var)
65745 return is_kernel(addr);
65746
65747@@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(st
65748
65749 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
65750 {
65751- iter->name[0] = '\0';
65752 iter->nameoff = get_symbol_offset(new_pos);
65753 iter->pos = new_pos;
65754 }
65755@@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, vo
65756 {
65757 struct kallsym_iter *iter = m->private;
65758
65759+#ifdef CONFIG_GRKERNSEC_HIDESYM
65760+ if (current_uid())
65761+ return 0;
65762+#endif
65763+
65764 /* Some debugging symbols have no name. Ignore them. */
65765 if (!iter->name[0])
65766 return 0;
65767@@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *i
65768 struct kallsym_iter *iter;
65769 int ret;
65770
65771- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
65772+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
65773 if (!iter)
65774 return -ENOMEM;
65775 reset_iter(iter, 0);
65776diff -urNp linux-2.6.32.46/kernel/kgdb.c linux-2.6.32.46/kernel/kgdb.c
65777--- linux-2.6.32.46/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400
65778+++ linux-2.6.32.46/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
65779@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
65780 /* Guard for recursive entry */
65781 static int exception_level;
65782
65783-static struct kgdb_io *kgdb_io_ops;
65784+static const struct kgdb_io *kgdb_io_ops;
65785 static DEFINE_SPINLOCK(kgdb_registration_lock);
65786
65787 /* kgdb console driver is loaded */
65788@@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1)
65789 */
65790 static atomic_t passive_cpu_wait[NR_CPUS];
65791 static atomic_t cpu_in_kgdb[NR_CPUS];
65792-atomic_t kgdb_setting_breakpoint;
65793+atomic_unchecked_t kgdb_setting_breakpoint;
65794
65795 struct task_struct *kgdb_usethread;
65796 struct task_struct *kgdb_contthread;
65797@@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBY
65798 sizeof(unsigned long)];
65799
65800 /* to keep track of the CPU which is doing the single stepping*/
65801-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65802+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
65803
65804 /*
65805 * If you are debugging a problem where roundup (the collection of
65806@@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
65807 return 0;
65808 if (kgdb_connected)
65809 return 1;
65810- if (atomic_read(&kgdb_setting_breakpoint))
65811+ if (atomic_read_unchecked(&kgdb_setting_breakpoint))
65812 return 1;
65813 if (print_wait)
65814 printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
65815@@ -1426,8 +1426,8 @@ acquirelock:
65816 * instance of the exception handler wanted to come into the
65817 * debugger on a different CPU via a single step
65818 */
65819- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
65820- atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
65821+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
65822+ atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
65823
65824 atomic_set(&kgdb_active, -1);
65825 touch_softlockup_watchdog();
65826@@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void
65827 *
65828 * Register it with the KGDB core.
65829 */
65830-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
65831+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
65832 {
65833 int err;
65834
65835@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
65836 *
65837 * Unregister it with the KGDB core.
65838 */
65839-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
65840+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
65841 {
65842 BUG_ON(kgdb_connected);
65843
65844@@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_mod
65845 */
65846 void kgdb_breakpoint(void)
65847 {
65848- atomic_set(&kgdb_setting_breakpoint, 1);
65849+ atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
65850 wmb(); /* Sync point before breakpoint */
65851 arch_kgdb_breakpoint();
65852 wmb(); /* Sync point after breakpoint */
65853- atomic_set(&kgdb_setting_breakpoint, 0);
65854+ atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
65855 }
65856 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
65857
65858diff -urNp linux-2.6.32.46/kernel/kmod.c linux-2.6.32.46/kernel/kmod.c
65859--- linux-2.6.32.46/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400
65860+++ linux-2.6.32.46/kernel/kmod.c 2011-04-17 15:56:46.000000000 -0400
65861@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
65862 * If module auto-loading support is disabled then this function
65863 * becomes a no-operation.
65864 */
65865-int __request_module(bool wait, const char *fmt, ...)
65866+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
65867 {
65868- va_list args;
65869 char module_name[MODULE_NAME_LEN];
65870 unsigned int max_modprobes;
65871 int ret;
65872- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
65873+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
65874 static char *envp[] = { "HOME=/",
65875 "TERM=linux",
65876 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
65877@@ -84,12 +83,24 @@ int __request_module(bool wait, const ch
65878 if (ret)
65879 return ret;
65880
65881- va_start(args, fmt);
65882- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
65883- va_end(args);
65884+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
65885 if (ret >= MODULE_NAME_LEN)
65886 return -ENAMETOOLONG;
65887
65888+#ifdef CONFIG_GRKERNSEC_MODHARDEN
65889+ if (!current_uid()) {
65890+ /* hack to workaround consolekit/udisks stupidity */
65891+ read_lock(&tasklist_lock);
65892+ if (!strcmp(current->comm, "mount") &&
65893+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
65894+ read_unlock(&tasklist_lock);
65895+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
65896+ return -EPERM;
65897+ }
65898+ read_unlock(&tasklist_lock);
65899+ }
65900+#endif
65901+
65902 /* If modprobe needs a service that is in a module, we get a recursive
65903 * loop. Limit the number of running kmod threads to max_threads/2 or
65904 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
65905@@ -121,6 +132,48 @@ int __request_module(bool wait, const ch
65906 atomic_dec(&kmod_concurrent);
65907 return ret;
65908 }
65909+
65910+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
65911+{
65912+ va_list args;
65913+ int ret;
65914+
65915+ va_start(args, fmt);
65916+ ret = ____request_module(wait, module_param, fmt, args);
65917+ va_end(args);
65918+
65919+ return ret;
65920+}
65921+
65922+int __request_module(bool wait, const char *fmt, ...)
65923+{
65924+ va_list args;
65925+ int ret;
65926+
65927+#ifdef CONFIG_GRKERNSEC_MODHARDEN
65928+ if (current_uid()) {
65929+ char module_param[MODULE_NAME_LEN];
65930+
65931+ memset(module_param, 0, sizeof(module_param));
65932+
65933+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
65934+
65935+ va_start(args, fmt);
65936+ ret = ____request_module(wait, module_param, fmt, args);
65937+ va_end(args);
65938+
65939+ return ret;
65940+ }
65941+#endif
65942+
65943+ va_start(args, fmt);
65944+ ret = ____request_module(wait, NULL, fmt, args);
65945+ va_end(args);
65946+
65947+ return ret;
65948+}
65949+
65950+
65951 EXPORT_SYMBOL(__request_module);
65952 #endif /* CONFIG_MODULES */
65953
65954diff -urNp linux-2.6.32.46/kernel/kprobes.c linux-2.6.32.46/kernel/kprobes.c
65955--- linux-2.6.32.46/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
65956+++ linux-2.6.32.46/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
65957@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
65958 * kernel image and loaded module images reside. This is required
65959 * so x86_64 can correctly handle the %rip-relative fixups.
65960 */
65961- kip->insns = module_alloc(PAGE_SIZE);
65962+ kip->insns = module_alloc_exec(PAGE_SIZE);
65963 if (!kip->insns) {
65964 kfree(kip);
65965 return NULL;
65966@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
65967 */
65968 if (!list_is_singular(&kprobe_insn_pages)) {
65969 list_del(&kip->list);
65970- module_free(NULL, kip->insns);
65971+ module_free_exec(NULL, kip->insns);
65972 kfree(kip);
65973 }
65974 return 1;
65975@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
65976 {
65977 int i, err = 0;
65978 unsigned long offset = 0, size = 0;
65979- char *modname, namebuf[128];
65980+ char *modname, namebuf[KSYM_NAME_LEN];
65981 const char *symbol_name;
65982 void *addr;
65983 struct kprobe_blackpoint *kb;
65984@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
65985 const char *sym = NULL;
65986 unsigned int i = *(loff_t *) v;
65987 unsigned long offset = 0;
65988- char *modname, namebuf[128];
65989+ char *modname, namebuf[KSYM_NAME_LEN];
65990
65991 head = &kprobe_table[i];
65992 preempt_disable();
65993diff -urNp linux-2.6.32.46/kernel/lockdep.c linux-2.6.32.46/kernel/lockdep.c
65994--- linux-2.6.32.46/kernel/lockdep.c 2011-06-25 12:55:35.000000000 -0400
65995+++ linux-2.6.32.46/kernel/lockdep.c 2011-06-25 12:56:37.000000000 -0400
65996@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_t
65997 /*
65998 * Various lockdep statistics:
65999 */
66000-atomic_t chain_lookup_hits;
66001-atomic_t chain_lookup_misses;
66002-atomic_t hardirqs_on_events;
66003-atomic_t hardirqs_off_events;
66004-atomic_t redundant_hardirqs_on;
66005-atomic_t redundant_hardirqs_off;
66006-atomic_t softirqs_on_events;
66007-atomic_t softirqs_off_events;
66008-atomic_t redundant_softirqs_on;
66009-atomic_t redundant_softirqs_off;
66010-atomic_t nr_unused_locks;
66011-atomic_t nr_cyclic_checks;
66012-atomic_t nr_find_usage_forwards_checks;
66013-atomic_t nr_find_usage_backwards_checks;
66014+atomic_unchecked_t chain_lookup_hits;
66015+atomic_unchecked_t chain_lookup_misses;
66016+atomic_unchecked_t hardirqs_on_events;
66017+atomic_unchecked_t hardirqs_off_events;
66018+atomic_unchecked_t redundant_hardirqs_on;
66019+atomic_unchecked_t redundant_hardirqs_off;
66020+atomic_unchecked_t softirqs_on_events;
66021+atomic_unchecked_t softirqs_off_events;
66022+atomic_unchecked_t redundant_softirqs_on;
66023+atomic_unchecked_t redundant_softirqs_off;
66024+atomic_unchecked_t nr_unused_locks;
66025+atomic_unchecked_t nr_cyclic_checks;
66026+atomic_unchecked_t nr_find_usage_forwards_checks;
66027+atomic_unchecked_t nr_find_usage_backwards_checks;
66028 #endif
66029
66030 /*
66031@@ -577,6 +577,10 @@ static int static_obj(void *obj)
66032 int i;
66033 #endif
66034
66035+#ifdef CONFIG_PAX_KERNEXEC
66036+ start = ktla_ktva(start);
66037+#endif
66038+
66039 /*
66040 * static variable?
66041 */
66042@@ -592,8 +596,7 @@ static int static_obj(void *obj)
66043 */
66044 for_each_possible_cpu(i) {
66045 start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
66046- end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
66047- + per_cpu_offset(i);
66048+ end = start + PERCPU_ENOUGH_ROOM;
66049
66050 if ((addr >= start) && (addr < end))
66051 return 1;
66052@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
66053 if (!static_obj(lock->key)) {
66054 debug_locks_off();
66055 printk("INFO: trying to register non-static key.\n");
66056+ printk("lock:%pS key:%pS.\n", lock, lock->key);
66057 printk("the code is fine but needs lockdep annotation.\n");
66058 printk("turning off the locking correctness validator.\n");
66059 dump_stack();
66060@@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep
66061 if (!class)
66062 return 0;
66063 }
66064- debug_atomic_inc((atomic_t *)&class->ops);
66065+ debug_atomic_inc((atomic_unchecked_t *)&class->ops);
66066 if (very_verbose(class)) {
66067 printk("\nacquire class [%p] %s", class->key, class->name);
66068 if (class->name_version > 1)
66069diff -urNp linux-2.6.32.46/kernel/lockdep_internals.h linux-2.6.32.46/kernel/lockdep_internals.h
66070--- linux-2.6.32.46/kernel/lockdep_internals.h 2011-03-27 14:31:47.000000000 -0400
66071+++ linux-2.6.32.46/kernel/lockdep_internals.h 2011-04-17 15:56:46.000000000 -0400
66072@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_
66073 /*
66074 * Various lockdep statistics:
66075 */
66076-extern atomic_t chain_lookup_hits;
66077-extern atomic_t chain_lookup_misses;
66078-extern atomic_t hardirqs_on_events;
66079-extern atomic_t hardirqs_off_events;
66080-extern atomic_t redundant_hardirqs_on;
66081-extern atomic_t redundant_hardirqs_off;
66082-extern atomic_t softirqs_on_events;
66083-extern atomic_t softirqs_off_events;
66084-extern atomic_t redundant_softirqs_on;
66085-extern atomic_t redundant_softirqs_off;
66086-extern atomic_t nr_unused_locks;
66087-extern atomic_t nr_cyclic_checks;
66088-extern atomic_t nr_cyclic_check_recursions;
66089-extern atomic_t nr_find_usage_forwards_checks;
66090-extern atomic_t nr_find_usage_forwards_recursions;
66091-extern atomic_t nr_find_usage_backwards_checks;
66092-extern atomic_t nr_find_usage_backwards_recursions;
66093-# define debug_atomic_inc(ptr) atomic_inc(ptr)
66094-# define debug_atomic_dec(ptr) atomic_dec(ptr)
66095-# define debug_atomic_read(ptr) atomic_read(ptr)
66096+extern atomic_unchecked_t chain_lookup_hits;
66097+extern atomic_unchecked_t chain_lookup_misses;
66098+extern atomic_unchecked_t hardirqs_on_events;
66099+extern atomic_unchecked_t hardirqs_off_events;
66100+extern atomic_unchecked_t redundant_hardirqs_on;
66101+extern atomic_unchecked_t redundant_hardirqs_off;
66102+extern atomic_unchecked_t softirqs_on_events;
66103+extern atomic_unchecked_t softirqs_off_events;
66104+extern atomic_unchecked_t redundant_softirqs_on;
66105+extern atomic_unchecked_t redundant_softirqs_off;
66106+extern atomic_unchecked_t nr_unused_locks;
66107+extern atomic_unchecked_t nr_cyclic_checks;
66108+extern atomic_unchecked_t nr_cyclic_check_recursions;
66109+extern atomic_unchecked_t nr_find_usage_forwards_checks;
66110+extern atomic_unchecked_t nr_find_usage_forwards_recursions;
66111+extern atomic_unchecked_t nr_find_usage_backwards_checks;
66112+extern atomic_unchecked_t nr_find_usage_backwards_recursions;
66113+# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
66114+# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
66115+# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
66116 #else
66117 # define debug_atomic_inc(ptr) do { } while (0)
66118 # define debug_atomic_dec(ptr) do { } while (0)
66119diff -urNp linux-2.6.32.46/kernel/lockdep_proc.c linux-2.6.32.46/kernel/lockdep_proc.c
66120--- linux-2.6.32.46/kernel/lockdep_proc.c 2011-03-27 14:31:47.000000000 -0400
66121+++ linux-2.6.32.46/kernel/lockdep_proc.c 2011-04-17 15:56:46.000000000 -0400
66122@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
66123
66124 static void print_name(struct seq_file *m, struct lock_class *class)
66125 {
66126- char str[128];
66127+ char str[KSYM_NAME_LEN];
66128 const char *name = class->name;
66129
66130 if (!name) {
66131diff -urNp linux-2.6.32.46/kernel/module.c linux-2.6.32.46/kernel/module.c
66132--- linux-2.6.32.46/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
66133+++ linux-2.6.32.46/kernel/module.c 2011-04-29 18:52:40.000000000 -0400
66134@@ -55,6 +55,7 @@
66135 #include <linux/async.h>
66136 #include <linux/percpu.h>
66137 #include <linux/kmemleak.h>
66138+#include <linux/grsecurity.h>
66139
66140 #define CREATE_TRACE_POINTS
66141 #include <trace/events/module.h>
66142@@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
66143 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
66144
66145 /* Bounds of module allocation, for speeding __module_address */
66146-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
66147+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
66148+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
66149
66150 int register_module_notifier(struct notifier_block * nb)
66151 {
66152@@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct
66153 return true;
66154
66155 list_for_each_entry_rcu(mod, &modules, list) {
66156- struct symsearch arr[] = {
66157+ struct symsearch modarr[] = {
66158 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
66159 NOT_GPL_ONLY, false },
66160 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
66161@@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct
66162 #endif
66163 };
66164
66165- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
66166+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
66167 return true;
66168 }
66169 return false;
66170@@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned lo
66171 void *ptr;
66172 int cpu;
66173
66174- if (align > PAGE_SIZE) {
66175+ if (align-1 >= PAGE_SIZE) {
66176 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
66177 name, align, PAGE_SIZE);
66178 align = PAGE_SIZE;
66179@@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resol
66180 * /sys/module/foo/sections stuff
66181 * J. Corbet <corbet@lwn.net>
66182 */
66183-#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
66184+#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
66185
66186 static inline bool sect_empty(const Elf_Shdr *sect)
66187 {
66188@@ -1545,7 +1547,8 @@ static void free_module(struct module *m
66189 destroy_params(mod->kp, mod->num_kp);
66190
66191 /* This may be NULL, but that's OK */
66192- module_free(mod, mod->module_init);
66193+ module_free(mod, mod->module_init_rw);
66194+ module_free_exec(mod, mod->module_init_rx);
66195 kfree(mod->args);
66196 if (mod->percpu)
66197 percpu_modfree(mod->percpu);
66198@@ -1554,10 +1557,12 @@ static void free_module(struct module *m
66199 percpu_modfree(mod->refptr);
66200 #endif
66201 /* Free lock-classes: */
66202- lockdep_free_key_range(mod->module_core, mod->core_size);
66203+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
66204+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
66205
66206 /* Finally, free the core (containing the module structure) */
66207- module_free(mod, mod->module_core);
66208+ module_free_exec(mod, mod->module_core_rx);
66209+ module_free(mod, mod->module_core_rw);
66210
66211 #ifdef CONFIG_MPU
66212 update_protections(current->mm);
66213@@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *se
66214 unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
66215 int ret = 0;
66216 const struct kernel_symbol *ksym;
66217+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66218+ int is_fs_load = 0;
66219+ int register_filesystem_found = 0;
66220+ char *p;
66221+
66222+ p = strstr(mod->args, "grsec_modharden_fs");
66223+
66224+ if (p) {
66225+ char *endptr = p + strlen("grsec_modharden_fs");
66226+ /* copy \0 as well */
66227+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
66228+ is_fs_load = 1;
66229+ }
66230+#endif
66231+
66232
66233 for (i = 1; i < n; i++) {
66234+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66235+ const char *name = strtab + sym[i].st_name;
66236+
66237+ /* it's a real shame this will never get ripped and copied
66238+ upstream! ;(
66239+ */
66240+ if (is_fs_load && !strcmp(name, "register_filesystem"))
66241+ register_filesystem_found = 1;
66242+#endif
66243 switch (sym[i].st_shndx) {
66244 case SHN_COMMON:
66245 /* We compiled with -fno-common. These are not
66246@@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *se
66247 strtab + sym[i].st_name, mod);
66248 /* Ok if resolved. */
66249 if (ksym) {
66250+ pax_open_kernel();
66251 sym[i].st_value = ksym->value;
66252+ pax_close_kernel();
66253 break;
66254 }
66255
66256@@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *se
66257 secbase = (unsigned long)mod->percpu;
66258 else
66259 secbase = sechdrs[sym[i].st_shndx].sh_addr;
66260+ pax_open_kernel();
66261 sym[i].st_value += secbase;
66262+ pax_close_kernel();
66263 break;
66264 }
66265 }
66266
66267+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66268+ if (is_fs_load && !register_filesystem_found) {
66269+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
66270+ ret = -EPERM;
66271+ }
66272+#endif
66273+
66274 return ret;
66275 }
66276
66277@@ -1731,11 +1771,12 @@ static void layout_sections(struct modul
66278 || s->sh_entsize != ~0UL
66279 || strstarts(secstrings + s->sh_name, ".init"))
66280 continue;
66281- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
66282+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66283+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
66284+ else
66285+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
66286 DEBUGP("\t%s\n", secstrings + s->sh_name);
66287 }
66288- if (m == 0)
66289- mod->core_text_size = mod->core_size;
66290 }
66291
66292 DEBUGP("Init section allocation order:\n");
66293@@ -1748,12 +1789,13 @@ static void layout_sections(struct modul
66294 || s->sh_entsize != ~0UL
66295 || !strstarts(secstrings + s->sh_name, ".init"))
66296 continue;
66297- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
66298- | INIT_OFFSET_MASK);
66299+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
66300+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
66301+ else
66302+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
66303+ s->sh_entsize |= INIT_OFFSET_MASK;
66304 DEBUGP("\t%s\n", secstrings + s->sh_name);
66305 }
66306- if (m == 0)
66307- mod->init_text_size = mod->init_size;
66308 }
66309 }
66310
66311@@ -1857,9 +1899,8 @@ static int is_exported(const char *name,
66312
66313 /* As per nm */
66314 static char elf_type(const Elf_Sym *sym,
66315- Elf_Shdr *sechdrs,
66316- const char *secstrings,
66317- struct module *mod)
66318+ const Elf_Shdr *sechdrs,
66319+ const char *secstrings)
66320 {
66321 if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
66322 if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
66323@@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struc
66324
66325 /* Put symbol section at end of init part of module. */
66326 symsect->sh_flags |= SHF_ALLOC;
66327- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
66328+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
66329 symindex) | INIT_OFFSET_MASK;
66330 DEBUGP("\t%s\n", secstrings + symsect->sh_name);
66331
66332@@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struc
66333 }
66334
66335 /* Append room for core symbols at end of core part. */
66336- symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
66337- mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
66338+ symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
66339+ mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
66340
66341 /* Put string table section at end of init part of module. */
66342 strsect->sh_flags |= SHF_ALLOC;
66343- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
66344+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
66345 strindex) | INIT_OFFSET_MASK;
66346 DEBUGP("\t%s\n", secstrings + strsect->sh_name);
66347
66348 /* Append room for core symbols' strings at end of core part. */
66349- *pstroffs = mod->core_size;
66350+ *pstroffs = mod->core_size_rx;
66351 __set_bit(0, strmap);
66352- mod->core_size += bitmap_weight(strmap, strsect->sh_size);
66353+ mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
66354
66355 return symoffs;
66356 }
66357@@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *
66358 mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
66359 mod->strtab = (void *)sechdrs[strindex].sh_addr;
66360
66361+ pax_open_kernel();
66362+
66363 /* Set types up while we still have access to sections. */
66364 for (i = 0; i < mod->num_symtab; i++)
66365 mod->symtab[i].st_info
66366- = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
66367+ = elf_type(&mod->symtab[i], sechdrs, secstrings);
66368
66369- mod->core_symtab = dst = mod->module_core + symoffs;
66370+ mod->core_symtab = dst = mod->module_core_rx + symoffs;
66371 src = mod->symtab;
66372 *dst = *src;
66373 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
66374@@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *
66375 }
66376 mod->core_num_syms = ndst;
66377
66378- mod->core_strtab = s = mod->module_core + stroffs;
66379+ mod->core_strtab = s = mod->module_core_rx + stroffs;
66380 for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
66381 if (test_bit(i, strmap))
66382 *++s = mod->strtab[i];
66383+
66384+ pax_close_kernel();
66385 }
66386 #else
66387 static inline unsigned long layout_symtab(struct module *mod,
66388@@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _
66389 #endif
66390 }
66391
66392-static void *module_alloc_update_bounds(unsigned long size)
66393+static void *module_alloc_update_bounds_rw(unsigned long size)
66394 {
66395 void *ret = module_alloc(size);
66396
66397 if (ret) {
66398 /* Update module bounds. */
66399- if ((unsigned long)ret < module_addr_min)
66400- module_addr_min = (unsigned long)ret;
66401- if ((unsigned long)ret + size > module_addr_max)
66402- module_addr_max = (unsigned long)ret + size;
66403+ if ((unsigned long)ret < module_addr_min_rw)
66404+ module_addr_min_rw = (unsigned long)ret;
66405+ if ((unsigned long)ret + size > module_addr_max_rw)
66406+ module_addr_max_rw = (unsigned long)ret + size;
66407+ }
66408+ return ret;
66409+}
66410+
66411+static void *module_alloc_update_bounds_rx(unsigned long size)
66412+{
66413+ void *ret = module_alloc_exec(size);
66414+
66415+ if (ret) {
66416+ /* Update module bounds. */
66417+ if ((unsigned long)ret < module_addr_min_rx)
66418+ module_addr_min_rx = (unsigned long)ret;
66419+ if ((unsigned long)ret + size > module_addr_max_rx)
66420+ module_addr_max_rx = (unsigned long)ret + size;
66421 }
66422 return ret;
66423 }
66424@@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct
66425 unsigned int i;
66426
66427 /* only scan the sections containing data */
66428- kmemleak_scan_area(mod->module_core, (unsigned long)mod -
66429- (unsigned long)mod->module_core,
66430+ kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
66431+ (unsigned long)mod->module_core_rw,
66432 sizeof(struct module), GFP_KERNEL);
66433
66434 for (i = 1; i < hdr->e_shnum; i++) {
66435@@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct
66436 && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
66437 continue;
66438
66439- kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
66440- (unsigned long)mod->module_core,
66441+ kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
66442+ (unsigned long)mod->module_core_rw,
66443 sechdrs[i].sh_size, GFP_KERNEL);
66444 }
66445 }
66446@@ -2263,7 +2322,7 @@ static noinline struct module *load_modu
66447 secstrings, &stroffs, strmap);
66448
66449 /* Do the allocs. */
66450- ptr = module_alloc_update_bounds(mod->core_size);
66451+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
66452 /*
66453 * The pointer to this block is stored in the module structure
66454 * which is inside the block. Just mark it as not being a
66455@@ -2274,23 +2333,47 @@ static noinline struct module *load_modu
66456 err = -ENOMEM;
66457 goto free_percpu;
66458 }
66459- memset(ptr, 0, mod->core_size);
66460- mod->module_core = ptr;
66461+ memset(ptr, 0, mod->core_size_rw);
66462+ mod->module_core_rw = ptr;
66463
66464- ptr = module_alloc_update_bounds(mod->init_size);
66465+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
66466 /*
66467 * The pointer to this block is stored in the module structure
66468 * which is inside the block. This block doesn't need to be
66469 * scanned as it contains data and code that will be freed
66470 * after the module is initialized.
66471 */
66472- kmemleak_ignore(ptr);
66473- if (!ptr && mod->init_size) {
66474+ kmemleak_not_leak(ptr);
66475+ if (!ptr && mod->init_size_rw) {
66476+ err = -ENOMEM;
66477+ goto free_core_rw;
66478+ }
66479+ memset(ptr, 0, mod->init_size_rw);
66480+ mod->module_init_rw = ptr;
66481+
66482+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
66483+ kmemleak_not_leak(ptr);
66484+ if (!ptr) {
66485 err = -ENOMEM;
66486- goto free_core;
66487+ goto free_init_rw;
66488 }
66489- memset(ptr, 0, mod->init_size);
66490- mod->module_init = ptr;
66491+
66492+ pax_open_kernel();
66493+ memset(ptr, 0, mod->core_size_rx);
66494+ pax_close_kernel();
66495+ mod->module_core_rx = ptr;
66496+
66497+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
66498+ kmemleak_not_leak(ptr);
66499+ if (!ptr && mod->init_size_rx) {
66500+ err = -ENOMEM;
66501+ goto free_core_rx;
66502+ }
66503+
66504+ pax_open_kernel();
66505+ memset(ptr, 0, mod->init_size_rx);
66506+ pax_close_kernel();
66507+ mod->module_init_rx = ptr;
66508
66509 /* Transfer each section which specifies SHF_ALLOC */
66510 DEBUGP("final section addresses:\n");
66511@@ -2300,17 +2383,45 @@ static noinline struct module *load_modu
66512 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
66513 continue;
66514
66515- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
66516- dest = mod->module_init
66517- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
66518- else
66519- dest = mod->module_core + sechdrs[i].sh_entsize;
66520+ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
66521+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
66522+ dest = mod->module_init_rw
66523+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
66524+ else
66525+ dest = mod->module_init_rx
66526+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
66527+ } else {
66528+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
66529+ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
66530+ else
66531+ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
66532+ }
66533+
66534+ if (sechdrs[i].sh_type != SHT_NOBITS) {
66535
66536- if (sechdrs[i].sh_type != SHT_NOBITS)
66537- memcpy(dest, (void *)sechdrs[i].sh_addr,
66538- sechdrs[i].sh_size);
66539+#ifdef CONFIG_PAX_KERNEXEC
66540+#ifdef CONFIG_X86_64
66541+ if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
66542+ set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
66543+#endif
66544+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
66545+ pax_open_kernel();
66546+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
66547+ pax_close_kernel();
66548+ } else
66549+#endif
66550+
66551+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
66552+ }
66553 /* Update sh_addr to point to copy in image. */
66554- sechdrs[i].sh_addr = (unsigned long)dest;
66555+
66556+#ifdef CONFIG_PAX_KERNEXEC
66557+ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
66558+ sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
66559+ else
66560+#endif
66561+
66562+ sechdrs[i].sh_addr = (unsigned long)dest;
66563 DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
66564 }
66565 /* Module has been moved. */
66566@@ -2322,7 +2433,7 @@ static noinline struct module *load_modu
66567 mod->name);
66568 if (!mod->refptr) {
66569 err = -ENOMEM;
66570- goto free_init;
66571+ goto free_init_rx;
66572 }
66573 #endif
66574 /* Now we've moved module, initialize linked lists, etc. */
66575@@ -2351,6 +2462,31 @@ static noinline struct module *load_modu
66576 /* Set up MODINFO_ATTR fields */
66577 setup_modinfo(mod, sechdrs, infoindex);
66578
66579+ mod->args = args;
66580+
66581+#ifdef CONFIG_GRKERNSEC_MODHARDEN
66582+ {
66583+ char *p, *p2;
66584+
66585+ if (strstr(mod->args, "grsec_modharden_netdev")) {
66586+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
66587+ err = -EPERM;
66588+ goto cleanup;
66589+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
66590+ p += strlen("grsec_modharden_normal");
66591+ p2 = strstr(p, "_");
66592+ if (p2) {
66593+ *p2 = '\0';
66594+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
66595+ *p2 = '_';
66596+ }
66597+ err = -EPERM;
66598+ goto cleanup;
66599+ }
66600+ }
66601+#endif
66602+
66603+
66604 /* Fix up syms, so that st_value is a pointer to location. */
66605 err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
66606 mod);
66607@@ -2431,8 +2567,8 @@ static noinline struct module *load_modu
66608
66609 /* Now do relocations. */
66610 for (i = 1; i < hdr->e_shnum; i++) {
66611- const char *strtab = (char *)sechdrs[strindex].sh_addr;
66612 unsigned int info = sechdrs[i].sh_info;
66613+ strtab = (char *)sechdrs[strindex].sh_addr;
66614
66615 /* Not a valid relocation section? */
66616 if (info >= hdr->e_shnum)
66617@@ -2493,16 +2629,15 @@ static noinline struct module *load_modu
66618 * Do it before processing of module parameters, so the module
66619 * can provide parameter accessor functions of its own.
66620 */
66621- if (mod->module_init)
66622- flush_icache_range((unsigned long)mod->module_init,
66623- (unsigned long)mod->module_init
66624- + mod->init_size);
66625- flush_icache_range((unsigned long)mod->module_core,
66626- (unsigned long)mod->module_core + mod->core_size);
66627+ if (mod->module_init_rx)
66628+ flush_icache_range((unsigned long)mod->module_init_rx,
66629+ (unsigned long)mod->module_init_rx
66630+ + mod->init_size_rx);
66631+ flush_icache_range((unsigned long)mod->module_core_rx,
66632+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
66633
66634 set_fs(old_fs);
66635
66636- mod->args = args;
66637 if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
66638 printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
66639 mod->name);
66640@@ -2546,12 +2681,16 @@ static noinline struct module *load_modu
66641 free_unload:
66642 module_unload_free(mod);
66643 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
66644+ free_init_rx:
66645 percpu_modfree(mod->refptr);
66646- free_init:
66647 #endif
66648- module_free(mod, mod->module_init);
66649- free_core:
66650- module_free(mod, mod->module_core);
66651+ module_free_exec(mod, mod->module_init_rx);
66652+ free_core_rx:
66653+ module_free_exec(mod, mod->module_core_rx);
66654+ free_init_rw:
66655+ module_free(mod, mod->module_init_rw);
66656+ free_core_rw:
66657+ module_free(mod, mod->module_core_rw);
66658 /* mod will be freed with core. Don't access it beyond this line! */
66659 free_percpu:
66660 if (percpu)
66661@@ -2653,10 +2792,12 @@ SYSCALL_DEFINE3(init_module, void __user
66662 mod->symtab = mod->core_symtab;
66663 mod->strtab = mod->core_strtab;
66664 #endif
66665- module_free(mod, mod->module_init);
66666- mod->module_init = NULL;
66667- mod->init_size = 0;
66668- mod->init_text_size = 0;
66669+ module_free(mod, mod->module_init_rw);
66670+ module_free_exec(mod, mod->module_init_rx);
66671+ mod->module_init_rw = NULL;
66672+ mod->module_init_rx = NULL;
66673+ mod->init_size_rw = 0;
66674+ mod->init_size_rx = 0;
66675 mutex_unlock(&module_mutex);
66676
66677 return 0;
66678@@ -2687,10 +2828,16 @@ static const char *get_ksymbol(struct mo
66679 unsigned long nextval;
66680
66681 /* At worse, next value is at end of module */
66682- if (within_module_init(addr, mod))
66683- nextval = (unsigned long)mod->module_init+mod->init_text_size;
66684+ if (within_module_init_rx(addr, mod))
66685+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
66686+ else if (within_module_init_rw(addr, mod))
66687+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
66688+ else if (within_module_core_rx(addr, mod))
66689+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
66690+ else if (within_module_core_rw(addr, mod))
66691+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
66692 else
66693- nextval = (unsigned long)mod->module_core+mod->core_text_size;
66694+ return NULL;
66695
66696 /* Scan for closest preceeding symbol, and next symbol. (ELF
66697 starts real symbols at 1). */
66698@@ -2936,7 +3083,7 @@ static int m_show(struct seq_file *m, vo
66699 char buf[8];
66700
66701 seq_printf(m, "%s %u",
66702- mod->name, mod->init_size + mod->core_size);
66703+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
66704 print_unload_info(m, mod);
66705
66706 /* Informative for users. */
66707@@ -2945,7 +3092,7 @@ static int m_show(struct seq_file *m, vo
66708 mod->state == MODULE_STATE_COMING ? "Loading":
66709 "Live");
66710 /* Used by oprofile and other similar tools. */
66711- seq_printf(m, " 0x%p", mod->module_core);
66712+ seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
66713
66714 /* Taints info */
66715 if (mod->taints)
66716@@ -2981,7 +3128,17 @@ static const struct file_operations proc
66717
66718 static int __init proc_modules_init(void)
66719 {
66720+#ifndef CONFIG_GRKERNSEC_HIDESYM
66721+#ifdef CONFIG_GRKERNSEC_PROC_USER
66722+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
66723+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66724+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
66725+#else
66726 proc_create("modules", 0, NULL, &proc_modules_operations);
66727+#endif
66728+#else
66729+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
66730+#endif
66731 return 0;
66732 }
66733 module_init(proc_modules_init);
66734@@ -3040,12 +3197,12 @@ struct module *__module_address(unsigned
66735 {
66736 struct module *mod;
66737
66738- if (addr < module_addr_min || addr > module_addr_max)
66739+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
66740+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
66741 return NULL;
66742
66743 list_for_each_entry_rcu(mod, &modules, list)
66744- if (within_module_core(addr, mod)
66745- || within_module_init(addr, mod))
66746+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
66747 return mod;
66748 return NULL;
66749 }
66750@@ -3079,11 +3236,20 @@ bool is_module_text_address(unsigned lon
66751 */
66752 struct module *__module_text_address(unsigned long addr)
66753 {
66754- struct module *mod = __module_address(addr);
66755+ struct module *mod;
66756+
66757+#ifdef CONFIG_X86_32
66758+ addr = ktla_ktva(addr);
66759+#endif
66760+
66761+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
66762+ return NULL;
66763+
66764+ mod = __module_address(addr);
66765+
66766 if (mod) {
66767 /* Make sure it's within the text section. */
66768- if (!within(addr, mod->module_init, mod->init_text_size)
66769- && !within(addr, mod->module_core, mod->core_text_size))
66770+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
66771 mod = NULL;
66772 }
66773 return mod;
66774diff -urNp linux-2.6.32.46/kernel/mutex.c linux-2.6.32.46/kernel/mutex.c
66775--- linux-2.6.32.46/kernel/mutex.c 2011-03-27 14:31:47.000000000 -0400
66776+++ linux-2.6.32.46/kernel/mutex.c 2011-04-17 15:56:46.000000000 -0400
66777@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock,
66778 */
66779
66780 for (;;) {
66781- struct thread_info *owner;
66782+ struct task_struct *owner;
66783
66784 /*
66785 * If we own the BKL, then don't spin. The owner of
66786@@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock,
66787 spin_lock_mutex(&lock->wait_lock, flags);
66788
66789 debug_mutex_lock_common(lock, &waiter);
66790- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
66791+ debug_mutex_add_waiter(lock, &waiter, task);
66792
66793 /* add waiting tasks to the end of the waitqueue (FIFO): */
66794 list_add_tail(&waiter.list, &lock->wait_list);
66795@@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock,
66796 * TASK_UNINTERRUPTIBLE case.)
66797 */
66798 if (unlikely(signal_pending_state(state, task))) {
66799- mutex_remove_waiter(lock, &waiter,
66800- task_thread_info(task));
66801+ mutex_remove_waiter(lock, &waiter, task);
66802 mutex_release(&lock->dep_map, 1, ip);
66803 spin_unlock_mutex(&lock->wait_lock, flags);
66804
66805@@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock,
66806 done:
66807 lock_acquired(&lock->dep_map, ip);
66808 /* got the lock - rejoice! */
66809- mutex_remove_waiter(lock, &waiter, current_thread_info());
66810+ mutex_remove_waiter(lock, &waiter, task);
66811 mutex_set_owner(lock);
66812
66813 /* set it to 0 if there are no waiters left: */
66814diff -urNp linux-2.6.32.46/kernel/mutex-debug.c linux-2.6.32.46/kernel/mutex-debug.c
66815--- linux-2.6.32.46/kernel/mutex-debug.c 2011-03-27 14:31:47.000000000 -0400
66816+++ linux-2.6.32.46/kernel/mutex-debug.c 2011-04-17 15:56:46.000000000 -0400
66817@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
66818 }
66819
66820 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
66821- struct thread_info *ti)
66822+ struct task_struct *task)
66823 {
66824 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
66825
66826 /* Mark the current thread as blocked on the lock: */
66827- ti->task->blocked_on = waiter;
66828+ task->blocked_on = waiter;
66829 }
66830
66831 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
66832- struct thread_info *ti)
66833+ struct task_struct *task)
66834 {
66835 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
66836- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
66837- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
66838- ti->task->blocked_on = NULL;
66839+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
66840+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
66841+ task->blocked_on = NULL;
66842
66843 list_del_init(&waiter->list);
66844 waiter->task = NULL;
66845@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
66846 return;
66847
66848 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
66849- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
66850+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
66851 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
66852 mutex_clear_owner(lock);
66853 }
66854diff -urNp linux-2.6.32.46/kernel/mutex-debug.h linux-2.6.32.46/kernel/mutex-debug.h
66855--- linux-2.6.32.46/kernel/mutex-debug.h 2011-03-27 14:31:47.000000000 -0400
66856+++ linux-2.6.32.46/kernel/mutex-debug.h 2011-04-17 15:56:46.000000000 -0400
66857@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
66858 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
66859 extern void debug_mutex_add_waiter(struct mutex *lock,
66860 struct mutex_waiter *waiter,
66861- struct thread_info *ti);
66862+ struct task_struct *task);
66863 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
66864- struct thread_info *ti);
66865+ struct task_struct *task);
66866 extern void debug_mutex_unlock(struct mutex *lock);
66867 extern void debug_mutex_init(struct mutex *lock, const char *name,
66868 struct lock_class_key *key);
66869
66870 static inline void mutex_set_owner(struct mutex *lock)
66871 {
66872- lock->owner = current_thread_info();
66873+ lock->owner = current;
66874 }
66875
66876 static inline void mutex_clear_owner(struct mutex *lock)
66877diff -urNp linux-2.6.32.46/kernel/mutex.h linux-2.6.32.46/kernel/mutex.h
66878--- linux-2.6.32.46/kernel/mutex.h 2011-03-27 14:31:47.000000000 -0400
66879+++ linux-2.6.32.46/kernel/mutex.h 2011-04-17 15:56:46.000000000 -0400
66880@@ -19,7 +19,7 @@
66881 #ifdef CONFIG_SMP
66882 static inline void mutex_set_owner(struct mutex *lock)
66883 {
66884- lock->owner = current_thread_info();
66885+ lock->owner = current;
66886 }
66887
66888 static inline void mutex_clear_owner(struct mutex *lock)
66889diff -urNp linux-2.6.32.46/kernel/panic.c linux-2.6.32.46/kernel/panic.c
66890--- linux-2.6.32.46/kernel/panic.c 2011-03-27 14:31:47.000000000 -0400
66891+++ linux-2.6.32.46/kernel/panic.c 2011-04-17 15:56:46.000000000 -0400
66892@@ -352,7 +352,7 @@ static void warn_slowpath_common(const c
66893 const char *board;
66894
66895 printk(KERN_WARNING "------------[ cut here ]------------\n");
66896- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
66897+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
66898 board = dmi_get_system_info(DMI_PRODUCT_NAME);
66899 if (board)
66900 printk(KERN_WARNING "Hardware name: %s\n", board);
66901@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
66902 */
66903 void __stack_chk_fail(void)
66904 {
66905- panic("stack-protector: Kernel stack is corrupted in: %p\n",
66906+ dump_stack();
66907+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
66908 __builtin_return_address(0));
66909 }
66910 EXPORT_SYMBOL(__stack_chk_fail);
66911diff -urNp linux-2.6.32.46/kernel/params.c linux-2.6.32.46/kernel/params.c
66912--- linux-2.6.32.46/kernel/params.c 2011-03-27 14:31:47.000000000 -0400
66913+++ linux-2.6.32.46/kernel/params.c 2011-04-17 15:56:46.000000000 -0400
66914@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct
66915 return ret;
66916 }
66917
66918-static struct sysfs_ops module_sysfs_ops = {
66919+static const struct sysfs_ops module_sysfs_ops = {
66920 .show = module_attr_show,
66921 .store = module_attr_store,
66922 };
66923@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
66924 return 0;
66925 }
66926
66927-static struct kset_uevent_ops module_uevent_ops = {
66928+static const struct kset_uevent_ops module_uevent_ops = {
66929 .filter = uevent_filter,
66930 };
66931
66932diff -urNp linux-2.6.32.46/kernel/perf_event.c linux-2.6.32.46/kernel/perf_event.c
66933--- linux-2.6.32.46/kernel/perf_event.c 2011-08-09 18:35:30.000000000 -0400
66934+++ linux-2.6.32.46/kernel/perf_event.c 2011-08-09 18:34:01.000000000 -0400
66935@@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl
66936 */
66937 int sysctl_perf_event_sample_rate __read_mostly = 100000;
66938
66939-static atomic64_t perf_event_id;
66940+static atomic64_unchecked_t perf_event_id;
66941
66942 /*
66943 * Lock for (sysadmin-configurable) event reservations:
66944@@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struc
66945 * In order to keep per-task stats reliable we need to flip the event
66946 * values when we flip the contexts.
66947 */
66948- value = atomic64_read(&next_event->count);
66949- value = atomic64_xchg(&event->count, value);
66950- atomic64_set(&next_event->count, value);
66951+ value = atomic64_read_unchecked(&next_event->count);
66952+ value = atomic64_xchg_unchecked(&event->count, value);
66953+ atomic64_set_unchecked(&next_event->count, value);
66954
66955 swap(event->total_time_enabled, next_event->total_time_enabled);
66956 swap(event->total_time_running, next_event->total_time_running);
66957@@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_e
66958 update_event_times(event);
66959 }
66960
66961- return atomic64_read(&event->count);
66962+ return atomic64_read_unchecked(&event->count);
66963 }
66964
66965 /*
66966@@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct
66967 values[n++] = 1 + leader->nr_siblings;
66968 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
66969 values[n++] = leader->total_time_enabled +
66970- atomic64_read(&leader->child_total_time_enabled);
66971+ atomic64_read_unchecked(&leader->child_total_time_enabled);
66972 }
66973 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
66974 values[n++] = leader->total_time_running +
66975- atomic64_read(&leader->child_total_time_running);
66976+ atomic64_read_unchecked(&leader->child_total_time_running);
66977 }
66978
66979 size = n * sizeof(u64);
66980@@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct pe
66981 values[n++] = perf_event_read_value(event);
66982 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
66983 values[n++] = event->total_time_enabled +
66984- atomic64_read(&event->child_total_time_enabled);
66985+ atomic64_read_unchecked(&event->child_total_time_enabled);
66986 }
66987 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
66988 values[n++] = event->total_time_running +
66989- atomic64_read(&event->child_total_time_running);
66990+ atomic64_read_unchecked(&event->child_total_time_running);
66991 }
66992 if (read_format & PERF_FORMAT_ID)
66993 values[n++] = primary_event_id(event);
66994@@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct fil
66995 static void perf_event_reset(struct perf_event *event)
66996 {
66997 (void)perf_event_read(event);
66998- atomic64_set(&event->count, 0);
66999+ atomic64_set_unchecked(&event->count, 0);
67000 perf_event_update_userpage(event);
67001 }
67002
67003@@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct p
67004 ++userpg->lock;
67005 barrier();
67006 userpg->index = perf_event_index(event);
67007- userpg->offset = atomic64_read(&event->count);
67008+ userpg->offset = atomic64_read_unchecked(&event->count);
67009 if (event->state == PERF_EVENT_STATE_ACTIVE)
67010- userpg->offset -= atomic64_read(&event->hw.prev_count);
67011+ userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
67012
67013 userpg->time_enabled = event->total_time_enabled +
67014- atomic64_read(&event->child_total_time_enabled);
67015+ atomic64_read_unchecked(&event->child_total_time_enabled);
67016
67017 userpg->time_running = event->total_time_running +
67018- atomic64_read(&event->child_total_time_running);
67019+ atomic64_read_unchecked(&event->child_total_time_running);
67020
67021 barrier();
67022 ++userpg->lock;
67023@@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct
67024 u64 values[4];
67025 int n = 0;
67026
67027- values[n++] = atomic64_read(&event->count);
67028+ values[n++] = atomic64_read_unchecked(&event->count);
67029 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
67030 values[n++] = event->total_time_enabled +
67031- atomic64_read(&event->child_total_time_enabled);
67032+ atomic64_read_unchecked(&event->child_total_time_enabled);
67033 }
67034 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
67035 values[n++] = event->total_time_running +
67036- atomic64_read(&event->child_total_time_running);
67037+ atomic64_read_unchecked(&event->child_total_time_running);
67038 }
67039 if (read_format & PERF_FORMAT_ID)
67040 values[n++] = primary_event_id(event);
67041@@ -2940,7 +2940,7 @@ static void perf_output_read_group(struc
67042 if (leader != event)
67043 leader->pmu->read(leader);
67044
67045- values[n++] = atomic64_read(&leader->count);
67046+ values[n++] = atomic64_read_unchecked(&leader->count);
67047 if (read_format & PERF_FORMAT_ID)
67048 values[n++] = primary_event_id(leader);
67049
67050@@ -2952,7 +2952,7 @@ static void perf_output_read_group(struc
67051 if (sub != event)
67052 sub->pmu->read(sub);
67053
67054- values[n++] = atomic64_read(&sub->count);
67055+ values[n++] = atomic64_read_unchecked(&sub->count);
67056 if (read_format & PERF_FORMAT_ID)
67057 values[n++] = primary_event_id(sub);
67058
67059@@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf
67060 {
67061 struct hw_perf_event *hwc = &event->hw;
67062
67063- atomic64_add(nr, &event->count);
67064+ atomic64_add_unchecked(nr, &event->count);
67065
67066 if (!hwc->sample_period)
67067 return;
67068@@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(
67069 u64 now;
67070
67071 now = cpu_clock(cpu);
67072- prev = atomic64_read(&event->hw.prev_count);
67073- atomic64_set(&event->hw.prev_count, now);
67074- atomic64_add(now - prev, &event->count);
67075+ prev = atomic64_read_unchecked(&event->hw.prev_count);
67076+ atomic64_set_unchecked(&event->hw.prev_count, now);
67077+ atomic64_add_unchecked(now - prev, &event->count);
67078 }
67079
67080 static int cpu_clock_perf_event_enable(struct perf_event *event)
67081@@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(s
67082 struct hw_perf_event *hwc = &event->hw;
67083 int cpu = raw_smp_processor_id();
67084
67085- atomic64_set(&hwc->prev_count, cpu_clock(cpu));
67086+ atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
67087 perf_swevent_start_hrtimer(event);
67088
67089 return 0;
67090@@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update
67091 u64 prev;
67092 s64 delta;
67093
67094- prev = atomic64_xchg(&event->hw.prev_count, now);
67095+ prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
67096 delta = now - prev;
67097- atomic64_add(delta, &event->count);
67098+ atomic64_add_unchecked(delta, &event->count);
67099 }
67100
67101 static int task_clock_perf_event_enable(struct perf_event *event)
67102@@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(
67103
67104 now = event->ctx->time;
67105
67106- atomic64_set(&hwc->prev_count, now);
67107+ atomic64_set_unchecked(&hwc->prev_count, now);
67108
67109 perf_swevent_start_hrtimer(event);
67110
67111@@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr
67112 event->parent = parent_event;
67113
67114 event->ns = get_pid_ns(current->nsproxy->pid_ns);
67115- event->id = atomic64_inc_return(&perf_event_id);
67116+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
67117
67118 event->state = PERF_EVENT_STATE_INACTIVE;
67119
67120@@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf
67121 if (child_event->attr.inherit_stat)
67122 perf_event_read_event(child_event, child);
67123
67124- child_val = atomic64_read(&child_event->count);
67125+ child_val = atomic64_read_unchecked(&child_event->count);
67126
67127 /*
67128 * Add back the child's count to the parent's count:
67129 */
67130- atomic64_add(child_val, &parent_event->count);
67131- atomic64_add(child_event->total_time_enabled,
67132+ atomic64_add_unchecked(child_val, &parent_event->count);
67133+ atomic64_add_unchecked(child_event->total_time_enabled,
67134 &parent_event->child_total_time_enabled);
67135- atomic64_add(child_event->total_time_running,
67136+ atomic64_add_unchecked(child_event->total_time_running,
67137 &parent_event->child_total_time_running);
67138
67139 /*
67140diff -urNp linux-2.6.32.46/kernel/pid.c linux-2.6.32.46/kernel/pid.c
67141--- linux-2.6.32.46/kernel/pid.c 2011-04-22 19:16:29.000000000 -0400
67142+++ linux-2.6.32.46/kernel/pid.c 2011-08-21 19:11:29.000000000 -0400
67143@@ -33,6 +33,7 @@
67144 #include <linux/rculist.h>
67145 #include <linux/bootmem.h>
67146 #include <linux/hash.h>
67147+#include <linux/security.h>
67148 #include <linux/pid_namespace.h>
67149 #include <linux/init_task.h>
67150 #include <linux/syscalls.h>
67151@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
67152
67153 int pid_max = PID_MAX_DEFAULT;
67154
67155-#define RESERVED_PIDS 300
67156+#define RESERVED_PIDS 500
67157
67158 int pid_max_min = RESERVED_PIDS + 1;
67159 int pid_max_max = PID_MAX_LIMIT;
67160@@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
67161 */
67162 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
67163 {
67164- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67165+ struct task_struct *task;
67166+
67167+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
67168+
67169+ if (gr_pid_is_chrooted(task))
67170+ return NULL;
67171+
67172+ return task;
67173 }
67174
67175 struct task_struct *find_task_by_vpid(pid_t vnr)
67176@@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pi
67177 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
67178 }
67179
67180+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
67181+{
67182+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
67183+}
67184+
67185 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
67186 {
67187 struct pid *pid;
67188diff -urNp linux-2.6.32.46/kernel/posix-cpu-timers.c linux-2.6.32.46/kernel/posix-cpu-timers.c
67189--- linux-2.6.32.46/kernel/posix-cpu-timers.c 2011-03-27 14:31:47.000000000 -0400
67190+++ linux-2.6.32.46/kernel/posix-cpu-timers.c 2011-08-06 09:33:44.000000000 -0400
67191@@ -6,6 +6,7 @@
67192 #include <linux/posix-timers.h>
67193 #include <linux/errno.h>
67194 #include <linux/math64.h>
67195+#include <linux/security.h>
67196 #include <asm/uaccess.h>
67197 #include <linux/kernel_stat.h>
67198 #include <trace/events/timer.h>
67199@@ -1697,7 +1698,7 @@ static long thread_cpu_nsleep_restart(st
67200
67201 static __init int init_posix_cpu_timers(void)
67202 {
67203- struct k_clock process = {
67204+ static struct k_clock process = {
67205 .clock_getres = process_cpu_clock_getres,
67206 .clock_get = process_cpu_clock_get,
67207 .clock_set = do_posix_clock_nosettime,
67208@@ -1705,7 +1706,7 @@ static __init int init_posix_cpu_timers(
67209 .nsleep = process_cpu_nsleep,
67210 .nsleep_restart = process_cpu_nsleep_restart,
67211 };
67212- struct k_clock thread = {
67213+ static struct k_clock thread = {
67214 .clock_getres = thread_cpu_clock_getres,
67215 .clock_get = thread_cpu_clock_get,
67216 .clock_set = do_posix_clock_nosettime,
67217diff -urNp linux-2.6.32.46/kernel/posix-timers.c linux-2.6.32.46/kernel/posix-timers.c
67218--- linux-2.6.32.46/kernel/posix-timers.c 2011-03-27 14:31:47.000000000 -0400
67219+++ linux-2.6.32.46/kernel/posix-timers.c 2011-08-23 20:22:38.000000000 -0400
67220@@ -42,6 +42,7 @@
67221 #include <linux/compiler.h>
67222 #include <linux/idr.h>
67223 #include <linux/posix-timers.h>
67224+#include <linux/grsecurity.h>
67225 #include <linux/syscalls.h>
67226 #include <linux/wait.h>
67227 #include <linux/workqueue.h>
67228@@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
67229 * which we beg off on and pass to do_sys_settimeofday().
67230 */
67231
67232-static struct k_clock posix_clocks[MAX_CLOCKS];
67233+static struct k_clock *posix_clocks[MAX_CLOCKS];
67234
67235 /*
67236 * These ones are defined below.
67237@@ -157,8 +158,8 @@ static inline void unlock_timer(struct k
67238 */
67239 #define CLOCK_DISPATCH(clock, call, arglist) \
67240 ((clock) < 0 ? posix_cpu_##call arglist : \
67241- (posix_clocks[clock].call != NULL \
67242- ? (*posix_clocks[clock].call) arglist : common_##call arglist))
67243+ (posix_clocks[clock]->call != NULL \
67244+ ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
67245
67246 /*
67247 * Default clock hook functions when the struct k_clock passed
67248@@ -172,7 +173,7 @@ static inline int common_clock_getres(co
67249 struct timespec *tp)
67250 {
67251 tp->tv_sec = 0;
67252- tp->tv_nsec = posix_clocks[which_clock].res;
67253+ tp->tv_nsec = posix_clocks[which_clock]->res;
67254 return 0;
67255 }
67256
67257@@ -217,9 +218,11 @@ static inline int invalid_clockid(const
67258 return 0;
67259 if ((unsigned) which_clock >= MAX_CLOCKS)
67260 return 1;
67261- if (posix_clocks[which_clock].clock_getres != NULL)
67262+ if (posix_clocks[which_clock] == NULL)
67263 return 0;
67264- if (posix_clocks[which_clock].res != 0)
67265+ if (posix_clocks[which_clock]->clock_getres != NULL)
67266+ return 0;
67267+ if (posix_clocks[which_clock]->res != 0)
67268 return 0;
67269 return 1;
67270 }
67271@@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t
67272 */
67273 static __init int init_posix_timers(void)
67274 {
67275- struct k_clock clock_realtime = {
67276+ static struct k_clock clock_realtime = {
67277 .clock_getres = hrtimer_get_res,
67278 };
67279- struct k_clock clock_monotonic = {
67280+ static struct k_clock clock_monotonic = {
67281 .clock_getres = hrtimer_get_res,
67282 .clock_get = posix_ktime_get_ts,
67283 .clock_set = do_posix_clock_nosettime,
67284 };
67285- struct k_clock clock_monotonic_raw = {
67286+ static struct k_clock clock_monotonic_raw = {
67287 .clock_getres = hrtimer_get_res,
67288 .clock_get = posix_get_monotonic_raw,
67289 .clock_set = do_posix_clock_nosettime,
67290 .timer_create = no_timer_create,
67291 .nsleep = no_nsleep,
67292 };
67293- struct k_clock clock_realtime_coarse = {
67294+ static struct k_clock clock_realtime_coarse = {
67295 .clock_getres = posix_get_coarse_res,
67296 .clock_get = posix_get_realtime_coarse,
67297 .clock_set = do_posix_clock_nosettime,
67298 .timer_create = no_timer_create,
67299 .nsleep = no_nsleep,
67300 };
67301- struct k_clock clock_monotonic_coarse = {
67302+ static struct k_clock clock_monotonic_coarse = {
67303 .clock_getres = posix_get_coarse_res,
67304 .clock_get = posix_get_monotonic_coarse,
67305 .clock_set = do_posix_clock_nosettime,
67306@@ -296,6 +299,8 @@ static __init int init_posix_timers(void
67307 .nsleep = no_nsleep,
67308 };
67309
67310+ pax_track_stack();
67311+
67312 register_posix_clock(CLOCK_REALTIME, &clock_realtime);
67313 register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
67314 register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
67315@@ -484,7 +489,7 @@ void register_posix_clock(const clockid_
67316 return;
67317 }
67318
67319- posix_clocks[clock_id] = *new_clock;
67320+ posix_clocks[clock_id] = new_clock;
67321 }
67322 EXPORT_SYMBOL_GPL(register_posix_clock);
67323
67324@@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
67325 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
67326 return -EFAULT;
67327
67328+ /* only the CLOCK_REALTIME clock can be set, all other clocks
67329+ have their clock_set fptr set to a nosettime dummy function
67330+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
67331+ call common_clock_set, which calls do_sys_settimeofday, which
67332+ we hook
67333+ */
67334+
67335 return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
67336 }
67337
67338diff -urNp linux-2.6.32.46/kernel/power/hibernate.c linux-2.6.32.46/kernel/power/hibernate.c
67339--- linux-2.6.32.46/kernel/power/hibernate.c 2011-03-27 14:31:47.000000000 -0400
67340+++ linux-2.6.32.46/kernel/power/hibernate.c 2011-04-17 15:56:46.000000000 -0400
67341@@ -48,14 +48,14 @@ enum {
67342
67343 static int hibernation_mode = HIBERNATION_SHUTDOWN;
67344
67345-static struct platform_hibernation_ops *hibernation_ops;
67346+static const struct platform_hibernation_ops *hibernation_ops;
67347
67348 /**
67349 * hibernation_set_ops - set the global hibernate operations
67350 * @ops: the hibernation operations to use in subsequent hibernation transitions
67351 */
67352
67353-void hibernation_set_ops(struct platform_hibernation_ops *ops)
67354+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
67355 {
67356 if (ops && !(ops->begin && ops->end && ops->pre_snapshot
67357 && ops->prepare && ops->finish && ops->enter && ops->pre_restore
67358diff -urNp linux-2.6.32.46/kernel/power/poweroff.c linux-2.6.32.46/kernel/power/poweroff.c
67359--- linux-2.6.32.46/kernel/power/poweroff.c 2011-03-27 14:31:47.000000000 -0400
67360+++ linux-2.6.32.46/kernel/power/poweroff.c 2011-04-17 15:56:46.000000000 -0400
67361@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
67362 .enable_mask = SYSRQ_ENABLE_BOOT,
67363 };
67364
67365-static int pm_sysrq_init(void)
67366+static int __init pm_sysrq_init(void)
67367 {
67368 register_sysrq_key('o', &sysrq_poweroff_op);
67369 return 0;
67370diff -urNp linux-2.6.32.46/kernel/power/process.c linux-2.6.32.46/kernel/power/process.c
67371--- linux-2.6.32.46/kernel/power/process.c 2011-03-27 14:31:47.000000000 -0400
67372+++ linux-2.6.32.46/kernel/power/process.c 2011-04-17 15:56:46.000000000 -0400
67373@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
67374 struct timeval start, end;
67375 u64 elapsed_csecs64;
67376 unsigned int elapsed_csecs;
67377+ bool timedout = false;
67378
67379 do_gettimeofday(&start);
67380
67381 end_time = jiffies + TIMEOUT;
67382 do {
67383 todo = 0;
67384+ if (time_after(jiffies, end_time))
67385+ timedout = true;
67386 read_lock(&tasklist_lock);
67387 do_each_thread(g, p) {
67388 if (frozen(p) || !freezeable(p))
67389@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
67390 * It is "frozen enough". If the task does wake
67391 * up, it will immediately call try_to_freeze.
67392 */
67393- if (!task_is_stopped_or_traced(p) &&
67394- !freezer_should_skip(p))
67395+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
67396 todo++;
67397+ if (timedout) {
67398+ printk(KERN_ERR "Task refusing to freeze:\n");
67399+ sched_show_task(p);
67400+ }
67401+ }
67402 } while_each_thread(g, p);
67403 read_unlock(&tasklist_lock);
67404 yield(); /* Yield is okay here */
67405- if (time_after(jiffies, end_time))
67406- break;
67407- } while (todo);
67408+ } while (todo && !timedout);
67409
67410 do_gettimeofday(&end);
67411 elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
67412diff -urNp linux-2.6.32.46/kernel/power/suspend.c linux-2.6.32.46/kernel/power/suspend.c
67413--- linux-2.6.32.46/kernel/power/suspend.c 2011-03-27 14:31:47.000000000 -0400
67414+++ linux-2.6.32.46/kernel/power/suspend.c 2011-04-17 15:56:46.000000000 -0400
67415@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
67416 [PM_SUSPEND_MEM] = "mem",
67417 };
67418
67419-static struct platform_suspend_ops *suspend_ops;
67420+static const struct platform_suspend_ops *suspend_ops;
67421
67422 /**
67423 * suspend_set_ops - Set the global suspend method table.
67424 * @ops: Pointer to ops structure.
67425 */
67426-void suspend_set_ops(struct platform_suspend_ops *ops)
67427+void suspend_set_ops(const struct platform_suspend_ops *ops)
67428 {
67429 mutex_lock(&pm_mutex);
67430 suspend_ops = ops;
67431diff -urNp linux-2.6.32.46/kernel/printk.c linux-2.6.32.46/kernel/printk.c
67432--- linux-2.6.32.46/kernel/printk.c 2011-03-27 14:31:47.000000000 -0400
67433+++ linux-2.6.32.46/kernel/printk.c 2011-04-17 15:56:46.000000000 -0400
67434@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
67435 char c;
67436 int error = 0;
67437
67438+#ifdef CONFIG_GRKERNSEC_DMESG
67439+ if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
67440+ return -EPERM;
67441+#endif
67442+
67443 error = security_syslog(type);
67444 if (error)
67445 return error;
67446diff -urNp linux-2.6.32.46/kernel/profile.c linux-2.6.32.46/kernel/profile.c
67447--- linux-2.6.32.46/kernel/profile.c 2011-03-27 14:31:47.000000000 -0400
67448+++ linux-2.6.32.46/kernel/profile.c 2011-05-04 17:56:28.000000000 -0400
67449@@ -39,7 +39,7 @@ struct profile_hit {
67450 /* Oprofile timer tick hook */
67451 static int (*timer_hook)(struct pt_regs *) __read_mostly;
67452
67453-static atomic_t *prof_buffer;
67454+static atomic_unchecked_t *prof_buffer;
67455 static unsigned long prof_len, prof_shift;
67456
67457 int prof_on __read_mostly;
67458@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
67459 hits[i].pc = 0;
67460 continue;
67461 }
67462- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67463+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67464 hits[i].hits = hits[i].pc = 0;
67465 }
67466 }
67467@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
67468 * Add the current hit(s) and flush the write-queue out
67469 * to the global buffer:
67470 */
67471- atomic_add(nr_hits, &prof_buffer[pc]);
67472+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
67473 for (i = 0; i < NR_PROFILE_HIT; ++i) {
67474- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
67475+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
67476 hits[i].pc = hits[i].hits = 0;
67477 }
67478 out:
67479@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
67480 if (prof_on != type || !prof_buffer)
67481 return;
67482 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
67483- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67484+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
67485 }
67486 #endif /* !CONFIG_SMP */
67487 EXPORT_SYMBOL_GPL(profile_hits);
67488@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
67489 return -EFAULT;
67490 buf++; p++; count--; read++;
67491 }
67492- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
67493+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
67494 if (copy_to_user(buf, (void *)pnt, count))
67495 return -EFAULT;
67496 read += count;
67497@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
67498 }
67499 #endif
67500 profile_discard_flip_buffers();
67501- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
67502+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
67503 return count;
67504 }
67505
67506diff -urNp linux-2.6.32.46/kernel/ptrace.c linux-2.6.32.46/kernel/ptrace.c
67507--- linux-2.6.32.46/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
67508+++ linux-2.6.32.46/kernel/ptrace.c 2011-05-22 23:02:06.000000000 -0400
67509@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
67510 return ret;
67511 }
67512
67513-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
67514+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
67515+ unsigned int log)
67516 {
67517 const struct cred *cred = current_cred(), *tcred;
67518
67519@@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_stru
67520 cred->gid != tcred->egid ||
67521 cred->gid != tcred->sgid ||
67522 cred->gid != tcred->gid) &&
67523- !capable(CAP_SYS_PTRACE)) {
67524+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
67525+ (log && !capable(CAP_SYS_PTRACE)))
67526+ ) {
67527 rcu_read_unlock();
67528 return -EPERM;
67529 }
67530@@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_stru
67531 smp_rmb();
67532 if (task->mm)
67533 dumpable = get_dumpable(task->mm);
67534- if (!dumpable && !capable(CAP_SYS_PTRACE))
67535+ if (!dumpable &&
67536+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
67537+ (log && !capable(CAP_SYS_PTRACE))))
67538 return -EPERM;
67539
67540 return security_ptrace_access_check(task, mode);
67541@@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struc
67542 {
67543 int err;
67544 task_lock(task);
67545- err = __ptrace_may_access(task, mode);
67546+ err = __ptrace_may_access(task, mode, 0);
67547+ task_unlock(task);
67548+ return !err;
67549+}
67550+
67551+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
67552+{
67553+ int err;
67554+ task_lock(task);
67555+ err = __ptrace_may_access(task, mode, 1);
67556 task_unlock(task);
67557 return !err;
67558 }
67559@@ -186,7 +200,7 @@ int ptrace_attach(struct task_struct *ta
67560 goto out;
67561
67562 task_lock(task);
67563- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
67564+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
67565 task_unlock(task);
67566 if (retval)
67567 goto unlock_creds;
67568@@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *ta
67569 goto unlock_tasklist;
67570
67571 task->ptrace = PT_PTRACED;
67572- if (capable(CAP_SYS_PTRACE))
67573+ if (capable_nolog(CAP_SYS_PTRACE))
67574 task->ptrace |= PT_PTRACE_CAP;
67575
67576 __ptrace_link(task, current);
67577@@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *
67578 {
67579 int copied = 0;
67580
67581+ pax_track_stack();
67582+
67583 while (len > 0) {
67584 char buf[128];
67585 int this_len, retval;
67586@@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct
67587 {
67588 int copied = 0;
67589
67590+ pax_track_stack();
67591+
67592 while (len > 0) {
67593 char buf[128];
67594 int this_len, retval;
67595@@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *c
67596 int ret = -EIO;
67597 siginfo_t siginfo;
67598
67599+ pax_track_stack();
67600+
67601 switch (request) {
67602 case PTRACE_PEEKTEXT:
67603 case PTRACE_PEEKDATA:
67604@@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *c
67605 ret = ptrace_setoptions(child, data);
67606 break;
67607 case PTRACE_GETEVENTMSG:
67608- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
67609+ ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
67610 break;
67611
67612 case PTRACE_GETSIGINFO:
67613 ret = ptrace_getsiginfo(child, &siginfo);
67614 if (!ret)
67615- ret = copy_siginfo_to_user((siginfo_t __user *) data,
67616+ ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
67617 &siginfo);
67618 break;
67619
67620 case PTRACE_SETSIGINFO:
67621- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
67622+ if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
67623 sizeof siginfo))
67624 ret = -EFAULT;
67625 else
67626@@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
67627 goto out;
67628 }
67629
67630+ if (gr_handle_ptrace(child, request)) {
67631+ ret = -EPERM;
67632+ goto out_put_task_struct;
67633+ }
67634+
67635 if (request == PTRACE_ATTACH) {
67636 ret = ptrace_attach(child);
67637 /*
67638 * Some architectures need to do book-keeping after
67639 * a ptrace attach.
67640 */
67641- if (!ret)
67642+ if (!ret) {
67643 arch_ptrace_attach(child);
67644+ gr_audit_ptrace(child);
67645+ }
67646 goto out_put_task_struct;
67647 }
67648
67649@@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_
67650 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
67651 if (copied != sizeof(tmp))
67652 return -EIO;
67653- return put_user(tmp, (unsigned long __user *)data);
67654+ return put_user(tmp, (__force unsigned long __user *)data);
67655 }
67656
67657 int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
67658@@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_st
67659 siginfo_t siginfo;
67660 int ret;
67661
67662+ pax_track_stack();
67663+
67664 switch (request) {
67665 case PTRACE_PEEKTEXT:
67666 case PTRACE_PEEKDATA:
67667@@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat
67668 goto out;
67669 }
67670
67671+ if (gr_handle_ptrace(child, request)) {
67672+ ret = -EPERM;
67673+ goto out_put_task_struct;
67674+ }
67675+
67676 if (request == PTRACE_ATTACH) {
67677 ret = ptrace_attach(child);
67678 /*
67679 * Some architectures need to do book-keeping after
67680 * a ptrace attach.
67681 */
67682- if (!ret)
67683+ if (!ret) {
67684 arch_ptrace_attach(child);
67685+ gr_audit_ptrace(child);
67686+ }
67687 goto out_put_task_struct;
67688 }
67689
67690diff -urNp linux-2.6.32.46/kernel/rcutorture.c linux-2.6.32.46/kernel/rcutorture.c
67691--- linux-2.6.32.46/kernel/rcutorture.c 2011-03-27 14:31:47.000000000 -0400
67692+++ linux-2.6.32.46/kernel/rcutorture.c 2011-05-04 17:56:28.000000000 -0400
67693@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
67694 { 0 };
67695 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
67696 { 0 };
67697-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67698-static atomic_t n_rcu_torture_alloc;
67699-static atomic_t n_rcu_torture_alloc_fail;
67700-static atomic_t n_rcu_torture_free;
67701-static atomic_t n_rcu_torture_mberror;
67702-static atomic_t n_rcu_torture_error;
67703+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
67704+static atomic_unchecked_t n_rcu_torture_alloc;
67705+static atomic_unchecked_t n_rcu_torture_alloc_fail;
67706+static atomic_unchecked_t n_rcu_torture_free;
67707+static atomic_unchecked_t n_rcu_torture_mberror;
67708+static atomic_unchecked_t n_rcu_torture_error;
67709 static long n_rcu_torture_timers;
67710 static struct list_head rcu_torture_removed;
67711 static cpumask_var_t shuffle_tmp_mask;
67712@@ -187,11 +187,11 @@ rcu_torture_alloc(void)
67713
67714 spin_lock_bh(&rcu_torture_lock);
67715 if (list_empty(&rcu_torture_freelist)) {
67716- atomic_inc(&n_rcu_torture_alloc_fail);
67717+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
67718 spin_unlock_bh(&rcu_torture_lock);
67719 return NULL;
67720 }
67721- atomic_inc(&n_rcu_torture_alloc);
67722+ atomic_inc_unchecked(&n_rcu_torture_alloc);
67723 p = rcu_torture_freelist.next;
67724 list_del_init(p);
67725 spin_unlock_bh(&rcu_torture_lock);
67726@@ -204,7 +204,7 @@ rcu_torture_alloc(void)
67727 static void
67728 rcu_torture_free(struct rcu_torture *p)
67729 {
67730- atomic_inc(&n_rcu_torture_free);
67731+ atomic_inc_unchecked(&n_rcu_torture_free);
67732 spin_lock_bh(&rcu_torture_lock);
67733 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
67734 spin_unlock_bh(&rcu_torture_lock);
67735@@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
67736 i = rp->rtort_pipe_count;
67737 if (i > RCU_TORTURE_PIPE_LEN)
67738 i = RCU_TORTURE_PIPE_LEN;
67739- atomic_inc(&rcu_torture_wcount[i]);
67740+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67741 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67742 rp->rtort_mbtest = 0;
67743 rcu_torture_free(rp);
67744@@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_fr
67745 i = rp->rtort_pipe_count;
67746 if (i > RCU_TORTURE_PIPE_LEN)
67747 i = RCU_TORTURE_PIPE_LEN;
67748- atomic_inc(&rcu_torture_wcount[i]);
67749+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67750 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
67751 rp->rtort_mbtest = 0;
67752 list_del(&rp->rtort_free);
67753@@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
67754 i = old_rp->rtort_pipe_count;
67755 if (i > RCU_TORTURE_PIPE_LEN)
67756 i = RCU_TORTURE_PIPE_LEN;
67757- atomic_inc(&rcu_torture_wcount[i]);
67758+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
67759 old_rp->rtort_pipe_count++;
67760 cur_ops->deferred_free(old_rp);
67761 }
67762@@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned l
67763 return;
67764 }
67765 if (p->rtort_mbtest == 0)
67766- atomic_inc(&n_rcu_torture_mberror);
67767+ atomic_inc_unchecked(&n_rcu_torture_mberror);
67768 spin_lock(&rand_lock);
67769 cur_ops->read_delay(&rand);
67770 n_rcu_torture_timers++;
67771@@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
67772 continue;
67773 }
67774 if (p->rtort_mbtest == 0)
67775- atomic_inc(&n_rcu_torture_mberror);
67776+ atomic_inc_unchecked(&n_rcu_torture_mberror);
67777 cur_ops->read_delay(&rand);
67778 preempt_disable();
67779 pipe_count = p->rtort_pipe_count;
67780@@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
67781 rcu_torture_current,
67782 rcu_torture_current_version,
67783 list_empty(&rcu_torture_freelist),
67784- atomic_read(&n_rcu_torture_alloc),
67785- atomic_read(&n_rcu_torture_alloc_fail),
67786- atomic_read(&n_rcu_torture_free),
67787- atomic_read(&n_rcu_torture_mberror),
67788+ atomic_read_unchecked(&n_rcu_torture_alloc),
67789+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
67790+ atomic_read_unchecked(&n_rcu_torture_free),
67791+ atomic_read_unchecked(&n_rcu_torture_mberror),
67792 n_rcu_torture_timers);
67793- if (atomic_read(&n_rcu_torture_mberror) != 0)
67794+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
67795 cnt += sprintf(&page[cnt], " !!!");
67796 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
67797 if (i > 1) {
67798 cnt += sprintf(&page[cnt], "!!! ");
67799- atomic_inc(&n_rcu_torture_error);
67800+ atomic_inc_unchecked(&n_rcu_torture_error);
67801 WARN_ON_ONCE(1);
67802 }
67803 cnt += sprintf(&page[cnt], "Reader Pipe: ");
67804@@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
67805 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
67806 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
67807 cnt += sprintf(&page[cnt], " %d",
67808- atomic_read(&rcu_torture_wcount[i]));
67809+ atomic_read_unchecked(&rcu_torture_wcount[i]));
67810 }
67811 cnt += sprintf(&page[cnt], "\n");
67812 if (cur_ops->stats)
67813@@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
67814
67815 if (cur_ops->cleanup)
67816 cur_ops->cleanup();
67817- if (atomic_read(&n_rcu_torture_error))
67818+ if (atomic_read_unchecked(&n_rcu_torture_error))
67819 rcu_torture_print_module_parms("End of test: FAILURE");
67820 else
67821 rcu_torture_print_module_parms("End of test: SUCCESS");
67822@@ -1138,13 +1138,13 @@ rcu_torture_init(void)
67823
67824 rcu_torture_current = NULL;
67825 rcu_torture_current_version = 0;
67826- atomic_set(&n_rcu_torture_alloc, 0);
67827- atomic_set(&n_rcu_torture_alloc_fail, 0);
67828- atomic_set(&n_rcu_torture_free, 0);
67829- atomic_set(&n_rcu_torture_mberror, 0);
67830- atomic_set(&n_rcu_torture_error, 0);
67831+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
67832+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
67833+ atomic_set_unchecked(&n_rcu_torture_free, 0);
67834+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
67835+ atomic_set_unchecked(&n_rcu_torture_error, 0);
67836 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
67837- atomic_set(&rcu_torture_wcount[i], 0);
67838+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
67839 for_each_possible_cpu(cpu) {
67840 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
67841 per_cpu(rcu_torture_count, cpu)[i] = 0;
67842diff -urNp linux-2.6.32.46/kernel/rcutree.c linux-2.6.32.46/kernel/rcutree.c
67843--- linux-2.6.32.46/kernel/rcutree.c 2011-03-27 14:31:47.000000000 -0400
67844+++ linux-2.6.32.46/kernel/rcutree.c 2011-04-17 15:56:46.000000000 -0400
67845@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
67846 /*
67847 * Do softirq processing for the current CPU.
67848 */
67849-static void rcu_process_callbacks(struct softirq_action *unused)
67850+static void rcu_process_callbacks(void)
67851 {
67852 /*
67853 * Memory references from any prior RCU read-side critical sections
67854diff -urNp linux-2.6.32.46/kernel/rcutree_plugin.h linux-2.6.32.46/kernel/rcutree_plugin.h
67855--- linux-2.6.32.46/kernel/rcutree_plugin.h 2011-03-27 14:31:47.000000000 -0400
67856+++ linux-2.6.32.46/kernel/rcutree_plugin.h 2011-04-17 15:56:46.000000000 -0400
67857@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_swi
67858 */
67859 void __rcu_read_lock(void)
67860 {
67861- ACCESS_ONCE(current->rcu_read_lock_nesting)++;
67862+ ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
67863 barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
67864 }
67865 EXPORT_SYMBOL_GPL(__rcu_read_lock);
67866@@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
67867 struct task_struct *t = current;
67868
67869 barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
67870- if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
67871+ if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
67872 unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
67873 rcu_read_unlock_special(t);
67874 }
67875diff -urNp linux-2.6.32.46/kernel/relay.c linux-2.6.32.46/kernel/relay.c
67876--- linux-2.6.32.46/kernel/relay.c 2011-03-27 14:31:47.000000000 -0400
67877+++ linux-2.6.32.46/kernel/relay.c 2011-05-16 21:46:57.000000000 -0400
67878@@ -1222,7 +1222,7 @@ static int subbuf_splice_actor(struct fi
67879 unsigned int flags,
67880 int *nonpad_ret)
67881 {
67882- unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
67883+ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
67884 struct rchan_buf *rbuf = in->private_data;
67885 unsigned int subbuf_size = rbuf->chan->subbuf_size;
67886 uint64_t pos = (uint64_t) *ppos;
67887@@ -1241,6 +1241,9 @@ static int subbuf_splice_actor(struct fi
67888 .ops = &relay_pipe_buf_ops,
67889 .spd_release = relay_page_release,
67890 };
67891+ ssize_t ret;
67892+
67893+ pax_track_stack();
67894
67895 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
67896 return 0;
67897diff -urNp linux-2.6.32.46/kernel/resource.c linux-2.6.32.46/kernel/resource.c
67898--- linux-2.6.32.46/kernel/resource.c 2011-03-27 14:31:47.000000000 -0400
67899+++ linux-2.6.32.46/kernel/resource.c 2011-04-17 15:56:46.000000000 -0400
67900@@ -132,8 +132,18 @@ static const struct file_operations proc
67901
67902 static int __init ioresources_init(void)
67903 {
67904+#ifdef CONFIG_GRKERNSEC_PROC_ADD
67905+#ifdef CONFIG_GRKERNSEC_PROC_USER
67906+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
67907+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
67908+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
67909+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
67910+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
67911+#endif
67912+#else
67913 proc_create("ioports", 0, NULL, &proc_ioports_operations);
67914 proc_create("iomem", 0, NULL, &proc_iomem_operations);
67915+#endif
67916 return 0;
67917 }
67918 __initcall(ioresources_init);
67919diff -urNp linux-2.6.32.46/kernel/rtmutex.c linux-2.6.32.46/kernel/rtmutex.c
67920--- linux-2.6.32.46/kernel/rtmutex.c 2011-03-27 14:31:47.000000000 -0400
67921+++ linux-2.6.32.46/kernel/rtmutex.c 2011-04-17 15:56:46.000000000 -0400
67922@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
67923 */
67924 spin_lock_irqsave(&pendowner->pi_lock, flags);
67925
67926- WARN_ON(!pendowner->pi_blocked_on);
67927+ BUG_ON(!pendowner->pi_blocked_on);
67928 WARN_ON(pendowner->pi_blocked_on != waiter);
67929 WARN_ON(pendowner->pi_blocked_on->lock != lock);
67930
67931diff -urNp linux-2.6.32.46/kernel/rtmutex-tester.c linux-2.6.32.46/kernel/rtmutex-tester.c
67932--- linux-2.6.32.46/kernel/rtmutex-tester.c 2011-03-27 14:31:47.000000000 -0400
67933+++ linux-2.6.32.46/kernel/rtmutex-tester.c 2011-05-04 17:56:28.000000000 -0400
67934@@ -21,7 +21,7 @@
67935 #define MAX_RT_TEST_MUTEXES 8
67936
67937 static spinlock_t rttest_lock;
67938-static atomic_t rttest_event;
67939+static atomic_unchecked_t rttest_event;
67940
67941 struct test_thread_data {
67942 int opcode;
67943@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_
67944
67945 case RTTEST_LOCKCONT:
67946 td->mutexes[td->opdata] = 1;
67947- td->event = atomic_add_return(1, &rttest_event);
67948+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67949 return 0;
67950
67951 case RTTEST_RESET:
67952@@ -82,7 +82,7 @@ static int handle_op(struct test_thread_
67953 return 0;
67954
67955 case RTTEST_RESETEVENT:
67956- atomic_set(&rttest_event, 0);
67957+ atomic_set_unchecked(&rttest_event, 0);
67958 return 0;
67959
67960 default:
67961@@ -99,9 +99,9 @@ static int handle_op(struct test_thread_
67962 return ret;
67963
67964 td->mutexes[id] = 1;
67965- td->event = atomic_add_return(1, &rttest_event);
67966+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67967 rt_mutex_lock(&mutexes[id]);
67968- td->event = atomic_add_return(1, &rttest_event);
67969+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67970 td->mutexes[id] = 4;
67971 return 0;
67972
67973@@ -112,9 +112,9 @@ static int handle_op(struct test_thread_
67974 return ret;
67975
67976 td->mutexes[id] = 1;
67977- td->event = atomic_add_return(1, &rttest_event);
67978+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67979 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
67980- td->event = atomic_add_return(1, &rttest_event);
67981+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67982 td->mutexes[id] = ret ? 0 : 4;
67983 return ret ? -EINTR : 0;
67984
67985@@ -123,9 +123,9 @@ static int handle_op(struct test_thread_
67986 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
67987 return ret;
67988
67989- td->event = atomic_add_return(1, &rttest_event);
67990+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67991 rt_mutex_unlock(&mutexes[id]);
67992- td->event = atomic_add_return(1, &rttest_event);
67993+ td->event = atomic_add_return_unchecked(1, &rttest_event);
67994 td->mutexes[id] = 0;
67995 return 0;
67996
67997@@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mu
67998 break;
67999
68000 td->mutexes[dat] = 2;
68001- td->event = atomic_add_return(1, &rttest_event);
68002+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68003 break;
68004
68005 case RTTEST_LOCKBKL:
68006@@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mu
68007 return;
68008
68009 td->mutexes[dat] = 3;
68010- td->event = atomic_add_return(1, &rttest_event);
68011+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68012 break;
68013
68014 case RTTEST_LOCKNOWAIT:
68015@@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mu
68016 return;
68017
68018 td->mutexes[dat] = 1;
68019- td->event = atomic_add_return(1, &rttest_event);
68020+ td->event = atomic_add_return_unchecked(1, &rttest_event);
68021 return;
68022
68023 case RTTEST_LOCKBKL:
68024diff -urNp linux-2.6.32.46/kernel/sched.c linux-2.6.32.46/kernel/sched.c
68025--- linux-2.6.32.46/kernel/sched.c 2011-03-27 14:31:47.000000000 -0400
68026+++ linux-2.6.32.46/kernel/sched.c 2011-08-21 19:29:25.000000000 -0400
68027@@ -2764,9 +2764,10 @@ void wake_up_new_task(struct task_struct
68028 {
68029 unsigned long flags;
68030 struct rq *rq;
68031- int cpu = get_cpu();
68032
68033 #ifdef CONFIG_SMP
68034+ int cpu = get_cpu();
68035+
68036 rq = task_rq_lock(p, &flags);
68037 p->state = TASK_WAKING;
68038
68039@@ -5043,7 +5044,7 @@ out:
68040 * In CONFIG_NO_HZ case, the idle load balance owner will do the
68041 * rebalancing for all the cpus for whom scheduler ticks are stopped.
68042 */
68043-static void run_rebalance_domains(struct softirq_action *h)
68044+static void run_rebalance_domains(void)
68045 {
68046 int this_cpu = smp_processor_id();
68047 struct rq *this_rq = cpu_rq(this_cpu);
68048@@ -5700,6 +5701,8 @@ asmlinkage void __sched schedule(void)
68049 struct rq *rq;
68050 int cpu;
68051
68052+ pax_track_stack();
68053+
68054 need_resched:
68055 preempt_disable();
68056 cpu = smp_processor_id();
68057@@ -5770,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
68058 * Look out! "owner" is an entirely speculative pointer
68059 * access and not reliable.
68060 */
68061-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
68062+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
68063 {
68064 unsigned int cpu;
68065 struct rq *rq;
68066@@ -5784,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lo
68067 * DEBUG_PAGEALLOC could have unmapped it if
68068 * the mutex owner just released it and exited.
68069 */
68070- if (probe_kernel_address(&owner->cpu, cpu))
68071+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
68072 return 0;
68073 #else
68074- cpu = owner->cpu;
68075+ cpu = task_thread_info(owner)->cpu;
68076 #endif
68077
68078 /*
68079@@ -5816,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lo
68080 /*
68081 * Is that owner really running on that cpu?
68082 */
68083- if (task_thread_info(rq->curr) != owner || need_resched())
68084+ if (rq->curr != owner || need_resched())
68085 return 0;
68086
68087 cpu_relax();
68088@@ -6359,6 +6362,8 @@ int can_nice(const struct task_struct *p
68089 /* convert nice value [19,-20] to rlimit style value [1,40] */
68090 int nice_rlim = 20 - nice;
68091
68092+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
68093+
68094 return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
68095 capable(CAP_SYS_NICE));
68096 }
68097@@ -6392,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
68098 if (nice > 19)
68099 nice = 19;
68100
68101- if (increment < 0 && !can_nice(current, nice))
68102+ if (increment < 0 && (!can_nice(current, nice) ||
68103+ gr_handle_chroot_nice()))
68104 return -EPERM;
68105
68106 retval = security_task_setnice(current, nice);
68107@@ -8774,7 +8780,7 @@ static void init_sched_groups_power(int
68108 long power;
68109 int weight;
68110
68111- WARN_ON(!sd || !sd->groups);
68112+ BUG_ON(!sd || !sd->groups);
68113
68114 if (cpu != group_first_cpu(sd->groups))
68115 return;
68116diff -urNp linux-2.6.32.46/kernel/signal.c linux-2.6.32.46/kernel/signal.c
68117--- linux-2.6.32.46/kernel/signal.c 2011-04-17 17:00:52.000000000 -0400
68118+++ linux-2.6.32.46/kernel/signal.c 2011-08-16 21:15:58.000000000 -0400
68119@@ -41,12 +41,12 @@
68120
68121 static struct kmem_cache *sigqueue_cachep;
68122
68123-static void __user *sig_handler(struct task_struct *t, int sig)
68124+static __sighandler_t sig_handler(struct task_struct *t, int sig)
68125 {
68126 return t->sighand->action[sig - 1].sa.sa_handler;
68127 }
68128
68129-static int sig_handler_ignored(void __user *handler, int sig)
68130+static int sig_handler_ignored(__sighandler_t handler, int sig)
68131 {
68132 /* Is it explicitly or implicitly ignored? */
68133 return handler == SIG_IGN ||
68134@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
68135 static int sig_task_ignored(struct task_struct *t, int sig,
68136 int from_ancestor_ns)
68137 {
68138- void __user *handler;
68139+ __sighandler_t handler;
68140
68141 handler = sig_handler(t, sig);
68142
68143@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
68144 */
68145 user = get_uid(__task_cred(t)->user);
68146 atomic_inc(&user->sigpending);
68147+
68148+ if (!override_rlimit)
68149+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
68150 if (override_rlimit ||
68151 atomic_read(&user->sigpending) <=
68152 t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
68153@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
68154
68155 int unhandled_signal(struct task_struct *tsk, int sig)
68156 {
68157- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
68158+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
68159 if (is_global_init(tsk))
68160 return 1;
68161 if (handler != SIG_IGN && handler != SIG_DFL)
68162@@ -627,6 +630,13 @@ static int check_kill_permission(int sig
68163 }
68164 }
68165
68166+ /* allow glibc communication via tgkill to other threads in our
68167+ thread group */
68168+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
68169+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
68170+ && gr_handle_signal(t, sig))
68171+ return -EPERM;
68172+
68173 return security_task_kill(t, info, sig, 0);
68174 }
68175
68176@@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct si
68177 return send_signal(sig, info, p, 1);
68178 }
68179
68180-static int
68181+int
68182 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
68183 {
68184 return send_signal(sig, info, t, 0);
68185@@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *
68186 unsigned long int flags;
68187 int ret, blocked, ignored;
68188 struct k_sigaction *action;
68189+ int is_unhandled = 0;
68190
68191 spin_lock_irqsave(&t->sighand->siglock, flags);
68192 action = &t->sighand->action[sig-1];
68193@@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *
68194 }
68195 if (action->sa.sa_handler == SIG_DFL)
68196 t->signal->flags &= ~SIGNAL_UNKILLABLE;
68197+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
68198+ is_unhandled = 1;
68199 ret = specific_send_sig_info(sig, info, t);
68200 spin_unlock_irqrestore(&t->sighand->siglock, flags);
68201
68202+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
68203+ normal operation */
68204+ if (is_unhandled) {
68205+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
68206+ gr_handle_crash(t, sig);
68207+ }
68208+
68209 return ret;
68210 }
68211
68212@@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct
68213 {
68214 int ret = check_kill_permission(sig, info, p);
68215
68216- if (!ret && sig)
68217+ if (!ret && sig) {
68218 ret = do_send_sig_info(sig, info, p, true);
68219+ if (!ret)
68220+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
68221+ }
68222
68223 return ret;
68224 }
68225@@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
68226 {
68227 siginfo_t info;
68228
68229+ pax_track_stack();
68230+
68231 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
68232
68233 memset(&info, 0, sizeof info);
68234@@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid,
68235 int error = -ESRCH;
68236
68237 rcu_read_lock();
68238- p = find_task_by_vpid(pid);
68239+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
68240+ /* allow glibc communication via tgkill to other threads in our
68241+ thread group */
68242+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
68243+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
68244+ p = find_task_by_vpid_unrestricted(pid);
68245+ else
68246+#endif
68247+ p = find_task_by_vpid(pid);
68248 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
68249 error = check_kill_permission(sig, info, p);
68250 /*
68251diff -urNp linux-2.6.32.46/kernel/smp.c linux-2.6.32.46/kernel/smp.c
68252--- linux-2.6.32.46/kernel/smp.c 2011-03-27 14:31:47.000000000 -0400
68253+++ linux-2.6.32.46/kernel/smp.c 2011-04-17 15:56:46.000000000 -0400
68254@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void
68255 }
68256 EXPORT_SYMBOL(smp_call_function);
68257
68258-void ipi_call_lock(void)
68259+void ipi_call_lock(void) __acquires(call_function.lock)
68260 {
68261 spin_lock(&call_function.lock);
68262 }
68263
68264-void ipi_call_unlock(void)
68265+void ipi_call_unlock(void) __releases(call_function.lock)
68266 {
68267 spin_unlock(&call_function.lock);
68268 }
68269
68270-void ipi_call_lock_irq(void)
68271+void ipi_call_lock_irq(void) __acquires(call_function.lock)
68272 {
68273 spin_lock_irq(&call_function.lock);
68274 }
68275
68276-void ipi_call_unlock_irq(void)
68277+void ipi_call_unlock_irq(void) __releases(call_function.lock)
68278 {
68279 spin_unlock_irq(&call_function.lock);
68280 }
68281diff -urNp linux-2.6.32.46/kernel/softirq.c linux-2.6.32.46/kernel/softirq.c
68282--- linux-2.6.32.46/kernel/softirq.c 2011-03-27 14:31:47.000000000 -0400
68283+++ linux-2.6.32.46/kernel/softirq.c 2011-08-05 20:33:55.000000000 -0400
68284@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
68285
68286 static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
68287
68288-char *softirq_to_name[NR_SOFTIRQS] = {
68289+const char * const softirq_to_name[NR_SOFTIRQS] = {
68290 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
68291 "TASKLET", "SCHED", "HRTIMER", "RCU"
68292 };
68293@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
68294
68295 asmlinkage void __do_softirq(void)
68296 {
68297- struct softirq_action *h;
68298+ const struct softirq_action *h;
68299 __u32 pending;
68300 int max_restart = MAX_SOFTIRQ_RESTART;
68301 int cpu;
68302@@ -233,7 +233,7 @@ restart:
68303 kstat_incr_softirqs_this_cpu(h - softirq_vec);
68304
68305 trace_softirq_entry(h, softirq_vec);
68306- h->action(h);
68307+ h->action();
68308 trace_softirq_exit(h, softirq_vec);
68309 if (unlikely(prev_count != preempt_count())) {
68310 printk(KERN_ERR "huh, entered softirq %td %s %p"
68311@@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
68312 local_irq_restore(flags);
68313 }
68314
68315-void open_softirq(int nr, void (*action)(struct softirq_action *))
68316+void open_softirq(int nr, void (*action)(void))
68317 {
68318- softirq_vec[nr].action = action;
68319+ pax_open_kernel();
68320+ *(void **)&softirq_vec[nr].action = action;
68321+ pax_close_kernel();
68322 }
68323
68324 /*
68325@@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct
68326
68327 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
68328
68329-static void tasklet_action(struct softirq_action *a)
68330+static void tasklet_action(void)
68331 {
68332 struct tasklet_struct *list;
68333
68334@@ -454,7 +456,7 @@ static void tasklet_action(struct softir
68335 }
68336 }
68337
68338-static void tasklet_hi_action(struct softirq_action *a)
68339+static void tasklet_hi_action(void)
68340 {
68341 struct tasklet_struct *list;
68342
68343diff -urNp linux-2.6.32.46/kernel/sys.c linux-2.6.32.46/kernel/sys.c
68344--- linux-2.6.32.46/kernel/sys.c 2011-03-27 14:31:47.000000000 -0400
68345+++ linux-2.6.32.46/kernel/sys.c 2011-08-11 19:51:54.000000000 -0400
68346@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
68347 error = -EACCES;
68348 goto out;
68349 }
68350+
68351+ if (gr_handle_chroot_setpriority(p, niceval)) {
68352+ error = -EACCES;
68353+ goto out;
68354+ }
68355+
68356 no_nice = security_task_setnice(p, niceval);
68357 if (no_nice) {
68358 error = no_nice;
68359@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
68360 !(user = find_user(who)))
68361 goto out_unlock; /* No processes for this user */
68362
68363- do_each_thread(g, p)
68364+ do_each_thread(g, p) {
68365 if (__task_cred(p)->uid == who)
68366 error = set_one_prio(p, niceval, error);
68367- while_each_thread(g, p);
68368+ } while_each_thread(g, p);
68369 if (who != cred->uid)
68370 free_uid(user); /* For find_user() */
68371 break;
68372@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
68373 !(user = find_user(who)))
68374 goto out_unlock; /* No processes for this user */
68375
68376- do_each_thread(g, p)
68377+ do_each_thread(g, p) {
68378 if (__task_cred(p)->uid == who) {
68379 niceval = 20 - task_nice(p);
68380 if (niceval > retval)
68381 retval = niceval;
68382 }
68383- while_each_thread(g, p);
68384+ } while_each_thread(g, p);
68385 if (who != cred->uid)
68386 free_uid(user); /* for find_user() */
68387 break;
68388@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
68389 goto error;
68390 }
68391
68392+ if (gr_check_group_change(new->gid, new->egid, -1))
68393+ goto error;
68394+
68395 if (rgid != (gid_t) -1 ||
68396 (egid != (gid_t) -1 && egid != old->gid))
68397 new->sgid = new->egid;
68398@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
68399 goto error;
68400
68401 retval = -EPERM;
68402+
68403+ if (gr_check_group_change(gid, gid, gid))
68404+ goto error;
68405+
68406 if (capable(CAP_SETGID))
68407 new->gid = new->egid = new->sgid = new->fsgid = gid;
68408 else if (gid == old->gid || gid == old->sgid)
68409@@ -567,12 +580,19 @@ static int set_user(struct cred *new)
68410 if (!new_user)
68411 return -EAGAIN;
68412
68413+ /*
68414+ * We don't fail in case of NPROC limit excess here because too many
68415+ * poorly written programs don't check set*uid() return code, assuming
68416+ * it never fails if called by root. We may still enforce NPROC limit
68417+ * for programs doing set*uid()+execve() by harmlessly deferring the
68418+ * failure to the execve() stage.
68419+ */
68420 if (atomic_read(&new_user->processes) >=
68421 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
68422- new_user != INIT_USER) {
68423- free_uid(new_user);
68424- return -EAGAIN;
68425- }
68426+ new_user != INIT_USER)
68427+ current->flags |= PF_NPROC_EXCEEDED;
68428+ else
68429+ current->flags &= ~PF_NPROC_EXCEEDED;
68430
68431 free_uid(new->user);
68432 new->user = new_user;
68433@@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
68434 goto error;
68435 }
68436
68437+ if (gr_check_user_change(new->uid, new->euid, -1))
68438+ goto error;
68439+
68440 if (new->uid != old->uid) {
68441 retval = set_user(new);
68442 if (retval < 0)
68443@@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
68444 goto error;
68445
68446 retval = -EPERM;
68447+
68448+ if (gr_check_crash_uid(uid))
68449+ goto error;
68450+ if (gr_check_user_change(uid, uid, uid))
68451+ goto error;
68452+
68453 if (capable(CAP_SETUID)) {
68454 new->suid = new->uid = uid;
68455 if (uid != old->uid) {
68456@@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
68457 goto error;
68458 }
68459
68460+ if (gr_check_user_change(ruid, euid, -1))
68461+ goto error;
68462+
68463 if (ruid != (uid_t) -1) {
68464 new->uid = ruid;
68465 if (ruid != old->uid) {
68466@@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
68467 goto error;
68468 }
68469
68470+ if (gr_check_group_change(rgid, egid, -1))
68471+ goto error;
68472+
68473 if (rgid != (gid_t) -1)
68474 new->gid = rgid;
68475 if (egid != (gid_t) -1)
68476@@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
68477 if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
68478 goto error;
68479
68480+ if (gr_check_user_change(-1, -1, uid))
68481+ goto error;
68482+
68483 if (uid == old->uid || uid == old->euid ||
68484 uid == old->suid || uid == old->fsuid ||
68485 capable(CAP_SETUID)) {
68486@@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
68487 if (gid == old->gid || gid == old->egid ||
68488 gid == old->sgid || gid == old->fsgid ||
68489 capable(CAP_SETGID)) {
68490+ if (gr_check_group_change(-1, -1, gid))
68491+ goto error;
68492+
68493 if (gid != old_fsgid) {
68494 new->fsgid = gid;
68495 goto change_okay;
68496@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
68497 error = get_dumpable(me->mm);
68498 break;
68499 case PR_SET_DUMPABLE:
68500- if (arg2 < 0 || arg2 > 1) {
68501+ if (arg2 > 1) {
68502 error = -EINVAL;
68503 break;
68504 }
68505diff -urNp linux-2.6.32.46/kernel/sysctl.c linux-2.6.32.46/kernel/sysctl.c
68506--- linux-2.6.32.46/kernel/sysctl.c 2011-03-27 14:31:47.000000000 -0400
68507+++ linux-2.6.32.46/kernel/sysctl.c 2011-04-17 15:56:46.000000000 -0400
68508@@ -63,6 +63,13 @@
68509 static int deprecated_sysctl_warning(struct __sysctl_args *args);
68510
68511 #if defined(CONFIG_SYSCTL)
68512+#include <linux/grsecurity.h>
68513+#include <linux/grinternal.h>
68514+
68515+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
68516+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
68517+ const int op);
68518+extern int gr_handle_chroot_sysctl(const int op);
68519
68520 /* External variables not in a header file. */
68521 extern int C_A_D;
68522@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
68523 static int proc_taint(struct ctl_table *table, int write,
68524 void __user *buffer, size_t *lenp, loff_t *ppos);
68525 #endif
68526+extern ctl_table grsecurity_table[];
68527
68528 static struct ctl_table root_table[];
68529 static struct ctl_table_root sysctl_table_root;
68530@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
68531 int sysctl_legacy_va_layout;
68532 #endif
68533
68534+#ifdef CONFIG_PAX_SOFTMODE
68535+static ctl_table pax_table[] = {
68536+ {
68537+ .ctl_name = CTL_UNNUMBERED,
68538+ .procname = "softmode",
68539+ .data = &pax_softmode,
68540+ .maxlen = sizeof(unsigned int),
68541+ .mode = 0600,
68542+ .proc_handler = &proc_dointvec,
68543+ },
68544+
68545+ { .ctl_name = 0 }
68546+};
68547+#endif
68548+
68549 extern int prove_locking;
68550 extern int lock_stat;
68551
68552@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
68553 #endif
68554
68555 static struct ctl_table kern_table[] = {
68556+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
68557+ {
68558+ .ctl_name = CTL_UNNUMBERED,
68559+ .procname = "grsecurity",
68560+ .mode = 0500,
68561+ .child = grsecurity_table,
68562+ },
68563+#endif
68564+
68565+#ifdef CONFIG_PAX_SOFTMODE
68566+ {
68567+ .ctl_name = CTL_UNNUMBERED,
68568+ .procname = "pax",
68569+ .mode = 0500,
68570+ .child = pax_table,
68571+ },
68572+#endif
68573+
68574 {
68575 .ctl_name = CTL_UNNUMBERED,
68576 .procname = "sched_child_runs_first",
68577@@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
68578 .data = &modprobe_path,
68579 .maxlen = KMOD_PATH_LEN,
68580 .mode = 0644,
68581- .proc_handler = &proc_dostring,
68582- .strategy = &sysctl_string,
68583+ .proc_handler = &proc_dostring_modpriv,
68584+ .strategy = &sysctl_string_modpriv,
68585 },
68586 {
68587 .ctl_name = CTL_UNNUMBERED,
68588@@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
68589 .mode = 0644,
68590 .proc_handler = &proc_dointvec
68591 },
68592+ {
68593+ .procname = "heap_stack_gap",
68594+ .data = &sysctl_heap_stack_gap,
68595+ .maxlen = sizeof(sysctl_heap_stack_gap),
68596+ .mode = 0644,
68597+ .proc_handler = proc_doulongvec_minmax,
68598+ },
68599 #else
68600 {
68601 .ctl_name = CTL_UNNUMBERED,
68602@@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl
68603 return 0;
68604 }
68605
68606+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
68607+
68608 static int parse_table(int __user *name, int nlen,
68609 void __user *oldval, size_t __user *oldlenp,
68610 void __user *newval, size_t newlen,
68611@@ -1821,7 +1871,7 @@ repeat:
68612 if (n == table->ctl_name) {
68613 int error;
68614 if (table->child) {
68615- if (sysctl_perm(root, table, MAY_EXEC))
68616+ if (sysctl_perm_nochk(root, table, MAY_EXEC))
68617 return -EPERM;
68618 name++;
68619 nlen--;
68620@@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *r
68621 int error;
68622 int mode;
68623
68624+ if (table->parent != NULL && table->parent->procname != NULL &&
68625+ table->procname != NULL &&
68626+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
68627+ return -EACCES;
68628+ if (gr_handle_chroot_sysctl(op))
68629+ return -EACCES;
68630+ error = gr_handle_sysctl(table, op);
68631+ if (error)
68632+ return error;
68633+
68634+ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
68635+ if (error)
68636+ return error;
68637+
68638+ if (root->permissions)
68639+ mode = root->permissions(root, current->nsproxy, table);
68640+ else
68641+ mode = table->mode;
68642+
68643+ return test_perm(mode, op);
68644+}
68645+
68646+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
68647+{
68648+ int error;
68649+ int mode;
68650+
68651 error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
68652 if (error)
68653 return error;
68654@@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *tabl
68655 buffer, lenp, ppos);
68656 }
68657
68658+int proc_dostring_modpriv(struct ctl_table *table, int write,
68659+ void __user *buffer, size_t *lenp, loff_t *ppos)
68660+{
68661+ if (write && !capable(CAP_SYS_MODULE))
68662+ return -EPERM;
68663+
68664+ return _proc_do_string(table->data, table->maxlen, write,
68665+ buffer, lenp, ppos);
68666+}
68667+
68668
68669 static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
68670 int *valp,
68671@@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(v
68672 vleft = table->maxlen / sizeof(unsigned long);
68673 left = *lenp;
68674
68675- for (; left && vleft--; i++, min++, max++, first=0) {
68676+ for (; left && vleft--; i++, first=0) {
68677 if (write) {
68678 while (left) {
68679 char c;
68680@@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *tabl
68681 return -ENOSYS;
68682 }
68683
68684+int proc_dostring_modpriv(struct ctl_table *table, int write,
68685+ void __user *buffer, size_t *lenp, loff_t *ppos)
68686+{
68687+ return -ENOSYS;
68688+}
68689+
68690 int proc_dointvec(struct ctl_table *table, int write,
68691 void __user *buffer, size_t *lenp, loff_t *ppos)
68692 {
68693@@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *tabl
68694 return 1;
68695 }
68696
68697+int sysctl_string_modpriv(struct ctl_table *table,
68698+ void __user *oldval, size_t __user *oldlenp,
68699+ void __user *newval, size_t newlen)
68700+{
68701+ if (newval && newlen && !capable(CAP_SYS_MODULE))
68702+ return -EPERM;
68703+
68704+ return sysctl_string(table, oldval, oldlenp, newval, newlen);
68705+}
68706+
68707 /*
68708 * This function makes sure that all of the integers in the vector
68709 * are between the minimum and maximum values given in the arrays
68710@@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *tabl
68711 return -ENOSYS;
68712 }
68713
68714+int sysctl_string_modpriv(struct ctl_table *table,
68715+ void __user *oldval, size_t __user *oldlenp,
68716+ void __user *newval, size_t newlen)
68717+{
68718+ return -ENOSYS;
68719+}
68720+
68721 int sysctl_intvec(struct ctl_table *table,
68722 void __user *oldval, size_t __user *oldlenp,
68723 void __user *newval, size_t newlen)
68724@@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
68725 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
68726 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
68727 EXPORT_SYMBOL(proc_dostring);
68728+EXPORT_SYMBOL(proc_dostring_modpriv);
68729 EXPORT_SYMBOL(proc_doulongvec_minmax);
68730 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
68731 EXPORT_SYMBOL(register_sysctl_table);
68732@@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
68733 EXPORT_SYMBOL(sysctl_jiffies);
68734 EXPORT_SYMBOL(sysctl_ms_jiffies);
68735 EXPORT_SYMBOL(sysctl_string);
68736+EXPORT_SYMBOL(sysctl_string_modpriv);
68737 EXPORT_SYMBOL(sysctl_data);
68738 EXPORT_SYMBOL(unregister_sysctl_table);
68739diff -urNp linux-2.6.32.46/kernel/sysctl_check.c linux-2.6.32.46/kernel/sysctl_check.c
68740--- linux-2.6.32.46/kernel/sysctl_check.c 2011-03-27 14:31:47.000000000 -0400
68741+++ linux-2.6.32.46/kernel/sysctl_check.c 2011-04-17 15:56:46.000000000 -0400
68742@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *n
68743 } else {
68744 if ((table->strategy == sysctl_data) ||
68745 (table->strategy == sysctl_string) ||
68746+ (table->strategy == sysctl_string_modpriv) ||
68747 (table->strategy == sysctl_intvec) ||
68748 (table->strategy == sysctl_jiffies) ||
68749 (table->strategy == sysctl_ms_jiffies) ||
68750 (table->proc_handler == proc_dostring) ||
68751+ (table->proc_handler == proc_dostring_modpriv) ||
68752 (table->proc_handler == proc_dointvec) ||
68753 (table->proc_handler == proc_dointvec_minmax) ||
68754 (table->proc_handler == proc_dointvec_jiffies) ||
68755diff -urNp linux-2.6.32.46/kernel/taskstats.c linux-2.6.32.46/kernel/taskstats.c
68756--- linux-2.6.32.46/kernel/taskstats.c 2011-07-13 17:23:04.000000000 -0400
68757+++ linux-2.6.32.46/kernel/taskstats.c 2011-07-13 17:23:19.000000000 -0400
68758@@ -26,9 +26,12 @@
68759 #include <linux/cgroup.h>
68760 #include <linux/fs.h>
68761 #include <linux/file.h>
68762+#include <linux/grsecurity.h>
68763 #include <net/genetlink.h>
68764 #include <asm/atomic.h>
68765
68766+extern int gr_is_taskstats_denied(int pid);
68767+
68768 /*
68769 * Maximum length of a cpumask that can be specified in
68770 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
68771@@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_
68772 size_t size;
68773 cpumask_var_t mask;
68774
68775+ if (gr_is_taskstats_denied(current->pid))
68776+ return -EACCES;
68777+
68778 if (!alloc_cpumask_var(&mask, GFP_KERNEL))
68779 return -ENOMEM;
68780
68781diff -urNp linux-2.6.32.46/kernel/time/tick-broadcast.c linux-2.6.32.46/kernel/time/tick-broadcast.c
68782--- linux-2.6.32.46/kernel/time/tick-broadcast.c 2011-05-23 16:56:59.000000000 -0400
68783+++ linux-2.6.32.46/kernel/time/tick-broadcast.c 2011-05-23 16:57:13.000000000 -0400
68784@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
68785 * then clear the broadcast bit.
68786 */
68787 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
68788- int cpu = smp_processor_id();
68789+ cpu = smp_processor_id();
68790
68791 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
68792 tick_broadcast_clear_oneshot(cpu);
68793diff -urNp linux-2.6.32.46/kernel/time/timekeeping.c linux-2.6.32.46/kernel/time/timekeeping.c
68794--- linux-2.6.32.46/kernel/time/timekeeping.c 2011-06-25 12:55:35.000000000 -0400
68795+++ linux-2.6.32.46/kernel/time/timekeeping.c 2011-06-25 12:56:37.000000000 -0400
68796@@ -14,6 +14,7 @@
68797 #include <linux/init.h>
68798 #include <linux/mm.h>
68799 #include <linux/sched.h>
68800+#include <linux/grsecurity.h>
68801 #include <linux/sysdev.h>
68802 #include <linux/clocksource.h>
68803 #include <linux/jiffies.h>
68804@@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
68805 */
68806 struct timespec ts = xtime;
68807 timespec_add_ns(&ts, nsec);
68808- ACCESS_ONCE(xtime_cache) = ts;
68809+ ACCESS_ONCE_RW(xtime_cache) = ts;
68810 }
68811
68812 /* must hold xtime_lock */
68813@@ -333,6 +334,8 @@ int do_settimeofday(struct timespec *tv)
68814 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
68815 return -EINVAL;
68816
68817+ gr_log_timechange();
68818+
68819 write_seqlock_irqsave(&xtime_lock, flags);
68820
68821 timekeeping_forward_now();
68822diff -urNp linux-2.6.32.46/kernel/time/timer_list.c linux-2.6.32.46/kernel/time/timer_list.c
68823--- linux-2.6.32.46/kernel/time/timer_list.c 2011-03-27 14:31:47.000000000 -0400
68824+++ linux-2.6.32.46/kernel/time/timer_list.c 2011-04-17 15:56:46.000000000 -0400
68825@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
68826
68827 static void print_name_offset(struct seq_file *m, void *sym)
68828 {
68829+#ifdef CONFIG_GRKERNSEC_HIDESYM
68830+ SEQ_printf(m, "<%p>", NULL);
68831+#else
68832 char symname[KSYM_NAME_LEN];
68833
68834 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
68835 SEQ_printf(m, "<%p>", sym);
68836 else
68837 SEQ_printf(m, "%s", symname);
68838+#endif
68839 }
68840
68841 static void
68842@@ -112,7 +116,11 @@ next_one:
68843 static void
68844 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
68845 {
68846+#ifdef CONFIG_GRKERNSEC_HIDESYM
68847+ SEQ_printf(m, " .base: %p\n", NULL);
68848+#else
68849 SEQ_printf(m, " .base: %p\n", base);
68850+#endif
68851 SEQ_printf(m, " .index: %d\n",
68852 base->index);
68853 SEQ_printf(m, " .resolution: %Lu nsecs\n",
68854@@ -289,7 +297,11 @@ static int __init init_timer_list_procfs
68855 {
68856 struct proc_dir_entry *pe;
68857
68858+#ifdef CONFIG_GRKERNSEC_PROC_ADD
68859+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
68860+#else
68861 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
68862+#endif
68863 if (!pe)
68864 return -ENOMEM;
68865 return 0;
68866diff -urNp linux-2.6.32.46/kernel/time/timer_stats.c linux-2.6.32.46/kernel/time/timer_stats.c
68867--- linux-2.6.32.46/kernel/time/timer_stats.c 2011-03-27 14:31:47.000000000 -0400
68868+++ linux-2.6.32.46/kernel/time/timer_stats.c 2011-05-04 17:56:28.000000000 -0400
68869@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
68870 static unsigned long nr_entries;
68871 static struct entry entries[MAX_ENTRIES];
68872
68873-static atomic_t overflow_count;
68874+static atomic_unchecked_t overflow_count;
68875
68876 /*
68877 * The entries are in a hash-table, for fast lookup:
68878@@ -140,7 +140,7 @@ static void reset_entries(void)
68879 nr_entries = 0;
68880 memset(entries, 0, sizeof(entries));
68881 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
68882- atomic_set(&overflow_count, 0);
68883+ atomic_set_unchecked(&overflow_count, 0);
68884 }
68885
68886 static struct entry *alloc_entry(void)
68887@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
68888 if (likely(entry))
68889 entry->count++;
68890 else
68891- atomic_inc(&overflow_count);
68892+ atomic_inc_unchecked(&overflow_count);
68893
68894 out_unlock:
68895 spin_unlock_irqrestore(lock, flags);
68896@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
68897
68898 static void print_name_offset(struct seq_file *m, unsigned long addr)
68899 {
68900+#ifdef CONFIG_GRKERNSEC_HIDESYM
68901+ seq_printf(m, "<%p>", NULL);
68902+#else
68903 char symname[KSYM_NAME_LEN];
68904
68905 if (lookup_symbol_name(addr, symname) < 0)
68906 seq_printf(m, "<%p>", (void *)addr);
68907 else
68908 seq_printf(m, "%s", symname);
68909+#endif
68910 }
68911
68912 static int tstats_show(struct seq_file *m, void *v)
68913@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
68914
68915 seq_puts(m, "Timer Stats Version: v0.2\n");
68916 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
68917- if (atomic_read(&overflow_count))
68918+ if (atomic_read_unchecked(&overflow_count))
68919 seq_printf(m, "Overflow: %d entries\n",
68920- atomic_read(&overflow_count));
68921+ atomic_read_unchecked(&overflow_count));
68922
68923 for (i = 0; i < nr_entries; i++) {
68924 entry = entries + i;
68925@@ -415,7 +419,11 @@ static int __init init_tstats_procfs(voi
68926 {
68927 struct proc_dir_entry *pe;
68928
68929+#ifdef CONFIG_GRKERNSEC_PROC_ADD
68930+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
68931+#else
68932 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
68933+#endif
68934 if (!pe)
68935 return -ENOMEM;
68936 return 0;
68937diff -urNp linux-2.6.32.46/kernel/time.c linux-2.6.32.46/kernel/time.c
68938--- linux-2.6.32.46/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
68939+++ linux-2.6.32.46/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
68940@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec
68941 return error;
68942
68943 if (tz) {
68944+ /* we log in do_settimeofday called below, so don't log twice
68945+ */
68946+ if (!tv)
68947+ gr_log_timechange();
68948+
68949 /* SMP safe, global irq locking makes it work. */
68950 sys_tz = *tz;
68951 update_vsyscall_tz();
68952@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
68953 * Avoid unnecessary multiplications/divisions in the
68954 * two most common HZ cases:
68955 */
68956-unsigned int inline jiffies_to_msecs(const unsigned long j)
68957+inline unsigned int jiffies_to_msecs(const unsigned long j)
68958 {
68959 #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
68960 return (MSEC_PER_SEC / HZ) * j;
68961@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
68962 }
68963 EXPORT_SYMBOL(jiffies_to_msecs);
68964
68965-unsigned int inline jiffies_to_usecs(const unsigned long j)
68966+inline unsigned int jiffies_to_usecs(const unsigned long j)
68967 {
68968 #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
68969 return (USEC_PER_SEC / HZ) * j;
68970diff -urNp linux-2.6.32.46/kernel/timer.c linux-2.6.32.46/kernel/timer.c
68971--- linux-2.6.32.46/kernel/timer.c 2011-03-27 14:31:47.000000000 -0400
68972+++ linux-2.6.32.46/kernel/timer.c 2011-04-17 15:56:46.000000000 -0400
68973@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
68974 /*
68975 * This function runs timers and the timer-tq in bottom half context.
68976 */
68977-static void run_timer_softirq(struct softirq_action *h)
68978+static void run_timer_softirq(void)
68979 {
68980 struct tvec_base *base = __get_cpu_var(tvec_bases);
68981
68982diff -urNp linux-2.6.32.46/kernel/trace/blktrace.c linux-2.6.32.46/kernel/trace/blktrace.c
68983--- linux-2.6.32.46/kernel/trace/blktrace.c 2011-03-27 14:31:47.000000000 -0400
68984+++ linux-2.6.32.46/kernel/trace/blktrace.c 2011-05-04 17:56:28.000000000 -0400
68985@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct f
68986 struct blk_trace *bt = filp->private_data;
68987 char buf[16];
68988
68989- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
68990+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
68991
68992 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
68993 }
68994@@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(str
68995 return 1;
68996
68997 bt = buf->chan->private_data;
68998- atomic_inc(&bt->dropped);
68999+ atomic_inc_unchecked(&bt->dropped);
69000 return 0;
69001 }
69002
69003@@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_qu
69004
69005 bt->dir = dir;
69006 bt->dev = dev;
69007- atomic_set(&bt->dropped, 0);
69008+ atomic_set_unchecked(&bt->dropped, 0);
69009
69010 ret = -EIO;
69011 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
69012diff -urNp linux-2.6.32.46/kernel/trace/ftrace.c linux-2.6.32.46/kernel/trace/ftrace.c
69013--- linux-2.6.32.46/kernel/trace/ftrace.c 2011-06-25 12:55:35.000000000 -0400
69014+++ linux-2.6.32.46/kernel/trace/ftrace.c 2011-06-25 12:56:37.000000000 -0400
69015@@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod,
69016
69017 ip = rec->ip;
69018
69019+ ret = ftrace_arch_code_modify_prepare();
69020+ FTRACE_WARN_ON(ret);
69021+ if (ret)
69022+ return 0;
69023+
69024 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
69025+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
69026 if (ret) {
69027 ftrace_bug(ret, ip);
69028 rec->flags |= FTRACE_FL_FAILED;
69029- return 0;
69030 }
69031- return 1;
69032+ return ret ? 0 : 1;
69033 }
69034
69035 /*
69036diff -urNp linux-2.6.32.46/kernel/trace/ring_buffer.c linux-2.6.32.46/kernel/trace/ring_buffer.c
69037--- linux-2.6.32.46/kernel/trace/ring_buffer.c 2011-03-27 14:31:47.000000000 -0400
69038+++ linux-2.6.32.46/kernel/trace/ring_buffer.c 2011-04-17 15:56:46.000000000 -0400
69039@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
69040 * the reader page). But if the next page is a header page,
69041 * its flags will be non zero.
69042 */
69043-static int inline
69044+static inline int
69045 rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
69046 struct buffer_page *page, struct list_head *list)
69047 {
69048diff -urNp linux-2.6.32.46/kernel/trace/trace.c linux-2.6.32.46/kernel/trace/trace.c
69049--- linux-2.6.32.46/kernel/trace/trace.c 2011-03-27 14:31:47.000000000 -0400
69050+++ linux-2.6.32.46/kernel/trace/trace.c 2011-05-16 21:46:57.000000000 -0400
69051@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(
69052 size_t rem;
69053 unsigned int i;
69054
69055+ pax_track_stack();
69056+
69057 /* copy the tracer to avoid using a global lock all around */
69058 mutex_lock(&trace_types_lock);
69059 if (unlikely(old_tracer != current_trace && current_trace)) {
69060@@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file
69061 int entries, size, i;
69062 size_t ret;
69063
69064+ pax_track_stack();
69065+
69066 if (*ppos & (PAGE_SIZE - 1)) {
69067 WARN_ONCE(1, "Ftrace: previous read must page-align\n");
69068 return -EINVAL;
69069@@ -3816,10 +3820,9 @@ static const struct file_operations trac
69070 };
69071 #endif
69072
69073-static struct dentry *d_tracer;
69074-
69075 struct dentry *tracing_init_dentry(void)
69076 {
69077+ static struct dentry *d_tracer;
69078 static int once;
69079
69080 if (d_tracer)
69081@@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
69082 return d_tracer;
69083 }
69084
69085-static struct dentry *d_percpu;
69086-
69087 struct dentry *tracing_dentry_percpu(void)
69088 {
69089+ static struct dentry *d_percpu;
69090 static int once;
69091 struct dentry *d_tracer;
69092
69093diff -urNp linux-2.6.32.46/kernel/trace/trace_events.c linux-2.6.32.46/kernel/trace/trace_events.c
69094--- linux-2.6.32.46/kernel/trace/trace_events.c 2011-03-27 14:31:47.000000000 -0400
69095+++ linux-2.6.32.46/kernel/trace/trace_events.c 2011-08-05 20:33:55.000000000 -0400
69096@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list
69097 * Modules must own their file_operations to keep up with
69098 * reference counting.
69099 */
69100+
69101 struct ftrace_module_file_ops {
69102 struct list_head list;
69103 struct module *mod;
69104- struct file_operations id;
69105- struct file_operations enable;
69106- struct file_operations format;
69107- struct file_operations filter;
69108 };
69109
69110 static void remove_subsystem_dir(const char *name)
69111@@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod
69112
69113 file_ops->mod = mod;
69114
69115- file_ops->id = ftrace_event_id_fops;
69116- file_ops->id.owner = mod;
69117-
69118- file_ops->enable = ftrace_enable_fops;
69119- file_ops->enable.owner = mod;
69120-
69121- file_ops->filter = ftrace_event_filter_fops;
69122- file_ops->filter.owner = mod;
69123-
69124- file_ops->format = ftrace_event_format_fops;
69125- file_ops->format.owner = mod;
69126+ pax_open_kernel();
69127+ *(void **)&mod->trace_id.owner = mod;
69128+ *(void **)&mod->trace_enable.owner = mod;
69129+ *(void **)&mod->trace_filter.owner = mod;
69130+ *(void **)&mod->trace_format.owner = mod;
69131+ pax_close_kernel();
69132
69133 list_add(&file_ops->list, &ftrace_module_file_list);
69134
69135@@ -1063,8 +1055,8 @@ static void trace_module_add_events(stru
69136 call->mod = mod;
69137 list_add(&call->list, &ftrace_events);
69138 event_create_dir(call, d_events,
69139- &file_ops->id, &file_ops->enable,
69140- &file_ops->filter, &file_ops->format);
69141+ &mod->trace_id, &mod->trace_enable,
69142+ &mod->trace_filter, &mod->trace_format);
69143 }
69144 }
69145
69146diff -urNp linux-2.6.32.46/kernel/trace/trace_mmiotrace.c linux-2.6.32.46/kernel/trace/trace_mmiotrace.c
69147--- linux-2.6.32.46/kernel/trace/trace_mmiotrace.c 2011-03-27 14:31:47.000000000 -0400
69148+++ linux-2.6.32.46/kernel/trace/trace_mmiotrace.c 2011-05-04 17:56:28.000000000 -0400
69149@@ -23,7 +23,7 @@ struct header_iter {
69150 static struct trace_array *mmio_trace_array;
69151 static bool overrun_detected;
69152 static unsigned long prev_overruns;
69153-static atomic_t dropped_count;
69154+static atomic_unchecked_t dropped_count;
69155
69156 static void mmio_reset_data(struct trace_array *tr)
69157 {
69158@@ -126,7 +126,7 @@ static void mmio_close(struct trace_iter
69159
69160 static unsigned long count_overruns(struct trace_iterator *iter)
69161 {
69162- unsigned long cnt = atomic_xchg(&dropped_count, 0);
69163+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
69164 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
69165
69166 if (over > prev_overruns)
69167@@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct
69168 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
69169 sizeof(*entry), 0, pc);
69170 if (!event) {
69171- atomic_inc(&dropped_count);
69172+ atomic_inc_unchecked(&dropped_count);
69173 return;
69174 }
69175 entry = ring_buffer_event_data(event);
69176@@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct
69177 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
69178 sizeof(*entry), 0, pc);
69179 if (!event) {
69180- atomic_inc(&dropped_count);
69181+ atomic_inc_unchecked(&dropped_count);
69182 return;
69183 }
69184 entry = ring_buffer_event_data(event);
69185diff -urNp linux-2.6.32.46/kernel/trace/trace_output.c linux-2.6.32.46/kernel/trace/trace_output.c
69186--- linux-2.6.32.46/kernel/trace/trace_output.c 2011-03-27 14:31:47.000000000 -0400
69187+++ linux-2.6.32.46/kernel/trace/trace_output.c 2011-04-17 15:56:46.000000000 -0400
69188@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s,
69189 return 0;
69190 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
69191 if (!IS_ERR(p)) {
69192- p = mangle_path(s->buffer + s->len, p, "\n");
69193+ p = mangle_path(s->buffer + s->len, p, "\n\\");
69194 if (p) {
69195 s->len = p - s->buffer;
69196 return 1;
69197diff -urNp linux-2.6.32.46/kernel/trace/trace_stack.c linux-2.6.32.46/kernel/trace/trace_stack.c
69198--- linux-2.6.32.46/kernel/trace/trace_stack.c 2011-03-27 14:31:47.000000000 -0400
69199+++ linux-2.6.32.46/kernel/trace/trace_stack.c 2011-04-17 15:56:46.000000000 -0400
69200@@ -50,7 +50,7 @@ static inline void check_stack(void)
69201 return;
69202
69203 /* we do not handle interrupt stacks yet */
69204- if (!object_is_on_stack(&this_size))
69205+ if (!object_starts_on_stack(&this_size))
69206 return;
69207
69208 local_irq_save(flags);
69209diff -urNp linux-2.6.32.46/kernel/trace/trace_workqueue.c linux-2.6.32.46/kernel/trace/trace_workqueue.c
69210--- linux-2.6.32.46/kernel/trace/trace_workqueue.c 2011-03-27 14:31:47.000000000 -0400
69211+++ linux-2.6.32.46/kernel/trace/trace_workqueue.c 2011-04-17 15:56:46.000000000 -0400
69212@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
69213 int cpu;
69214 pid_t pid;
69215 /* Can be inserted from interrupt or user context, need to be atomic */
69216- atomic_t inserted;
69217+ atomic_unchecked_t inserted;
69218 /*
69219 * Don't need to be atomic, works are serialized in a single workqueue thread
69220 * on a single CPU.
69221@@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_st
69222 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
69223 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
69224 if (node->pid == wq_thread->pid) {
69225- atomic_inc(&node->inserted);
69226+ atomic_inc_unchecked(&node->inserted);
69227 goto found;
69228 }
69229 }
69230@@ -205,7 +205,7 @@ static int workqueue_stat_show(struct se
69231 tsk = get_pid_task(pid, PIDTYPE_PID);
69232 if (tsk) {
69233 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
69234- atomic_read(&cws->inserted), cws->executed,
69235+ atomic_read_unchecked(&cws->inserted), cws->executed,
69236 tsk->comm);
69237 put_task_struct(tsk);
69238 }
69239diff -urNp linux-2.6.32.46/kernel/user.c linux-2.6.32.46/kernel/user.c
69240--- linux-2.6.32.46/kernel/user.c 2011-03-27 14:31:47.000000000 -0400
69241+++ linux-2.6.32.46/kernel/user.c 2011-04-17 15:56:46.000000000 -0400
69242@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct use
69243 spin_lock_irq(&uidhash_lock);
69244 up = uid_hash_find(uid, hashent);
69245 if (up) {
69246+ put_user_ns(ns);
69247 key_put(new->uid_keyring);
69248 key_put(new->session_keyring);
69249 kmem_cache_free(uid_cachep, new);
69250diff -urNp linux-2.6.32.46/lib/bug.c linux-2.6.32.46/lib/bug.c
69251--- linux-2.6.32.46/lib/bug.c 2011-03-27 14:31:47.000000000 -0400
69252+++ linux-2.6.32.46/lib/bug.c 2011-04-17 15:56:46.000000000 -0400
69253@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
69254 return BUG_TRAP_TYPE_NONE;
69255
69256 bug = find_bug(bugaddr);
69257+ if (!bug)
69258+ return BUG_TRAP_TYPE_NONE;
69259
69260 printk(KERN_EMERG "------------[ cut here ]------------\n");
69261
69262diff -urNp linux-2.6.32.46/lib/debugobjects.c linux-2.6.32.46/lib/debugobjects.c
69263--- linux-2.6.32.46/lib/debugobjects.c 2011-07-13 17:23:04.000000000 -0400
69264+++ linux-2.6.32.46/lib/debugobjects.c 2011-07-13 17:23:19.000000000 -0400
69265@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
69266 if (limit > 4)
69267 return;
69268
69269- is_on_stack = object_is_on_stack(addr);
69270+ is_on_stack = object_starts_on_stack(addr);
69271 if (is_on_stack == onstack)
69272 return;
69273
69274diff -urNp linux-2.6.32.46/lib/dma-debug.c linux-2.6.32.46/lib/dma-debug.c
69275--- linux-2.6.32.46/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400
69276+++ linux-2.6.32.46/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400
69277@@ -861,7 +861,7 @@ out:
69278
69279 static void check_for_stack(struct device *dev, void *addr)
69280 {
69281- if (object_is_on_stack(addr))
69282+ if (object_starts_on_stack(addr))
69283 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
69284 "stack [addr=%p]\n", addr);
69285 }
69286diff -urNp linux-2.6.32.46/lib/idr.c linux-2.6.32.46/lib/idr.c
69287--- linux-2.6.32.46/lib/idr.c 2011-03-27 14:31:47.000000000 -0400
69288+++ linux-2.6.32.46/lib/idr.c 2011-04-17 15:56:46.000000000 -0400
69289@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
69290 id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
69291
69292 /* if already at the top layer, we need to grow */
69293- if (id >= 1 << (idp->layers * IDR_BITS)) {
69294+ if (id >= (1 << (idp->layers * IDR_BITS))) {
69295 *starting_id = id;
69296 return IDR_NEED_TO_GROW;
69297 }
69298diff -urNp linux-2.6.32.46/lib/inflate.c linux-2.6.32.46/lib/inflate.c
69299--- linux-2.6.32.46/lib/inflate.c 2011-03-27 14:31:47.000000000 -0400
69300+++ linux-2.6.32.46/lib/inflate.c 2011-04-17 15:56:46.000000000 -0400
69301@@ -266,7 +266,7 @@ static void free(void *where)
69302 malloc_ptr = free_mem_ptr;
69303 }
69304 #else
69305-#define malloc(a) kmalloc(a, GFP_KERNEL)
69306+#define malloc(a) kmalloc((a), GFP_KERNEL)
69307 #define free(a) kfree(a)
69308 #endif
69309
69310diff -urNp linux-2.6.32.46/lib/Kconfig.debug linux-2.6.32.46/lib/Kconfig.debug
69311--- linux-2.6.32.46/lib/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
69312+++ linux-2.6.32.46/lib/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
69313@@ -905,7 +905,7 @@ config LATENCYTOP
69314 select STACKTRACE
69315 select SCHEDSTATS
69316 select SCHED_DEBUG
69317- depends on HAVE_LATENCYTOP_SUPPORT
69318+ depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
69319 help
69320 Enable this option if you want to use the LatencyTOP tool
69321 to find out which userspace is blocking on what kernel operations.
69322diff -urNp linux-2.6.32.46/lib/kobject.c linux-2.6.32.46/lib/kobject.c
69323--- linux-2.6.32.46/lib/kobject.c 2011-03-27 14:31:47.000000000 -0400
69324+++ linux-2.6.32.46/lib/kobject.c 2011-04-17 15:56:46.000000000 -0400
69325@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
69326 return ret;
69327 }
69328
69329-struct sysfs_ops kobj_sysfs_ops = {
69330+const struct sysfs_ops kobj_sysfs_ops = {
69331 .show = kobj_attr_show,
69332 .store = kobj_attr_store,
69333 };
69334@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
69335 * If the kset was not able to be created, NULL will be returned.
69336 */
69337 static struct kset *kset_create(const char *name,
69338- struct kset_uevent_ops *uevent_ops,
69339+ const struct kset_uevent_ops *uevent_ops,
69340 struct kobject *parent_kobj)
69341 {
69342 struct kset *kset;
69343@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
69344 * If the kset was not able to be created, NULL will be returned.
69345 */
69346 struct kset *kset_create_and_add(const char *name,
69347- struct kset_uevent_ops *uevent_ops,
69348+ const struct kset_uevent_ops *uevent_ops,
69349 struct kobject *parent_kobj)
69350 {
69351 struct kset *kset;
69352diff -urNp linux-2.6.32.46/lib/kobject_uevent.c linux-2.6.32.46/lib/kobject_uevent.c
69353--- linux-2.6.32.46/lib/kobject_uevent.c 2011-03-27 14:31:47.000000000 -0400
69354+++ linux-2.6.32.46/lib/kobject_uevent.c 2011-04-17 15:56:46.000000000 -0400
69355@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
69356 const char *subsystem;
69357 struct kobject *top_kobj;
69358 struct kset *kset;
69359- struct kset_uevent_ops *uevent_ops;
69360+ const struct kset_uevent_ops *uevent_ops;
69361 u64 seq;
69362 int i = 0;
69363 int retval = 0;
69364diff -urNp linux-2.6.32.46/lib/kref.c linux-2.6.32.46/lib/kref.c
69365--- linux-2.6.32.46/lib/kref.c 2011-03-27 14:31:47.000000000 -0400
69366+++ linux-2.6.32.46/lib/kref.c 2011-04-17 15:56:46.000000000 -0400
69367@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
69368 */
69369 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
69370 {
69371- WARN_ON(release == NULL);
69372+ BUG_ON(release == NULL);
69373 WARN_ON(release == (void (*)(struct kref *))kfree);
69374
69375 if (atomic_dec_and_test(&kref->refcount)) {
69376diff -urNp linux-2.6.32.46/lib/parser.c linux-2.6.32.46/lib/parser.c
69377--- linux-2.6.32.46/lib/parser.c 2011-03-27 14:31:47.000000000 -0400
69378+++ linux-2.6.32.46/lib/parser.c 2011-04-17 15:56:46.000000000 -0400
69379@@ -126,7 +126,7 @@ static int match_number(substring_t *s,
69380 char *buf;
69381 int ret;
69382
69383- buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
69384+ buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
69385 if (!buf)
69386 return -ENOMEM;
69387 memcpy(buf, s->from, s->to - s->from);
69388diff -urNp linux-2.6.32.46/lib/radix-tree.c linux-2.6.32.46/lib/radix-tree.c
69389--- linux-2.6.32.46/lib/radix-tree.c 2011-03-27 14:31:47.000000000 -0400
69390+++ linux-2.6.32.46/lib/radix-tree.c 2011-04-17 15:56:46.000000000 -0400
69391@@ -81,7 +81,7 @@ struct radix_tree_preload {
69392 int nr;
69393 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
69394 };
69395-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
69396+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
69397
69398 static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
69399 {
69400diff -urNp linux-2.6.32.46/lib/random32.c linux-2.6.32.46/lib/random32.c
69401--- linux-2.6.32.46/lib/random32.c 2011-03-27 14:31:47.000000000 -0400
69402+++ linux-2.6.32.46/lib/random32.c 2011-04-17 15:56:46.000000000 -0400
69403@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
69404 */
69405 static inline u32 __seed(u32 x, u32 m)
69406 {
69407- return (x < m) ? x + m : x;
69408+ return (x <= m) ? x + m + 1 : x;
69409 }
69410
69411 /**
69412diff -urNp linux-2.6.32.46/lib/vsprintf.c linux-2.6.32.46/lib/vsprintf.c
69413--- linux-2.6.32.46/lib/vsprintf.c 2011-03-27 14:31:47.000000000 -0400
69414+++ linux-2.6.32.46/lib/vsprintf.c 2011-04-17 15:56:46.000000000 -0400
69415@@ -16,6 +16,9 @@
69416 * - scnprintf and vscnprintf
69417 */
69418
69419+#ifdef CONFIG_GRKERNSEC_HIDESYM
69420+#define __INCLUDED_BY_HIDESYM 1
69421+#endif
69422 #include <stdarg.h>
69423 #include <linux/module.h>
69424 #include <linux/types.h>
69425@@ -546,12 +549,12 @@ static char *number(char *buf, char *end
69426 return buf;
69427 }
69428
69429-static char *string(char *buf, char *end, char *s, struct printf_spec spec)
69430+static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
69431 {
69432 int len, i;
69433
69434 if ((unsigned long)s < PAGE_SIZE)
69435- s = "<NULL>";
69436+ s = "(null)";
69437
69438 len = strnlen(s, spec.precision);
69439
69440@@ -581,7 +584,7 @@ static char *symbol_string(char *buf, ch
69441 unsigned long value = (unsigned long) ptr;
69442 #ifdef CONFIG_KALLSYMS
69443 char sym[KSYM_SYMBOL_LEN];
69444- if (ext != 'f' && ext != 's')
69445+ if (ext != 'f' && ext != 's' && ext != 'a')
69446 sprint_symbol(sym, value);
69447 else
69448 kallsyms_lookup(value, NULL, NULL, NULL, sym);
69449@@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf,
69450 * - 'f' For simple symbolic function names without offset
69451 * - 'S' For symbolic direct pointers with offset
69452 * - 's' For symbolic direct pointers without offset
69453+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
69454+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
69455 * - 'R' For a struct resource pointer, it prints the range of
69456 * addresses (not the name nor the flags)
69457 * - 'M' For a 6-byte MAC address, it prints the address in the
69458@@ -822,7 +827,7 @@ static char *pointer(const char *fmt, ch
69459 struct printf_spec spec)
69460 {
69461 if (!ptr)
69462- return string(buf, end, "(null)", spec);
69463+ return string(buf, end, "(nil)", spec);
69464
69465 switch (*fmt) {
69466 case 'F':
69467@@ -831,6 +836,14 @@ static char *pointer(const char *fmt, ch
69468 case 's':
69469 /* Fallthrough */
69470 case 'S':
69471+#ifdef CONFIG_GRKERNSEC_HIDESYM
69472+ break;
69473+#else
69474+ return symbol_string(buf, end, ptr, spec, *fmt);
69475+#endif
69476+ case 'a':
69477+ /* Fallthrough */
69478+ case 'A':
69479 return symbol_string(buf, end, ptr, spec, *fmt);
69480 case 'R':
69481 return resource_string(buf, end, ptr, spec);
69482@@ -1445,7 +1458,7 @@ do { \
69483 size_t len;
69484 if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
69485 || (unsigned long)save_str < PAGE_SIZE)
69486- save_str = "<NULL>";
69487+ save_str = "(null)";
69488 len = strlen(save_str);
69489 if (str + len + 1 < end)
69490 memcpy(str, save_str, len + 1);
69491@@ -1555,11 +1568,11 @@ int bstr_printf(char *buf, size_t size,
69492 typeof(type) value; \
69493 if (sizeof(type) == 8) { \
69494 args = PTR_ALIGN(args, sizeof(u32)); \
69495- *(u32 *)&value = *(u32 *)args; \
69496- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
69497+ *(u32 *)&value = *(const u32 *)args; \
69498+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
69499 } else { \
69500 args = PTR_ALIGN(args, sizeof(type)); \
69501- value = *(typeof(type) *)args; \
69502+ value = *(const typeof(type) *)args; \
69503 } \
69504 args += sizeof(type); \
69505 value; \
69506@@ -1622,7 +1635,7 @@ int bstr_printf(char *buf, size_t size,
69507 const char *str_arg = args;
69508 size_t len = strlen(str_arg);
69509 args += len + 1;
69510- str = string(str, end, (char *)str_arg, spec);
69511+ str = string(str, end, str_arg, spec);
69512 break;
69513 }
69514
69515diff -urNp linux-2.6.32.46/localversion-grsec linux-2.6.32.46/localversion-grsec
69516--- linux-2.6.32.46/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
69517+++ linux-2.6.32.46/localversion-grsec 2011-04-17 15:56:46.000000000 -0400
69518@@ -0,0 +1 @@
69519+-grsec
69520diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile
69521--- linux-2.6.32.46/Makefile 2011-08-29 22:24:44.000000000 -0400
69522+++ linux-2.6.32.46/Makefile 2011-09-01 17:24:34.000000000 -0400
69523@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
69524
69525 HOSTCC = gcc
69526 HOSTCXX = g++
69527-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
69528-HOSTCXXFLAGS = -O2
69529+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
69530+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
69531+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
69532
69533 # Decide whether to build built-in, modular, or both.
69534 # Normally, just do built-in.
69535@@ -342,10 +343,12 @@ LINUXINCLUDE := -Iinclude \
69536 KBUILD_CPPFLAGS := -D__KERNEL__
69537
69538 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
69539+ -W -Wno-unused-parameter -Wno-missing-field-initializers \
69540 -fno-strict-aliasing -fno-common \
69541 -Werror-implicit-function-declaration \
69542 -Wno-format-security \
69543 -fno-delete-null-pointer-checks
69544+KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
69545 KBUILD_AFLAGS := -D__ASSEMBLY__
69546
69547 # Read KERNELRELEASE from include/config/kernel.release (if it exists)
69548@@ -377,6 +380,7 @@ export RCS_TAR_IGNORE := --exclude SCCS
69549
69550 # Basic helpers built in scripts/
69551 PHONY += scripts_basic
69552+scripts_basic: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS))
69553 scripts_basic:
69554 $(Q)$(MAKE) $(build)=scripts/basic
69555
69556@@ -403,7 +407,7 @@ endif
69557 # of make so .config is not included in this case either (for *config).
69558
69559 no-dot-config-targets := clean mrproper distclean \
69560- cscope TAGS tags help %docs check% \
69561+ cscope gtags TAGS tags help %docs check% \
69562 include/linux/version.h headers_% \
69563 kernelrelease kernelversion
69564
69565@@ -526,6 +530,24 @@ else
69566 KBUILD_CFLAGS += -O2
69567 endif
69568
69569+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC)), y)
69570+CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
69571+ifdef CONFIG_PAX_MEMORY_STACKLEAK
69572+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100
69573+endif
69574+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN
69575+gcc-plugins:
69576+ $(Q)$(MAKE) $(build)=tools/gcc
69577+else
69578+gcc-plugins:
69579+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
69580+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.))
69581+else
69582+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
69583+endif
69584+ $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
69585+endif
69586+
69587 include $(srctree)/arch/$(SRCARCH)/Makefile
69588
69589 ifneq ($(CONFIG_FRAME_WARN),0)
69590@@ -644,7 +666,7 @@ export mod_strip_cmd
69591
69592
69593 ifeq ($(KBUILD_EXTMOD),)
69594-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
69595+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
69596
69597 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
69598 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
69599@@ -840,6 +862,8 @@ define rule_vmlinux-modpost
69600 endef
69601
69602 # vmlinux image - including updated kernel symbols
69603+$(vmlinux-all): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69604+$(vmlinux-all): gcc-plugins
69605 vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o $(kallsyms.o) FORCE
69606 ifdef CONFIG_HEADERS_CHECK
69607 $(Q)$(MAKE) -f $(srctree)/Makefile headers_check
69608@@ -874,7 +898,8 @@ $(sort $(vmlinux-init) $(vmlinux-main))
69609 # Error messages still appears in the original language
69610
69611 PHONY += $(vmlinux-dirs)
69612-$(vmlinux-dirs): prepare scripts
69613+$(vmlinux-dirs): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69614+$(vmlinux-dirs): gcc-plugins prepare scripts
69615 $(Q)$(MAKE) $(build)=$@
69616
69617 # Build the kernel release string
69618@@ -983,6 +1008,7 @@ prepare0: archprepare FORCE
69619 $(Q)$(MAKE) $(build)=. missing-syscalls
69620
69621 # All the preparing..
69622+prepare: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS))
69623 prepare: prepare0
69624
69625 # The asm symlink changes when $(ARCH) changes.
69626@@ -1133,7 +1159,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_B
69627
69628 # Target to prepare building external modules
69629 PHONY += modules_prepare
69630-modules_prepare: prepare scripts
69631+modules_prepare: gcc-plugins prepare scripts
69632
69633 # Target to install modules
69634 PHONY += modules_install
69635@@ -1198,7 +1224,7 @@ MRPROPER_FILES += .config .config.old in
69636 include/linux/autoconf.h include/linux/version.h \
69637 include/linux/utsrelease.h \
69638 include/linux/bounds.h include/asm*/asm-offsets.h \
69639- Module.symvers Module.markers tags TAGS cscope*
69640+ Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
69641
69642 # clean - Delete most, but leave enough to build external modules
69643 #
69644@@ -1242,7 +1268,7 @@ distclean: mrproper
69645 @find $(srctree) $(RCS_FIND_IGNORE) \
69646 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
69647 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
69648- -o -name '.*.rej' -o -size 0 \
69649+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
69650 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
69651 -type f -print | xargs rm -f
69652
69653@@ -1289,6 +1315,7 @@ help:
69654 @echo ' modules_prepare - Set up for building external modules'
69655 @echo ' tags/TAGS - Generate tags file for editors'
69656 @echo ' cscope - Generate cscope index'
69657+ @echo ' gtags - Generate GNU GLOBAL index'
69658 @echo ' kernelrelease - Output the release version string'
69659 @echo ' kernelversion - Output the version stored in Makefile'
69660 @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
69661@@ -1390,6 +1417,7 @@ PHONY += $(module-dirs) modules
69662 $(module-dirs): crmodverdir $(objtree)/Module.symvers
69663 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
69664
69665+modules: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69666 modules: $(module-dirs)
69667 @$(kecho) ' Building modules, stage 2.';
69668 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
69669@@ -1445,7 +1473,7 @@ endif # KBUILD_EXTMOD
69670 quiet_cmd_tags = GEN $@
69671 cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
69672
69673-tags TAGS cscope: FORCE
69674+tags TAGS cscope gtags: FORCE
69675 $(call cmd,tags)
69676
69677 # Scripts to check various things for consistency
69678@@ -1510,17 +1538,19 @@ else
69679 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
69680 endif
69681
69682-%.s: %.c prepare scripts FORCE
69683+%.s: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69684+%.s: %.c gcc-plugins prepare scripts FORCE
69685 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69686 %.i: %.c prepare scripts FORCE
69687 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69688-%.o: %.c prepare scripts FORCE
69689+%.o: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69690+%.o: %.c gcc-plugins prepare scripts FORCE
69691 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69692 %.lst: %.c prepare scripts FORCE
69693 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69694-%.s: %.S prepare scripts FORCE
69695+%.s: %.S gcc-plugins prepare scripts FORCE
69696 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69697-%.o: %.S prepare scripts FORCE
69698+%.o: %.S gcc-plugins prepare scripts FORCE
69699 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69700 %.symtypes: %.c prepare scripts FORCE
69701 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
69702@@ -1530,11 +1560,13 @@ endif
69703 $(cmd_crmodverdir)
69704 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
69705 $(build)=$(build-dir)
69706-%/: prepare scripts FORCE
69707+%/: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69708+%/: gcc-plugins prepare scripts FORCE
69709 $(cmd_crmodverdir)
69710 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
69711 $(build)=$(build-dir)
69712-%.ko: prepare scripts FORCE
69713+%.ko: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
69714+%.ko: gcc-plugins prepare scripts FORCE
69715 $(cmd_crmodverdir)
69716 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
69717 $(build)=$(build-dir) $(@:.ko=.o)
69718diff -urNp linux-2.6.32.46/mm/backing-dev.c linux-2.6.32.46/mm/backing-dev.c
69719--- linux-2.6.32.46/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400
69720+++ linux-2.6.32.46/mm/backing-dev.c 2011-08-11 19:48:17.000000000 -0400
69721@@ -272,7 +272,7 @@ static void bdi_task_init(struct backing
69722 list_add_tail_rcu(&wb->list, &bdi->wb_list);
69723 spin_unlock(&bdi->wb_lock);
69724
69725- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
69726+ tsk->flags |= PF_SWAPWRITE;
69727 set_freezable();
69728
69729 /*
69730@@ -484,7 +484,7 @@ static void bdi_add_to_pending(struct rc
69731 * Add the default flusher task that gets created for any bdi
69732 * that has dirty data pending writeout
69733 */
69734-void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
69735+static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
69736 {
69737 if (!bdi_cap_writeback_dirty(bdi))
69738 return;
69739diff -urNp linux-2.6.32.46/mm/filemap.c linux-2.6.32.46/mm/filemap.c
69740--- linux-2.6.32.46/mm/filemap.c 2011-03-27 14:31:47.000000000 -0400
69741+++ linux-2.6.32.46/mm/filemap.c 2011-04-17 15:56:46.000000000 -0400
69742@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file
69743 struct address_space *mapping = file->f_mapping;
69744
69745 if (!mapping->a_ops->readpage)
69746- return -ENOEXEC;
69747+ return -ENODEV;
69748 file_accessed(file);
69749 vma->vm_ops = &generic_file_vm_ops;
69750 vma->vm_flags |= VM_CAN_NONLINEAR;
69751@@ -2027,6 +2027,7 @@ inline int generic_write_checks(struct f
69752 *pos = i_size_read(inode);
69753
69754 if (limit != RLIM_INFINITY) {
69755+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
69756 if (*pos >= limit) {
69757 send_sig(SIGXFSZ, current, 0);
69758 return -EFBIG;
69759diff -urNp linux-2.6.32.46/mm/fremap.c linux-2.6.32.46/mm/fremap.c
69760--- linux-2.6.32.46/mm/fremap.c 2011-03-27 14:31:47.000000000 -0400
69761+++ linux-2.6.32.46/mm/fremap.c 2011-04-17 15:56:46.000000000 -0400
69762@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
69763 retry:
69764 vma = find_vma(mm, start);
69765
69766+#ifdef CONFIG_PAX_SEGMEXEC
69767+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
69768+ goto out;
69769+#endif
69770+
69771 /*
69772 * Make sure the vma is shared, that it supports prefaulting,
69773 * and that the remapped range is valid and fully within
69774@@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
69775 /*
69776 * drop PG_Mlocked flag for over-mapped range
69777 */
69778- unsigned int saved_flags = vma->vm_flags;
69779+ unsigned long saved_flags = vma->vm_flags;
69780 munlock_vma_pages_range(vma, start, start + size);
69781 vma->vm_flags = saved_flags;
69782 }
69783diff -urNp linux-2.6.32.46/mm/highmem.c linux-2.6.32.46/mm/highmem.c
69784--- linux-2.6.32.46/mm/highmem.c 2011-03-27 14:31:47.000000000 -0400
69785+++ linux-2.6.32.46/mm/highmem.c 2011-04-17 15:56:46.000000000 -0400
69786@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
69787 * So no dangers, even with speculative execution.
69788 */
69789 page = pte_page(pkmap_page_table[i]);
69790+ pax_open_kernel();
69791 pte_clear(&init_mm, (unsigned long)page_address(page),
69792 &pkmap_page_table[i]);
69793-
69794+ pax_close_kernel();
69795 set_page_address(page, NULL);
69796 need_flush = 1;
69797 }
69798@@ -177,9 +178,11 @@ start:
69799 }
69800 }
69801 vaddr = PKMAP_ADDR(last_pkmap_nr);
69802+
69803+ pax_open_kernel();
69804 set_pte_at(&init_mm, vaddr,
69805 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
69806-
69807+ pax_close_kernel();
69808 pkmap_count[last_pkmap_nr] = 1;
69809 set_page_address(page, (void *)vaddr);
69810
69811diff -urNp linux-2.6.32.46/mm/hugetlb.c linux-2.6.32.46/mm/hugetlb.c
69812--- linux-2.6.32.46/mm/hugetlb.c 2011-07-13 17:23:04.000000000 -0400
69813+++ linux-2.6.32.46/mm/hugetlb.c 2011-07-13 17:23:19.000000000 -0400
69814@@ -1933,6 +1933,26 @@ static int unmap_ref_private(struct mm_s
69815 return 1;
69816 }
69817
69818+#ifdef CONFIG_PAX_SEGMEXEC
69819+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
69820+{
69821+ struct mm_struct *mm = vma->vm_mm;
69822+ struct vm_area_struct *vma_m;
69823+ unsigned long address_m;
69824+ pte_t *ptep_m;
69825+
69826+ vma_m = pax_find_mirror_vma(vma);
69827+ if (!vma_m)
69828+ return;
69829+
69830+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
69831+ address_m = address + SEGMEXEC_TASK_SIZE;
69832+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
69833+ get_page(page_m);
69834+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
69835+}
69836+#endif
69837+
69838 static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
69839 unsigned long address, pte_t *ptep, pte_t pte,
69840 struct page *pagecache_page)
69841@@ -2004,6 +2024,11 @@ retry_avoidcopy:
69842 huge_ptep_clear_flush(vma, address, ptep);
69843 set_huge_pte_at(mm, address, ptep,
69844 make_huge_pte(vma, new_page, 1));
69845+
69846+#ifdef CONFIG_PAX_SEGMEXEC
69847+ pax_mirror_huge_pte(vma, address, new_page);
69848+#endif
69849+
69850 /* Make the old page be freed below */
69851 new_page = old_page;
69852 }
69853@@ -2135,6 +2160,10 @@ retry:
69854 && (vma->vm_flags & VM_SHARED)));
69855 set_huge_pte_at(mm, address, ptep, new_pte);
69856
69857+#ifdef CONFIG_PAX_SEGMEXEC
69858+ pax_mirror_huge_pte(vma, address, page);
69859+#endif
69860+
69861 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
69862 /* Optimization, do the COW without a second fault */
69863 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
69864@@ -2163,6 +2192,28 @@ int hugetlb_fault(struct mm_struct *mm,
69865 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
69866 struct hstate *h = hstate_vma(vma);
69867
69868+#ifdef CONFIG_PAX_SEGMEXEC
69869+ struct vm_area_struct *vma_m;
69870+
69871+ vma_m = pax_find_mirror_vma(vma);
69872+ if (vma_m) {
69873+ unsigned long address_m;
69874+
69875+ if (vma->vm_start > vma_m->vm_start) {
69876+ address_m = address;
69877+ address -= SEGMEXEC_TASK_SIZE;
69878+ vma = vma_m;
69879+ h = hstate_vma(vma);
69880+ } else
69881+ address_m = address + SEGMEXEC_TASK_SIZE;
69882+
69883+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
69884+ return VM_FAULT_OOM;
69885+ address_m &= HPAGE_MASK;
69886+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
69887+ }
69888+#endif
69889+
69890 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
69891 if (!ptep)
69892 return VM_FAULT_OOM;
69893diff -urNp linux-2.6.32.46/mm/internal.h linux-2.6.32.46/mm/internal.h
69894--- linux-2.6.32.46/mm/internal.h 2011-03-27 14:31:47.000000000 -0400
69895+++ linux-2.6.32.46/mm/internal.h 2011-07-09 09:13:08.000000000 -0400
69896@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
69897 * in mm/page_alloc.c
69898 */
69899 extern void __free_pages_bootmem(struct page *page, unsigned int order);
69900+extern void free_compound_page(struct page *page);
69901 extern void prep_compound_page(struct page *page, unsigned long order);
69902
69903
69904diff -urNp linux-2.6.32.46/mm/Kconfig linux-2.6.32.46/mm/Kconfig
69905--- linux-2.6.32.46/mm/Kconfig 2011-03-27 14:31:47.000000000 -0400
69906+++ linux-2.6.32.46/mm/Kconfig 2011-04-17 15:56:46.000000000 -0400
69907@@ -228,7 +228,7 @@ config KSM
69908 config DEFAULT_MMAP_MIN_ADDR
69909 int "Low address space to protect from user allocation"
69910 depends on MMU
69911- default 4096
69912+ default 65536
69913 help
69914 This is the portion of low virtual memory which should be protected
69915 from userspace allocation. Keeping a user from writing to low pages
69916diff -urNp linux-2.6.32.46/mm/kmemleak.c linux-2.6.32.46/mm/kmemleak.c
69917--- linux-2.6.32.46/mm/kmemleak.c 2011-06-25 12:55:35.000000000 -0400
69918+++ linux-2.6.32.46/mm/kmemleak.c 2011-06-25 12:56:37.000000000 -0400
69919@@ -358,7 +358,7 @@ static void print_unreferenced(struct se
69920
69921 for (i = 0; i < object->trace_len; i++) {
69922 void *ptr = (void *)object->trace[i];
69923- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
69924+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
69925 }
69926 }
69927
69928diff -urNp linux-2.6.32.46/mm/maccess.c linux-2.6.32.46/mm/maccess.c
69929--- linux-2.6.32.46/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400
69930+++ linux-2.6.32.46/mm/maccess.c 2011-04-17 15:56:46.000000000 -0400
69931@@ -14,7 +14,7 @@
69932 * Safely read from address @src to the buffer at @dst. If a kernel fault
69933 * happens, handle that and return -EFAULT.
69934 */
69935-long probe_kernel_read(void *dst, void *src, size_t size)
69936+long probe_kernel_read(void *dst, const void *src, size_t size)
69937 {
69938 long ret;
69939 mm_segment_t old_fs = get_fs();
69940@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
69941 * Safely write to address @dst from the buffer at @src. If a kernel fault
69942 * happens, handle that and return -EFAULT.
69943 */
69944-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
69945+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
69946 {
69947 long ret;
69948 mm_segment_t old_fs = get_fs();
69949diff -urNp linux-2.6.32.46/mm/madvise.c linux-2.6.32.46/mm/madvise.c
69950--- linux-2.6.32.46/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400
69951+++ linux-2.6.32.46/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400
69952@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
69953 pgoff_t pgoff;
69954 unsigned long new_flags = vma->vm_flags;
69955
69956+#ifdef CONFIG_PAX_SEGMEXEC
69957+ struct vm_area_struct *vma_m;
69958+#endif
69959+
69960 switch (behavior) {
69961 case MADV_NORMAL:
69962 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
69963@@ -103,6 +107,13 @@ success:
69964 /*
69965 * vm_flags is protected by the mmap_sem held in write mode.
69966 */
69967+
69968+#ifdef CONFIG_PAX_SEGMEXEC
69969+ vma_m = pax_find_mirror_vma(vma);
69970+ if (vma_m)
69971+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
69972+#endif
69973+
69974 vma->vm_flags = new_flags;
69975
69976 out:
69977@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
69978 struct vm_area_struct ** prev,
69979 unsigned long start, unsigned long end)
69980 {
69981+
69982+#ifdef CONFIG_PAX_SEGMEXEC
69983+ struct vm_area_struct *vma_m;
69984+#endif
69985+
69986 *prev = vma;
69987 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
69988 return -EINVAL;
69989@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
69990 zap_page_range(vma, start, end - start, &details);
69991 } else
69992 zap_page_range(vma, start, end - start, NULL);
69993+
69994+#ifdef CONFIG_PAX_SEGMEXEC
69995+ vma_m = pax_find_mirror_vma(vma);
69996+ if (vma_m) {
69997+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
69998+ struct zap_details details = {
69999+ .nonlinear_vma = vma_m,
70000+ .last_index = ULONG_MAX,
70001+ };
70002+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
70003+ } else
70004+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
70005+ }
70006+#endif
70007+
70008 return 0;
70009 }
70010
70011@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
70012 if (end < start)
70013 goto out;
70014
70015+#ifdef CONFIG_PAX_SEGMEXEC
70016+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
70017+ if (end > SEGMEXEC_TASK_SIZE)
70018+ goto out;
70019+ } else
70020+#endif
70021+
70022+ if (end > TASK_SIZE)
70023+ goto out;
70024+
70025 error = 0;
70026 if (end == start)
70027 goto out;
70028diff -urNp linux-2.6.32.46/mm/memory.c linux-2.6.32.46/mm/memory.c
70029--- linux-2.6.32.46/mm/memory.c 2011-07-13 17:23:04.000000000 -0400
70030+++ linux-2.6.32.46/mm/memory.c 2011-07-13 17:23:23.000000000 -0400
70031@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct
70032 return;
70033
70034 pmd = pmd_offset(pud, start);
70035+
70036+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
70037 pud_clear(pud);
70038 pmd_free_tlb(tlb, pmd, start);
70039+#endif
70040+
70041 }
70042
70043 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
70044@@ -219,9 +223,12 @@ static inline void free_pud_range(struct
70045 if (end - 1 > ceiling - 1)
70046 return;
70047
70048+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
70049 pud = pud_offset(pgd, start);
70050 pgd_clear(pgd);
70051 pud_free_tlb(tlb, pud, start);
70052+#endif
70053+
70054 }
70055
70056 /*
70057@@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct
70058 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
70059 i = 0;
70060
70061- do {
70062+ while (nr_pages) {
70063 struct vm_area_struct *vma;
70064
70065- vma = find_extend_vma(mm, start);
70066+ vma = find_vma(mm, start);
70067 if (!vma && in_gate_area(tsk, start)) {
70068 unsigned long pg = start & PAGE_MASK;
70069 struct vm_area_struct *gate_vma = get_gate_vma(tsk);
70070@@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct
70071 continue;
70072 }
70073
70074- if (!vma ||
70075+ if (!vma || start < vma->vm_start ||
70076 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
70077 !(vm_flags & vma->vm_flags))
70078 return i ? : -EFAULT;
70079@@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct
70080 start += PAGE_SIZE;
70081 nr_pages--;
70082 } while (nr_pages && start < vma->vm_end);
70083- } while (nr_pages);
70084+ }
70085 return i;
70086 }
70087
70088@@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_st
70089 page_add_file_rmap(page);
70090 set_pte_at(mm, addr, pte, mk_pte(page, prot));
70091
70092+#ifdef CONFIG_PAX_SEGMEXEC
70093+ pax_mirror_file_pte(vma, addr, page, ptl);
70094+#endif
70095+
70096 retval = 0;
70097 pte_unmap_unlock(pte, ptl);
70098 return retval;
70099@@ -1560,10 +1571,22 @@ out:
70100 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
70101 struct page *page)
70102 {
70103+
70104+#ifdef CONFIG_PAX_SEGMEXEC
70105+ struct vm_area_struct *vma_m;
70106+#endif
70107+
70108 if (addr < vma->vm_start || addr >= vma->vm_end)
70109 return -EFAULT;
70110 if (!page_count(page))
70111 return -EINVAL;
70112+
70113+#ifdef CONFIG_PAX_SEGMEXEC
70114+ vma_m = pax_find_mirror_vma(vma);
70115+ if (vma_m)
70116+ vma_m->vm_flags |= VM_INSERTPAGE;
70117+#endif
70118+
70119 vma->vm_flags |= VM_INSERTPAGE;
70120 return insert_page(vma, addr, page, vma->vm_page_prot);
70121 }
70122@@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struc
70123 unsigned long pfn)
70124 {
70125 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
70126+ BUG_ON(vma->vm_mirror);
70127
70128 if (addr < vma->vm_start || addr >= vma->vm_end)
70129 return -EFAULT;
70130@@ -1977,6 +2001,186 @@ static inline void cow_user_page(struct
70131 copy_user_highpage(dst, src, va, vma);
70132 }
70133
70134+#ifdef CONFIG_PAX_SEGMEXEC
70135+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
70136+{
70137+ struct mm_struct *mm = vma->vm_mm;
70138+ spinlock_t *ptl;
70139+ pte_t *pte, entry;
70140+
70141+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
70142+ entry = *pte;
70143+ if (!pte_present(entry)) {
70144+ if (!pte_none(entry)) {
70145+ BUG_ON(pte_file(entry));
70146+ free_swap_and_cache(pte_to_swp_entry(entry));
70147+ pte_clear_not_present_full(mm, address, pte, 0);
70148+ }
70149+ } else {
70150+ struct page *page;
70151+
70152+ flush_cache_page(vma, address, pte_pfn(entry));
70153+ entry = ptep_clear_flush(vma, address, pte);
70154+ BUG_ON(pte_dirty(entry));
70155+ page = vm_normal_page(vma, address, entry);
70156+ if (page) {
70157+ update_hiwater_rss(mm);
70158+ if (PageAnon(page))
70159+ dec_mm_counter(mm, anon_rss);
70160+ else
70161+ dec_mm_counter(mm, file_rss);
70162+ page_remove_rmap(page);
70163+ page_cache_release(page);
70164+ }
70165+ }
70166+ pte_unmap_unlock(pte, ptl);
70167+}
70168+
70169+/* PaX: if vma is mirrored, synchronize the mirror's PTE
70170+ *
70171+ * the ptl of the lower mapped page is held on entry and is not released on exit
70172+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
70173+ */
70174+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70175+{
70176+ struct mm_struct *mm = vma->vm_mm;
70177+ unsigned long address_m;
70178+ spinlock_t *ptl_m;
70179+ struct vm_area_struct *vma_m;
70180+ pmd_t *pmd_m;
70181+ pte_t *pte_m, entry_m;
70182+
70183+ BUG_ON(!page_m || !PageAnon(page_m));
70184+
70185+ vma_m = pax_find_mirror_vma(vma);
70186+ if (!vma_m)
70187+ return;
70188+
70189+ BUG_ON(!PageLocked(page_m));
70190+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70191+ address_m = address + SEGMEXEC_TASK_SIZE;
70192+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70193+ pte_m = pte_offset_map_nested(pmd_m, address_m);
70194+ ptl_m = pte_lockptr(mm, pmd_m);
70195+ if (ptl != ptl_m) {
70196+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70197+ if (!pte_none(*pte_m))
70198+ goto out;
70199+ }
70200+
70201+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70202+ page_cache_get(page_m);
70203+ page_add_anon_rmap(page_m, vma_m, address_m);
70204+ inc_mm_counter(mm, anon_rss);
70205+ set_pte_at(mm, address_m, pte_m, entry_m);
70206+ update_mmu_cache(vma_m, address_m, entry_m);
70207+out:
70208+ if (ptl != ptl_m)
70209+ spin_unlock(ptl_m);
70210+ pte_unmap_nested(pte_m);
70211+ unlock_page(page_m);
70212+}
70213+
70214+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
70215+{
70216+ struct mm_struct *mm = vma->vm_mm;
70217+ unsigned long address_m;
70218+ spinlock_t *ptl_m;
70219+ struct vm_area_struct *vma_m;
70220+ pmd_t *pmd_m;
70221+ pte_t *pte_m, entry_m;
70222+
70223+ BUG_ON(!page_m || PageAnon(page_m));
70224+
70225+ vma_m = pax_find_mirror_vma(vma);
70226+ if (!vma_m)
70227+ return;
70228+
70229+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70230+ address_m = address + SEGMEXEC_TASK_SIZE;
70231+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70232+ pte_m = pte_offset_map_nested(pmd_m, address_m);
70233+ ptl_m = pte_lockptr(mm, pmd_m);
70234+ if (ptl != ptl_m) {
70235+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70236+ if (!pte_none(*pte_m))
70237+ goto out;
70238+ }
70239+
70240+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
70241+ page_cache_get(page_m);
70242+ page_add_file_rmap(page_m);
70243+ inc_mm_counter(mm, file_rss);
70244+ set_pte_at(mm, address_m, pte_m, entry_m);
70245+ update_mmu_cache(vma_m, address_m, entry_m);
70246+out:
70247+ if (ptl != ptl_m)
70248+ spin_unlock(ptl_m);
70249+ pte_unmap_nested(pte_m);
70250+}
70251+
70252+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
70253+{
70254+ struct mm_struct *mm = vma->vm_mm;
70255+ unsigned long address_m;
70256+ spinlock_t *ptl_m;
70257+ struct vm_area_struct *vma_m;
70258+ pmd_t *pmd_m;
70259+ pte_t *pte_m, entry_m;
70260+
70261+ vma_m = pax_find_mirror_vma(vma);
70262+ if (!vma_m)
70263+ return;
70264+
70265+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
70266+ address_m = address + SEGMEXEC_TASK_SIZE;
70267+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
70268+ pte_m = pte_offset_map_nested(pmd_m, address_m);
70269+ ptl_m = pte_lockptr(mm, pmd_m);
70270+ if (ptl != ptl_m) {
70271+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
70272+ if (!pte_none(*pte_m))
70273+ goto out;
70274+ }
70275+
70276+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
70277+ set_pte_at(mm, address_m, pte_m, entry_m);
70278+out:
70279+ if (ptl != ptl_m)
70280+ spin_unlock(ptl_m);
70281+ pte_unmap_nested(pte_m);
70282+}
70283+
70284+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
70285+{
70286+ struct page *page_m;
70287+ pte_t entry;
70288+
70289+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
70290+ goto out;
70291+
70292+ entry = *pte;
70293+ page_m = vm_normal_page(vma, address, entry);
70294+ if (!page_m)
70295+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
70296+ else if (PageAnon(page_m)) {
70297+ if (pax_find_mirror_vma(vma)) {
70298+ pte_unmap_unlock(pte, ptl);
70299+ lock_page(page_m);
70300+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
70301+ if (pte_same(entry, *pte))
70302+ pax_mirror_anon_pte(vma, address, page_m, ptl);
70303+ else
70304+ unlock_page(page_m);
70305+ }
70306+ } else
70307+ pax_mirror_file_pte(vma, address, page_m, ptl);
70308+
70309+out:
70310+ pte_unmap_unlock(pte, ptl);
70311+}
70312+#endif
70313+
70314 /*
70315 * This routine handles present pages, when users try to write
70316 * to a shared page. It is done by copying the page to a new address
70317@@ -2156,6 +2360,12 @@ gotten:
70318 */
70319 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70320 if (likely(pte_same(*page_table, orig_pte))) {
70321+
70322+#ifdef CONFIG_PAX_SEGMEXEC
70323+ if (pax_find_mirror_vma(vma))
70324+ BUG_ON(!trylock_page(new_page));
70325+#endif
70326+
70327 if (old_page) {
70328 if (!PageAnon(old_page)) {
70329 dec_mm_counter(mm, file_rss);
70330@@ -2207,6 +2417,10 @@ gotten:
70331 page_remove_rmap(old_page);
70332 }
70333
70334+#ifdef CONFIG_PAX_SEGMEXEC
70335+ pax_mirror_anon_pte(vma, address, new_page, ptl);
70336+#endif
70337+
70338 /* Free the old page.. */
70339 new_page = old_page;
70340 ret |= VM_FAULT_WRITE;
70341@@ -2606,6 +2820,11 @@ static int do_swap_page(struct mm_struct
70342 swap_free(entry);
70343 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
70344 try_to_free_swap(page);
70345+
70346+#ifdef CONFIG_PAX_SEGMEXEC
70347+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
70348+#endif
70349+
70350 unlock_page(page);
70351
70352 if (flags & FAULT_FLAG_WRITE) {
70353@@ -2617,6 +2836,11 @@ static int do_swap_page(struct mm_struct
70354
70355 /* No need to invalidate - it was non-present before */
70356 update_mmu_cache(vma, address, pte);
70357+
70358+#ifdef CONFIG_PAX_SEGMEXEC
70359+ pax_mirror_anon_pte(vma, address, page, ptl);
70360+#endif
70361+
70362 unlock:
70363 pte_unmap_unlock(page_table, ptl);
70364 out:
70365@@ -2632,40 +2856,6 @@ out_release:
70366 }
70367
70368 /*
70369- * This is like a special single-page "expand_{down|up}wards()",
70370- * except we must first make sure that 'address{-|+}PAGE_SIZE'
70371- * doesn't hit another vma.
70372- */
70373-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
70374-{
70375- address &= PAGE_MASK;
70376- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
70377- struct vm_area_struct *prev = vma->vm_prev;
70378-
70379- /*
70380- * Is there a mapping abutting this one below?
70381- *
70382- * That's only ok if it's the same stack mapping
70383- * that has gotten split..
70384- */
70385- if (prev && prev->vm_end == address)
70386- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
70387-
70388- expand_stack(vma, address - PAGE_SIZE);
70389- }
70390- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
70391- struct vm_area_struct *next = vma->vm_next;
70392-
70393- /* As VM_GROWSDOWN but s/below/above/ */
70394- if (next && next->vm_start == address + PAGE_SIZE)
70395- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
70396-
70397- expand_upwards(vma, address + PAGE_SIZE);
70398- }
70399- return 0;
70400-}
70401-
70402-/*
70403 * We enter with non-exclusive mmap_sem (to exclude vma changes,
70404 * but allow concurrent faults), and pte mapped but not yet locked.
70405 * We return with mmap_sem still held, but pte unmapped and unlocked.
70406@@ -2674,27 +2864,23 @@ static int do_anonymous_page(struct mm_s
70407 unsigned long address, pte_t *page_table, pmd_t *pmd,
70408 unsigned int flags)
70409 {
70410- struct page *page;
70411+ struct page *page = NULL;
70412 spinlock_t *ptl;
70413 pte_t entry;
70414
70415- pte_unmap(page_table);
70416-
70417- /* Check if we need to add a guard page to the stack */
70418- if (check_stack_guard_page(vma, address) < 0)
70419- return VM_FAULT_SIGBUS;
70420-
70421- /* Use the zero-page for reads */
70422 if (!(flags & FAULT_FLAG_WRITE)) {
70423 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
70424 vma->vm_page_prot));
70425- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
70426+ ptl = pte_lockptr(mm, pmd);
70427+ spin_lock(ptl);
70428 if (!pte_none(*page_table))
70429 goto unlock;
70430 goto setpte;
70431 }
70432
70433 /* Allocate our own private page. */
70434+ pte_unmap(page_table);
70435+
70436 if (unlikely(anon_vma_prepare(vma)))
70437 goto oom;
70438 page = alloc_zeroed_user_highpage_movable(vma, address);
70439@@ -2713,6 +2899,11 @@ static int do_anonymous_page(struct mm_s
70440 if (!pte_none(*page_table))
70441 goto release;
70442
70443+#ifdef CONFIG_PAX_SEGMEXEC
70444+ if (pax_find_mirror_vma(vma))
70445+ BUG_ON(!trylock_page(page));
70446+#endif
70447+
70448 inc_mm_counter(mm, anon_rss);
70449 page_add_new_anon_rmap(page, vma, address);
70450 setpte:
70451@@ -2720,6 +2911,12 @@ setpte:
70452
70453 /* No need to invalidate - it was non-present before */
70454 update_mmu_cache(vma, address, entry);
70455+
70456+#ifdef CONFIG_PAX_SEGMEXEC
70457+ if (page)
70458+ pax_mirror_anon_pte(vma, address, page, ptl);
70459+#endif
70460+
70461 unlock:
70462 pte_unmap_unlock(page_table, ptl);
70463 return 0;
70464@@ -2862,6 +3059,12 @@ static int __do_fault(struct mm_struct *
70465 */
70466 /* Only go through if we didn't race with anybody else... */
70467 if (likely(pte_same(*page_table, orig_pte))) {
70468+
70469+#ifdef CONFIG_PAX_SEGMEXEC
70470+ if (anon && pax_find_mirror_vma(vma))
70471+ BUG_ON(!trylock_page(page));
70472+#endif
70473+
70474 flush_icache_page(vma, page);
70475 entry = mk_pte(page, vma->vm_page_prot);
70476 if (flags & FAULT_FLAG_WRITE)
70477@@ -2881,6 +3084,14 @@ static int __do_fault(struct mm_struct *
70478
70479 /* no need to invalidate: a not-present page won't be cached */
70480 update_mmu_cache(vma, address, entry);
70481+
70482+#ifdef CONFIG_PAX_SEGMEXEC
70483+ if (anon)
70484+ pax_mirror_anon_pte(vma, address, page, ptl);
70485+ else
70486+ pax_mirror_file_pte(vma, address, page, ptl);
70487+#endif
70488+
70489 } else {
70490 if (charged)
70491 mem_cgroup_uncharge_page(page);
70492@@ -3028,6 +3239,12 @@ static inline int handle_pte_fault(struc
70493 if (flags & FAULT_FLAG_WRITE)
70494 flush_tlb_page(vma, address);
70495 }
70496+
70497+#ifdef CONFIG_PAX_SEGMEXEC
70498+ pax_mirror_pte(vma, address, pte, pmd, ptl);
70499+ return 0;
70500+#endif
70501+
70502 unlock:
70503 pte_unmap_unlock(pte, ptl);
70504 return 0;
70505@@ -3044,6 +3261,10 @@ int handle_mm_fault(struct mm_struct *mm
70506 pmd_t *pmd;
70507 pte_t *pte;
70508
70509+#ifdef CONFIG_PAX_SEGMEXEC
70510+ struct vm_area_struct *vma_m;
70511+#endif
70512+
70513 __set_current_state(TASK_RUNNING);
70514
70515 count_vm_event(PGFAULT);
70516@@ -3051,6 +3272,34 @@ int handle_mm_fault(struct mm_struct *mm
70517 if (unlikely(is_vm_hugetlb_page(vma)))
70518 return hugetlb_fault(mm, vma, address, flags);
70519
70520+#ifdef CONFIG_PAX_SEGMEXEC
70521+ vma_m = pax_find_mirror_vma(vma);
70522+ if (vma_m) {
70523+ unsigned long address_m;
70524+ pgd_t *pgd_m;
70525+ pud_t *pud_m;
70526+ pmd_t *pmd_m;
70527+
70528+ if (vma->vm_start > vma_m->vm_start) {
70529+ address_m = address;
70530+ address -= SEGMEXEC_TASK_SIZE;
70531+ vma = vma_m;
70532+ } else
70533+ address_m = address + SEGMEXEC_TASK_SIZE;
70534+
70535+ pgd_m = pgd_offset(mm, address_m);
70536+ pud_m = pud_alloc(mm, pgd_m, address_m);
70537+ if (!pud_m)
70538+ return VM_FAULT_OOM;
70539+ pmd_m = pmd_alloc(mm, pud_m, address_m);
70540+ if (!pmd_m)
70541+ return VM_FAULT_OOM;
70542+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
70543+ return VM_FAULT_OOM;
70544+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
70545+ }
70546+#endif
70547+
70548 pgd = pgd_offset(mm, address);
70549 pud = pud_alloc(mm, pgd, address);
70550 if (!pud)
70551@@ -3148,7 +3397,7 @@ static int __init gate_vma_init(void)
70552 gate_vma.vm_start = FIXADDR_USER_START;
70553 gate_vma.vm_end = FIXADDR_USER_END;
70554 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
70555- gate_vma.vm_page_prot = __P101;
70556+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
70557 /*
70558 * Make sure the vDSO gets into every core dump.
70559 * Dumping its contents makes post-mortem fully interpretable later
70560diff -urNp linux-2.6.32.46/mm/memory-failure.c linux-2.6.32.46/mm/memory-failure.c
70561--- linux-2.6.32.46/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400
70562+++ linux-2.6.32.46/mm/memory-failure.c 2011-04-17 15:56:46.000000000 -0400
70563@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
70564
70565 int sysctl_memory_failure_recovery __read_mostly = 1;
70566
70567-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70568+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
70569
70570 /*
70571 * Send all the processes who have the page mapped an ``action optional''
70572@@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn,
70573 return 0;
70574 }
70575
70576- atomic_long_add(1, &mce_bad_pages);
70577+ atomic_long_add_unchecked(1, &mce_bad_pages);
70578
70579 /*
70580 * We need/can do nothing about count=0 pages.
70581diff -urNp linux-2.6.32.46/mm/mempolicy.c linux-2.6.32.46/mm/mempolicy.c
70582--- linux-2.6.32.46/mm/mempolicy.c 2011-03-27 14:31:47.000000000 -0400
70583+++ linux-2.6.32.46/mm/mempolicy.c 2011-04-17 15:56:46.000000000 -0400
70584@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
70585 struct vm_area_struct *next;
70586 int err;
70587
70588+#ifdef CONFIG_PAX_SEGMEXEC
70589+ struct vm_area_struct *vma_m;
70590+#endif
70591+
70592 err = 0;
70593 for (; vma && vma->vm_start < end; vma = next) {
70594 next = vma->vm_next;
70595@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
70596 err = policy_vma(vma, new);
70597 if (err)
70598 break;
70599+
70600+#ifdef CONFIG_PAX_SEGMEXEC
70601+ vma_m = pax_find_mirror_vma(vma);
70602+ if (vma_m) {
70603+ err = policy_vma(vma_m, new);
70604+ if (err)
70605+ break;
70606+ }
70607+#endif
70608+
70609 }
70610 return err;
70611 }
70612@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
70613
70614 if (end < start)
70615 return -EINVAL;
70616+
70617+#ifdef CONFIG_PAX_SEGMEXEC
70618+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
70619+ if (end > SEGMEXEC_TASK_SIZE)
70620+ return -EINVAL;
70621+ } else
70622+#endif
70623+
70624+ if (end > TASK_SIZE)
70625+ return -EINVAL;
70626+
70627 if (end == start)
70628 return 0;
70629
70630@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
70631 if (!mm)
70632 return -EINVAL;
70633
70634+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
70635+ if (mm != current->mm &&
70636+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
70637+ err = -EPERM;
70638+ goto out;
70639+ }
70640+#endif
70641+
70642 /*
70643 * Check if this process has the right to modify the specified
70644 * process. The right exists if the process has administrative
70645@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
70646 rcu_read_lock();
70647 tcred = __task_cred(task);
70648 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
70649- cred->uid != tcred->suid && cred->uid != tcred->uid &&
70650- !capable(CAP_SYS_NICE)) {
70651+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
70652 rcu_read_unlock();
70653 err = -EPERM;
70654 goto out;
70655@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
70656
70657 if (file) {
70658 seq_printf(m, " file=");
70659- seq_path(m, &file->f_path, "\n\t= ");
70660+ seq_path(m, &file->f_path, "\n\t\\= ");
70661 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
70662 seq_printf(m, " heap");
70663 } else if (vma->vm_start <= mm->start_stack &&
70664diff -urNp linux-2.6.32.46/mm/migrate.c linux-2.6.32.46/mm/migrate.c
70665--- linux-2.6.32.46/mm/migrate.c 2011-07-13 17:23:04.000000000 -0400
70666+++ linux-2.6.32.46/mm/migrate.c 2011-07-13 17:23:23.000000000 -0400
70667@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struc
70668 unsigned long chunk_start;
70669 int err;
70670
70671+ pax_track_stack();
70672+
70673 task_nodes = cpuset_mems_allowed(task);
70674
70675 err = -ENOMEM;
70676@@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
70677 if (!mm)
70678 return -EINVAL;
70679
70680+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
70681+ if (mm != current->mm &&
70682+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
70683+ err = -EPERM;
70684+ goto out;
70685+ }
70686+#endif
70687+
70688 /*
70689 * Check if this process has the right to modify the specified
70690 * process. The right exists if the process has administrative
70691@@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
70692 rcu_read_lock();
70693 tcred = __task_cred(task);
70694 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
70695- cred->uid != tcred->suid && cred->uid != tcred->uid &&
70696- !capable(CAP_SYS_NICE)) {
70697+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
70698 rcu_read_unlock();
70699 err = -EPERM;
70700 goto out;
70701diff -urNp linux-2.6.32.46/mm/mlock.c linux-2.6.32.46/mm/mlock.c
70702--- linux-2.6.32.46/mm/mlock.c 2011-03-27 14:31:47.000000000 -0400
70703+++ linux-2.6.32.46/mm/mlock.c 2011-04-17 15:56:46.000000000 -0400
70704@@ -13,6 +13,7 @@
70705 #include <linux/pagemap.h>
70706 #include <linux/mempolicy.h>
70707 #include <linux/syscalls.h>
70708+#include <linux/security.h>
70709 #include <linux/sched.h>
70710 #include <linux/module.h>
70711 #include <linux/rmap.h>
70712@@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
70713 }
70714 }
70715
70716-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
70717-{
70718- return (vma->vm_flags & VM_GROWSDOWN) &&
70719- (vma->vm_start == addr) &&
70720- !vma_stack_continue(vma->vm_prev, addr);
70721-}
70722-
70723 /**
70724 * __mlock_vma_pages_range() - mlock a range of pages in the vma.
70725 * @vma: target vma
70726@@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(stru
70727 if (vma->vm_flags & VM_WRITE)
70728 gup_flags |= FOLL_WRITE;
70729
70730- /* We don't try to access the guard page of a stack vma */
70731- if (stack_guard_page(vma, start)) {
70732- addr += PAGE_SIZE;
70733- nr_pages--;
70734- }
70735-
70736 while (nr_pages > 0) {
70737 int i;
70738
70739@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start,
70740 {
70741 unsigned long nstart, end, tmp;
70742 struct vm_area_struct * vma, * prev;
70743- int error;
70744+ int error = -EINVAL;
70745
70746 len = PAGE_ALIGN(len);
70747 end = start + len;
70748@@ -448,6 +436,9 @@ static int do_mlock(unsigned long start,
70749 return -EINVAL;
70750 if (end == start)
70751 return 0;
70752+ if (end > TASK_SIZE)
70753+ return -EINVAL;
70754+
70755 vma = find_vma_prev(current->mm, start, &prev);
70756 if (!vma || vma->vm_start > start)
70757 return -ENOMEM;
70758@@ -458,6 +449,11 @@ static int do_mlock(unsigned long start,
70759 for (nstart = start ; ; ) {
70760 unsigned int newflags;
70761
70762+#ifdef CONFIG_PAX_SEGMEXEC
70763+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
70764+ break;
70765+#endif
70766+
70767 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
70768
70769 newflags = vma->vm_flags | VM_LOCKED;
70770@@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
70771 lock_limit >>= PAGE_SHIFT;
70772
70773 /* check against resource limits */
70774+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
70775 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
70776 error = do_mlock(start, len, 1);
70777 up_write(&current->mm->mmap_sem);
70778@@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
70779 static int do_mlockall(int flags)
70780 {
70781 struct vm_area_struct * vma, * prev = NULL;
70782- unsigned int def_flags = 0;
70783
70784 if (flags & MCL_FUTURE)
70785- def_flags = VM_LOCKED;
70786- current->mm->def_flags = def_flags;
70787+ current->mm->def_flags |= VM_LOCKED;
70788+ else
70789+ current->mm->def_flags &= ~VM_LOCKED;
70790 if (flags == MCL_FUTURE)
70791 goto out;
70792
70793 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
70794- unsigned int newflags;
70795+ unsigned long newflags;
70796+
70797+#ifdef CONFIG_PAX_SEGMEXEC
70798+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
70799+ break;
70800+#endif
70801
70802+ BUG_ON(vma->vm_end > TASK_SIZE);
70803 newflags = vma->vm_flags | VM_LOCKED;
70804 if (!(flags & MCL_CURRENT))
70805 newflags &= ~VM_LOCKED;
70806@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
70807 lock_limit >>= PAGE_SHIFT;
70808
70809 ret = -ENOMEM;
70810+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
70811 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
70812 capable(CAP_IPC_LOCK))
70813 ret = do_mlockall(flags);
70814diff -urNp linux-2.6.32.46/mm/mmap.c linux-2.6.32.46/mm/mmap.c
70815--- linux-2.6.32.46/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
70816+++ linux-2.6.32.46/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
70817@@ -45,6 +45,16 @@
70818 #define arch_rebalance_pgtables(addr, len) (addr)
70819 #endif
70820
70821+static inline void verify_mm_writelocked(struct mm_struct *mm)
70822+{
70823+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
70824+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
70825+ up_read(&mm->mmap_sem);
70826+ BUG();
70827+ }
70828+#endif
70829+}
70830+
70831 static void unmap_region(struct mm_struct *mm,
70832 struct vm_area_struct *vma, struct vm_area_struct *prev,
70833 unsigned long start, unsigned long end);
70834@@ -70,22 +80,32 @@ static void unmap_region(struct mm_struc
70835 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
70836 *
70837 */
70838-pgprot_t protection_map[16] = {
70839+pgprot_t protection_map[16] __read_only = {
70840 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
70841 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
70842 };
70843
70844 pgprot_t vm_get_page_prot(unsigned long vm_flags)
70845 {
70846- return __pgprot(pgprot_val(protection_map[vm_flags &
70847+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
70848 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
70849 pgprot_val(arch_vm_get_page_prot(vm_flags)));
70850+
70851+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
70852+ if (!nx_enabled &&
70853+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
70854+ (vm_flags & (VM_READ | VM_WRITE)))
70855+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
70856+#endif
70857+
70858+ return prot;
70859 }
70860 EXPORT_SYMBOL(vm_get_page_prot);
70861
70862 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
70863 int sysctl_overcommit_ratio = 50; /* default is 50% */
70864 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
70865+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
70866 struct percpu_counter vm_committed_as;
70867
70868 /*
70869@@ -231,6 +251,7 @@ static struct vm_area_struct *remove_vma
70870 struct vm_area_struct *next = vma->vm_next;
70871
70872 might_sleep();
70873+ BUG_ON(vma->vm_mirror);
70874 if (vma->vm_ops && vma->vm_ops->close)
70875 vma->vm_ops->close(vma);
70876 if (vma->vm_file) {
70877@@ -267,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
70878 * not page aligned -Ram Gupta
70879 */
70880 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
70881+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
70882 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
70883 (mm->end_data - mm->start_data) > rlim)
70884 goto out;
70885@@ -704,6 +726,12 @@ static int
70886 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
70887 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
70888 {
70889+
70890+#ifdef CONFIG_PAX_SEGMEXEC
70891+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
70892+ return 0;
70893+#endif
70894+
70895 if (is_mergeable_vma(vma, file, vm_flags) &&
70896 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
70897 if (vma->vm_pgoff == vm_pgoff)
70898@@ -723,6 +751,12 @@ static int
70899 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
70900 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
70901 {
70902+
70903+#ifdef CONFIG_PAX_SEGMEXEC
70904+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
70905+ return 0;
70906+#endif
70907+
70908 if (is_mergeable_vma(vma, file, vm_flags) &&
70909 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
70910 pgoff_t vm_pglen;
70911@@ -765,12 +799,19 @@ can_vma_merge_after(struct vm_area_struc
70912 struct vm_area_struct *vma_merge(struct mm_struct *mm,
70913 struct vm_area_struct *prev, unsigned long addr,
70914 unsigned long end, unsigned long vm_flags,
70915- struct anon_vma *anon_vma, struct file *file,
70916+ struct anon_vma *anon_vma, struct file *file,
70917 pgoff_t pgoff, struct mempolicy *policy)
70918 {
70919 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
70920 struct vm_area_struct *area, *next;
70921
70922+#ifdef CONFIG_PAX_SEGMEXEC
70923+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
70924+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
70925+
70926+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
70927+#endif
70928+
70929 /*
70930 * We later require that vma->vm_flags == vm_flags,
70931 * so this tests vma->vm_flags & VM_SPECIAL, too.
70932@@ -786,6 +827,15 @@ struct vm_area_struct *vma_merge(struct
70933 if (next && next->vm_end == end) /* cases 6, 7, 8 */
70934 next = next->vm_next;
70935
70936+#ifdef CONFIG_PAX_SEGMEXEC
70937+ if (prev)
70938+ prev_m = pax_find_mirror_vma(prev);
70939+ if (area)
70940+ area_m = pax_find_mirror_vma(area);
70941+ if (next)
70942+ next_m = pax_find_mirror_vma(next);
70943+#endif
70944+
70945 /*
70946 * Can it merge with the predecessor?
70947 */
70948@@ -805,9 +855,24 @@ struct vm_area_struct *vma_merge(struct
70949 /* cases 1, 6 */
70950 vma_adjust(prev, prev->vm_start,
70951 next->vm_end, prev->vm_pgoff, NULL);
70952- } else /* cases 2, 5, 7 */
70953+
70954+#ifdef CONFIG_PAX_SEGMEXEC
70955+ if (prev_m)
70956+ vma_adjust(prev_m, prev_m->vm_start,
70957+ next_m->vm_end, prev_m->vm_pgoff, NULL);
70958+#endif
70959+
70960+ } else { /* cases 2, 5, 7 */
70961 vma_adjust(prev, prev->vm_start,
70962 end, prev->vm_pgoff, NULL);
70963+
70964+#ifdef CONFIG_PAX_SEGMEXEC
70965+ if (prev_m)
70966+ vma_adjust(prev_m, prev_m->vm_start,
70967+ end_m, prev_m->vm_pgoff, NULL);
70968+#endif
70969+
70970+ }
70971 return prev;
70972 }
70973
70974@@ -818,12 +883,27 @@ struct vm_area_struct *vma_merge(struct
70975 mpol_equal(policy, vma_policy(next)) &&
70976 can_vma_merge_before(next, vm_flags,
70977 anon_vma, file, pgoff+pglen)) {
70978- if (prev && addr < prev->vm_end) /* case 4 */
70979+ if (prev && addr < prev->vm_end) { /* case 4 */
70980 vma_adjust(prev, prev->vm_start,
70981 addr, prev->vm_pgoff, NULL);
70982- else /* cases 3, 8 */
70983+
70984+#ifdef CONFIG_PAX_SEGMEXEC
70985+ if (prev_m)
70986+ vma_adjust(prev_m, prev_m->vm_start,
70987+ addr_m, prev_m->vm_pgoff, NULL);
70988+#endif
70989+
70990+ } else { /* cases 3, 8 */
70991 vma_adjust(area, addr, next->vm_end,
70992 next->vm_pgoff - pglen, NULL);
70993+
70994+#ifdef CONFIG_PAX_SEGMEXEC
70995+ if (area_m)
70996+ vma_adjust(area_m, addr_m, next_m->vm_end,
70997+ next_m->vm_pgoff - pglen, NULL);
70998+#endif
70999+
71000+ }
71001 return area;
71002 }
71003
71004@@ -898,14 +978,11 @@ none:
71005 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
71006 struct file *file, long pages)
71007 {
71008- const unsigned long stack_flags
71009- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
71010-
71011 if (file) {
71012 mm->shared_vm += pages;
71013 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
71014 mm->exec_vm += pages;
71015- } else if (flags & stack_flags)
71016+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
71017 mm->stack_vm += pages;
71018 if (flags & (VM_RESERVED|VM_IO))
71019 mm->reserved_vm += pages;
71020@@ -932,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file
71021 * (the exception is when the underlying filesystem is noexec
71022 * mounted, in which case we dont add PROT_EXEC.)
71023 */
71024- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
71025+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
71026 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
71027 prot |= PROT_EXEC;
71028
71029@@ -958,7 +1035,7 @@ unsigned long do_mmap_pgoff(struct file
71030 /* Obtain the address to map to. we verify (or select) it and ensure
71031 * that it represents a valid section of the address space.
71032 */
71033- addr = get_unmapped_area(file, addr, len, pgoff, flags);
71034+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
71035 if (addr & ~PAGE_MASK)
71036 return addr;
71037
71038@@ -969,6 +1046,36 @@ unsigned long do_mmap_pgoff(struct file
71039 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
71040 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
71041
71042+#ifdef CONFIG_PAX_MPROTECT
71043+ if (mm->pax_flags & MF_PAX_MPROTECT) {
71044+#ifndef CONFIG_PAX_MPROTECT_COMPAT
71045+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
71046+ gr_log_rwxmmap(file);
71047+
71048+#ifdef CONFIG_PAX_EMUPLT
71049+ vm_flags &= ~VM_EXEC;
71050+#else
71051+ return -EPERM;
71052+#endif
71053+
71054+ }
71055+
71056+ if (!(vm_flags & VM_EXEC))
71057+ vm_flags &= ~VM_MAYEXEC;
71058+#else
71059+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
71060+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
71061+#endif
71062+ else
71063+ vm_flags &= ~VM_MAYWRITE;
71064+ }
71065+#endif
71066+
71067+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71068+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
71069+ vm_flags &= ~VM_PAGEEXEC;
71070+#endif
71071+
71072 if (flags & MAP_LOCKED)
71073 if (!can_do_mlock())
71074 return -EPERM;
71075@@ -980,6 +1087,7 @@ unsigned long do_mmap_pgoff(struct file
71076 locked += mm->locked_vm;
71077 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
71078 lock_limit >>= PAGE_SHIFT;
71079+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71080 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
71081 return -EAGAIN;
71082 }
71083@@ -1053,6 +1161,9 @@ unsigned long do_mmap_pgoff(struct file
71084 if (error)
71085 return error;
71086
71087+ if (!gr_acl_handle_mmap(file, prot))
71088+ return -EACCES;
71089+
71090 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
71091 }
71092 EXPORT_SYMBOL(do_mmap_pgoff);
71093@@ -1065,10 +1176,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
71094 */
71095 int vma_wants_writenotify(struct vm_area_struct *vma)
71096 {
71097- unsigned int vm_flags = vma->vm_flags;
71098+ unsigned long vm_flags = vma->vm_flags;
71099
71100 /* If it was private or non-writable, the write bit is already clear */
71101- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
71102+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
71103 return 0;
71104
71105 /* The backer wishes to know when pages are first written to? */
71106@@ -1117,14 +1228,24 @@ unsigned long mmap_region(struct file *f
71107 unsigned long charged = 0;
71108 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
71109
71110+#ifdef CONFIG_PAX_SEGMEXEC
71111+ struct vm_area_struct *vma_m = NULL;
71112+#endif
71113+
71114+ /*
71115+ * mm->mmap_sem is required to protect against another thread
71116+ * changing the mappings in case we sleep.
71117+ */
71118+ verify_mm_writelocked(mm);
71119+
71120 /* Clear old maps */
71121 error = -ENOMEM;
71122-munmap_back:
71123 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71124 if (vma && vma->vm_start < addr + len) {
71125 if (do_munmap(mm, addr, len))
71126 return -ENOMEM;
71127- goto munmap_back;
71128+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71129+ BUG_ON(vma && vma->vm_start < addr + len);
71130 }
71131
71132 /* Check against address space limit. */
71133@@ -1173,6 +1294,16 @@ munmap_back:
71134 goto unacct_error;
71135 }
71136
71137+#ifdef CONFIG_PAX_SEGMEXEC
71138+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
71139+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71140+ if (!vma_m) {
71141+ error = -ENOMEM;
71142+ goto free_vma;
71143+ }
71144+ }
71145+#endif
71146+
71147 vma->vm_mm = mm;
71148 vma->vm_start = addr;
71149 vma->vm_end = addr + len;
71150@@ -1195,6 +1326,19 @@ munmap_back:
71151 error = file->f_op->mmap(file, vma);
71152 if (error)
71153 goto unmap_and_free_vma;
71154+
71155+#ifdef CONFIG_PAX_SEGMEXEC
71156+ if (vma_m && (vm_flags & VM_EXECUTABLE))
71157+ added_exe_file_vma(mm);
71158+#endif
71159+
71160+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
71161+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
71162+ vma->vm_flags |= VM_PAGEEXEC;
71163+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
71164+ }
71165+#endif
71166+
71167 if (vm_flags & VM_EXECUTABLE)
71168 added_exe_file_vma(mm);
71169
71170@@ -1218,6 +1362,11 @@ munmap_back:
71171 vma_link(mm, vma, prev, rb_link, rb_parent);
71172 file = vma->vm_file;
71173
71174+#ifdef CONFIG_PAX_SEGMEXEC
71175+ if (vma_m)
71176+ pax_mirror_vma(vma_m, vma);
71177+#endif
71178+
71179 /* Once vma denies write, undo our temporary denial count */
71180 if (correct_wcount)
71181 atomic_inc(&inode->i_writecount);
71182@@ -1226,6 +1375,7 @@ out:
71183
71184 mm->total_vm += len >> PAGE_SHIFT;
71185 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
71186+ track_exec_limit(mm, addr, addr + len, vm_flags);
71187 if (vm_flags & VM_LOCKED) {
71188 /*
71189 * makes pages present; downgrades, drops, reacquires mmap_sem
71190@@ -1248,6 +1398,12 @@ unmap_and_free_vma:
71191 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
71192 charged = 0;
71193 free_vma:
71194+
71195+#ifdef CONFIG_PAX_SEGMEXEC
71196+ if (vma_m)
71197+ kmem_cache_free(vm_area_cachep, vma_m);
71198+#endif
71199+
71200 kmem_cache_free(vm_area_cachep, vma);
71201 unacct_error:
71202 if (charged)
71203@@ -1255,6 +1411,44 @@ unacct_error:
71204 return error;
71205 }
71206
71207+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
71208+{
71209+ if (!vma) {
71210+#ifdef CONFIG_STACK_GROWSUP
71211+ if (addr > sysctl_heap_stack_gap)
71212+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
71213+ else
71214+ vma = find_vma(current->mm, 0);
71215+ if (vma && (vma->vm_flags & VM_GROWSUP))
71216+ return false;
71217+#endif
71218+ return true;
71219+ }
71220+
71221+ if (addr + len > vma->vm_start)
71222+ return false;
71223+
71224+ if (vma->vm_flags & VM_GROWSDOWN)
71225+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
71226+#ifdef CONFIG_STACK_GROWSUP
71227+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
71228+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
71229+#endif
71230+
71231+ return true;
71232+}
71233+
71234+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
71235+{
71236+ if (vma->vm_start < len)
71237+ return -ENOMEM;
71238+ if (!(vma->vm_flags & VM_GROWSDOWN))
71239+ return vma->vm_start - len;
71240+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
71241+ return vma->vm_start - len - sysctl_heap_stack_gap;
71242+ return -ENOMEM;
71243+}
71244+
71245 /* Get an address range which is currently unmapped.
71246 * For shmat() with addr=0.
71247 *
71248@@ -1281,18 +1475,23 @@ arch_get_unmapped_area(struct file *filp
71249 if (flags & MAP_FIXED)
71250 return addr;
71251
71252+#ifdef CONFIG_PAX_RANDMMAP
71253+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71254+#endif
71255+
71256 if (addr) {
71257 addr = PAGE_ALIGN(addr);
71258- vma = find_vma(mm, addr);
71259- if (TASK_SIZE - len >= addr &&
71260- (!vma || addr + len <= vma->vm_start))
71261- return addr;
71262+ if (TASK_SIZE - len >= addr) {
71263+ vma = find_vma(mm, addr);
71264+ if (check_heap_stack_gap(vma, addr, len))
71265+ return addr;
71266+ }
71267 }
71268 if (len > mm->cached_hole_size) {
71269- start_addr = addr = mm->free_area_cache;
71270+ start_addr = addr = mm->free_area_cache;
71271 } else {
71272- start_addr = addr = TASK_UNMAPPED_BASE;
71273- mm->cached_hole_size = 0;
71274+ start_addr = addr = mm->mmap_base;
71275+ mm->cached_hole_size = 0;
71276 }
71277
71278 full_search:
71279@@ -1303,34 +1502,40 @@ full_search:
71280 * Start a new search - just in case we missed
71281 * some holes.
71282 */
71283- if (start_addr != TASK_UNMAPPED_BASE) {
71284- addr = TASK_UNMAPPED_BASE;
71285- start_addr = addr;
71286+ if (start_addr != mm->mmap_base) {
71287+ start_addr = addr = mm->mmap_base;
71288 mm->cached_hole_size = 0;
71289 goto full_search;
71290 }
71291 return -ENOMEM;
71292 }
71293- if (!vma || addr + len <= vma->vm_start) {
71294- /*
71295- * Remember the place where we stopped the search:
71296- */
71297- mm->free_area_cache = addr + len;
71298- return addr;
71299- }
71300+ if (check_heap_stack_gap(vma, addr, len))
71301+ break;
71302 if (addr + mm->cached_hole_size < vma->vm_start)
71303 mm->cached_hole_size = vma->vm_start - addr;
71304 addr = vma->vm_end;
71305 }
71306+
71307+ /*
71308+ * Remember the place where we stopped the search:
71309+ */
71310+ mm->free_area_cache = addr + len;
71311+ return addr;
71312 }
71313 #endif
71314
71315 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
71316 {
71317+
71318+#ifdef CONFIG_PAX_SEGMEXEC
71319+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71320+ return;
71321+#endif
71322+
71323 /*
71324 * Is this a new hole at the lowest possible address?
71325 */
71326- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
71327+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
71328 mm->free_area_cache = addr;
71329 mm->cached_hole_size = ~0UL;
71330 }
71331@@ -1348,7 +1553,7 @@ arch_get_unmapped_area_topdown(struct fi
71332 {
71333 struct vm_area_struct *vma;
71334 struct mm_struct *mm = current->mm;
71335- unsigned long addr = addr0;
71336+ unsigned long base = mm->mmap_base, addr = addr0;
71337
71338 /* requested length too big for entire address space */
71339 if (len > TASK_SIZE)
71340@@ -1357,13 +1562,18 @@ arch_get_unmapped_area_topdown(struct fi
71341 if (flags & MAP_FIXED)
71342 return addr;
71343
71344+#ifdef CONFIG_PAX_RANDMMAP
71345+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
71346+#endif
71347+
71348 /* requesting a specific address */
71349 if (addr) {
71350 addr = PAGE_ALIGN(addr);
71351- vma = find_vma(mm, addr);
71352- if (TASK_SIZE - len >= addr &&
71353- (!vma || addr + len <= vma->vm_start))
71354- return addr;
71355+ if (TASK_SIZE - len >= addr) {
71356+ vma = find_vma(mm, addr);
71357+ if (check_heap_stack_gap(vma, addr, len))
71358+ return addr;
71359+ }
71360 }
71361
71362 /* check if free_area_cache is useful for us */
71363@@ -1378,7 +1588,7 @@ arch_get_unmapped_area_topdown(struct fi
71364 /* make sure it can fit in the remaining address space */
71365 if (addr > len) {
71366 vma = find_vma(mm, addr-len);
71367- if (!vma || addr <= vma->vm_start)
71368+ if (check_heap_stack_gap(vma, addr - len, len))
71369 /* remember the address as a hint for next time */
71370 return (mm->free_area_cache = addr-len);
71371 }
71372@@ -1395,7 +1605,7 @@ arch_get_unmapped_area_topdown(struct fi
71373 * return with success:
71374 */
71375 vma = find_vma(mm, addr);
71376- if (!vma || addr+len <= vma->vm_start)
71377+ if (check_heap_stack_gap(vma, addr, len))
71378 /* remember the address as a hint for next time */
71379 return (mm->free_area_cache = addr);
71380
71381@@ -1404,8 +1614,8 @@ arch_get_unmapped_area_topdown(struct fi
71382 mm->cached_hole_size = vma->vm_start - addr;
71383
71384 /* try just below the current vma->vm_start */
71385- addr = vma->vm_start-len;
71386- } while (len < vma->vm_start);
71387+ addr = skip_heap_stack_gap(vma, len);
71388+ } while (!IS_ERR_VALUE(addr));
71389
71390 bottomup:
71391 /*
71392@@ -1414,13 +1624,21 @@ bottomup:
71393 * can happen with large stack limits and large mmap()
71394 * allocations.
71395 */
71396+ mm->mmap_base = TASK_UNMAPPED_BASE;
71397+
71398+#ifdef CONFIG_PAX_RANDMMAP
71399+ if (mm->pax_flags & MF_PAX_RANDMMAP)
71400+ mm->mmap_base += mm->delta_mmap;
71401+#endif
71402+
71403+ mm->free_area_cache = mm->mmap_base;
71404 mm->cached_hole_size = ~0UL;
71405- mm->free_area_cache = TASK_UNMAPPED_BASE;
71406 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
71407 /*
71408 * Restore the topdown base:
71409 */
71410- mm->free_area_cache = mm->mmap_base;
71411+ mm->mmap_base = base;
71412+ mm->free_area_cache = base;
71413 mm->cached_hole_size = ~0UL;
71414
71415 return addr;
71416@@ -1429,6 +1647,12 @@ bottomup:
71417
71418 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
71419 {
71420+
71421+#ifdef CONFIG_PAX_SEGMEXEC
71422+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
71423+ return;
71424+#endif
71425+
71426 /*
71427 * Is this a new hole at the highest possible address?
71428 */
71429@@ -1436,8 +1660,10 @@ void arch_unmap_area_topdown(struct mm_s
71430 mm->free_area_cache = addr;
71431
71432 /* dont allow allocations above current base */
71433- if (mm->free_area_cache > mm->mmap_base)
71434+ if (mm->free_area_cache > mm->mmap_base) {
71435 mm->free_area_cache = mm->mmap_base;
71436+ mm->cached_hole_size = ~0UL;
71437+ }
71438 }
71439
71440 unsigned long
71441@@ -1545,6 +1771,27 @@ out:
71442 return prev ? prev->vm_next : vma;
71443 }
71444
71445+#ifdef CONFIG_PAX_SEGMEXEC
71446+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
71447+{
71448+ struct vm_area_struct *vma_m;
71449+
71450+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
71451+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
71452+ BUG_ON(vma->vm_mirror);
71453+ return NULL;
71454+ }
71455+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
71456+ vma_m = vma->vm_mirror;
71457+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
71458+ BUG_ON(vma->vm_file != vma_m->vm_file);
71459+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
71460+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
71461+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
71462+ return vma_m;
71463+}
71464+#endif
71465+
71466 /*
71467 * Verify that the stack growth is acceptable and
71468 * update accounting. This is shared with both the
71469@@ -1561,6 +1808,7 @@ static int acct_stack_growth(struct vm_a
71470 return -ENOMEM;
71471
71472 /* Stack limit test */
71473+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
71474 if (size > rlim[RLIMIT_STACK].rlim_cur)
71475 return -ENOMEM;
71476
71477@@ -1570,6 +1818,7 @@ static int acct_stack_growth(struct vm_a
71478 unsigned long limit;
71479 locked = mm->locked_vm + grow;
71480 limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
71481+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
71482 if (locked > limit && !capable(CAP_IPC_LOCK))
71483 return -ENOMEM;
71484 }
71485@@ -1600,37 +1849,48 @@ static int acct_stack_growth(struct vm_a
71486 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
71487 * vma is the last one with address > vma->vm_end. Have to extend vma.
71488 */
71489+#ifndef CONFIG_IA64
71490+static
71491+#endif
71492 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
71493 {
71494 int error;
71495+ bool locknext;
71496
71497 if (!(vma->vm_flags & VM_GROWSUP))
71498 return -EFAULT;
71499
71500+ /* Also guard against wrapping around to address 0. */
71501+ if (address < PAGE_ALIGN(address+1))
71502+ address = PAGE_ALIGN(address+1);
71503+ else
71504+ return -ENOMEM;
71505+
71506 /*
71507 * We must make sure the anon_vma is allocated
71508 * so that the anon_vma locking is not a noop.
71509 */
71510 if (unlikely(anon_vma_prepare(vma)))
71511 return -ENOMEM;
71512+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
71513+ if (locknext && anon_vma_prepare(vma->vm_next))
71514+ return -ENOMEM;
71515 anon_vma_lock(vma);
71516+ if (locknext)
71517+ anon_vma_lock(vma->vm_next);
71518
71519 /*
71520 * vma->vm_start/vm_end cannot change under us because the caller
71521 * is required to hold the mmap_sem in read mode. We need the
71522- * anon_vma lock to serialize against concurrent expand_stacks.
71523- * Also guard against wrapping around to address 0.
71524+ * anon_vma locks to serialize against concurrent expand_stacks
71525+ * and expand_upwards.
71526 */
71527- if (address < PAGE_ALIGN(address+4))
71528- address = PAGE_ALIGN(address+4);
71529- else {
71530- anon_vma_unlock(vma);
71531- return -ENOMEM;
71532- }
71533 error = 0;
71534
71535 /* Somebody else might have raced and expanded it already */
71536- if (address > vma->vm_end) {
71537+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
71538+ error = -ENOMEM;
71539+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
71540 unsigned long size, grow;
71541
71542 size = address - vma->vm_start;
71543@@ -1640,6 +1900,8 @@ int expand_upwards(struct vm_area_struct
71544 if (!error)
71545 vma->vm_end = address;
71546 }
71547+ if (locknext)
71548+ anon_vma_unlock(vma->vm_next);
71549 anon_vma_unlock(vma);
71550 return error;
71551 }
71552@@ -1652,6 +1914,8 @@ static int expand_downwards(struct vm_ar
71553 unsigned long address)
71554 {
71555 int error;
71556+ bool lockprev = false;
71557+ struct vm_area_struct *prev;
71558
71559 /*
71560 * We must make sure the anon_vma is allocated
71561@@ -1665,6 +1929,15 @@ static int expand_downwards(struct vm_ar
71562 if (error)
71563 return error;
71564
71565+ prev = vma->vm_prev;
71566+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
71567+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
71568+#endif
71569+ if (lockprev && anon_vma_prepare(prev))
71570+ return -ENOMEM;
71571+ if (lockprev)
71572+ anon_vma_lock(prev);
71573+
71574 anon_vma_lock(vma);
71575
71576 /*
71577@@ -1674,9 +1947,17 @@ static int expand_downwards(struct vm_ar
71578 */
71579
71580 /* Somebody else might have raced and expanded it already */
71581- if (address < vma->vm_start) {
71582+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
71583+ error = -ENOMEM;
71584+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
71585 unsigned long size, grow;
71586
71587+#ifdef CONFIG_PAX_SEGMEXEC
71588+ struct vm_area_struct *vma_m;
71589+
71590+ vma_m = pax_find_mirror_vma(vma);
71591+#endif
71592+
71593 size = vma->vm_end - address;
71594 grow = (vma->vm_start - address) >> PAGE_SHIFT;
71595
71596@@ -1684,9 +1965,20 @@ static int expand_downwards(struct vm_ar
71597 if (!error) {
71598 vma->vm_start = address;
71599 vma->vm_pgoff -= grow;
71600+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
71601+
71602+#ifdef CONFIG_PAX_SEGMEXEC
71603+ if (vma_m) {
71604+ vma_m->vm_start -= grow << PAGE_SHIFT;
71605+ vma_m->vm_pgoff -= grow;
71606+ }
71607+#endif
71608+
71609 }
71610 }
71611 anon_vma_unlock(vma);
71612+ if (lockprev)
71613+ anon_vma_unlock(prev);
71614 return error;
71615 }
71616
71617@@ -1762,6 +2054,13 @@ static void remove_vma_list(struct mm_st
71618 do {
71619 long nrpages = vma_pages(vma);
71620
71621+#ifdef CONFIG_PAX_SEGMEXEC
71622+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
71623+ vma = remove_vma(vma);
71624+ continue;
71625+ }
71626+#endif
71627+
71628 mm->total_vm -= nrpages;
71629 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
71630 vma = remove_vma(vma);
71631@@ -1807,6 +2106,16 @@ detach_vmas_to_be_unmapped(struct mm_str
71632 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
71633 vma->vm_prev = NULL;
71634 do {
71635+
71636+#ifdef CONFIG_PAX_SEGMEXEC
71637+ if (vma->vm_mirror) {
71638+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
71639+ vma->vm_mirror->vm_mirror = NULL;
71640+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
71641+ vma->vm_mirror = NULL;
71642+ }
71643+#endif
71644+
71645 rb_erase(&vma->vm_rb, &mm->mm_rb);
71646 mm->map_count--;
71647 tail_vma = vma;
71648@@ -1834,10 +2143,25 @@ int split_vma(struct mm_struct * mm, str
71649 struct mempolicy *pol;
71650 struct vm_area_struct *new;
71651
71652+#ifdef CONFIG_PAX_SEGMEXEC
71653+ struct vm_area_struct *vma_m, *new_m = NULL;
71654+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
71655+#endif
71656+
71657 if (is_vm_hugetlb_page(vma) && (addr &
71658 ~(huge_page_mask(hstate_vma(vma)))))
71659 return -EINVAL;
71660
71661+#ifdef CONFIG_PAX_SEGMEXEC
71662+ vma_m = pax_find_mirror_vma(vma);
71663+
71664+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
71665+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
71666+ if (mm->map_count >= sysctl_max_map_count-1)
71667+ return -ENOMEM;
71668+ } else
71669+#endif
71670+
71671 if (mm->map_count >= sysctl_max_map_count)
71672 return -ENOMEM;
71673
71674@@ -1845,6 +2169,16 @@ int split_vma(struct mm_struct * mm, str
71675 if (!new)
71676 return -ENOMEM;
71677
71678+#ifdef CONFIG_PAX_SEGMEXEC
71679+ if (vma_m) {
71680+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
71681+ if (!new_m) {
71682+ kmem_cache_free(vm_area_cachep, new);
71683+ return -ENOMEM;
71684+ }
71685+ }
71686+#endif
71687+
71688 /* most fields are the same, copy all, and then fixup */
71689 *new = *vma;
71690
71691@@ -1855,8 +2189,29 @@ int split_vma(struct mm_struct * mm, str
71692 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
71693 }
71694
71695+#ifdef CONFIG_PAX_SEGMEXEC
71696+ if (vma_m) {
71697+ *new_m = *vma_m;
71698+ new_m->vm_mirror = new;
71699+ new->vm_mirror = new_m;
71700+
71701+ if (new_below)
71702+ new_m->vm_end = addr_m;
71703+ else {
71704+ new_m->vm_start = addr_m;
71705+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
71706+ }
71707+ }
71708+#endif
71709+
71710 pol = mpol_dup(vma_policy(vma));
71711 if (IS_ERR(pol)) {
71712+
71713+#ifdef CONFIG_PAX_SEGMEXEC
71714+ if (new_m)
71715+ kmem_cache_free(vm_area_cachep, new_m);
71716+#endif
71717+
71718 kmem_cache_free(vm_area_cachep, new);
71719 return PTR_ERR(pol);
71720 }
71721@@ -1877,6 +2232,28 @@ int split_vma(struct mm_struct * mm, str
71722 else
71723 vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
71724
71725+#ifdef CONFIG_PAX_SEGMEXEC
71726+ if (vma_m) {
71727+ mpol_get(pol);
71728+ vma_set_policy(new_m, pol);
71729+
71730+ if (new_m->vm_file) {
71731+ get_file(new_m->vm_file);
71732+ if (vma_m->vm_flags & VM_EXECUTABLE)
71733+ added_exe_file_vma(mm);
71734+ }
71735+
71736+ if (new_m->vm_ops && new_m->vm_ops->open)
71737+ new_m->vm_ops->open(new_m);
71738+
71739+ if (new_below)
71740+ vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
71741+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
71742+ else
71743+ vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
71744+ }
71745+#endif
71746+
71747 return 0;
71748 }
71749
71750@@ -1885,11 +2262,30 @@ int split_vma(struct mm_struct * mm, str
71751 * work. This now handles partial unmappings.
71752 * Jeremy Fitzhardinge <jeremy@goop.org>
71753 */
71754+#ifdef CONFIG_PAX_SEGMEXEC
71755+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
71756+{
71757+ int ret = __do_munmap(mm, start, len);
71758+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
71759+ return ret;
71760+
71761+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
71762+}
71763+
71764+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
71765+#else
71766 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
71767+#endif
71768 {
71769 unsigned long end;
71770 struct vm_area_struct *vma, *prev, *last;
71771
71772+ /*
71773+ * mm->mmap_sem is required to protect against another thread
71774+ * changing the mappings in case we sleep.
71775+ */
71776+ verify_mm_writelocked(mm);
71777+
71778 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
71779 return -EINVAL;
71780
71781@@ -1953,6 +2349,8 @@ int do_munmap(struct mm_struct *mm, unsi
71782 /* Fix up all other VM information */
71783 remove_vma_list(mm, vma);
71784
71785+ track_exec_limit(mm, start, end, 0UL);
71786+
71787 return 0;
71788 }
71789
71790@@ -1965,22 +2363,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
71791
71792 profile_munmap(addr);
71793
71794+#ifdef CONFIG_PAX_SEGMEXEC
71795+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
71796+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
71797+ return -EINVAL;
71798+#endif
71799+
71800 down_write(&mm->mmap_sem);
71801 ret = do_munmap(mm, addr, len);
71802 up_write(&mm->mmap_sem);
71803 return ret;
71804 }
71805
71806-static inline void verify_mm_writelocked(struct mm_struct *mm)
71807-{
71808-#ifdef CONFIG_DEBUG_VM
71809- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
71810- WARN_ON(1);
71811- up_read(&mm->mmap_sem);
71812- }
71813-#endif
71814-}
71815-
71816 /*
71817 * this is really a simplified "do_mmap". it only handles
71818 * anonymous maps. eventually we may be able to do some
71819@@ -1994,6 +2388,7 @@ unsigned long do_brk(unsigned long addr,
71820 struct rb_node ** rb_link, * rb_parent;
71821 pgoff_t pgoff = addr >> PAGE_SHIFT;
71822 int error;
71823+ unsigned long charged;
71824
71825 len = PAGE_ALIGN(len);
71826 if (!len)
71827@@ -2005,16 +2400,30 @@ unsigned long do_brk(unsigned long addr,
71828
71829 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
71830
71831+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
71832+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
71833+ flags &= ~VM_EXEC;
71834+
71835+#ifdef CONFIG_PAX_MPROTECT
71836+ if (mm->pax_flags & MF_PAX_MPROTECT)
71837+ flags &= ~VM_MAYEXEC;
71838+#endif
71839+
71840+ }
71841+#endif
71842+
71843 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
71844 if (error & ~PAGE_MASK)
71845 return error;
71846
71847+ charged = len >> PAGE_SHIFT;
71848+
71849 /*
71850 * mlock MCL_FUTURE?
71851 */
71852 if (mm->def_flags & VM_LOCKED) {
71853 unsigned long locked, lock_limit;
71854- locked = len >> PAGE_SHIFT;
71855+ locked = charged;
71856 locked += mm->locked_vm;
71857 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
71858 lock_limit >>= PAGE_SHIFT;
71859@@ -2031,22 +2440,22 @@ unsigned long do_brk(unsigned long addr,
71860 /*
71861 * Clear old maps. this also does some error checking for us
71862 */
71863- munmap_back:
71864 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71865 if (vma && vma->vm_start < addr + len) {
71866 if (do_munmap(mm, addr, len))
71867 return -ENOMEM;
71868- goto munmap_back;
71869+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
71870+ BUG_ON(vma && vma->vm_start < addr + len);
71871 }
71872
71873 /* Check against address space limits *after* clearing old maps... */
71874- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
71875+ if (!may_expand_vm(mm, charged))
71876 return -ENOMEM;
71877
71878 if (mm->map_count > sysctl_max_map_count)
71879 return -ENOMEM;
71880
71881- if (security_vm_enough_memory(len >> PAGE_SHIFT))
71882+ if (security_vm_enough_memory(charged))
71883 return -ENOMEM;
71884
71885 /* Can we just expand an old private anonymous mapping? */
71886@@ -2060,7 +2469,7 @@ unsigned long do_brk(unsigned long addr,
71887 */
71888 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71889 if (!vma) {
71890- vm_unacct_memory(len >> PAGE_SHIFT);
71891+ vm_unacct_memory(charged);
71892 return -ENOMEM;
71893 }
71894
71895@@ -2072,11 +2481,12 @@ unsigned long do_brk(unsigned long addr,
71896 vma->vm_page_prot = vm_get_page_prot(flags);
71897 vma_link(mm, vma, prev, rb_link, rb_parent);
71898 out:
71899- mm->total_vm += len >> PAGE_SHIFT;
71900+ mm->total_vm += charged;
71901 if (flags & VM_LOCKED) {
71902 if (!mlock_vma_pages_range(vma, addr, addr + len))
71903- mm->locked_vm += (len >> PAGE_SHIFT);
71904+ mm->locked_vm += charged;
71905 }
71906+ track_exec_limit(mm, addr, addr + len, flags);
71907 return addr;
71908 }
71909
71910@@ -2123,8 +2533,10 @@ void exit_mmap(struct mm_struct *mm)
71911 * Walk the list again, actually closing and freeing it,
71912 * with preemption enabled, without holding any MM locks.
71913 */
71914- while (vma)
71915+ while (vma) {
71916+ vma->vm_mirror = NULL;
71917 vma = remove_vma(vma);
71918+ }
71919
71920 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
71921 }
71922@@ -2138,6 +2550,10 @@ int insert_vm_struct(struct mm_struct *
71923 struct vm_area_struct * __vma, * prev;
71924 struct rb_node ** rb_link, * rb_parent;
71925
71926+#ifdef CONFIG_PAX_SEGMEXEC
71927+ struct vm_area_struct *vma_m = NULL;
71928+#endif
71929+
71930 /*
71931 * The vm_pgoff of a purely anonymous vma should be irrelevant
71932 * until its first write fault, when page's anon_vma and index
71933@@ -2160,7 +2576,22 @@ int insert_vm_struct(struct mm_struct *
71934 if ((vma->vm_flags & VM_ACCOUNT) &&
71935 security_vm_enough_memory_mm(mm, vma_pages(vma)))
71936 return -ENOMEM;
71937+
71938+#ifdef CONFIG_PAX_SEGMEXEC
71939+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
71940+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
71941+ if (!vma_m)
71942+ return -ENOMEM;
71943+ }
71944+#endif
71945+
71946 vma_link(mm, vma, prev, rb_link, rb_parent);
71947+
71948+#ifdef CONFIG_PAX_SEGMEXEC
71949+ if (vma_m)
71950+ pax_mirror_vma(vma_m, vma);
71951+#endif
71952+
71953 return 0;
71954 }
71955
71956@@ -2178,6 +2609,8 @@ struct vm_area_struct *copy_vma(struct v
71957 struct rb_node **rb_link, *rb_parent;
71958 struct mempolicy *pol;
71959
71960+ BUG_ON(vma->vm_mirror);
71961+
71962 /*
71963 * If anonymous vma has not yet been faulted, update new pgoff
71964 * to match new location, to increase its chance of merging.
71965@@ -2221,6 +2654,35 @@ struct vm_area_struct *copy_vma(struct v
71966 return new_vma;
71967 }
71968
71969+#ifdef CONFIG_PAX_SEGMEXEC
71970+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
71971+{
71972+ struct vm_area_struct *prev_m;
71973+ struct rb_node **rb_link_m, *rb_parent_m;
71974+ struct mempolicy *pol_m;
71975+
71976+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
71977+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
71978+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
71979+ *vma_m = *vma;
71980+ pol_m = vma_policy(vma_m);
71981+ mpol_get(pol_m);
71982+ vma_set_policy(vma_m, pol_m);
71983+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
71984+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
71985+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
71986+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
71987+ if (vma_m->vm_file)
71988+ get_file(vma_m->vm_file);
71989+ if (vma_m->vm_ops && vma_m->vm_ops->open)
71990+ vma_m->vm_ops->open(vma_m);
71991+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
71992+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
71993+ vma_m->vm_mirror = vma;
71994+ vma->vm_mirror = vma_m;
71995+}
71996+#endif
71997+
71998 /*
71999 * Return true if the calling process may expand its vm space by the passed
72000 * number of pages
72001@@ -2231,7 +2693,7 @@ int may_expand_vm(struct mm_struct *mm,
72002 unsigned long lim;
72003
72004 lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
72005-
72006+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
72007 if (cur + npages > lim)
72008 return 0;
72009 return 1;
72010@@ -2301,6 +2763,22 @@ int install_special_mapping(struct mm_st
72011 vma->vm_start = addr;
72012 vma->vm_end = addr + len;
72013
72014+#ifdef CONFIG_PAX_MPROTECT
72015+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72016+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72017+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
72018+ return -EPERM;
72019+ if (!(vm_flags & VM_EXEC))
72020+ vm_flags &= ~VM_MAYEXEC;
72021+#else
72022+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72023+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72024+#endif
72025+ else
72026+ vm_flags &= ~VM_MAYWRITE;
72027+ }
72028+#endif
72029+
72030 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
72031 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72032
72033diff -urNp linux-2.6.32.46/mm/mprotect.c linux-2.6.32.46/mm/mprotect.c
72034--- linux-2.6.32.46/mm/mprotect.c 2011-03-27 14:31:47.000000000 -0400
72035+++ linux-2.6.32.46/mm/mprotect.c 2011-04-17 15:56:46.000000000 -0400
72036@@ -24,10 +24,16 @@
72037 #include <linux/mmu_notifier.h>
72038 #include <linux/migrate.h>
72039 #include <linux/perf_event.h>
72040+
72041+#ifdef CONFIG_PAX_MPROTECT
72042+#include <linux/elf.h>
72043+#endif
72044+
72045 #include <asm/uaccess.h>
72046 #include <asm/pgtable.h>
72047 #include <asm/cacheflush.h>
72048 #include <asm/tlbflush.h>
72049+#include <asm/mmu_context.h>
72050
72051 #ifndef pgprot_modify
72052 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
72053@@ -132,6 +138,48 @@ static void change_protection(struct vm_
72054 flush_tlb_range(vma, start, end);
72055 }
72056
72057+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72058+/* called while holding the mmap semaphor for writing except stack expansion */
72059+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
72060+{
72061+ unsigned long oldlimit, newlimit = 0UL;
72062+
72063+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
72064+ return;
72065+
72066+ spin_lock(&mm->page_table_lock);
72067+ oldlimit = mm->context.user_cs_limit;
72068+ if ((prot & VM_EXEC) && oldlimit < end)
72069+ /* USER_CS limit moved up */
72070+ newlimit = end;
72071+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
72072+ /* USER_CS limit moved down */
72073+ newlimit = start;
72074+
72075+ if (newlimit) {
72076+ mm->context.user_cs_limit = newlimit;
72077+
72078+#ifdef CONFIG_SMP
72079+ wmb();
72080+ cpus_clear(mm->context.cpu_user_cs_mask);
72081+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
72082+#endif
72083+
72084+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
72085+ }
72086+ spin_unlock(&mm->page_table_lock);
72087+ if (newlimit == end) {
72088+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
72089+
72090+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
72091+ if (is_vm_hugetlb_page(vma))
72092+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
72093+ else
72094+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
72095+ }
72096+}
72097+#endif
72098+
72099 int
72100 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
72101 unsigned long start, unsigned long end, unsigned long newflags)
72102@@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vm
72103 int error;
72104 int dirty_accountable = 0;
72105
72106+#ifdef CONFIG_PAX_SEGMEXEC
72107+ struct vm_area_struct *vma_m = NULL;
72108+ unsigned long start_m, end_m;
72109+
72110+ start_m = start + SEGMEXEC_TASK_SIZE;
72111+ end_m = end + SEGMEXEC_TASK_SIZE;
72112+#endif
72113+
72114 if (newflags == oldflags) {
72115 *pprev = vma;
72116 return 0;
72117 }
72118
72119+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
72120+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
72121+
72122+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
72123+ return -ENOMEM;
72124+
72125+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
72126+ return -ENOMEM;
72127+ }
72128+
72129 /*
72130 * If we make a private mapping writable we increase our commit;
72131 * but (without finer accounting) cannot reduce our commit if we
72132@@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vm
72133 }
72134 }
72135
72136+#ifdef CONFIG_PAX_SEGMEXEC
72137+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
72138+ if (start != vma->vm_start) {
72139+ error = split_vma(mm, vma, start, 1);
72140+ if (error)
72141+ goto fail;
72142+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
72143+ *pprev = (*pprev)->vm_next;
72144+ }
72145+
72146+ if (end != vma->vm_end) {
72147+ error = split_vma(mm, vma, end, 0);
72148+ if (error)
72149+ goto fail;
72150+ }
72151+
72152+ if (pax_find_mirror_vma(vma)) {
72153+ error = __do_munmap(mm, start_m, end_m - start_m);
72154+ if (error)
72155+ goto fail;
72156+ } else {
72157+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72158+ if (!vma_m) {
72159+ error = -ENOMEM;
72160+ goto fail;
72161+ }
72162+ vma->vm_flags = newflags;
72163+ pax_mirror_vma(vma_m, vma);
72164+ }
72165+ }
72166+#endif
72167+
72168 /*
72169 * First try to merge with previous and/or next vma.
72170 */
72171@@ -195,9 +293,21 @@ success:
72172 * vm_flags and vm_page_prot are protected by the mmap_sem
72173 * held in write mode.
72174 */
72175+
72176+#ifdef CONFIG_PAX_SEGMEXEC
72177+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
72178+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
72179+#endif
72180+
72181 vma->vm_flags = newflags;
72182+
72183+#ifdef CONFIG_PAX_MPROTECT
72184+ if (mm->binfmt && mm->binfmt->handle_mprotect)
72185+ mm->binfmt->handle_mprotect(vma, newflags);
72186+#endif
72187+
72188 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
72189- vm_get_page_prot(newflags));
72190+ vm_get_page_prot(vma->vm_flags));
72191
72192 if (vma_wants_writenotify(vma)) {
72193 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
72194@@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
72195 end = start + len;
72196 if (end <= start)
72197 return -ENOMEM;
72198+
72199+#ifdef CONFIG_PAX_SEGMEXEC
72200+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
72201+ if (end > SEGMEXEC_TASK_SIZE)
72202+ return -EINVAL;
72203+ } else
72204+#endif
72205+
72206+ if (end > TASK_SIZE)
72207+ return -EINVAL;
72208+
72209 if (!arch_validate_prot(prot))
72210 return -EINVAL;
72211
72212@@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
72213 /*
72214 * Does the application expect PROT_READ to imply PROT_EXEC:
72215 */
72216- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72217+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72218 prot |= PROT_EXEC;
72219
72220 vm_flags = calc_vm_prot_bits(prot);
72221@@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
72222 if (start > vma->vm_start)
72223 prev = vma;
72224
72225+#ifdef CONFIG_PAX_MPROTECT
72226+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
72227+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
72228+#endif
72229+
72230 for (nstart = start ; ; ) {
72231 unsigned long newflags;
72232
72233@@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
72234
72235 /* newflags >> 4 shift VM_MAY% in place of VM_% */
72236 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
72237+ if (prot & (PROT_WRITE | PROT_EXEC))
72238+ gr_log_rwxmprotect(vma->vm_file);
72239+
72240+ error = -EACCES;
72241+ goto out;
72242+ }
72243+
72244+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
72245 error = -EACCES;
72246 goto out;
72247 }
72248@@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
72249 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
72250 if (error)
72251 goto out;
72252+
72253+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
72254+
72255 nstart = tmp;
72256
72257 if (nstart < prev->vm_end)
72258diff -urNp linux-2.6.32.46/mm/mremap.c linux-2.6.32.46/mm/mremap.c
72259--- linux-2.6.32.46/mm/mremap.c 2011-04-17 17:00:52.000000000 -0400
72260+++ linux-2.6.32.46/mm/mremap.c 2011-04-17 17:03:58.000000000 -0400
72261@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_str
72262 continue;
72263 pte = ptep_clear_flush(vma, old_addr, old_pte);
72264 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
72265+
72266+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
72267+ if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
72268+ pte = pte_exprotect(pte);
72269+#endif
72270+
72271 set_pte_at(mm, new_addr, new_pte, pte);
72272 }
72273
72274@@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_res
72275 if (is_vm_hugetlb_page(vma))
72276 goto Einval;
72277
72278+#ifdef CONFIG_PAX_SEGMEXEC
72279+ if (pax_find_mirror_vma(vma))
72280+ goto Einval;
72281+#endif
72282+
72283 /* We can't remap across vm area boundaries */
72284 if (old_len > vma->vm_end - addr)
72285 goto Efault;
72286@@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned
72287 unsigned long ret = -EINVAL;
72288 unsigned long charged = 0;
72289 unsigned long map_flags;
72290+ unsigned long pax_task_size = TASK_SIZE;
72291
72292 if (new_addr & ~PAGE_MASK)
72293 goto out;
72294
72295- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
72296+#ifdef CONFIG_PAX_SEGMEXEC
72297+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72298+ pax_task_size = SEGMEXEC_TASK_SIZE;
72299+#endif
72300+
72301+ pax_task_size -= PAGE_SIZE;
72302+
72303+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
72304 goto out;
72305
72306 /* Check if the location we're moving into overlaps the
72307 * old location at all, and fail if it does.
72308 */
72309- if ((new_addr <= addr) && (new_addr+new_len) > addr)
72310- goto out;
72311-
72312- if ((addr <= new_addr) && (addr+old_len) > new_addr)
72313+ if (addr + old_len > new_addr && new_addr + new_len > addr)
72314 goto out;
72315
72316 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72317@@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long ad
72318 struct vm_area_struct *vma;
72319 unsigned long ret = -EINVAL;
72320 unsigned long charged = 0;
72321+ unsigned long pax_task_size = TASK_SIZE;
72322
72323 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
72324 goto out;
72325@@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long ad
72326 if (!new_len)
72327 goto out;
72328
72329+#ifdef CONFIG_PAX_SEGMEXEC
72330+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
72331+ pax_task_size = SEGMEXEC_TASK_SIZE;
72332+#endif
72333+
72334+ pax_task_size -= PAGE_SIZE;
72335+
72336+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
72337+ old_len > pax_task_size || addr > pax_task_size-old_len)
72338+ goto out;
72339+
72340 if (flags & MREMAP_FIXED) {
72341 if (flags & MREMAP_MAYMOVE)
72342 ret = mremap_to(addr, old_len, new_addr, new_len);
72343@@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long ad
72344 addr + new_len);
72345 }
72346 ret = addr;
72347+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
72348 goto out;
72349 }
72350 }
72351@@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long ad
72352 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
72353 if (ret)
72354 goto out;
72355+
72356+ map_flags = vma->vm_flags;
72357 ret = move_vma(vma, addr, old_len, new_len, new_addr);
72358+ if (!(ret & ~PAGE_MASK)) {
72359+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
72360+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
72361+ }
72362 }
72363 out:
72364 if (ret & ~PAGE_MASK)
72365diff -urNp linux-2.6.32.46/mm/nommu.c linux-2.6.32.46/mm/nommu.c
72366--- linux-2.6.32.46/mm/nommu.c 2011-03-27 14:31:47.000000000 -0400
72367+++ linux-2.6.32.46/mm/nommu.c 2011-04-17 15:56:46.000000000 -0400
72368@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMI
72369 int sysctl_overcommit_ratio = 50; /* default is 50% */
72370 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
72371 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
72372-int heap_stack_gap = 0;
72373
72374 atomic_long_t mmap_pages_allocated;
72375
72376@@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct m
72377 EXPORT_SYMBOL(find_vma);
72378
72379 /*
72380- * find a VMA
72381- * - we don't extend stack VMAs under NOMMU conditions
72382- */
72383-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
72384-{
72385- return find_vma(mm, addr);
72386-}
72387-
72388-/*
72389 * expand a stack to a given address
72390 * - not supported under NOMMU conditions
72391 */
72392diff -urNp linux-2.6.32.46/mm/page_alloc.c linux-2.6.32.46/mm/page_alloc.c
72393--- linux-2.6.32.46/mm/page_alloc.c 2011-06-25 12:55:35.000000000 -0400
72394+++ linux-2.6.32.46/mm/page_alloc.c 2011-07-09 09:13:08.000000000 -0400
72395@@ -289,7 +289,7 @@ out:
72396 * This usage means that zero-order pages may not be compound.
72397 */
72398
72399-static void free_compound_page(struct page *page)
72400+void free_compound_page(struct page *page)
72401 {
72402 __free_pages_ok(page, compound_order(page));
72403 }
72404@@ -587,6 +587,10 @@ static void __free_pages_ok(struct page
72405 int bad = 0;
72406 int wasMlocked = __TestClearPageMlocked(page);
72407
72408+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72409+ unsigned long index = 1UL << order;
72410+#endif
72411+
72412 kmemcheck_free_shadow(page, order);
72413
72414 for (i = 0 ; i < (1 << order) ; ++i)
72415@@ -599,6 +603,12 @@ static void __free_pages_ok(struct page
72416 debug_check_no_obj_freed(page_address(page),
72417 PAGE_SIZE << order);
72418 }
72419+
72420+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72421+ for (; index; --index)
72422+ sanitize_highpage(page + index - 1);
72423+#endif
72424+
72425 arch_free_page(page, order);
72426 kernel_map_pages(page, 1 << order, 0);
72427
72428@@ -702,8 +712,10 @@ static int prep_new_page(struct page *pa
72429 arch_alloc_page(page, order);
72430 kernel_map_pages(page, 1 << order, 1);
72431
72432+#ifndef CONFIG_PAX_MEMORY_SANITIZE
72433 if (gfp_flags & __GFP_ZERO)
72434 prep_zero_page(page, order, gfp_flags);
72435+#endif
72436
72437 if (order && (gfp_flags & __GFP_COMP))
72438 prep_compound_page(page, order);
72439@@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct pa
72440 debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
72441 debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
72442 }
72443+
72444+#ifdef CONFIG_PAX_MEMORY_SANITIZE
72445+ sanitize_highpage(page);
72446+#endif
72447+
72448 arch_free_page(page, 0);
72449 kernel_map_pages(page, 1, 0);
72450
72451@@ -2179,6 +2196,8 @@ void show_free_areas(void)
72452 int cpu;
72453 struct zone *zone;
72454
72455+ pax_track_stack();
72456+
72457 for_each_populated_zone(zone) {
72458 show_node(zone);
72459 printk("%s per-cpu:\n", zone->name);
72460@@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct p
72461 zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
72462 }
72463 #else
72464-static void inline setup_usemap(struct pglist_data *pgdat,
72465+static inline void setup_usemap(struct pglist_data *pgdat,
72466 struct zone *zone, unsigned long zonesize) {}
72467 #endif /* CONFIG_SPARSEMEM */
72468
72469diff -urNp linux-2.6.32.46/mm/percpu.c linux-2.6.32.46/mm/percpu.c
72470--- linux-2.6.32.46/mm/percpu.c 2011-03-27 14:31:47.000000000 -0400
72471+++ linux-2.6.32.46/mm/percpu.c 2011-04-17 15:56:46.000000000 -0400
72472@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu
72473 static unsigned int pcpu_last_unit_cpu __read_mostly;
72474
72475 /* the address of the first chunk which starts with the kernel static area */
72476-void *pcpu_base_addr __read_mostly;
72477+void *pcpu_base_addr __read_only;
72478 EXPORT_SYMBOL_GPL(pcpu_base_addr);
72479
72480 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
72481diff -urNp linux-2.6.32.46/mm/rmap.c linux-2.6.32.46/mm/rmap.c
72482--- linux-2.6.32.46/mm/rmap.c 2011-03-27 14:31:47.000000000 -0400
72483+++ linux-2.6.32.46/mm/rmap.c 2011-04-17 15:56:46.000000000 -0400
72484@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_stru
72485 /* page_table_lock to protect against threads */
72486 spin_lock(&mm->page_table_lock);
72487 if (likely(!vma->anon_vma)) {
72488+
72489+#ifdef CONFIG_PAX_SEGMEXEC
72490+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
72491+
72492+ if (vma_m) {
72493+ BUG_ON(vma_m->anon_vma);
72494+ vma_m->anon_vma = anon_vma;
72495+ list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
72496+ }
72497+#endif
72498+
72499 vma->anon_vma = anon_vma;
72500 list_add_tail(&vma->anon_vma_node, &anon_vma->head);
72501 allocated = NULL;
72502diff -urNp linux-2.6.32.46/mm/shmem.c linux-2.6.32.46/mm/shmem.c
72503--- linux-2.6.32.46/mm/shmem.c 2011-03-27 14:31:47.000000000 -0400
72504+++ linux-2.6.32.46/mm/shmem.c 2011-05-18 20:09:37.000000000 -0400
72505@@ -31,7 +31,7 @@
72506 #include <linux/swap.h>
72507 #include <linux/ima.h>
72508
72509-static struct vfsmount *shm_mnt;
72510+struct vfsmount *shm_mnt;
72511
72512 #ifdef CONFIG_SHMEM
72513 /*
72514@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *
72515 goto unlock;
72516 }
72517 entry = shmem_swp_entry(info, index, NULL);
72518+ if (!entry)
72519+ goto unlock;
72520 if (entry->val) {
72521 /*
72522 * The more uptodate page coming down from a stacked
72523@@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_ent
72524 struct vm_area_struct pvma;
72525 struct page *page;
72526
72527+ pax_track_stack();
72528+
72529 spol = mpol_cond_copy(&mpol,
72530 mpol_shared_policy_lookup(&info->policy, idx));
72531
72532@@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *d
72533
72534 info = SHMEM_I(inode);
72535 inode->i_size = len-1;
72536- if (len <= (char *)inode - (char *)info) {
72537+ if (len <= (char *)inode - (char *)info && len <= 64) {
72538 /* do it inline */
72539 memcpy(info, symname, len);
72540 inode->i_op = &shmem_symlink_inline_operations;
72541@@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block
72542 int err = -ENOMEM;
72543
72544 /* Round up to L1_CACHE_BYTES to resist false sharing */
72545- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
72546- L1_CACHE_BYTES), GFP_KERNEL);
72547+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
72548 if (!sbinfo)
72549 return -ENOMEM;
72550
72551diff -urNp linux-2.6.32.46/mm/slab.c linux-2.6.32.46/mm/slab.c
72552--- linux-2.6.32.46/mm/slab.c 2011-03-27 14:31:47.000000000 -0400
72553+++ linux-2.6.32.46/mm/slab.c 2011-05-04 17:56:20.000000000 -0400
72554@@ -174,7 +174,7 @@
72555
72556 /* Legal flag mask for kmem_cache_create(). */
72557 #if DEBUG
72558-# define CREATE_MASK (SLAB_RED_ZONE | \
72559+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
72560 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
72561 SLAB_CACHE_DMA | \
72562 SLAB_STORE_USER | \
72563@@ -182,7 +182,7 @@
72564 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
72565 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
72566 #else
72567-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
72568+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
72569 SLAB_CACHE_DMA | \
72570 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
72571 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
72572@@ -308,7 +308,7 @@ struct kmem_list3 {
72573 * Need this for bootstrapping a per node allocator.
72574 */
72575 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
72576-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
72577+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
72578 #define CACHE_CACHE 0
72579 #define SIZE_AC MAX_NUMNODES
72580 #define SIZE_L3 (2 * MAX_NUMNODES)
72581@@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_
72582 if ((x)->max_freeable < i) \
72583 (x)->max_freeable = i; \
72584 } while (0)
72585-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
72586-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
72587-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
72588-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
72589+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
72590+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
72591+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
72592+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
72593 #else
72594 #define STATS_INC_ACTIVE(x) do { } while (0)
72595 #define STATS_DEC_ACTIVE(x) do { } while (0)
72596@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct
72597 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
72598 */
72599 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
72600- const struct slab *slab, void *obj)
72601+ const struct slab *slab, const void *obj)
72602 {
72603 u32 offset = (obj - slab->s_mem);
72604 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
72605@@ -1453,7 +1453,7 @@ void __init kmem_cache_init(void)
72606 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
72607 sizes[INDEX_AC].cs_size,
72608 ARCH_KMALLOC_MINALIGN,
72609- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
72610+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
72611 NULL);
72612
72613 if (INDEX_AC != INDEX_L3) {
72614@@ -1461,7 +1461,7 @@ void __init kmem_cache_init(void)
72615 kmem_cache_create(names[INDEX_L3].name,
72616 sizes[INDEX_L3].cs_size,
72617 ARCH_KMALLOC_MINALIGN,
72618- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
72619+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
72620 NULL);
72621 }
72622
72623@@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
72624 sizes->cs_cachep = kmem_cache_create(names->name,
72625 sizes->cs_size,
72626 ARCH_KMALLOC_MINALIGN,
72627- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
72628+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
72629 NULL);
72630 }
72631 #ifdef CONFIG_ZONE_DMA
72632@@ -4211,10 +4211,10 @@ static int s_show(struct seq_file *m, vo
72633 }
72634 /* cpu stats */
72635 {
72636- unsigned long allochit = atomic_read(&cachep->allochit);
72637- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
72638- unsigned long freehit = atomic_read(&cachep->freehit);
72639- unsigned long freemiss = atomic_read(&cachep->freemiss);
72640+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
72641+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
72642+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
72643+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
72644
72645 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
72646 allochit, allocmiss, freehit, freemiss);
72647@@ -4471,15 +4471,66 @@ static const struct file_operations proc
72648
72649 static int __init slab_proc_init(void)
72650 {
72651- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
72652+ mode_t gr_mode = S_IRUGO;
72653+
72654+#ifdef CONFIG_GRKERNSEC_PROC_ADD
72655+ gr_mode = S_IRUSR;
72656+#endif
72657+
72658+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
72659 #ifdef CONFIG_DEBUG_SLAB_LEAK
72660- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
72661+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
72662 #endif
72663 return 0;
72664 }
72665 module_init(slab_proc_init);
72666 #endif
72667
72668+void check_object_size(const void *ptr, unsigned long n, bool to)
72669+{
72670+
72671+#ifdef CONFIG_PAX_USERCOPY
72672+ struct page *page;
72673+ struct kmem_cache *cachep = NULL;
72674+ struct slab *slabp;
72675+ unsigned int objnr;
72676+ unsigned long offset;
72677+
72678+ if (!n)
72679+ return;
72680+
72681+ if (ZERO_OR_NULL_PTR(ptr))
72682+ goto report;
72683+
72684+ if (!virt_addr_valid(ptr))
72685+ return;
72686+
72687+ page = virt_to_head_page(ptr);
72688+
72689+ if (!PageSlab(page)) {
72690+ if (object_is_on_stack(ptr, n) == -1)
72691+ goto report;
72692+ return;
72693+ }
72694+
72695+ cachep = page_get_cache(page);
72696+ if (!(cachep->flags & SLAB_USERCOPY))
72697+ goto report;
72698+
72699+ slabp = page_get_slab(page);
72700+ objnr = obj_to_index(cachep, slabp, ptr);
72701+ BUG_ON(objnr >= cachep->num);
72702+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
72703+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
72704+ return;
72705+
72706+report:
72707+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
72708+#endif
72709+
72710+}
72711+EXPORT_SYMBOL(check_object_size);
72712+
72713 /**
72714 * ksize - get the actual amount of memory allocated for a given object
72715 * @objp: Pointer to the object
72716diff -urNp linux-2.6.32.46/mm/slob.c linux-2.6.32.46/mm/slob.c
72717--- linux-2.6.32.46/mm/slob.c 2011-03-27 14:31:47.000000000 -0400
72718+++ linux-2.6.32.46/mm/slob.c 2011-07-06 19:53:33.000000000 -0400
72719@@ -29,7 +29,7 @@
72720 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
72721 * alloc_pages() directly, allocating compound pages so the page order
72722 * does not have to be separately tracked, and also stores the exact
72723- * allocation size in page->private so that it can be used to accurately
72724+ * allocation size in slob_page->size so that it can be used to accurately
72725 * provide ksize(). These objects are detected in kfree() because slob_page()
72726 * is false for them.
72727 *
72728@@ -58,6 +58,7 @@
72729 */
72730
72731 #include <linux/kernel.h>
72732+#include <linux/sched.h>
72733 #include <linux/slab.h>
72734 #include <linux/mm.h>
72735 #include <linux/swap.h> /* struct reclaim_state */
72736@@ -100,7 +101,8 @@ struct slob_page {
72737 unsigned long flags; /* mandatory */
72738 atomic_t _count; /* mandatory */
72739 slobidx_t units; /* free units left in page */
72740- unsigned long pad[2];
72741+ unsigned long pad[1];
72742+ unsigned long size; /* size when >=PAGE_SIZE */
72743 slob_t *free; /* first free slob_t in page */
72744 struct list_head list; /* linked list of free pages */
72745 };
72746@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
72747 */
72748 static inline int is_slob_page(struct slob_page *sp)
72749 {
72750- return PageSlab((struct page *)sp);
72751+ return PageSlab((struct page *)sp) && !sp->size;
72752 }
72753
72754 static inline void set_slob_page(struct slob_page *sp)
72755@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
72756
72757 static inline struct slob_page *slob_page(const void *addr)
72758 {
72759- return (struct slob_page *)virt_to_page(addr);
72760+ return (struct slob_page *)virt_to_head_page(addr);
72761 }
72762
72763 /*
72764@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
72765 /*
72766 * Return the size of a slob block.
72767 */
72768-static slobidx_t slob_units(slob_t *s)
72769+static slobidx_t slob_units(const slob_t *s)
72770 {
72771 if (s->units > 0)
72772 return s->units;
72773@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
72774 /*
72775 * Return the next free slob block pointer after this one.
72776 */
72777-static slob_t *slob_next(slob_t *s)
72778+static slob_t *slob_next(const slob_t *s)
72779 {
72780 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
72781 slobidx_t next;
72782@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
72783 /*
72784 * Returns true if s is the last free block in its page.
72785 */
72786-static int slob_last(slob_t *s)
72787+static int slob_last(const slob_t *s)
72788 {
72789 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
72790 }
72791@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
72792 if (!page)
72793 return NULL;
72794
72795+ set_slob_page(page);
72796 return page_address(page);
72797 }
72798
72799@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
72800 if (!b)
72801 return NULL;
72802 sp = slob_page(b);
72803- set_slob_page(sp);
72804
72805 spin_lock_irqsave(&slob_lock, flags);
72806 sp->units = SLOB_UNITS(PAGE_SIZE);
72807 sp->free = b;
72808+ sp->size = 0;
72809 INIT_LIST_HEAD(&sp->list);
72810 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
72811 set_slob_page_free(sp, slob_list);
72812@@ -475,10 +478,9 @@ out:
72813 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
72814 #endif
72815
72816-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
72817+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
72818 {
72819- unsigned int *m;
72820- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
72821+ slob_t *m;
72822 void *ret;
72823
72824 lockdep_trace_alloc(gfp);
72825@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t
72826
72827 if (!m)
72828 return NULL;
72829- *m = size;
72830+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
72831+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
72832+ m[0].units = size;
72833+ m[1].units = align;
72834 ret = (void *)m + align;
72835
72836 trace_kmalloc_node(_RET_IP_, ret,
72837@@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t
72838
72839 ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
72840 if (ret) {
72841- struct page *page;
72842- page = virt_to_page(ret);
72843- page->private = size;
72844+ struct slob_page *sp;
72845+ sp = slob_page(ret);
72846+ sp->size = size;
72847 }
72848
72849 trace_kmalloc_node(_RET_IP_, ret,
72850 size, PAGE_SIZE << order, gfp, node);
72851 }
72852
72853- kmemleak_alloc(ret, size, 1, gfp);
72854+ return ret;
72855+}
72856+
72857+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
72858+{
72859+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
72860+ void *ret = __kmalloc_node_align(size, gfp, node, align);
72861+
72862+ if (!ZERO_OR_NULL_PTR(ret))
72863+ kmemleak_alloc(ret, size, 1, gfp);
72864 return ret;
72865 }
72866 EXPORT_SYMBOL(__kmalloc_node);
72867@@ -528,13 +542,88 @@ void kfree(const void *block)
72868 sp = slob_page(block);
72869 if (is_slob_page(sp)) {
72870 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
72871- unsigned int *m = (unsigned int *)(block - align);
72872- slob_free(m, *m + align);
72873- } else
72874+ slob_t *m = (slob_t *)(block - align);
72875+ slob_free(m, m[0].units + align);
72876+ } else {
72877+ clear_slob_page(sp);
72878+ free_slob_page(sp);
72879+ sp->size = 0;
72880 put_page(&sp->page);
72881+ }
72882 }
72883 EXPORT_SYMBOL(kfree);
72884
72885+void check_object_size(const void *ptr, unsigned long n, bool to)
72886+{
72887+
72888+#ifdef CONFIG_PAX_USERCOPY
72889+ struct slob_page *sp;
72890+ const slob_t *free;
72891+ const void *base;
72892+ unsigned long flags;
72893+
72894+ if (!n)
72895+ return;
72896+
72897+ if (ZERO_OR_NULL_PTR(ptr))
72898+ goto report;
72899+
72900+ if (!virt_addr_valid(ptr))
72901+ return;
72902+
72903+ sp = slob_page(ptr);
72904+ if (!PageSlab((struct page*)sp)) {
72905+ if (object_is_on_stack(ptr, n) == -1)
72906+ goto report;
72907+ return;
72908+ }
72909+
72910+ if (sp->size) {
72911+ base = page_address(&sp->page);
72912+ if (base <= ptr && n <= sp->size - (ptr - base))
72913+ return;
72914+ goto report;
72915+ }
72916+
72917+ /* some tricky double walking to find the chunk */
72918+ spin_lock_irqsave(&slob_lock, flags);
72919+ base = (void *)((unsigned long)ptr & PAGE_MASK);
72920+ free = sp->free;
72921+
72922+ while (!slob_last(free) && (void *)free <= ptr) {
72923+ base = free + slob_units(free);
72924+ free = slob_next(free);
72925+ }
72926+
72927+ while (base < (void *)free) {
72928+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
72929+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
72930+ int offset;
72931+
72932+ if (ptr < base + align)
72933+ break;
72934+
72935+ offset = ptr - base - align;
72936+ if (offset >= m) {
72937+ base += size;
72938+ continue;
72939+ }
72940+
72941+ if (n > m - offset)
72942+ break;
72943+
72944+ spin_unlock_irqrestore(&slob_lock, flags);
72945+ return;
72946+ }
72947+
72948+ spin_unlock_irqrestore(&slob_lock, flags);
72949+report:
72950+ pax_report_usercopy(ptr, n, to, NULL);
72951+#endif
72952+
72953+}
72954+EXPORT_SYMBOL(check_object_size);
72955+
72956 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
72957 size_t ksize(const void *block)
72958 {
72959@@ -547,10 +636,10 @@ size_t ksize(const void *block)
72960 sp = slob_page(block);
72961 if (is_slob_page(sp)) {
72962 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
72963- unsigned int *m = (unsigned int *)(block - align);
72964- return SLOB_UNITS(*m) * SLOB_UNIT;
72965+ slob_t *m = (slob_t *)(block - align);
72966+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
72967 } else
72968- return sp->page.private;
72969+ return sp->size;
72970 }
72971 EXPORT_SYMBOL(ksize);
72972
72973@@ -566,8 +655,13 @@ struct kmem_cache *kmem_cache_create(con
72974 {
72975 struct kmem_cache *c;
72976
72977+#ifdef CONFIG_PAX_USERCOPY
72978+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
72979+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
72980+#else
72981 c = slob_alloc(sizeof(struct kmem_cache),
72982 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
72983+#endif
72984
72985 if (c) {
72986 c->name = name;
72987@@ -605,17 +699,25 @@ void *kmem_cache_alloc_node(struct kmem_
72988 {
72989 void *b;
72990
72991+#ifdef CONFIG_PAX_USERCOPY
72992+ b = __kmalloc_node_align(c->size, flags, node, c->align);
72993+#else
72994 if (c->size < PAGE_SIZE) {
72995 b = slob_alloc(c->size, flags, c->align, node);
72996 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
72997 SLOB_UNITS(c->size) * SLOB_UNIT,
72998 flags, node);
72999 } else {
73000+ struct slob_page *sp;
73001+
73002 b = slob_new_pages(flags, get_order(c->size), node);
73003+ sp = slob_page(b);
73004+ sp->size = c->size;
73005 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
73006 PAGE_SIZE << get_order(c->size),
73007 flags, node);
73008 }
73009+#endif
73010
73011 if (c->ctor)
73012 c->ctor(b);
73013@@ -627,10 +729,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
73014
73015 static void __kmem_cache_free(void *b, int size)
73016 {
73017- if (size < PAGE_SIZE)
73018+ struct slob_page *sp = slob_page(b);
73019+
73020+ if (is_slob_page(sp))
73021 slob_free(b, size);
73022- else
73023+ else {
73024+ clear_slob_page(sp);
73025+ free_slob_page(sp);
73026+ sp->size = 0;
73027 slob_free_pages(b, get_order(size));
73028+ }
73029 }
73030
73031 static void kmem_rcu_free(struct rcu_head *head)
73032@@ -643,18 +751,32 @@ static void kmem_rcu_free(struct rcu_hea
73033
73034 void kmem_cache_free(struct kmem_cache *c, void *b)
73035 {
73036+ int size = c->size;
73037+
73038+#ifdef CONFIG_PAX_USERCOPY
73039+ if (size + c->align < PAGE_SIZE) {
73040+ size += c->align;
73041+ b -= c->align;
73042+ }
73043+#endif
73044+
73045 kmemleak_free_recursive(b, c->flags);
73046 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
73047 struct slob_rcu *slob_rcu;
73048- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
73049+ slob_rcu = b + (size - sizeof(struct slob_rcu));
73050 INIT_RCU_HEAD(&slob_rcu->head);
73051- slob_rcu->size = c->size;
73052+ slob_rcu->size = size;
73053 call_rcu(&slob_rcu->head, kmem_rcu_free);
73054 } else {
73055- __kmem_cache_free(b, c->size);
73056+ __kmem_cache_free(b, size);
73057 }
73058
73059+#ifdef CONFIG_PAX_USERCOPY
73060+ trace_kfree(_RET_IP_, b);
73061+#else
73062 trace_kmem_cache_free(_RET_IP_, b);
73063+#endif
73064+
73065 }
73066 EXPORT_SYMBOL(kmem_cache_free);
73067
73068diff -urNp linux-2.6.32.46/mm/slub.c linux-2.6.32.46/mm/slub.c
73069--- linux-2.6.32.46/mm/slub.c 2011-03-27 14:31:47.000000000 -0400
73070+++ linux-2.6.32.46/mm/slub.c 2011-04-17 15:56:46.000000000 -0400
73071@@ -410,7 +410,7 @@ static void print_track(const char *s, s
73072 if (!t->addr)
73073 return;
73074
73075- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
73076+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
73077 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
73078 }
73079
73080@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
73081
73082 page = virt_to_head_page(x);
73083
73084+ BUG_ON(!PageSlab(page));
73085+
73086 slab_free(s, page, x, _RET_IP_);
73087
73088 trace_kmem_cache_free(_RET_IP_, x);
73089@@ -1937,7 +1939,7 @@ static int slub_min_objects;
73090 * Merge control. If this is set then no merging of slab caches will occur.
73091 * (Could be removed. This was introduced to pacify the merge skeptics.)
73092 */
73093-static int slub_nomerge;
73094+static int slub_nomerge = 1;
73095
73096 /*
73097 * Calculate the order of allocation given an slab object size.
73098@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
73099 * list to avoid pounding the page allocator excessively.
73100 */
73101 set_min_partial(s, ilog2(s->size));
73102- s->refcount = 1;
73103+ atomic_set(&s->refcount, 1);
73104 #ifdef CONFIG_NUMA
73105 s->remote_node_defrag_ratio = 1000;
73106 #endif
73107@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
73108 void kmem_cache_destroy(struct kmem_cache *s)
73109 {
73110 down_write(&slub_lock);
73111- s->refcount--;
73112- if (!s->refcount) {
73113+ if (atomic_dec_and_test(&s->refcount)) {
73114 list_del(&s->list);
73115 up_write(&slub_lock);
73116 if (kmem_cache_close(s)) {
73117@@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(cha
73118 __setup("slub_nomerge", setup_slub_nomerge);
73119
73120 static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
73121- const char *name, int size, gfp_t gfp_flags)
73122+ const char *name, int size, gfp_t gfp_flags, unsigned int flags)
73123 {
73124- unsigned int flags = 0;
73125-
73126 if (gfp_flags & SLUB_DMA)
73127- flags = SLAB_CACHE_DMA;
73128+ flags |= SLAB_CACHE_DMA;
73129
73130 /*
73131 * This function is called with IRQs disabled during early-boot on
73132@@ -2915,6 +2914,46 @@ void *__kmalloc_node(size_t size, gfp_t
73133 EXPORT_SYMBOL(__kmalloc_node);
73134 #endif
73135
73136+void check_object_size(const void *ptr, unsigned long n, bool to)
73137+{
73138+
73139+#ifdef CONFIG_PAX_USERCOPY
73140+ struct page *page;
73141+ struct kmem_cache *s = NULL;
73142+ unsigned long offset;
73143+
73144+ if (!n)
73145+ return;
73146+
73147+ if (ZERO_OR_NULL_PTR(ptr))
73148+ goto report;
73149+
73150+ if (!virt_addr_valid(ptr))
73151+ return;
73152+
73153+ page = get_object_page(ptr);
73154+
73155+ if (!page) {
73156+ if (object_is_on_stack(ptr, n) == -1)
73157+ goto report;
73158+ return;
73159+ }
73160+
73161+ s = page->slab;
73162+ if (!(s->flags & SLAB_USERCOPY))
73163+ goto report;
73164+
73165+ offset = (ptr - page_address(page)) % s->size;
73166+ if (offset <= s->objsize && n <= s->objsize - offset)
73167+ return;
73168+
73169+report:
73170+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
73171+#endif
73172+
73173+}
73174+EXPORT_SYMBOL(check_object_size);
73175+
73176 size_t ksize(const void *object)
73177 {
73178 struct page *page;
73179@@ -3185,8 +3224,8 @@ void __init kmem_cache_init(void)
73180 * kmem_cache_open for slab_state == DOWN.
73181 */
73182 create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
73183- sizeof(struct kmem_cache_node), GFP_NOWAIT);
73184- kmalloc_caches[0].refcount = -1;
73185+ sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
73186+ atomic_set(&kmalloc_caches[0].refcount, -1);
73187 caches++;
73188
73189 hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
73190@@ -3198,18 +3237,18 @@ void __init kmem_cache_init(void)
73191 /* Caches that are not of the two-to-the-power-of size */
73192 if (KMALLOC_MIN_SIZE <= 32) {
73193 create_kmalloc_cache(&kmalloc_caches[1],
73194- "kmalloc-96", 96, GFP_NOWAIT);
73195+ "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
73196 caches++;
73197 }
73198 if (KMALLOC_MIN_SIZE <= 64) {
73199 create_kmalloc_cache(&kmalloc_caches[2],
73200- "kmalloc-192", 192, GFP_NOWAIT);
73201+ "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
73202 caches++;
73203 }
73204
73205 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
73206 create_kmalloc_cache(&kmalloc_caches[i],
73207- "kmalloc", 1 << i, GFP_NOWAIT);
73208+ "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
73209 caches++;
73210 }
73211
73212@@ -3293,7 +3332,7 @@ static int slab_unmergeable(struct kmem_
73213 /*
73214 * We may have set a slab to be unmergeable during bootstrap.
73215 */
73216- if (s->refcount < 0)
73217+ if (atomic_read(&s->refcount) < 0)
73218 return 1;
73219
73220 return 0;
73221@@ -3353,7 +3392,7 @@ struct kmem_cache *kmem_cache_create(con
73222 if (s) {
73223 int cpu;
73224
73225- s->refcount++;
73226+ atomic_inc(&s->refcount);
73227 /*
73228 * Adjust the object sizes so that we clear
73229 * the complete object on kzalloc.
73230@@ -3372,7 +3411,7 @@ struct kmem_cache *kmem_cache_create(con
73231
73232 if (sysfs_slab_alias(s, name)) {
73233 down_write(&slub_lock);
73234- s->refcount--;
73235+ atomic_dec(&s->refcount);
73236 up_write(&slub_lock);
73237 goto err;
73238 }
73239@@ -4101,7 +4140,7 @@ SLAB_ATTR_RO(ctor);
73240
73241 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
73242 {
73243- return sprintf(buf, "%d\n", s->refcount - 1);
73244+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
73245 }
73246 SLAB_ATTR_RO(aliases);
73247
73248@@ -4503,7 +4542,7 @@ static void kmem_cache_release(struct ko
73249 kfree(s);
73250 }
73251
73252-static struct sysfs_ops slab_sysfs_ops = {
73253+static const struct sysfs_ops slab_sysfs_ops = {
73254 .show = slab_attr_show,
73255 .store = slab_attr_store,
73256 };
73257@@ -4522,7 +4561,7 @@ static int uevent_filter(struct kset *ks
73258 return 0;
73259 }
73260
73261-static struct kset_uevent_ops slab_uevent_ops = {
73262+static const struct kset_uevent_ops slab_uevent_ops = {
73263 .filter = uevent_filter,
73264 };
73265
73266@@ -4785,7 +4824,13 @@ static const struct file_operations proc
73267
73268 static int __init slab_proc_init(void)
73269 {
73270- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
73271+ mode_t gr_mode = S_IRUGO;
73272+
73273+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73274+ gr_mode = S_IRUSR;
73275+#endif
73276+
73277+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
73278 return 0;
73279 }
73280 module_init(slab_proc_init);
73281diff -urNp linux-2.6.32.46/mm/swap.c linux-2.6.32.46/mm/swap.c
73282--- linux-2.6.32.46/mm/swap.c 2011-03-27 14:31:47.000000000 -0400
73283+++ linux-2.6.32.46/mm/swap.c 2011-07-09 09:15:19.000000000 -0400
73284@@ -30,6 +30,7 @@
73285 #include <linux/notifier.h>
73286 #include <linux/backing-dev.h>
73287 #include <linux/memcontrol.h>
73288+#include <linux/hugetlb.h>
73289
73290 #include "internal.h"
73291
73292@@ -65,6 +66,8 @@ static void put_compound_page(struct pag
73293 compound_page_dtor *dtor;
73294
73295 dtor = get_compound_page_dtor(page);
73296+ if (!PageHuge(page))
73297+ BUG_ON(dtor != free_compound_page);
73298 (*dtor)(page);
73299 }
73300 }
73301diff -urNp linux-2.6.32.46/mm/util.c linux-2.6.32.46/mm/util.c
73302--- linux-2.6.32.46/mm/util.c 2011-03-27 14:31:47.000000000 -0400
73303+++ linux-2.6.32.46/mm/util.c 2011-04-17 15:56:46.000000000 -0400
73304@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
73305 void arch_pick_mmap_layout(struct mm_struct *mm)
73306 {
73307 mm->mmap_base = TASK_UNMAPPED_BASE;
73308+
73309+#ifdef CONFIG_PAX_RANDMMAP
73310+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73311+ mm->mmap_base += mm->delta_mmap;
73312+#endif
73313+
73314 mm->get_unmapped_area = arch_get_unmapped_area;
73315 mm->unmap_area = arch_unmap_area;
73316 }
73317diff -urNp linux-2.6.32.46/mm/vmalloc.c linux-2.6.32.46/mm/vmalloc.c
73318--- linux-2.6.32.46/mm/vmalloc.c 2011-08-29 22:24:44.000000000 -0400
73319+++ linux-2.6.32.46/mm/vmalloc.c 2011-08-29 22:25:07.000000000 -0400
73320@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
73321
73322 pte = pte_offset_kernel(pmd, addr);
73323 do {
73324- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73325- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73326+
73327+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73328+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
73329+ BUG_ON(!pte_exec(*pte));
73330+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
73331+ continue;
73332+ }
73333+#endif
73334+
73335+ {
73336+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
73337+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
73338+ }
73339 } while (pte++, addr += PAGE_SIZE, addr != end);
73340 }
73341
73342@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
73343 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
73344 {
73345 pte_t *pte;
73346+ int ret = -ENOMEM;
73347
73348 /*
73349 * nr is a running index into the array which helps higher level
73350@@ -101,17 +113,32 @@ static int vmap_pte_range(pmd_t *pmd, un
73351 pte = pte_alloc_kernel(pmd, addr);
73352 if (!pte)
73353 return -ENOMEM;
73354+
73355+ pax_open_kernel();
73356 do {
73357 struct page *page = pages[*nr];
73358
73359- if (WARN_ON(!pte_none(*pte)))
73360- return -EBUSY;
73361- if (WARN_ON(!page))
73362- return -ENOMEM;
73363+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73364+ if (!(pgprot_val(prot) & _PAGE_NX))
73365+ BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
73366+ else
73367+#endif
73368+
73369+ if (WARN_ON(!pte_none(*pte))) {
73370+ ret = -EBUSY;
73371+ goto out;
73372+ }
73373+ if (WARN_ON(!page)) {
73374+ ret = -ENOMEM;
73375+ goto out;
73376+ }
73377 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
73378 (*nr)++;
73379 } while (pte++, addr += PAGE_SIZE, addr != end);
73380- return 0;
73381+ ret = 0;
73382+out:
73383+ pax_close_kernel();
73384+ return ret;
73385 }
73386
73387 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
73388@@ -192,11 +219,20 @@ int is_vmalloc_or_module_addr(const void
73389 * and fall back on vmalloc() if that fails. Others
73390 * just put it in the vmalloc space.
73391 */
73392-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
73393+#ifdef CONFIG_MODULES
73394+#ifdef MODULES_VADDR
73395 unsigned long addr = (unsigned long)x;
73396 if (addr >= MODULES_VADDR && addr < MODULES_END)
73397 return 1;
73398 #endif
73399+
73400+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
73401+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
73402+ return 1;
73403+#endif
73404+
73405+#endif
73406+
73407 return is_vmalloc_addr(x);
73408 }
73409
73410@@ -217,8 +253,14 @@ struct page *vmalloc_to_page(const void
73411
73412 if (!pgd_none(*pgd)) {
73413 pud_t *pud = pud_offset(pgd, addr);
73414+#ifdef CONFIG_X86
73415+ if (!pud_large(*pud))
73416+#endif
73417 if (!pud_none(*pud)) {
73418 pmd_t *pmd = pmd_offset(pud, addr);
73419+#ifdef CONFIG_X86
73420+ if (!pmd_large(*pmd))
73421+#endif
73422 if (!pmd_none(*pmd)) {
73423 pte_t *ptep, pte;
73424
73425@@ -292,13 +334,13 @@ static void __insert_vmap_area(struct vm
73426 struct rb_node *tmp;
73427
73428 while (*p) {
73429- struct vmap_area *tmp;
73430+ struct vmap_area *varea;
73431
73432 parent = *p;
73433- tmp = rb_entry(parent, struct vmap_area, rb_node);
73434- if (va->va_start < tmp->va_end)
73435+ varea = rb_entry(parent, struct vmap_area, rb_node);
73436+ if (va->va_start < varea->va_end)
73437 p = &(*p)->rb_left;
73438- else if (va->va_end > tmp->va_start)
73439+ else if (va->va_end > varea->va_start)
73440 p = &(*p)->rb_right;
73441 else
73442 BUG();
73443@@ -1233,6 +1275,16 @@ static struct vm_struct *__get_vm_area_n
73444 struct vm_struct *area;
73445
73446 BUG_ON(in_interrupt());
73447+
73448+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73449+ if (flags & VM_KERNEXEC) {
73450+ if (start != VMALLOC_START || end != VMALLOC_END)
73451+ return NULL;
73452+ start = (unsigned long)MODULES_EXEC_VADDR;
73453+ end = (unsigned long)MODULES_EXEC_END;
73454+ }
73455+#endif
73456+
73457 if (flags & VM_IOREMAP) {
73458 int bit = fls(size);
73459
73460@@ -1458,6 +1510,11 @@ void *vmap(struct page **pages, unsigned
73461 if (count > totalram_pages)
73462 return NULL;
73463
73464+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73465+ if (!(pgprot_val(prot) & _PAGE_NX))
73466+ flags |= VM_KERNEXEC;
73467+#endif
73468+
73469 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
73470 __builtin_return_address(0));
73471 if (!area)
73472@@ -1568,6 +1625,13 @@ static void *__vmalloc_node(unsigned lon
73473 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
73474 return NULL;
73475
73476+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
73477+ if (!(pgprot_val(prot) & _PAGE_NX))
73478+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
73479+ node, gfp_mask, caller);
73480+ else
73481+#endif
73482+
73483 area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
73484 VMALLOC_END, node, gfp_mask, caller);
73485
73486@@ -1586,6 +1650,7 @@ static void *__vmalloc_node(unsigned lon
73487 return addr;
73488 }
73489
73490+#undef __vmalloc
73491 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
73492 {
73493 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
73494@@ -1602,6 +1667,7 @@ EXPORT_SYMBOL(__vmalloc);
73495 * For tight control over page level allocator and protection flags
73496 * use __vmalloc() instead.
73497 */
73498+#undef vmalloc
73499 void *vmalloc(unsigned long size)
73500 {
73501 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
73502@@ -1616,6 +1682,7 @@ EXPORT_SYMBOL(vmalloc);
73503 * The resulting memory area is zeroed so it can be mapped to userspace
73504 * without leaking data.
73505 */
73506+#undef vmalloc_user
73507 void *vmalloc_user(unsigned long size)
73508 {
73509 struct vm_struct *area;
73510@@ -1643,6 +1710,7 @@ EXPORT_SYMBOL(vmalloc_user);
73511 * For tight control over page level allocator and protection flags
73512 * use __vmalloc() instead.
73513 */
73514+#undef vmalloc_node
73515 void *vmalloc_node(unsigned long size, int node)
73516 {
73517 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
73518@@ -1665,10 +1733,10 @@ EXPORT_SYMBOL(vmalloc_node);
73519 * For tight control over page level allocator and protection flags
73520 * use __vmalloc() instead.
73521 */
73522-
73523+#undef vmalloc_exec
73524 void *vmalloc_exec(unsigned long size)
73525 {
73526- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
73527+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
73528 -1, __builtin_return_address(0));
73529 }
73530
73531@@ -1687,6 +1755,7 @@ void *vmalloc_exec(unsigned long size)
73532 * Allocate enough 32bit PA addressable pages to cover @size from the
73533 * page level allocator and map them into contiguous kernel virtual space.
73534 */
73535+#undef vmalloc_32
73536 void *vmalloc_32(unsigned long size)
73537 {
73538 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
73539@@ -1701,6 +1770,7 @@ EXPORT_SYMBOL(vmalloc_32);
73540 * The resulting memory area is 32bit addressable and zeroed so it can be
73541 * mapped to userspace without leaking data.
73542 */
73543+#undef vmalloc_32_user
73544 void *vmalloc_32_user(unsigned long size)
73545 {
73546 struct vm_struct *area;
73547@@ -1965,6 +2035,8 @@ int remap_vmalloc_range(struct vm_area_s
73548 unsigned long uaddr = vma->vm_start;
73549 unsigned long usize = vma->vm_end - vma->vm_start;
73550
73551+ BUG_ON(vma->vm_mirror);
73552+
73553 if ((PAGE_SIZE-1) & (unsigned long)addr)
73554 return -EINVAL;
73555
73556diff -urNp linux-2.6.32.46/mm/vmstat.c linux-2.6.32.46/mm/vmstat.c
73557--- linux-2.6.32.46/mm/vmstat.c 2011-03-27 14:31:47.000000000 -0400
73558+++ linux-2.6.32.46/mm/vmstat.c 2011-04-17 15:56:46.000000000 -0400
73559@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
73560 *
73561 * vm_stat contains the global counters
73562 */
73563-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
73564+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
73565 EXPORT_SYMBOL(vm_stat);
73566
73567 #ifdef CONFIG_SMP
73568@@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
73569 v = p->vm_stat_diff[i];
73570 p->vm_stat_diff[i] = 0;
73571 local_irq_restore(flags);
73572- atomic_long_add(v, &zone->vm_stat[i]);
73573+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
73574 global_diff[i] += v;
73575 #ifdef CONFIG_NUMA
73576 /* 3 seconds idle till flush */
73577@@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
73578
73579 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
73580 if (global_diff[i])
73581- atomic_long_add(global_diff[i], &vm_stat[i]);
73582+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
73583 }
73584
73585 #endif
73586@@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
73587 start_cpu_timer(cpu);
73588 #endif
73589 #ifdef CONFIG_PROC_FS
73590- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
73591- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
73592- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
73593- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
73594+ {
73595+ mode_t gr_mode = S_IRUGO;
73596+#ifdef CONFIG_GRKERNSEC_PROC_ADD
73597+ gr_mode = S_IRUSR;
73598+#endif
73599+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
73600+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
73601+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
73602+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
73603+#else
73604+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
73605+#endif
73606+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
73607+ }
73608 #endif
73609 return 0;
73610 }
73611diff -urNp linux-2.6.32.46/net/8021q/vlan.c linux-2.6.32.46/net/8021q/vlan.c
73612--- linux-2.6.32.46/net/8021q/vlan.c 2011-03-27 14:31:47.000000000 -0400
73613+++ linux-2.6.32.46/net/8021q/vlan.c 2011-04-17 15:56:46.000000000 -0400
73614@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
73615 err = -EPERM;
73616 if (!capable(CAP_NET_ADMIN))
73617 break;
73618- if ((args.u.name_type >= 0) &&
73619- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
73620+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
73621 struct vlan_net *vn;
73622
73623 vn = net_generic(net, vlan_net_id);
73624diff -urNp linux-2.6.32.46/net/atm/atm_misc.c linux-2.6.32.46/net/atm/atm_misc.c
73625--- linux-2.6.32.46/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400
73626+++ linux-2.6.32.46/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400
73627@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
73628 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
73629 return 1;
73630 atm_return(vcc,truesize);
73631- atomic_inc(&vcc->stats->rx_drop);
73632+ atomic_inc_unchecked(&vcc->stats->rx_drop);
73633 return 0;
73634 }
73635
73636@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct
73637 }
73638 }
73639 atm_return(vcc,guess);
73640- atomic_inc(&vcc->stats->rx_drop);
73641+ atomic_inc_unchecked(&vcc->stats->rx_drop);
73642 return NULL;
73643 }
73644
73645@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
73646
73647 void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
73648 {
73649-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
73650+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
73651 __SONET_ITEMS
73652 #undef __HANDLE_ITEM
73653 }
73654@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
73655
73656 void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
73657 {
73658-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
73659+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
73660 __SONET_ITEMS
73661 #undef __HANDLE_ITEM
73662 }
73663diff -urNp linux-2.6.32.46/net/atm/lec.h linux-2.6.32.46/net/atm/lec.h
73664--- linux-2.6.32.46/net/atm/lec.h 2011-03-27 14:31:47.000000000 -0400
73665+++ linux-2.6.32.46/net/atm/lec.h 2011-08-05 20:33:55.000000000 -0400
73666@@ -48,7 +48,7 @@ struct lane2_ops {
73667 const u8 *tlvs, u32 sizeoftlvs);
73668 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
73669 const u8 *tlvs, u32 sizeoftlvs);
73670-};
73671+} __no_const;
73672
73673 /*
73674 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
73675diff -urNp linux-2.6.32.46/net/atm/mpc.h linux-2.6.32.46/net/atm/mpc.h
73676--- linux-2.6.32.46/net/atm/mpc.h 2011-03-27 14:31:47.000000000 -0400
73677+++ linux-2.6.32.46/net/atm/mpc.h 2011-08-23 21:22:38.000000000 -0400
73678@@ -33,7 +33,7 @@ struct mpoa_client {
73679 struct mpc_parameters parameters; /* parameters for this client */
73680
73681 const struct net_device_ops *old_ops;
73682- struct net_device_ops new_ops;
73683+ net_device_ops_no_const new_ops;
73684 };
73685
73686
73687diff -urNp linux-2.6.32.46/net/atm/mpoa_caches.c linux-2.6.32.46/net/atm/mpoa_caches.c
73688--- linux-2.6.32.46/net/atm/mpoa_caches.c 2011-03-27 14:31:47.000000000 -0400
73689+++ linux-2.6.32.46/net/atm/mpoa_caches.c 2011-05-16 21:46:57.000000000 -0400
73690@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_cl
73691 struct timeval now;
73692 struct k_message msg;
73693
73694+ pax_track_stack();
73695+
73696 do_gettimeofday(&now);
73697
73698 write_lock_irq(&client->egress_lock);
73699diff -urNp linux-2.6.32.46/net/atm/proc.c linux-2.6.32.46/net/atm/proc.c
73700--- linux-2.6.32.46/net/atm/proc.c 2011-03-27 14:31:47.000000000 -0400
73701+++ linux-2.6.32.46/net/atm/proc.c 2011-04-17 15:56:46.000000000 -0400
73702@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
73703 const struct k_atm_aal_stats *stats)
73704 {
73705 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
73706- atomic_read(&stats->tx),atomic_read(&stats->tx_err),
73707- atomic_read(&stats->rx),atomic_read(&stats->rx_err),
73708- atomic_read(&stats->rx_drop));
73709+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
73710+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
73711+ atomic_read_unchecked(&stats->rx_drop));
73712 }
73713
73714 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
73715@@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *se
73716 {
73717 struct sock *sk = sk_atm(vcc);
73718
73719+#ifdef CONFIG_GRKERNSEC_HIDESYM
73720+ seq_printf(seq, "%p ", NULL);
73721+#else
73722 seq_printf(seq, "%p ", vcc);
73723+#endif
73724+
73725 if (!vcc->dev)
73726 seq_printf(seq, "Unassigned ");
73727 else
73728@@ -214,7 +219,11 @@ static void svc_info(struct seq_file *se
73729 {
73730 if (!vcc->dev)
73731 seq_printf(seq, sizeof(void *) == 4 ?
73732+#ifdef CONFIG_GRKERNSEC_HIDESYM
73733+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
73734+#else
73735 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
73736+#endif
73737 else
73738 seq_printf(seq, "%3d %3d %5d ",
73739 vcc->dev->number, vcc->vpi, vcc->vci);
73740diff -urNp linux-2.6.32.46/net/atm/resources.c linux-2.6.32.46/net/atm/resources.c
73741--- linux-2.6.32.46/net/atm/resources.c 2011-03-27 14:31:47.000000000 -0400
73742+++ linux-2.6.32.46/net/atm/resources.c 2011-04-17 15:56:46.000000000 -0400
73743@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
73744 static void copy_aal_stats(struct k_atm_aal_stats *from,
73745 struct atm_aal_stats *to)
73746 {
73747-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
73748+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
73749 __AAL_STAT_ITEMS
73750 #undef __HANDLE_ITEM
73751 }
73752@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
73753 static void subtract_aal_stats(struct k_atm_aal_stats *from,
73754 struct atm_aal_stats *to)
73755 {
73756-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
73757+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
73758 __AAL_STAT_ITEMS
73759 #undef __HANDLE_ITEM
73760 }
73761diff -urNp linux-2.6.32.46/net/bluetooth/l2cap.c linux-2.6.32.46/net/bluetooth/l2cap.c
73762--- linux-2.6.32.46/net/bluetooth/l2cap.c 2011-03-27 14:31:47.000000000 -0400
73763+++ linux-2.6.32.46/net/bluetooth/l2cap.c 2011-06-25 14:36:21.000000000 -0400
73764@@ -1885,7 +1885,7 @@ static int l2cap_sock_getsockopt_old(str
73765 err = -ENOTCONN;
73766 break;
73767 }
73768-
73769+ memset(&cinfo, 0, sizeof(cinfo));
73770 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
73771 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
73772
73773@@ -2719,7 +2719,7 @@ static inline int l2cap_config_req(struc
73774
73775 /* Reject if config buffer is too small. */
73776 len = cmd_len - sizeof(*req);
73777- if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
73778+ if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
73779 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
73780 l2cap_build_conf_rsp(sk, rsp,
73781 L2CAP_CONF_REJECT, flags), rsp);
73782diff -urNp linux-2.6.32.46/net/bluetooth/rfcomm/sock.c linux-2.6.32.46/net/bluetooth/rfcomm/sock.c
73783--- linux-2.6.32.46/net/bluetooth/rfcomm/sock.c 2011-03-27 14:31:47.000000000 -0400
73784+++ linux-2.6.32.46/net/bluetooth/rfcomm/sock.c 2011-06-12 06:35:00.000000000 -0400
73785@@ -878,6 +878,7 @@ static int rfcomm_sock_getsockopt_old(st
73786
73787 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
73788
73789+ memset(&cinfo, 0, sizeof(cinfo));
73790 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
73791 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
73792
73793diff -urNp linux-2.6.32.46/net/bridge/br_private.h linux-2.6.32.46/net/bridge/br_private.h
73794--- linux-2.6.32.46/net/bridge/br_private.h 2011-08-09 18:35:30.000000000 -0400
73795+++ linux-2.6.32.46/net/bridge/br_private.h 2011-08-09 18:34:01.000000000 -0400
73796@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event,
73797
73798 #ifdef CONFIG_SYSFS
73799 /* br_sysfs_if.c */
73800-extern struct sysfs_ops brport_sysfs_ops;
73801+extern const struct sysfs_ops brport_sysfs_ops;
73802 extern int br_sysfs_addif(struct net_bridge_port *p);
73803
73804 /* br_sysfs_br.c */
73805diff -urNp linux-2.6.32.46/net/bridge/br_stp_if.c linux-2.6.32.46/net/bridge/br_stp_if.c
73806--- linux-2.6.32.46/net/bridge/br_stp_if.c 2011-03-27 14:31:47.000000000 -0400
73807+++ linux-2.6.32.46/net/bridge/br_stp_if.c 2011-04-17 15:56:46.000000000 -0400
73808@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
73809 char *envp[] = { NULL };
73810
73811 if (br->stp_enabled == BR_USER_STP) {
73812- r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
73813+ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
73814 printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
73815 br->dev->name, r);
73816
73817diff -urNp linux-2.6.32.46/net/bridge/br_sysfs_if.c linux-2.6.32.46/net/bridge/br_sysfs_if.c
73818--- linux-2.6.32.46/net/bridge/br_sysfs_if.c 2011-03-27 14:31:47.000000000 -0400
73819+++ linux-2.6.32.46/net/bridge/br_sysfs_if.c 2011-04-17 15:56:46.000000000 -0400
73820@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
73821 return ret;
73822 }
73823
73824-struct sysfs_ops brport_sysfs_ops = {
73825+const struct sysfs_ops brport_sysfs_ops = {
73826 .show = brport_show,
73827 .store = brport_store,
73828 };
73829diff -urNp linux-2.6.32.46/net/bridge/netfilter/ebtables.c linux-2.6.32.46/net/bridge/netfilter/ebtables.c
73830--- linux-2.6.32.46/net/bridge/netfilter/ebtables.c 2011-04-17 17:00:52.000000000 -0400
73831+++ linux-2.6.32.46/net/bridge/netfilter/ebtables.c 2011-05-16 21:46:57.000000000 -0400
73832@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struc
73833 unsigned int entries_size, nentries;
73834 char *entries;
73835
73836+ pax_track_stack();
73837+
73838 if (cmd == EBT_SO_GET_ENTRIES) {
73839 entries_size = t->private->entries_size;
73840 nentries = t->private->nentries;
73841diff -urNp linux-2.6.32.46/net/can/bcm.c linux-2.6.32.46/net/can/bcm.c
73842--- linux-2.6.32.46/net/can/bcm.c 2011-05-10 22:12:01.000000000 -0400
73843+++ linux-2.6.32.46/net/can/bcm.c 2011-05-10 22:12:34.000000000 -0400
73844@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file
73845 struct bcm_sock *bo = bcm_sk(sk);
73846 struct bcm_op *op;
73847
73848+#ifdef CONFIG_GRKERNSEC_HIDESYM
73849+ seq_printf(m, ">>> socket %p", NULL);
73850+ seq_printf(m, " / sk %p", NULL);
73851+ seq_printf(m, " / bo %p", NULL);
73852+#else
73853 seq_printf(m, ">>> socket %p", sk->sk_socket);
73854 seq_printf(m, " / sk %p", sk);
73855 seq_printf(m, " / bo %p", bo);
73856+#endif
73857 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
73858 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
73859 seq_printf(m, " <<<\n");
73860diff -urNp linux-2.6.32.46/net/core/dev.c linux-2.6.32.46/net/core/dev.c
73861--- linux-2.6.32.46/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400
73862+++ linux-2.6.32.46/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400
73863@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const cha
73864 if (no_module && capable(CAP_NET_ADMIN))
73865 no_module = request_module("netdev-%s", name);
73866 if (no_module && capable(CAP_SYS_MODULE)) {
73867+#ifdef CONFIG_GRKERNSEC_MODHARDEN
73868+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
73869+#else
73870 if (!request_module("%s", name))
73871 pr_err("Loading kernel module for a network device "
73872 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
73873 "instead\n", name);
73874+#endif
73875 }
73876 }
73877 EXPORT_SYMBOL(dev_load);
73878@@ -1654,7 +1658,7 @@ static inline int illegal_highdma(struct
73879
73880 struct dev_gso_cb {
73881 void (*destructor)(struct sk_buff *skb);
73882-};
73883+} __no_const;
73884
73885 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
73886
73887@@ -2063,7 +2067,7 @@ int netif_rx_ni(struct sk_buff *skb)
73888 }
73889 EXPORT_SYMBOL(netif_rx_ni);
73890
73891-static void net_tx_action(struct softirq_action *h)
73892+static void net_tx_action(void)
73893 {
73894 struct softnet_data *sd = &__get_cpu_var(softnet_data);
73895
73896@@ -2826,7 +2830,7 @@ void netif_napi_del(struct napi_struct *
73897 EXPORT_SYMBOL(netif_napi_del);
73898
73899
73900-static void net_rx_action(struct softirq_action *h)
73901+static void net_rx_action(void)
73902 {
73903 struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
73904 unsigned long time_limit = jiffies + 2;
73905diff -urNp linux-2.6.32.46/net/core/flow.c linux-2.6.32.46/net/core/flow.c
73906--- linux-2.6.32.46/net/core/flow.c 2011-03-27 14:31:47.000000000 -0400
73907+++ linux-2.6.32.46/net/core/flow.c 2011-05-04 17:56:20.000000000 -0400
73908@@ -35,11 +35,11 @@ struct flow_cache_entry {
73909 atomic_t *object_ref;
73910 };
73911
73912-atomic_t flow_cache_genid = ATOMIC_INIT(0);
73913+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
73914
73915 static u32 flow_hash_shift;
73916 #define flow_hash_size (1 << flow_hash_shift)
73917-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
73918+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
73919
73920 #define flow_table(cpu) (per_cpu(flow_tables, cpu))
73921
73922@@ -52,7 +52,7 @@ struct flow_percpu_info {
73923 u32 hash_rnd;
73924 int count;
73925 };
73926-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
73927+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
73928
73929 #define flow_hash_rnd_recalc(cpu) \
73930 (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
73931@@ -69,7 +69,7 @@ struct flow_flush_info {
73932 atomic_t cpuleft;
73933 struct completion completion;
73934 };
73935-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
73936+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
73937
73938 #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
73939
73940@@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net,
73941 if (fle->family == family &&
73942 fle->dir == dir &&
73943 flow_key_compare(key, &fle->key) == 0) {
73944- if (fle->genid == atomic_read(&flow_cache_genid)) {
73945+ if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
73946 void *ret = fle->object;
73947
73948 if (ret)
73949@@ -228,7 +228,7 @@ nocache:
73950 err = resolver(net, key, family, dir, &obj, &obj_ref);
73951
73952 if (fle && !err) {
73953- fle->genid = atomic_read(&flow_cache_genid);
73954+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
73955
73956 if (fle->object)
73957 atomic_dec(fle->object_ref);
73958@@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(uns
73959
73960 fle = flow_table(cpu)[i];
73961 for (; fle; fle = fle->next) {
73962- unsigned genid = atomic_read(&flow_cache_genid);
73963+ unsigned genid = atomic_read_unchecked(&flow_cache_genid);
73964
73965 if (!fle->object || fle->genid == genid)
73966 continue;
73967diff -urNp linux-2.6.32.46/net/core/rtnetlink.c linux-2.6.32.46/net/core/rtnetlink.c
73968--- linux-2.6.32.46/net/core/rtnetlink.c 2011-03-27 14:31:47.000000000 -0400
73969+++ linux-2.6.32.46/net/core/rtnetlink.c 2011-08-05 20:33:55.000000000 -0400
73970@@ -57,7 +57,7 @@ struct rtnl_link
73971 {
73972 rtnl_doit_func doit;
73973 rtnl_dumpit_func dumpit;
73974-};
73975+} __no_const;
73976
73977 static DEFINE_MUTEX(rtnl_mutex);
73978
73979diff -urNp linux-2.6.32.46/net/core/secure_seq.c linux-2.6.32.46/net/core/secure_seq.c
73980--- linux-2.6.32.46/net/core/secure_seq.c 2011-08-16 20:37:25.000000000 -0400
73981+++ linux-2.6.32.46/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400
73982@@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be3
73983 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
73984
73985 u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
73986- __be16 dport)
73987+ __be16 dport)
73988 {
73989 u32 secret[MD5_MESSAGE_BYTES / 4];
73990 u32 hash[MD5_DIGEST_WORDS];
73991@@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __b
73992 secret[i] = net_secret[i];
73993
73994 md5_transform(hash, secret);
73995-
73996 return hash[0];
73997 }
73998 #endif
73999diff -urNp linux-2.6.32.46/net/core/skbuff.c linux-2.6.32.46/net/core/skbuff.c
74000--- linux-2.6.32.46/net/core/skbuff.c 2011-03-27 14:31:47.000000000 -0400
74001+++ linux-2.6.32.46/net/core/skbuff.c 2011-05-16 21:46:57.000000000 -0400
74002@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb,
74003 struct sk_buff *frag_iter;
74004 struct sock *sk = skb->sk;
74005
74006+ pax_track_stack();
74007+
74008 /*
74009 * __skb_splice_bits() only fails if the output has no room left,
74010 * so no point in going over the frag_list for the error case.
74011diff -urNp linux-2.6.32.46/net/core/sock.c linux-2.6.32.46/net/core/sock.c
74012--- linux-2.6.32.46/net/core/sock.c 2011-03-27 14:31:47.000000000 -0400
74013+++ linux-2.6.32.46/net/core/sock.c 2011-05-04 17:56:20.000000000 -0400
74014@@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock,
74015 break;
74016
74017 case SO_PEERCRED:
74018+ {
74019+ struct ucred peercred;
74020 if (len > sizeof(sk->sk_peercred))
74021 len = sizeof(sk->sk_peercred);
74022- if (copy_to_user(optval, &sk->sk_peercred, len))
74023+ peercred = sk->sk_peercred;
74024+ if (copy_to_user(optval, &peercred, len))
74025 return -EFAULT;
74026 goto lenout;
74027+ }
74028
74029 case SO_PEERNAME:
74030 {
74031@@ -1892,7 +1896,7 @@ void sock_init_data(struct socket *sock,
74032 */
74033 smp_wmb();
74034 atomic_set(&sk->sk_refcnt, 1);
74035- atomic_set(&sk->sk_drops, 0);
74036+ atomic_set_unchecked(&sk->sk_drops, 0);
74037 }
74038 EXPORT_SYMBOL(sock_init_data);
74039
74040diff -urNp linux-2.6.32.46/net/decnet/sysctl_net_decnet.c linux-2.6.32.46/net/decnet/sysctl_net_decnet.c
74041--- linux-2.6.32.46/net/decnet/sysctl_net_decnet.c 2011-03-27 14:31:47.000000000 -0400
74042+++ linux-2.6.32.46/net/decnet/sysctl_net_decnet.c 2011-04-17 15:56:46.000000000 -0400
74043@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
74044
74045 if (len > *lenp) len = *lenp;
74046
74047- if (copy_to_user(buffer, addr, len))
74048+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
74049 return -EFAULT;
74050
74051 *lenp = len;
74052@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table
74053
74054 if (len > *lenp) len = *lenp;
74055
74056- if (copy_to_user(buffer, devname, len))
74057+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
74058 return -EFAULT;
74059
74060 *lenp = len;
74061diff -urNp linux-2.6.32.46/net/econet/Kconfig linux-2.6.32.46/net/econet/Kconfig
74062--- linux-2.6.32.46/net/econet/Kconfig 2011-03-27 14:31:47.000000000 -0400
74063+++ linux-2.6.32.46/net/econet/Kconfig 2011-04-17 15:56:46.000000000 -0400
74064@@ -4,7 +4,7 @@
74065
74066 config ECONET
74067 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
74068- depends on EXPERIMENTAL && INET
74069+ depends on EXPERIMENTAL && INET && BROKEN
74070 ---help---
74071 Econet is a fairly old and slow networking protocol mainly used by
74072 Acorn computers to access file and print servers. It uses native
74073diff -urNp linux-2.6.32.46/net/ieee802154/dgram.c linux-2.6.32.46/net/ieee802154/dgram.c
74074--- linux-2.6.32.46/net/ieee802154/dgram.c 2011-03-27 14:31:47.000000000 -0400
74075+++ linux-2.6.32.46/net/ieee802154/dgram.c 2011-05-04 17:56:28.000000000 -0400
74076@@ -318,7 +318,7 @@ out:
74077 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
74078 {
74079 if (sock_queue_rcv_skb(sk, skb) < 0) {
74080- atomic_inc(&sk->sk_drops);
74081+ atomic_inc_unchecked(&sk->sk_drops);
74082 kfree_skb(skb);
74083 return NET_RX_DROP;
74084 }
74085diff -urNp linux-2.6.32.46/net/ieee802154/raw.c linux-2.6.32.46/net/ieee802154/raw.c
74086--- linux-2.6.32.46/net/ieee802154/raw.c 2011-03-27 14:31:47.000000000 -0400
74087+++ linux-2.6.32.46/net/ieee802154/raw.c 2011-05-04 17:56:28.000000000 -0400
74088@@ -206,7 +206,7 @@ out:
74089 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
74090 {
74091 if (sock_queue_rcv_skb(sk, skb) < 0) {
74092- atomic_inc(&sk->sk_drops);
74093+ atomic_inc_unchecked(&sk->sk_drops);
74094 kfree_skb(skb);
74095 return NET_RX_DROP;
74096 }
74097diff -urNp linux-2.6.32.46/net/ipv4/inet_diag.c linux-2.6.32.46/net/ipv4/inet_diag.c
74098--- linux-2.6.32.46/net/ipv4/inet_diag.c 2011-07-13 17:23:04.000000000 -0400
74099+++ linux-2.6.32.46/net/ipv4/inet_diag.c 2011-06-20 19:31:13.000000000 -0400
74100@@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct soc
74101 r->idiag_retrans = 0;
74102
74103 r->id.idiag_if = sk->sk_bound_dev_if;
74104+#ifdef CONFIG_GRKERNSEC_HIDESYM
74105+ r->id.idiag_cookie[0] = 0;
74106+ r->id.idiag_cookie[1] = 0;
74107+#else
74108 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
74109 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
74110+#endif
74111
74112 r->id.idiag_sport = inet->sport;
74113 r->id.idiag_dport = inet->dport;
74114@@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct in
74115 r->idiag_family = tw->tw_family;
74116 r->idiag_retrans = 0;
74117 r->id.idiag_if = tw->tw_bound_dev_if;
74118+
74119+#ifdef CONFIG_GRKERNSEC_HIDESYM
74120+ r->id.idiag_cookie[0] = 0;
74121+ r->id.idiag_cookie[1] = 0;
74122+#else
74123 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
74124 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
74125+#endif
74126+
74127 r->id.idiag_sport = tw->tw_sport;
74128 r->id.idiag_dport = tw->tw_dport;
74129 r->id.idiag_src[0] = tw->tw_rcv_saddr;
74130@@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk
74131 if (sk == NULL)
74132 goto unlock;
74133
74134+#ifndef CONFIG_GRKERNSEC_HIDESYM
74135 err = -ESTALE;
74136 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
74137 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
74138 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
74139 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
74140 goto out;
74141+#endif
74142
74143 err = -ENOMEM;
74144 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
74145@@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_
74146 r->idiag_retrans = req->retrans;
74147
74148 r->id.idiag_if = sk->sk_bound_dev_if;
74149+
74150+#ifdef CONFIG_GRKERNSEC_HIDESYM
74151+ r->id.idiag_cookie[0] = 0;
74152+ r->id.idiag_cookie[1] = 0;
74153+#else
74154 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
74155 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
74156+#endif
74157
74158 tmo = req->expires - jiffies;
74159 if (tmo < 0)
74160diff -urNp linux-2.6.32.46/net/ipv4/inet_hashtables.c linux-2.6.32.46/net/ipv4/inet_hashtables.c
74161--- linux-2.6.32.46/net/ipv4/inet_hashtables.c 2011-08-16 20:37:25.000000000 -0400
74162+++ linux-2.6.32.46/net/ipv4/inet_hashtables.c 2011-08-16 20:42:30.000000000 -0400
74163@@ -18,12 +18,15 @@
74164 #include <linux/sched.h>
74165 #include <linux/slab.h>
74166 #include <linux/wait.h>
74167+#include <linux/security.h>
74168
74169 #include <net/inet_connection_sock.h>
74170 #include <net/inet_hashtables.h>
74171 #include <net/secure_seq.h>
74172 #include <net/ip.h>
74173
74174+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
74175+
74176 /*
74177 * Allocate and initialize a new local port bind bucket.
74178 * The bindhash mutex for snum's hash chain must be held here.
74179@@ -491,6 +494,8 @@ ok:
74180 }
74181 spin_unlock(&head->lock);
74182
74183+ gr_update_task_in_ip_table(current, inet_sk(sk));
74184+
74185 if (tw) {
74186 inet_twsk_deschedule(tw, death_row);
74187 inet_twsk_put(tw);
74188diff -urNp linux-2.6.32.46/net/ipv4/inetpeer.c linux-2.6.32.46/net/ipv4/inetpeer.c
74189--- linux-2.6.32.46/net/ipv4/inetpeer.c 2011-08-16 20:37:25.000000000 -0400
74190+++ linux-2.6.32.46/net/ipv4/inetpeer.c 2011-08-07 19:48:09.000000000 -0400
74191@@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 da
74192 struct inet_peer *p, *n;
74193 struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
74194
74195+ pax_track_stack();
74196+
74197 /* Look up for the address quickly. */
74198 read_lock_bh(&peer_pool_lock);
74199 p = lookup(daddr, NULL);
74200@@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 da
74201 return NULL;
74202 n->v4daddr = daddr;
74203 atomic_set(&n->refcnt, 1);
74204- atomic_set(&n->rid, 0);
74205+ atomic_set_unchecked(&n->rid, 0);
74206 n->ip_id_count = secure_ip_id(daddr);
74207 n->tcp_ts_stamp = 0;
74208
74209diff -urNp linux-2.6.32.46/net/ipv4/ip_fragment.c linux-2.6.32.46/net/ipv4/ip_fragment.c
74210--- linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400
74211+++ linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400
74212@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct
74213 return 0;
74214
74215 start = qp->rid;
74216- end = atomic_inc_return(&peer->rid);
74217+ end = atomic_inc_return_unchecked(&peer->rid);
74218 qp->rid = end;
74219
74220 rc = qp->q.fragments && (end - start) > max;
74221diff -urNp linux-2.6.32.46/net/ipv4/ip_sockglue.c linux-2.6.32.46/net/ipv4/ip_sockglue.c
74222--- linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400
74223+++ linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-05-16 21:46:57.000000000 -0400
74224@@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock
74225 int val;
74226 int len;
74227
74228+ pax_track_stack();
74229+
74230 if (level != SOL_IP)
74231 return -EOPNOTSUPP;
74232
74233diff -urNp linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c
74234--- linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400
74235+++ linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400
74236@@ -934,6 +934,7 @@ static int get_info(struct net *net, voi
74237 private = &tmp;
74238 }
74239 #endif
74240+ memset(&info, 0, sizeof(info));
74241 info.valid_hooks = t->valid_hooks;
74242 memcpy(info.hook_entry, private->hook_entry,
74243 sizeof(info.hook_entry));
74244diff -urNp linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c
74245--- linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c 2011-03-27 14:31:47.000000000 -0400
74246+++ linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c 2011-08-21 18:42:53.000000000 -0400
74247@@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
74248
74249 if (v->data_len < sizeof(*user_iph))
74250 return 0;
74251+ if (v->data_len > 65535)
74252+ return -EMSGSIZE;
74253+
74254 diff = v->data_len - e->skb->len;
74255 if (diff < 0) {
74256 if (pskb_trim(e->skb, v->data_len))
74257@@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
74258 static inline void
74259 __ipq_rcv_skb(struct sk_buff *skb)
74260 {
74261- int status, type, pid, flags, nlmsglen, skblen;
74262+ int status, type, pid, flags;
74263+ unsigned int nlmsglen, skblen;
74264 struct nlmsghdr *nlh;
74265
74266 skblen = skb->len;
74267diff -urNp linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c
74268--- linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:00:52.000000000 -0400
74269+++ linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:04:18.000000000 -0400
74270@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, voi
74271 private = &tmp;
74272 }
74273 #endif
74274+ memset(&info, 0, sizeof(info));
74275 info.valid_hooks = t->valid_hooks;
74276 memcpy(info.hook_entry, private->hook_entry,
74277 sizeof(info.hook_entry));
74278diff -urNp linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c
74279--- linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-03-27 14:31:47.000000000 -0400
74280+++ linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-04-17 15:56:46.000000000 -0400
74281@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
74282
74283 *len = 0;
74284
74285- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
74286+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
74287 if (*octets == NULL) {
74288 if (net_ratelimit())
74289 printk("OOM in bsalg (%d)\n", __LINE__);
74290diff -urNp linux-2.6.32.46/net/ipv4/raw.c linux-2.6.32.46/net/ipv4/raw.c
74291--- linux-2.6.32.46/net/ipv4/raw.c 2011-03-27 14:31:47.000000000 -0400
74292+++ linux-2.6.32.46/net/ipv4/raw.c 2011-08-14 11:46:51.000000000 -0400
74293@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk,
74294 /* Charge it to the socket. */
74295
74296 if (sock_queue_rcv_skb(sk, skb) < 0) {
74297- atomic_inc(&sk->sk_drops);
74298+ atomic_inc_unchecked(&sk->sk_drops);
74299 kfree_skb(skb);
74300 return NET_RX_DROP;
74301 }
74302@@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk,
74303 int raw_rcv(struct sock *sk, struct sk_buff *skb)
74304 {
74305 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
74306- atomic_inc(&sk->sk_drops);
74307+ atomic_inc_unchecked(&sk->sk_drops);
74308 kfree_skb(skb);
74309 return NET_RX_DROP;
74310 }
74311@@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
74312
74313 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
74314 {
74315+ struct icmp_filter filter;
74316+
74317+ if (optlen < 0)
74318+ return -EINVAL;
74319 if (optlen > sizeof(struct icmp_filter))
74320 optlen = sizeof(struct icmp_filter);
74321- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
74322+ if (copy_from_user(&filter, optval, optlen))
74323 return -EFAULT;
74324+ raw_sk(sk)->filter = filter;
74325+
74326 return 0;
74327 }
74328
74329 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
74330 {
74331 int len, ret = -EFAULT;
74332+ struct icmp_filter filter;
74333
74334 if (get_user(len, optlen))
74335 goto out;
74336@@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock
74337 if (len > sizeof(struct icmp_filter))
74338 len = sizeof(struct icmp_filter);
74339 ret = -EFAULT;
74340- if (put_user(len, optlen) ||
74341- copy_to_user(optval, &raw_sk(sk)->filter, len))
74342+ filter = raw_sk(sk)->filter;
74343+ if (put_user(len, optlen) || len > sizeof filter ||
74344+ copy_to_user(optval, &filter, len))
74345 goto out;
74346 ret = 0;
74347 out: return ret;
74348@@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq
74349 sk_wmem_alloc_get(sp),
74350 sk_rmem_alloc_get(sp),
74351 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
74352- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
74353+ atomic_read(&sp->sk_refcnt),
74354+#ifdef CONFIG_GRKERNSEC_HIDESYM
74355+ NULL,
74356+#else
74357+ sp,
74358+#endif
74359+ atomic_read_unchecked(&sp->sk_drops));
74360 }
74361
74362 static int raw_seq_show(struct seq_file *seq, void *v)
74363diff -urNp linux-2.6.32.46/net/ipv4/route.c linux-2.6.32.46/net/ipv4/route.c
74364--- linux-2.6.32.46/net/ipv4/route.c 2011-08-16 20:37:25.000000000 -0400
74365+++ linux-2.6.32.46/net/ipv4/route.c 2011-08-07 19:48:09.000000000 -0400
74366@@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be3
74367
74368 static inline int rt_genid(struct net *net)
74369 {
74370- return atomic_read(&net->ipv4.rt_genid);
74371+ return atomic_read_unchecked(&net->ipv4.rt_genid);
74372 }
74373
74374 #ifdef CONFIG_PROC_FS
74375@@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct n
74376 unsigned char shuffle;
74377
74378 get_random_bytes(&shuffle, sizeof(shuffle));
74379- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
74380+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
74381 }
74382
74383 /*
74384@@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_oper
74385
74386 static __net_init int rt_secret_timer_init(struct net *net)
74387 {
74388- atomic_set(&net->ipv4.rt_genid,
74389+ atomic_set_unchecked(&net->ipv4.rt_genid,
74390 (int) ((num_physpages ^ (num_physpages>>8)) ^
74391 (jiffies ^ (jiffies >> 7))));
74392
74393diff -urNp linux-2.6.32.46/net/ipv4/tcp.c linux-2.6.32.46/net/ipv4/tcp.c
74394--- linux-2.6.32.46/net/ipv4/tcp.c 2011-03-27 14:31:47.000000000 -0400
74395+++ linux-2.6.32.46/net/ipv4/tcp.c 2011-05-16 21:46:57.000000000 -0400
74396@@ -2085,6 +2085,8 @@ static int do_tcp_setsockopt(struct sock
74397 int val;
74398 int err = 0;
74399
74400+ pax_track_stack();
74401+
74402 /* This is a string value all the others are int's */
74403 if (optname == TCP_CONGESTION) {
74404 char name[TCP_CA_NAME_MAX];
74405@@ -2355,6 +2357,8 @@ static int do_tcp_getsockopt(struct sock
74406 struct tcp_sock *tp = tcp_sk(sk);
74407 int val, len;
74408
74409+ pax_track_stack();
74410+
74411 if (get_user(len, optlen))
74412 return -EFAULT;
74413
74414diff -urNp linux-2.6.32.46/net/ipv4/tcp_ipv4.c linux-2.6.32.46/net/ipv4/tcp_ipv4.c
74415--- linux-2.6.32.46/net/ipv4/tcp_ipv4.c 2011-08-16 20:37:25.000000000 -0400
74416+++ linux-2.6.32.46/net/ipv4/tcp_ipv4.c 2011-08-23 21:22:32.000000000 -0400
74417@@ -85,6 +85,9 @@
74418 int sysctl_tcp_tw_reuse __read_mostly;
74419 int sysctl_tcp_low_latency __read_mostly;
74420
74421+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74422+extern int grsec_enable_blackhole;
74423+#endif
74424
74425 #ifdef CONFIG_TCP_MD5SIG
74426 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
74427@@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
74428 return 0;
74429
74430 reset:
74431+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74432+ if (!grsec_enable_blackhole)
74433+#endif
74434 tcp_v4_send_reset(rsk, skb);
74435 discard:
74436 kfree_skb(skb);
74437@@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
74438 TCP_SKB_CB(skb)->sacked = 0;
74439
74440 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
74441- if (!sk)
74442+ if (!sk) {
74443+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74444+ ret = 1;
74445+#endif
74446 goto no_tcp_socket;
74447+ }
74448
74449 process:
74450- if (sk->sk_state == TCP_TIME_WAIT)
74451+ if (sk->sk_state == TCP_TIME_WAIT) {
74452+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74453+ ret = 2;
74454+#endif
74455 goto do_time_wait;
74456+ }
74457
74458 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
74459 goto discard_and_relse;
74460@@ -1651,6 +1665,10 @@ no_tcp_socket:
74461 bad_packet:
74462 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
74463 } else {
74464+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74465+ if (!grsec_enable_blackhole || (ret == 1 &&
74466+ (skb->dev->flags & IFF_LOOPBACK)))
74467+#endif
74468 tcp_v4_send_reset(NULL, skb);
74469 }
74470
74471@@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk
74472 0, /* non standard timer */
74473 0, /* open_requests have no inode */
74474 atomic_read(&sk->sk_refcnt),
74475+#ifdef CONFIG_GRKERNSEC_HIDESYM
74476+ NULL,
74477+#else
74478 req,
74479+#endif
74480 len);
74481 }
74482
74483@@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *s
74484 sock_i_uid(sk),
74485 icsk->icsk_probes_out,
74486 sock_i_ino(sk),
74487- atomic_read(&sk->sk_refcnt), sk,
74488+ atomic_read(&sk->sk_refcnt),
74489+#ifdef CONFIG_GRKERNSEC_HIDESYM
74490+ NULL,
74491+#else
74492+ sk,
74493+#endif
74494 jiffies_to_clock_t(icsk->icsk_rto),
74495 jiffies_to_clock_t(icsk->icsk_ack.ato),
74496 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
74497@@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct in
74498 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
74499 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
74500 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
74501- atomic_read(&tw->tw_refcnt), tw, len);
74502+ atomic_read(&tw->tw_refcnt),
74503+#ifdef CONFIG_GRKERNSEC_HIDESYM
74504+ NULL,
74505+#else
74506+ tw,
74507+#endif
74508+ len);
74509 }
74510
74511 #define TMPSZ 150
74512diff -urNp linux-2.6.32.46/net/ipv4/tcp_minisocks.c linux-2.6.32.46/net/ipv4/tcp_minisocks.c
74513--- linux-2.6.32.46/net/ipv4/tcp_minisocks.c 2011-03-27 14:31:47.000000000 -0400
74514+++ linux-2.6.32.46/net/ipv4/tcp_minisocks.c 2011-04-17 15:56:46.000000000 -0400
74515@@ -26,6 +26,10 @@
74516 #include <net/inet_common.h>
74517 #include <net/xfrm.h>
74518
74519+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74520+extern int grsec_enable_blackhole;
74521+#endif
74522+
74523 #ifdef CONFIG_SYSCTL
74524 #define SYNC_INIT 0 /* let the user enable it */
74525 #else
74526@@ -672,6 +676,10 @@ listen_overflow:
74527
74528 embryonic_reset:
74529 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
74530+
74531+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74532+ if (!grsec_enable_blackhole)
74533+#endif
74534 if (!(flg & TCP_FLAG_RST))
74535 req->rsk_ops->send_reset(sk, skb);
74536
74537diff -urNp linux-2.6.32.46/net/ipv4/tcp_output.c linux-2.6.32.46/net/ipv4/tcp_output.c
74538--- linux-2.6.32.46/net/ipv4/tcp_output.c 2011-03-27 14:31:47.000000000 -0400
74539+++ linux-2.6.32.46/net/ipv4/tcp_output.c 2011-05-16 21:46:57.000000000 -0400
74540@@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct s
74541 __u8 *md5_hash_location;
74542 int mss;
74543
74544+ pax_track_stack();
74545+
74546 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
74547 if (skb == NULL)
74548 return NULL;
74549diff -urNp linux-2.6.32.46/net/ipv4/tcp_probe.c linux-2.6.32.46/net/ipv4/tcp_probe.c
74550--- linux-2.6.32.46/net/ipv4/tcp_probe.c 2011-03-27 14:31:47.000000000 -0400
74551+++ linux-2.6.32.46/net/ipv4/tcp_probe.c 2011-04-17 15:56:46.000000000 -0400
74552@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
74553 if (cnt + width >= len)
74554 break;
74555
74556- if (copy_to_user(buf + cnt, tbuf, width))
74557+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
74558 return -EFAULT;
74559 cnt += width;
74560 }
74561diff -urNp linux-2.6.32.46/net/ipv4/tcp_timer.c linux-2.6.32.46/net/ipv4/tcp_timer.c
74562--- linux-2.6.32.46/net/ipv4/tcp_timer.c 2011-03-27 14:31:47.000000000 -0400
74563+++ linux-2.6.32.46/net/ipv4/tcp_timer.c 2011-04-17 15:56:46.000000000 -0400
74564@@ -21,6 +21,10 @@
74565 #include <linux/module.h>
74566 #include <net/tcp.h>
74567
74568+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74569+extern int grsec_lastack_retries;
74570+#endif
74571+
74572 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
74573 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
74574 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
74575@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
74576 }
74577 }
74578
74579+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74580+ if ((sk->sk_state == TCP_LAST_ACK) &&
74581+ (grsec_lastack_retries > 0) &&
74582+ (grsec_lastack_retries < retry_until))
74583+ retry_until = grsec_lastack_retries;
74584+#endif
74585+
74586 if (retransmits_timed_out(sk, retry_until)) {
74587 /* Has it gone just too far? */
74588 tcp_write_err(sk);
74589diff -urNp linux-2.6.32.46/net/ipv4/udp.c linux-2.6.32.46/net/ipv4/udp.c
74590--- linux-2.6.32.46/net/ipv4/udp.c 2011-07-13 17:23:04.000000000 -0400
74591+++ linux-2.6.32.46/net/ipv4/udp.c 2011-08-23 21:22:32.000000000 -0400
74592@@ -86,6 +86,7 @@
74593 #include <linux/types.h>
74594 #include <linux/fcntl.h>
74595 #include <linux/module.h>
74596+#include <linux/security.h>
74597 #include <linux/socket.h>
74598 #include <linux/sockios.h>
74599 #include <linux/igmp.h>
74600@@ -106,6 +107,10 @@
74601 #include <net/xfrm.h>
74602 #include "udp_impl.h"
74603
74604+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74605+extern int grsec_enable_blackhole;
74606+#endif
74607+
74608 struct udp_table udp_table;
74609 EXPORT_SYMBOL(udp_table);
74610
74611@@ -371,6 +376,9 @@ found:
74612 return s;
74613 }
74614
74615+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
74616+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
74617+
74618 /*
74619 * This routine is called by the ICMP module when it gets some
74620 * sort of error condition. If err < 0 then the socket should
74621@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
74622 dport = usin->sin_port;
74623 if (dport == 0)
74624 return -EINVAL;
74625+
74626+ err = gr_search_udp_sendmsg(sk, usin);
74627+ if (err)
74628+ return err;
74629 } else {
74630 if (sk->sk_state != TCP_ESTABLISHED)
74631 return -EDESTADDRREQ;
74632+
74633+ err = gr_search_udp_sendmsg(sk, NULL);
74634+ if (err)
74635+ return err;
74636+
74637 daddr = inet->daddr;
74638 dport = inet->dport;
74639 /* Open fast path for connected socket.
74640@@ -945,6 +962,10 @@ try_again:
74641 if (!skb)
74642 goto out;
74643
74644+ err = gr_search_udp_recvmsg(sk, skb);
74645+ if (err)
74646+ goto out_free;
74647+
74648 ulen = skb->len - sizeof(struct udphdr);
74649 copied = len;
74650 if (copied > ulen)
74651@@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct so
74652 if (rc == -ENOMEM) {
74653 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
74654 is_udplite);
74655- atomic_inc(&sk->sk_drops);
74656+ atomic_inc_unchecked(&sk->sk_drops);
74657 }
74658 goto drop;
74659 }
74660@@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
74661 goto csum_error;
74662
74663 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
74664+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74665+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
74666+#endif
74667 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
74668
74669 /*
74670@@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock
74671 sk_wmem_alloc_get(sp),
74672 sk_rmem_alloc_get(sp),
74673 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
74674- atomic_read(&sp->sk_refcnt), sp,
74675- atomic_read(&sp->sk_drops), len);
74676+ atomic_read(&sp->sk_refcnt),
74677+#ifdef CONFIG_GRKERNSEC_HIDESYM
74678+ NULL,
74679+#else
74680+ sp,
74681+#endif
74682+ atomic_read_unchecked(&sp->sk_drops), len);
74683 }
74684
74685 int udp4_seq_show(struct seq_file *seq, void *v)
74686diff -urNp linux-2.6.32.46/net/ipv6/inet6_connection_sock.c linux-2.6.32.46/net/ipv6/inet6_connection_sock.c
74687--- linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400
74688+++ linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400
74689@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *
74690 #ifdef CONFIG_XFRM
74691 {
74692 struct rt6_info *rt = (struct rt6_info *)dst;
74693- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
74694+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
74695 }
74696 #endif
74697 }
74698@@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(
74699 #ifdef CONFIG_XFRM
74700 if (dst) {
74701 struct rt6_info *rt = (struct rt6_info *)dst;
74702- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
74703+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
74704 sk->sk_dst_cache = NULL;
74705 dst_release(dst);
74706 dst = NULL;
74707diff -urNp linux-2.6.32.46/net/ipv6/inet6_hashtables.c linux-2.6.32.46/net/ipv6/inet6_hashtables.c
74708--- linux-2.6.32.46/net/ipv6/inet6_hashtables.c 2011-08-16 20:37:25.000000000 -0400
74709+++ linux-2.6.32.46/net/ipv6/inet6_hashtables.c 2011-08-07 19:48:09.000000000 -0400
74710@@ -119,7 +119,7 @@ out:
74711 }
74712 EXPORT_SYMBOL(__inet6_lookup_established);
74713
74714-static int inline compute_score(struct sock *sk, struct net *net,
74715+static inline int compute_score(struct sock *sk, struct net *net,
74716 const unsigned short hnum,
74717 const struct in6_addr *daddr,
74718 const int dif)
74719diff -urNp linux-2.6.32.46/net/ipv6/ip6_tunnel.c linux-2.6.32.46/net/ipv6/ip6_tunnel.c
74720--- linux-2.6.32.46/net/ipv6/ip6_tunnel.c 2011-08-09 18:35:30.000000000 -0400
74721+++ linux-2.6.32.46/net/ipv6/ip6_tunnel.c 2011-08-24 18:52:25.000000000 -0400
74722@@ -1466,7 +1466,7 @@ static int __init ip6_tunnel_init(void)
74723 {
74724 int err;
74725
74726- err = register_pernet_device(&ip6_tnl_net_ops);
74727+ err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
74728 if (err < 0)
74729 goto out_pernet;
74730
74731@@ -1487,7 +1487,7 @@ static int __init ip6_tunnel_init(void)
74732 out_ip6ip6:
74733 xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
74734 out_ip4ip6:
74735- unregister_pernet_device(&ip6_tnl_net_ops);
74736+ unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
74737 out_pernet:
74738 return err;
74739 }
74740diff -urNp linux-2.6.32.46/net/ipv6/ipv6_sockglue.c linux-2.6.32.46/net/ipv6/ipv6_sockglue.c
74741--- linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400
74742+++ linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-05-16 21:46:57.000000000 -0400
74743@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc
74744 int val, valbool;
74745 int retv = -ENOPROTOOPT;
74746
74747+ pax_track_stack();
74748+
74749 if (optval == NULL)
74750 val=0;
74751 else {
74752@@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct soc
74753 int len;
74754 int val;
74755
74756+ pax_track_stack();
74757+
74758 if (ip6_mroute_opt(optname))
74759 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
74760
74761diff -urNp linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c
74762--- linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-03-27 14:31:47.000000000 -0400
74763+++ linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-08-21 18:43:32.000000000 -0400
74764@@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, st
74765
74766 if (v->data_len < sizeof(*user_iph))
74767 return 0;
74768+ if (v->data_len > 65535)
74769+ return -EMSGSIZE;
74770+
74771 diff = v->data_len - e->skb->len;
74772 if (diff < 0) {
74773 if (pskb_trim(e->skb, v->data_len))
74774@@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
74775 static inline void
74776 __ipq_rcv_skb(struct sk_buff *skb)
74777 {
74778- int status, type, pid, flags, nlmsglen, skblen;
74779+ int status, type, pid, flags;
74780+ unsigned int nlmsglen, skblen;
74781 struct nlmsghdr *nlh;
74782
74783 skblen = skb->len;
74784diff -urNp linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c
74785--- linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:00:52.000000000 -0400
74786+++ linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:04:18.000000000 -0400
74787@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, voi
74788 private = &tmp;
74789 }
74790 #endif
74791+ memset(&info, 0, sizeof(info));
74792 info.valid_hooks = t->valid_hooks;
74793 memcpy(info.hook_entry, private->hook_entry,
74794 sizeof(info.hook_entry));
74795diff -urNp linux-2.6.32.46/net/ipv6/raw.c linux-2.6.32.46/net/ipv6/raw.c
74796--- linux-2.6.32.46/net/ipv6/raw.c 2011-03-27 14:31:47.000000000 -0400
74797+++ linux-2.6.32.46/net/ipv6/raw.c 2011-08-14 11:48:20.000000000 -0400
74798@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct s
74799 {
74800 if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
74801 skb_checksum_complete(skb)) {
74802- atomic_inc(&sk->sk_drops);
74803+ atomic_inc_unchecked(&sk->sk_drops);
74804 kfree_skb(skb);
74805 return NET_RX_DROP;
74806 }
74807
74808 /* Charge it to the socket. */
74809 if (sock_queue_rcv_skb(sk,skb)<0) {
74810- atomic_inc(&sk->sk_drops);
74811+ atomic_inc_unchecked(&sk->sk_drops);
74812 kfree_skb(skb);
74813 return NET_RX_DROP;
74814 }
74815@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
74816 struct raw6_sock *rp = raw6_sk(sk);
74817
74818 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
74819- atomic_inc(&sk->sk_drops);
74820+ atomic_inc_unchecked(&sk->sk_drops);
74821 kfree_skb(skb);
74822 return NET_RX_DROP;
74823 }
74824@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
74825
74826 if (inet->hdrincl) {
74827 if (skb_checksum_complete(skb)) {
74828- atomic_inc(&sk->sk_drops);
74829+ atomic_inc_unchecked(&sk->sk_drops);
74830 kfree_skb(skb);
74831 return NET_RX_DROP;
74832 }
74833@@ -518,7 +518,7 @@ csum_copy_err:
74834 as some normal condition.
74835 */
74836 err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
74837- atomic_inc(&sk->sk_drops);
74838+ atomic_inc_unchecked(&sk->sk_drops);
74839 goto out;
74840 }
74841
74842@@ -600,7 +600,7 @@ out:
74843 return err;
74844 }
74845
74846-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
74847+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
74848 struct flowi *fl, struct rt6_info *rt,
74849 unsigned int flags)
74850 {
74851@@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *i
74852 u16 proto;
74853 int err;
74854
74855+ pax_track_stack();
74856+
74857 /* Rough check on arithmetic overflow,
74858 better check is made in ip6_append_data().
74859 */
74860@@ -916,12 +918,17 @@ do_confirm:
74861 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
74862 char __user *optval, int optlen)
74863 {
74864+ struct icmp6_filter filter;
74865+
74866 switch (optname) {
74867 case ICMPV6_FILTER:
74868+ if (optlen < 0)
74869+ return -EINVAL;
74870 if (optlen > sizeof(struct icmp6_filter))
74871 optlen = sizeof(struct icmp6_filter);
74872- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
74873+ if (copy_from_user(&filter, optval, optlen))
74874 return -EFAULT;
74875+ raw6_sk(sk)->filter = filter;
74876 return 0;
74877 default:
74878 return -ENOPROTOOPT;
74879@@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct so
74880 char __user *optval, int __user *optlen)
74881 {
74882 int len;
74883+ struct icmp6_filter filter;
74884
74885 switch (optname) {
74886 case ICMPV6_FILTER:
74887@@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct so
74888 len = sizeof(struct icmp6_filter);
74889 if (put_user(len, optlen))
74890 return -EFAULT;
74891- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
74892+ filter = raw6_sk(sk)->filter;
74893+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
74894 return -EFAULT;
74895 return 0;
74896 default:
74897@@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct se
74898 0, 0L, 0,
74899 sock_i_uid(sp), 0,
74900 sock_i_ino(sp),
74901- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
74902+ atomic_read(&sp->sk_refcnt),
74903+#ifdef CONFIG_GRKERNSEC_HIDESYM
74904+ NULL,
74905+#else
74906+ sp,
74907+#endif
74908+ atomic_read_unchecked(&sp->sk_drops));
74909 }
74910
74911 static int raw6_seq_show(struct seq_file *seq, void *v)
74912diff -urNp linux-2.6.32.46/net/ipv6/tcp_ipv6.c linux-2.6.32.46/net/ipv6/tcp_ipv6.c
74913--- linux-2.6.32.46/net/ipv6/tcp_ipv6.c 2011-08-16 20:37:25.000000000 -0400
74914+++ linux-2.6.32.46/net/ipv6/tcp_ipv6.c 2011-08-07 19:48:09.000000000 -0400
74915@@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
74916 }
74917 #endif
74918
74919+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74920+extern int grsec_enable_blackhole;
74921+#endif
74922+
74923 static void tcp_v6_hash(struct sock *sk)
74924 {
74925 if (sk->sk_state != TCP_CLOSE) {
74926@@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk
74927 return 0;
74928
74929 reset:
74930+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74931+ if (!grsec_enable_blackhole)
74932+#endif
74933 tcp_v6_send_reset(sk, skb);
74934 discard:
74935 if (opt_skb)
74936@@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
74937 TCP_SKB_CB(skb)->sacked = 0;
74938
74939 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
74940- if (!sk)
74941+ if (!sk) {
74942+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74943+ ret = 1;
74944+#endif
74945 goto no_tcp_socket;
74946+ }
74947
74948 process:
74949- if (sk->sk_state == TCP_TIME_WAIT)
74950+ if (sk->sk_state == TCP_TIME_WAIT) {
74951+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74952+ ret = 2;
74953+#endif
74954 goto do_time_wait;
74955+ }
74956
74957 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
74958 goto discard_and_relse;
74959@@ -1701,6 +1716,10 @@ no_tcp_socket:
74960 bad_packet:
74961 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
74962 } else {
74963+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74964+ if (!grsec_enable_blackhole || (ret == 1 &&
74965+ (skb->dev->flags & IFF_LOOPBACK)))
74966+#endif
74967 tcp_v6_send_reset(NULL, skb);
74968 }
74969
74970@@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file
74971 uid,
74972 0, /* non standard timer */
74973 0, /* open_requests have no inode */
74974- 0, req);
74975+ 0,
74976+#ifdef CONFIG_GRKERNSEC_HIDESYM
74977+ NULL
74978+#else
74979+ req
74980+#endif
74981+ );
74982 }
74983
74984 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
74985@@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_fil
74986 sock_i_uid(sp),
74987 icsk->icsk_probes_out,
74988 sock_i_ino(sp),
74989- atomic_read(&sp->sk_refcnt), sp,
74990+ atomic_read(&sp->sk_refcnt),
74991+#ifdef CONFIG_GRKERNSEC_HIDESYM
74992+ NULL,
74993+#else
74994+ sp,
74995+#endif
74996 jiffies_to_clock_t(icsk->icsk_rto),
74997 jiffies_to_clock_t(icsk->icsk_ack.ato),
74998 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
74999@@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct se
75000 dest->s6_addr32[2], dest->s6_addr32[3], destp,
75001 tw->tw_substate, 0, 0,
75002 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
75003- atomic_read(&tw->tw_refcnt), tw);
75004+ atomic_read(&tw->tw_refcnt),
75005+#ifdef CONFIG_GRKERNSEC_HIDESYM
75006+ NULL
75007+#else
75008+ tw
75009+#endif
75010+ );
75011 }
75012
75013 static int tcp6_seq_show(struct seq_file *seq, void *v)
75014diff -urNp linux-2.6.32.46/net/ipv6/udp.c linux-2.6.32.46/net/ipv6/udp.c
75015--- linux-2.6.32.46/net/ipv6/udp.c 2011-07-13 17:23:04.000000000 -0400
75016+++ linux-2.6.32.46/net/ipv6/udp.c 2011-07-13 17:23:27.000000000 -0400
75017@@ -49,6 +49,10 @@
75018 #include <linux/seq_file.h>
75019 #include "udp_impl.h"
75020
75021+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75022+extern int grsec_enable_blackhole;
75023+#endif
75024+
75025 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
75026 {
75027 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
75028@@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
75029 if (rc == -ENOMEM) {
75030 UDP6_INC_STATS_BH(sock_net(sk),
75031 UDP_MIB_RCVBUFERRORS, is_udplite);
75032- atomic_inc(&sk->sk_drops);
75033+ atomic_inc_unchecked(&sk->sk_drops);
75034 }
75035 goto drop;
75036 }
75037@@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
75038 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
75039 proto == IPPROTO_UDPLITE);
75040
75041+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
75042+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
75043+#endif
75044 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
75045
75046 kfree_skb(skb);
75047@@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct se
75048 0, 0L, 0,
75049 sock_i_uid(sp), 0,
75050 sock_i_ino(sp),
75051- atomic_read(&sp->sk_refcnt), sp,
75052- atomic_read(&sp->sk_drops));
75053+ atomic_read(&sp->sk_refcnt),
75054+#ifdef CONFIG_GRKERNSEC_HIDESYM
75055+ NULL,
75056+#else
75057+ sp,
75058+#endif
75059+ atomic_read_unchecked(&sp->sk_drops));
75060 }
75061
75062 int udp6_seq_show(struct seq_file *seq, void *v)
75063diff -urNp linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c
75064--- linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c 2011-03-27 14:31:47.000000000 -0400
75065+++ linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c 2011-04-17 15:56:46.000000000 -0400
75066@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
75067 add_wait_queue(&self->open_wait, &wait);
75068
75069 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
75070- __FILE__,__LINE__, tty->driver->name, self->open_count );
75071+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
75072
75073 /* As far as I can see, we protect open_count - Jean II */
75074 spin_lock_irqsave(&self->spinlock, flags);
75075 if (!tty_hung_up_p(filp)) {
75076 extra_count = 1;
75077- self->open_count--;
75078+ local_dec(&self->open_count);
75079 }
75080 spin_unlock_irqrestore(&self->spinlock, flags);
75081- self->blocked_open++;
75082+ local_inc(&self->blocked_open);
75083
75084 while (1) {
75085 if (tty->termios->c_cflag & CBAUD) {
75086@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
75087 }
75088
75089 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
75090- __FILE__,__LINE__, tty->driver->name, self->open_count );
75091+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
75092
75093 schedule();
75094 }
75095@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
75096 if (extra_count) {
75097 /* ++ is not atomic, so this should be protected - Jean II */
75098 spin_lock_irqsave(&self->spinlock, flags);
75099- self->open_count++;
75100+ local_inc(&self->open_count);
75101 spin_unlock_irqrestore(&self->spinlock, flags);
75102 }
75103- self->blocked_open--;
75104+ local_dec(&self->blocked_open);
75105
75106 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
75107- __FILE__,__LINE__, tty->driver->name, self->open_count);
75108+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
75109
75110 if (!retval)
75111 self->flags |= ASYNC_NORMAL_ACTIVE;
75112@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
75113 }
75114 /* ++ is not atomic, so this should be protected - Jean II */
75115 spin_lock_irqsave(&self->spinlock, flags);
75116- self->open_count++;
75117+ local_inc(&self->open_count);
75118
75119 tty->driver_data = self;
75120 self->tty = tty;
75121 spin_unlock_irqrestore(&self->spinlock, flags);
75122
75123 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
75124- self->line, self->open_count);
75125+ self->line, local_read(&self->open_count));
75126
75127 /* Not really used by us, but lets do it anyway */
75128 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
75129@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
75130 return;
75131 }
75132
75133- if ((tty->count == 1) && (self->open_count != 1)) {
75134+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
75135 /*
75136 * Uh, oh. tty->count is 1, which means that the tty
75137 * structure will be freed. state->count should always
75138@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
75139 */
75140 IRDA_DEBUG(0, "%s(), bad serial port count; "
75141 "tty->count is 1, state->count is %d\n", __func__ ,
75142- self->open_count);
75143- self->open_count = 1;
75144+ local_read(&self->open_count));
75145+ local_set(&self->open_count, 1);
75146 }
75147
75148- if (--self->open_count < 0) {
75149+ if (local_dec_return(&self->open_count) < 0) {
75150 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
75151- __func__, self->line, self->open_count);
75152- self->open_count = 0;
75153+ __func__, self->line, local_read(&self->open_count));
75154+ local_set(&self->open_count, 0);
75155 }
75156- if (self->open_count) {
75157+ if (local_read(&self->open_count)) {
75158 spin_unlock_irqrestore(&self->spinlock, flags);
75159
75160 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
75161@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
75162 tty->closing = 0;
75163 self->tty = NULL;
75164
75165- if (self->blocked_open) {
75166+ if (local_read(&self->blocked_open)) {
75167 if (self->close_delay)
75168 schedule_timeout_interruptible(self->close_delay);
75169 wake_up_interruptible(&self->open_wait);
75170@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
75171 spin_lock_irqsave(&self->spinlock, flags);
75172 self->flags &= ~ASYNC_NORMAL_ACTIVE;
75173 self->tty = NULL;
75174- self->open_count = 0;
75175+ local_set(&self->open_count, 0);
75176 spin_unlock_irqrestore(&self->spinlock, flags);
75177
75178 wake_up_interruptible(&self->open_wait);
75179@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct
75180 seq_putc(m, '\n');
75181
75182 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
75183- seq_printf(m, "Open count: %d\n", self->open_count);
75184+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
75185 seq_printf(m, "Max data size: %d\n", self->max_data_size);
75186 seq_printf(m, "Max header size: %d\n", self->max_header_size);
75187
75188diff -urNp linux-2.6.32.46/net/iucv/af_iucv.c linux-2.6.32.46/net/iucv/af_iucv.c
75189--- linux-2.6.32.46/net/iucv/af_iucv.c 2011-03-27 14:31:47.000000000 -0400
75190+++ linux-2.6.32.46/net/iucv/af_iucv.c 2011-05-04 17:56:28.000000000 -0400
75191@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct soc
75192
75193 write_lock_bh(&iucv_sk_list.lock);
75194
75195- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
75196+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
75197 while (__iucv_get_sock_by_name(name)) {
75198 sprintf(name, "%08x",
75199- atomic_inc_return(&iucv_sk_list.autobind_name));
75200+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
75201 }
75202
75203 write_unlock_bh(&iucv_sk_list.lock);
75204diff -urNp linux-2.6.32.46/net/key/af_key.c linux-2.6.32.46/net/key/af_key.c
75205--- linux-2.6.32.46/net/key/af_key.c 2011-03-27 14:31:47.000000000 -0400
75206+++ linux-2.6.32.46/net/key/af_key.c 2011-05-16 21:46:57.000000000 -0400
75207@@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk
75208 struct xfrm_migrate m[XFRM_MAX_DEPTH];
75209 struct xfrm_kmaddress k;
75210
75211+ pax_track_stack();
75212+
75213 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
75214 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
75215 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
75216@@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_fil
75217 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
75218 else
75219 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
75220+#ifdef CONFIG_GRKERNSEC_HIDESYM
75221+ NULL,
75222+#else
75223 s,
75224+#endif
75225 atomic_read(&s->sk_refcnt),
75226 sk_rmem_alloc_get(s),
75227 sk_wmem_alloc_get(s),
75228diff -urNp linux-2.6.32.46/net/lapb/lapb_iface.c linux-2.6.32.46/net/lapb/lapb_iface.c
75229--- linux-2.6.32.46/net/lapb/lapb_iface.c 2011-03-27 14:31:47.000000000 -0400
75230+++ linux-2.6.32.46/net/lapb/lapb_iface.c 2011-08-05 20:33:55.000000000 -0400
75231@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev
75232 goto out;
75233
75234 lapb->dev = dev;
75235- lapb->callbacks = *callbacks;
75236+ lapb->callbacks = callbacks;
75237
75238 __lapb_insert_cb(lapb);
75239
75240@@ -379,32 +379,32 @@ int lapb_data_received(struct net_device
75241
75242 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
75243 {
75244- if (lapb->callbacks.connect_confirmation)
75245- lapb->callbacks.connect_confirmation(lapb->dev, reason);
75246+ if (lapb->callbacks->connect_confirmation)
75247+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
75248 }
75249
75250 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
75251 {
75252- if (lapb->callbacks.connect_indication)
75253- lapb->callbacks.connect_indication(lapb->dev, reason);
75254+ if (lapb->callbacks->connect_indication)
75255+ lapb->callbacks->connect_indication(lapb->dev, reason);
75256 }
75257
75258 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
75259 {
75260- if (lapb->callbacks.disconnect_confirmation)
75261- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
75262+ if (lapb->callbacks->disconnect_confirmation)
75263+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
75264 }
75265
75266 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
75267 {
75268- if (lapb->callbacks.disconnect_indication)
75269- lapb->callbacks.disconnect_indication(lapb->dev, reason);
75270+ if (lapb->callbacks->disconnect_indication)
75271+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
75272 }
75273
75274 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
75275 {
75276- if (lapb->callbacks.data_indication)
75277- return lapb->callbacks.data_indication(lapb->dev, skb);
75278+ if (lapb->callbacks->data_indication)
75279+ return lapb->callbacks->data_indication(lapb->dev, skb);
75280
75281 kfree_skb(skb);
75282 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
75283@@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *l
75284 {
75285 int used = 0;
75286
75287- if (lapb->callbacks.data_transmit) {
75288- lapb->callbacks.data_transmit(lapb->dev, skb);
75289+ if (lapb->callbacks->data_transmit) {
75290+ lapb->callbacks->data_transmit(lapb->dev, skb);
75291 used = 1;
75292 }
75293
75294diff -urNp linux-2.6.32.46/net/mac80211/cfg.c linux-2.6.32.46/net/mac80211/cfg.c
75295--- linux-2.6.32.46/net/mac80211/cfg.c 2011-03-27 14:31:47.000000000 -0400
75296+++ linux-2.6.32.46/net/mac80211/cfg.c 2011-04-17 15:56:46.000000000 -0400
75297@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(st
75298 return err;
75299 }
75300
75301-struct cfg80211_ops mac80211_config_ops = {
75302+const struct cfg80211_ops mac80211_config_ops = {
75303 .add_virtual_intf = ieee80211_add_iface,
75304 .del_virtual_intf = ieee80211_del_iface,
75305 .change_virtual_intf = ieee80211_change_iface,
75306diff -urNp linux-2.6.32.46/net/mac80211/cfg.h linux-2.6.32.46/net/mac80211/cfg.h
75307--- linux-2.6.32.46/net/mac80211/cfg.h 2011-03-27 14:31:47.000000000 -0400
75308+++ linux-2.6.32.46/net/mac80211/cfg.h 2011-04-17 15:56:46.000000000 -0400
75309@@ -4,6 +4,6 @@
75310 #ifndef __CFG_H
75311 #define __CFG_H
75312
75313-extern struct cfg80211_ops mac80211_config_ops;
75314+extern const struct cfg80211_ops mac80211_config_ops;
75315
75316 #endif /* __CFG_H */
75317diff -urNp linux-2.6.32.46/net/mac80211/debugfs_key.c linux-2.6.32.46/net/mac80211/debugfs_key.c
75318--- linux-2.6.32.46/net/mac80211/debugfs_key.c 2011-03-27 14:31:47.000000000 -0400
75319+++ linux-2.6.32.46/net/mac80211/debugfs_key.c 2011-04-17 15:56:46.000000000 -0400
75320@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file
75321 size_t count, loff_t *ppos)
75322 {
75323 struct ieee80211_key *key = file->private_data;
75324- int i, res, bufsize = 2 * key->conf.keylen + 2;
75325+ int i, bufsize = 2 * key->conf.keylen + 2;
75326 char *buf = kmalloc(bufsize, GFP_KERNEL);
75327 char *p = buf;
75328+ ssize_t res;
75329+
75330+ if (buf == NULL)
75331+ return -ENOMEM;
75332
75333 for (i = 0; i < key->conf.keylen; i++)
75334 p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
75335diff -urNp linux-2.6.32.46/net/mac80211/debugfs_sta.c linux-2.6.32.46/net/mac80211/debugfs_sta.c
75336--- linux-2.6.32.46/net/mac80211/debugfs_sta.c 2011-03-27 14:31:47.000000000 -0400
75337+++ linux-2.6.32.46/net/mac80211/debugfs_sta.c 2011-05-16 21:46:57.000000000 -0400
75338@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struc
75339 int i;
75340 struct sta_info *sta = file->private_data;
75341
75342+ pax_track_stack();
75343+
75344 spin_lock_bh(&sta->lock);
75345 p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
75346 sta->ampdu_mlme.dialog_token_allocator + 1);
75347diff -urNp linux-2.6.32.46/net/mac80211/ieee80211_i.h linux-2.6.32.46/net/mac80211/ieee80211_i.h
75348--- linux-2.6.32.46/net/mac80211/ieee80211_i.h 2011-03-27 14:31:47.000000000 -0400
75349+++ linux-2.6.32.46/net/mac80211/ieee80211_i.h 2011-04-17 15:56:46.000000000 -0400
75350@@ -25,6 +25,7 @@
75351 #include <linux/etherdevice.h>
75352 #include <net/cfg80211.h>
75353 #include <net/mac80211.h>
75354+#include <asm/local.h>
75355 #include "key.h"
75356 #include "sta_info.h"
75357
75358@@ -635,7 +636,7 @@ struct ieee80211_local {
75359 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
75360 spinlock_t queue_stop_reason_lock;
75361
75362- int open_count;
75363+ local_t open_count;
75364 int monitors, cooked_mntrs;
75365 /* number of interfaces with corresponding FIF_ flags */
75366 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
75367diff -urNp linux-2.6.32.46/net/mac80211/iface.c linux-2.6.32.46/net/mac80211/iface.c
75368--- linux-2.6.32.46/net/mac80211/iface.c 2011-03-27 14:31:47.000000000 -0400
75369+++ linux-2.6.32.46/net/mac80211/iface.c 2011-04-17 15:56:46.000000000 -0400
75370@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
75371 break;
75372 }
75373
75374- if (local->open_count == 0) {
75375+ if (local_read(&local->open_count) == 0) {
75376 res = drv_start(local);
75377 if (res)
75378 goto err_del_bss;
75379@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
75380 * Validate the MAC address for this device.
75381 */
75382 if (!is_valid_ether_addr(dev->dev_addr)) {
75383- if (!local->open_count)
75384+ if (!local_read(&local->open_count))
75385 drv_stop(local);
75386 return -EADDRNOTAVAIL;
75387 }
75388@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
75389
75390 hw_reconf_flags |= __ieee80211_recalc_idle(local);
75391
75392- local->open_count++;
75393+ local_inc(&local->open_count);
75394 if (hw_reconf_flags) {
75395 ieee80211_hw_config(local, hw_reconf_flags);
75396 /*
75397@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
75398 err_del_interface:
75399 drv_remove_interface(local, &conf);
75400 err_stop:
75401- if (!local->open_count)
75402+ if (!local_read(&local->open_count))
75403 drv_stop(local);
75404 err_del_bss:
75405 sdata->bss = NULL;
75406@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
75407 WARN_ON(!list_empty(&sdata->u.ap.vlans));
75408 }
75409
75410- local->open_count--;
75411+ local_dec(&local->open_count);
75412
75413 switch (sdata->vif.type) {
75414 case NL80211_IFTYPE_AP_VLAN:
75415@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
75416
75417 ieee80211_recalc_ps(local, -1);
75418
75419- if (local->open_count == 0) {
75420+ if (local_read(&local->open_count) == 0) {
75421 ieee80211_clear_tx_pending(local);
75422 ieee80211_stop_device(local);
75423
75424diff -urNp linux-2.6.32.46/net/mac80211/main.c linux-2.6.32.46/net/mac80211/main.c
75425--- linux-2.6.32.46/net/mac80211/main.c 2011-05-10 22:12:02.000000000 -0400
75426+++ linux-2.6.32.46/net/mac80211/main.c 2011-05-10 22:12:34.000000000 -0400
75427@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
75428 local->hw.conf.power_level = power;
75429 }
75430
75431- if (changed && local->open_count) {
75432+ if (changed && local_read(&local->open_count)) {
75433 ret = drv_config(local, changed);
75434 /*
75435 * Goal:
75436diff -urNp linux-2.6.32.46/net/mac80211/mlme.c linux-2.6.32.46/net/mac80211/mlme.c
75437--- linux-2.6.32.46/net/mac80211/mlme.c 2011-08-09 18:35:30.000000000 -0400
75438+++ linux-2.6.32.46/net/mac80211/mlme.c 2011-08-09 18:34:01.000000000 -0400
75439@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
75440 bool have_higher_than_11mbit = false, newsta = false;
75441 u16 ap_ht_cap_flags;
75442
75443+ pax_track_stack();
75444+
75445 /*
75446 * AssocResp and ReassocResp have identical structure, so process both
75447 * of them in this function.
75448diff -urNp linux-2.6.32.46/net/mac80211/pm.c linux-2.6.32.46/net/mac80211/pm.c
75449--- linux-2.6.32.46/net/mac80211/pm.c 2011-03-27 14:31:47.000000000 -0400
75450+++ linux-2.6.32.46/net/mac80211/pm.c 2011-04-17 15:56:46.000000000 -0400
75451@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
75452 }
75453
75454 /* stop hardware - this must stop RX */
75455- if (local->open_count)
75456+ if (local_read(&local->open_count))
75457 ieee80211_stop_device(local);
75458
75459 local->suspended = true;
75460diff -urNp linux-2.6.32.46/net/mac80211/rate.c linux-2.6.32.46/net/mac80211/rate.c
75461--- linux-2.6.32.46/net/mac80211/rate.c 2011-03-27 14:31:47.000000000 -0400
75462+++ linux-2.6.32.46/net/mac80211/rate.c 2011-04-17 15:56:46.000000000 -0400
75463@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct
75464 struct rate_control_ref *ref, *old;
75465
75466 ASSERT_RTNL();
75467- if (local->open_count)
75468+ if (local_read(&local->open_count))
75469 return -EBUSY;
75470
75471 ref = rate_control_alloc(name, local);
75472diff -urNp linux-2.6.32.46/net/mac80211/tx.c linux-2.6.32.46/net/mac80211/tx.c
75473--- linux-2.6.32.46/net/mac80211/tx.c 2011-03-27 14:31:47.000000000 -0400
75474+++ linux-2.6.32.46/net/mac80211/tx.c 2011-04-17 15:56:46.000000000 -0400
75475@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct
75476 return cpu_to_le16(dur);
75477 }
75478
75479-static int inline is_ieee80211_device(struct ieee80211_local *local,
75480+static inline int is_ieee80211_device(struct ieee80211_local *local,
75481 struct net_device *dev)
75482 {
75483 return local == wdev_priv(dev->ieee80211_ptr);
75484diff -urNp linux-2.6.32.46/net/mac80211/util.c linux-2.6.32.46/net/mac80211/util.c
75485--- linux-2.6.32.46/net/mac80211/util.c 2011-03-27 14:31:47.000000000 -0400
75486+++ linux-2.6.32.46/net/mac80211/util.c 2011-04-17 15:56:46.000000000 -0400
75487@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
75488 local->resuming = true;
75489
75490 /* restart hardware */
75491- if (local->open_count) {
75492+ if (local_read(&local->open_count)) {
75493 /*
75494 * Upon resume hardware can sometimes be goofy due to
75495 * various platform / driver / bus issues, so restarting
75496diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c
75497--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c 2011-03-27 14:31:47.000000000 -0400
75498+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c 2011-05-17 19:26:34.000000000 -0400
75499@@ -564,7 +564,7 @@ static const struct file_operations ip_v
75500 .open = ip_vs_app_open,
75501 .read = seq_read,
75502 .llseek = seq_lseek,
75503- .release = seq_release,
75504+ .release = seq_release_net,
75505 };
75506 #endif
75507
75508diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c
75509--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c 2011-03-27 14:31:47.000000000 -0400
75510+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c 2011-05-17 19:26:34.000000000 -0400
75511@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
75512 /* if the connection is not template and is created
75513 * by sync, preserve the activity flag.
75514 */
75515- cp->flags |= atomic_read(&dest->conn_flags) &
75516+ cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
75517 (~IP_VS_CONN_F_INACTIVE);
75518 else
75519- cp->flags |= atomic_read(&dest->conn_flags);
75520+ cp->flags |= atomic_read_unchecked(&dest->conn_flags);
75521 cp->dest = dest;
75522
75523 IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
75524@@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const
75525 atomic_set(&cp->refcnt, 1);
75526
75527 atomic_set(&cp->n_control, 0);
75528- atomic_set(&cp->in_pkts, 0);
75529+ atomic_set_unchecked(&cp->in_pkts, 0);
75530
75531 atomic_inc(&ip_vs_conn_count);
75532 if (flags & IP_VS_CONN_F_NO_CPORT)
75533@@ -871,7 +871,7 @@ static const struct file_operations ip_v
75534 .open = ip_vs_conn_open,
75535 .read = seq_read,
75536 .llseek = seq_lseek,
75537- .release = seq_release,
75538+ .release = seq_release_net,
75539 };
75540
75541 static const char *ip_vs_origin_name(unsigned flags)
75542@@ -934,7 +934,7 @@ static const struct file_operations ip_v
75543 .open = ip_vs_conn_sync_open,
75544 .read = seq_read,
75545 .llseek = seq_lseek,
75546- .release = seq_release,
75547+ .release = seq_release_net,
75548 };
75549
75550 #endif
75551@@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip
75552
75553 /* Don't drop the entry if its number of incoming packets is not
75554 located in [0, 8] */
75555- i = atomic_read(&cp->in_pkts);
75556+ i = atomic_read_unchecked(&cp->in_pkts);
75557 if (i > 8 || i < 0) return 0;
75558
75559 if (!todrop_rate[i]) return 0;
75560diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c
75561--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c 2011-03-27 14:31:47.000000000 -0400
75562+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c 2011-05-04 17:56:28.000000000 -0400
75563@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *sv
75564 ret = cp->packet_xmit(skb, cp, pp);
75565 /* do not touch skb anymore */
75566
75567- atomic_inc(&cp->in_pkts);
75568+ atomic_inc_unchecked(&cp->in_pkts);
75569 ip_vs_conn_put(cp);
75570 return ret;
75571 }
75572@@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk
75573 * Sync connection if it is about to close to
75574 * encorage the standby servers to update the connections timeout
75575 */
75576- pkts = atomic_add_return(1, &cp->in_pkts);
75577+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
75578 if (af == AF_INET &&
75579 (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
75580 (((cp->protocol != IPPROTO_TCP ||
75581diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c
75582--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c 2011-03-27 14:31:47.000000000 -0400
75583+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-17 19:26:34.000000000 -0400
75584@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service
75585 ip_vs_rs_hash(dest);
75586 write_unlock_bh(&__ip_vs_rs_lock);
75587 }
75588- atomic_set(&dest->conn_flags, conn_flags);
75589+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
75590
75591 /* bind the service */
75592 if (!dest->svc) {
75593@@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct se
75594 " %-7s %-6d %-10d %-10d\n",
75595 &dest->addr.in6,
75596 ntohs(dest->port),
75597- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
75598+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
75599 atomic_read(&dest->weight),
75600 atomic_read(&dest->activeconns),
75601 atomic_read(&dest->inactconns));
75602@@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct se
75603 "%-7s %-6d %-10d %-10d\n",
75604 ntohl(dest->addr.ip),
75605 ntohs(dest->port),
75606- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
75607+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
75608 atomic_read(&dest->weight),
75609 atomic_read(&dest->activeconns),
75610 atomic_read(&dest->inactconns));
75611@@ -1927,7 +1927,7 @@ static const struct file_operations ip_v
75612 .open = ip_vs_info_open,
75613 .read = seq_read,
75614 .llseek = seq_lseek,
75615- .release = seq_release_private,
75616+ .release = seq_release_net,
75617 };
75618
75619 #endif
75620@@ -1976,7 +1976,7 @@ static const struct file_operations ip_v
75621 .open = ip_vs_stats_seq_open,
75622 .read = seq_read,
75623 .llseek = seq_lseek,
75624- .release = single_release,
75625+ .release = single_release_net,
75626 };
75627
75628 #endif
75629@@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip
75630
75631 entry.addr = dest->addr.ip;
75632 entry.port = dest->port;
75633- entry.conn_flags = atomic_read(&dest->conn_flags);
75634+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
75635 entry.weight = atomic_read(&dest->weight);
75636 entry.u_threshold = dest->u_threshold;
75637 entry.l_threshold = dest->l_threshold;
75638@@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
75639 unsigned char arg[128];
75640 int ret = 0;
75641
75642+ pax_track_stack();
75643+
75644 if (!capable(CAP_NET_ADMIN))
75645 return -EPERM;
75646
75647@@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct s
75648 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
75649
75650 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
75651- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
75652+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
75653 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
75654 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
75655 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
75656diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c
75657--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c 2011-03-27 14:31:47.000000000 -0400
75658+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c 2011-05-04 17:56:28.000000000 -0400
75659@@ -438,7 +438,7 @@ static void ip_vs_process_message(const
75660
75661 if (opt)
75662 memcpy(&cp->in_seq, opt, sizeof(*opt));
75663- atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
75664+ atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
75665 cp->state = state;
75666 cp->old_state = cp->state;
75667 /*
75668diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c
75669--- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c 2011-03-27 14:31:47.000000000 -0400
75670+++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-04 17:56:28.000000000 -0400
75671@@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
75672 else
75673 rc = NF_ACCEPT;
75674 /* do not touch skb anymore */
75675- atomic_inc(&cp->in_pkts);
75676+ atomic_inc_unchecked(&cp->in_pkts);
75677 goto out;
75678 }
75679
75680@@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
75681 else
75682 rc = NF_ACCEPT;
75683 /* do not touch skb anymore */
75684- atomic_inc(&cp->in_pkts);
75685+ atomic_inc_unchecked(&cp->in_pkts);
75686 goto out;
75687 }
75688
75689diff -urNp linux-2.6.32.46/net/netfilter/Kconfig linux-2.6.32.46/net/netfilter/Kconfig
75690--- linux-2.6.32.46/net/netfilter/Kconfig 2011-03-27 14:31:47.000000000 -0400
75691+++ linux-2.6.32.46/net/netfilter/Kconfig 2011-04-17 15:56:46.000000000 -0400
75692@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
75693
75694 To compile it as a module, choose M here. If unsure, say N.
75695
75696+config NETFILTER_XT_MATCH_GRADM
75697+ tristate '"gradm" match support'
75698+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
75699+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
75700+ ---help---
75701+ The gradm match allows to match on grsecurity RBAC being enabled.
75702+ It is useful when iptables rules are applied early on bootup to
75703+ prevent connections to the machine (except from a trusted host)
75704+ while the RBAC system is disabled.
75705+
75706 config NETFILTER_XT_MATCH_HASHLIMIT
75707 tristate '"hashlimit" match support'
75708 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
75709diff -urNp linux-2.6.32.46/net/netfilter/Makefile linux-2.6.32.46/net/netfilter/Makefile
75710--- linux-2.6.32.46/net/netfilter/Makefile 2011-03-27 14:31:47.000000000 -0400
75711+++ linux-2.6.32.46/net/netfilter/Makefile 2011-04-17 15:56:46.000000000 -0400
75712@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRAC
75713 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
75714 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
75715 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
75716+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
75717 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
75718 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
75719 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
75720diff -urNp linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c
75721--- linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c 2011-03-27 14:31:47.000000000 -0400
75722+++ linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c 2011-04-17 15:56:46.000000000 -0400
75723@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlatt
75724 static int
75725 ctnetlink_parse_tuple(const struct nlattr * const cda[],
75726 struct nf_conntrack_tuple *tuple,
75727- enum ctattr_tuple type, u_int8_t l3num)
75728+ enum ctattr_type type, u_int8_t l3num)
75729 {
75730 struct nlattr *tb[CTA_TUPLE_MAX+1];
75731 int err;
75732diff -urNp linux-2.6.32.46/net/netfilter/nfnetlink_log.c linux-2.6.32.46/net/netfilter/nfnetlink_log.c
75733--- linux-2.6.32.46/net/netfilter/nfnetlink_log.c 2011-03-27 14:31:47.000000000 -0400
75734+++ linux-2.6.32.46/net/netfilter/nfnetlink_log.c 2011-05-04 17:56:28.000000000 -0400
75735@@ -68,7 +68,7 @@ struct nfulnl_instance {
75736 };
75737
75738 static DEFINE_RWLOCK(instances_lock);
75739-static atomic_t global_seq;
75740+static atomic_unchecked_t global_seq;
75741
75742 #define INSTANCE_BUCKETS 16
75743 static struct hlist_head instance_table[INSTANCE_BUCKETS];
75744@@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_ins
75745 /* global sequence number */
75746 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
75747 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
75748- htonl(atomic_inc_return(&global_seq)));
75749+ htonl(atomic_inc_return_unchecked(&global_seq)));
75750
75751 if (data_len) {
75752 struct nlattr *nla;
75753diff -urNp linux-2.6.32.46/net/netfilter/xt_gradm.c linux-2.6.32.46/net/netfilter/xt_gradm.c
75754--- linux-2.6.32.46/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
75755+++ linux-2.6.32.46/net/netfilter/xt_gradm.c 2011-04-17 15:56:46.000000000 -0400
75756@@ -0,0 +1,51 @@
75757+/*
75758+ * gradm match for netfilter
75759